@rmhrisk Weird!
I recently learned that USPS has a service where they send you their scan of your incoming envelopes a day or so in advance.
Throw in some OCR and you've got a new ACME challenge waiting to be defined...
@empijei Great post!
Regarding the section on "Self referring", I believe you can make it work outside a func parameter in a slightly roundabout way: https://t.co/zKqALWeNjO.
(Its actually not that roundabout, its literally factoring it out of the func, it just reads oddly)
It would be nice for Go to have great support for batch UDP send/recv that falls back to non-batch APIs on unsupported operating systems.
(ccing @bradfitz@commaok (in a shameless attempt to nerdsnipe this into existence))
Microsoft has been doing some stellar work optimizing their #QUIC implementation and formalizing benchmarks for the new protocol. They went from 1.7 to 8 Gbps and you can read all about it in their new blogpost: https://t.co/qr7pBjCyWe
@empijei I absolutely agree that cookie dialogs should be a focus.
I don't agree that that has any implications for WebUSB (or any other feature). There are many engineers associated with the Web Platform all pushing it forward in different ways in parallel; that seems healthy and ok.
@ciphergoth It has whitehouse in the name, Paul...
The only domain more authoritative would be https://t.co/uw5nAakwej, covering between 1.5 and 2 branches of government (depending on how you count).
@cramforce Unfortunately, this only works for (phishable) 2FA codes, as opposed to U2F tokens.
I'd really like some way to authenticate to my browser in a phishing resistant way, and then have my browser authenticate me to sites in a phishing resistant way that isn't O(n).
@ivanristic@rmhrisk Yea... I had a very similar thought. That seems like a small delta over what exists.
It'd be kinda amazing to see millions of certificates automatically revalidated and renewed without human intervention in the WebPKI.
@chosensecurity@sleevi_ Speaking as someone who reads mdsp for the centithread entertainment value, I am very excited.
(Also, yay for the extra security)
@ericlaw@mrisher@Google Isn't https://t.co/oAlJqTI1Nz on HSTS preload list?
I can't remember; will check when I'm at a real computer.
I hope so, we aren't super careful about it either (though I think I added a presubmit at some point to just ban the string "http://").
@jaffathecake Semi-serious proposal: have GFEs obfuscate the user agent and the only unobfuscation library has only feature detection methods (and the browser detection methods are behind a visibility list controlled by the chrome team)