@mozhacks This is a great write-up! Thanks for explaining all the rationale and the design choices that went into it. It sounds like some solid engineering.
@chriscassano As a footnote, the user/client also needs to present a normal auth token to attempt a recovery, so in practice the user would probably demonstrate ownership of an email or phone number or OIDC to get an auth token first.
Juicebox improves the UX for end-to-end encrypted apps. I helped build lots of it, and it launched publicly today. It lets a user retrieve their strong encryption key by entering a short PIN, so logging into a new device is easy. https://t.co/0jZWWa4F6k
@chriscassano Thanks. The user+client only need to remember the user's ID and PIN. That's what makes Juicebox really attractive for registering a new device. The client will re-derive the unlock tags during recovery. The exact protocol details are in the whitepaper.
There's a lot happening under the hood to make this secure. The protocol distributes trust across independent backends, some running on tamper-resistant hardware (HSMs). See the blog post for details, whitepapers and Rust code.
In the first edition of #JOTB we had one of the creators of the Raft algorithm, don @ongardie . This year, we will learn with @MaslankaMichal how they implemented it in @redpandadata
Please welcome back again Michał Maślanka to #JOTB24
https://t.co/ZuVESAlOKG
@rui314 Do you have a 32-bit PowerPC? If so, mind sharing what/how/why? I've been looking at one in an embedded context but probably don't need mold there.
@ernesbro_o@notamyfromdbt Look, I respect what Otis has accomplished in his long life, and he has many awards to show for it. But we can't deny that there are other, possibly fatter, bears this year.
Consent-O-Matic identifies about 50 of the most commonly deployed #GDPR tracking opt-out dialog boxes and automatically opts you out of all tracking, invisibly and instantaneously:
https://t.co/aBv7V44WGF 17/
@gudmundur I'm running Linux and using bwrap for now. There's not a lot of fs to bridge though? I have VS Code and all the tooling running in each container.
I've been setting up a system for doing local development inside containers. I want a pristine environment with nice modern tooling for every experiment and project, without putting my system or files at risk.
BTW, it turns out the fzf crate, with the description "fuzzy finder", is literally just a "Hello, world!" program. That user has over 100 more-or-less empty crates, but it's not clear that those violate https://t.co/aOhSwtScqb
This was a really easy mistake to make. Even if I got the installation command right, that repo or package or one of its dependencies could have been hijacked. I feel like I'm on the right track by moving my development inside containers. It limits the blast radius.