Notices by ✧✦✶✷Catherine✷✶✦✧ (whitequark@mastodon.social), page 3

Radically Open Security did a formal assessment of smoltcp, a TCP/IP stack that I wrote in Rust with #![deny(unsafe)] a few years back and many others contributed to since

they found only two issues, two DoS via crafted packets, both in the default build configuration

memory-safe TCP/IP stacks are so boring, i love them

@dalias @glyph @mcc the problem is that people ignore these things

@dalias @glyph @mcc don't a lot of people reuse passwords between "trash site nobody cares about" and "gmail with keys to their kingdon"? like this is how a bunch of high profile people got popped, afaik

i agree re: accounts being pointless, but also like... how would you enforce that? EU decree? no idea what else

@dalias @glyph @mcc i said nothing about a separate device

biblically accurate python installation instructions

@th they're plaintext

yes, really

@th it's not like you can win or lose a court case based on reactions, anyway https://www.walkermorris.co.uk/comment-opinion/emojis-informality-and-the-risk-of-inadvertent-contracting/

discovered two new-to-me open-source toolchain components for Atmel/Microchip ATF15xx CPLDs that are based on my work in prjbureau, one with attribution, one without

nice

@glyph @dalias @emma @mcc i'm going to go ahead and say that anyone who uses my software from a distro Must, and that is a capital-M must, obtain all support from the distro itself

the distro is of course free to obtain support from me

@glyph @dalias @emma @mcc something I find useful to keep in mind, for myself, is that I'm in technology because it is an almost unbounded force multiplier

between various packages, software I wrote has been downloaded over _eight billion_ times

that's a lot of potential for malice.

@glyph @dalias @emma @mcc I actually have no idea what was the decisionmaking behind PyPI's decisions and if I had to guess I would feel that some industry pressure probably came into it. do you know what the reasoning was? I'd be interested

@dalias @glyph @emma @mcc "simply don't get phished" is not a viable security strategy on social scale

@glyph @dalias @emma @mcc yeah, this is what I assumed you meant, but not really what you wrote

I'm kind of upset about having mandatory 2FA enabled on PyPI because my software got too popular (today it's mandatory for everyone I think, but initially it was a punishment for being good at OSS) but with keepassxc's TOTP support it's fine I guess

@glyph @dalias @emma @mcc (this seems like a jarring strawman to me)

@dalias @glyph @emma @mcc fwiw I'm kind of in betweent these positions

GitHub or whatever is where development takes place from

but also, GitHub is where probably millions of people people grab .exe's from and run them unsandboxed

I wouldn't want to be the vector through which someone else gets their life fucked

@dalias @glyph @mcc please imagine a real person without PTSD hypervigilance using a password manager

1/2

@dalias @glyph @mcc let's say you register on amazon.com, you save an entry, it's fine
now, because you are in the UK, you get amazon.co.uk. it uses the same login, so you pull up your password manager, and either copy the password, or manually add it to the allowlist
now, you get a phishing email with a link on amazom.co.uk. amazon has trained you to do this and you don't quite remember everything you've done, so you just do it again

2/2

@dalias @emma @glyph @mcc in fact, *because* passkeys are seen as strong as SMS-based MFA, passkeys provide a vast advantage to me, someone who has repeatedly lost access to accounts due to stupid phone number shenanigans

i hope every bank i have adopts passkeys asap

@dalias @emma @glyph @mcc as a refugee who had to cross borders i am fine with passkeys because passkeys do not have the problem you are describing

@dalias @glyph @mcc PKI-based authentication is strictly better than what you're suggesting since you can no longer steal a credential (other than from the password manager), no matter what happens with the browser or the website