Community approach basically failed in building a "web of trust" with all the PGP/GPG signing parties: both tools were tricky to use, integrating PGP/GPG signing into common tools (like email, word processors, web, but also version control systems like CVS, SVN, bzr, git...) was always lackluster.

LetsEncrypt is a surprising success, but it's still a centralized system running as a non-profit — which means that it's always at risk of not being funded and/or to be under influence of big sponsors. It also came too late, app stores were already centralized.

Obviously, enterprises prefer to be the one to gate the access, so with a situation as it was, they jumped on the opportunity.

Deactivating SIP is not that dangerous if you know what you’re doing. All it does it give back write access to root to some parts of the system.

Obviously, for the commoners, it is definitely not recommended, especially since they usually run random commands from stochastic engines w/o supervision… oh…… engineers do that too now? how in the hell???

I’m out.

Apple won't even let you pay the fee in some cases. I've been fighting with them trying to figure out why they won't accept my ID verification since March. They keep saying my devices are linked to another Apple Account, but I purchased them all directly from the Apple Store and none of them have ever touched another account, so what the fuck.

Not surprisingly "isn't recommended" by the ones who want you to pay them.

No, the simplest (but far from the only) example is DNS injection.

Make the web unusable unless you're protected by your "DDOS" protection, offer a free service to solve the problem. Or provide a free service with as little friction to start replacing private/internal networking with, ideally with wide platform support. Or provide some sort of alternative "private" altnet, promising anonymity and access to clearnet via some sort of gateways, specifically for murky stuff.

Yes, VT-220. The amber color was so pleasant, and so easy on the eyes.

So we either expose the key material for inspection (very obviously bad) or we try and brute force how many possible "weak" private keys from the public key to see if they check out?

Note that this is on the order of trillions of useless computations at least per year since almost everyone just uses a CSPRNG or HWRNG available in all modern computers to generate their keys sanely.

Now, for CAs, sure because that is a very small number of certificates. But that's a completely different discussion and also however eMudhra managed to lop off all of the entropy except for the final byte was wildly incompetent and not something a layman would even consider doing.

It's also not the job of the CA to detect you being an idiot. You can go post your private key online after getting your certificate if you so wish, the CA may revoke it if they find out but they're just in the business of helping you secure your communications with others. If you wish for them to actually be insecure... You are silly, but that was always allowed.

Certificates don't tell you whether a site is trustworthy.

I suspect there might be something intentional about this. There is a strangely high seeming-typo count in that post (yeild, pivate, relevent, etc). There are typos in the author's other work, but not quite at this density.

See also: https://maurycyz.com/misc/quality/indicators.html#:~:text=Th...