Hacker News new | past | comments | ask | show | jobs | submit | bart__'s comments login

Certificate Transparency, all CA's log their issued certificates to central log servers, managed by Cloudflare, google etc. If this is not done, the certificate will not be seen as trusted by Browsers. It was designed to have a publicly auditable source of issued certificates, exactly so we can notice rogue google.com certs.


Actually, it won't be trusted by most browsers. As of today, Firefox hasn't implemented it yet [0]

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1281469


Technically you don't have to log certificates during issuance, and actually doing so is slightly more trouble (because of a chicken & egg problem, you want the log proof in the certificate, so you must log special "poisoned" certificates to get that proof and then fasten that proof to the certificate.

A customer can take an unlogged cert, log it themselves, and then use the certificate and the separate proof of logging they received and use that just fine. Google have some services which do this. One clever thing this enables is you can buy the cert secret-product-name.example, unlogged, build the web site, check everything works, and log the certificate seconds before the product launch event, so snoops can't tell your new product is secret-product-name until the moment you announce it, yet the site works immediately. I have very rarely seen this done but it's possible. When there's an ordinary White House transition process both plausible transition site certs get logged, even though in practice one of those sites is never published. Since Trump I have no idea if this process is so smooth any more.

A CA can choose whether to have this "issue unlogged certs" process as something they offer, it's a niche thing, but it could make sense. They need to keep adequate records of every certificate they issue (that's required) and logging is a very easy way to satisfy that requirement, but it's not the only way.

In practice, the logged certificates are the easy consumer option, like selling ready-to-eat food in a deli. Some customers might be prepared to buy ingredients and go away to make food, but, many customers probably want to eat food immediately so for extra money you sell products that can just be eaten immediately. So, yes, the vast majority of certificates issued every day are indeed logged immediately so as to provide the product people want.


Browsers will check if a certificate is in the transparency log, and alert the user if it isn't if I am not mistaken.


But XMPP clients do not, as far as I'm aware? and browsers aren't connecting to XMPP server ports.


Yeah usually the TLS libraries used by XMPP clients don't check SCTs. Not even all browsers do it. Chrome does it, Firefox does not for example.


Source?


https://developer.mozilla.org/en-US/docs/Web/Security/Certif...

As the other commenter already pointed out, Firefox does not require this. Safari and Chrome do. This indeed is not directly applicable to this situation, since XMPP don't involve browsers. But for websites, the parents attack scenario is not applicable.


Probably the coolest answer in this thread! Did Antarctica have any other option for internet, next to the previous gen satellites?


Here at McMurdo we've had 24/7 satellite internet for at least as long as I've been coming down (~10 years). Think roughly a ~30mbps connection shared with ~1000 people with business and science bandwidth prioritized over personal browsing. So starlink has been a game changer for sure.

At South Pole, I believe they don't yet have access to starlink. They also don't have 24 hour coverage for the few internet satellites they do get.

I don't work in IT so don't have direct access to more specific information, and obviously I can't speak for the many other stations scattered throughout the continent.


Woah! So there was just a single "downlink" for the entire station? Are there multiple starlink antennas now? I guess the upside is that you don't have issues with overloaded satellites in your area :')


What kind of bandwidth do you get now with Starlink?


~20 GB vram for the 7B model and 48 GB for the 13B model. It depends on the context size as well. I'd recommend renting a 4090 from a cloud provider like runpod/vast ai to get started, using a PEFT tutorial.


Thanks. What about the 70B model? I assume a 4090 will not be enough. Is it linear system requirements ?


4090 only has 24 GB and will only be able to fine tune (and merge, which is more memory intensive) the 7B model. The RTX6000 with 48 GB is able to fine tune the 13B model. The 70B model presumably needs multiple GPUs, like 4 RTX6000. For people starting out, you can also use a free GPU from Google colab to fine tune a 7B model. Finetuning 70B gets more expensive and I would suggest trying smaller models first with a high quality dataset.

It is mostly linear I think.


Thanks. My plan is to use this research cluster: https://www.ex3.simula.no/resources

I will probably train how to fine tune on the small model but I don’t really need to use a worse model to save money.


It is also 99% sure some sort of post is a human.


Totally contra to this project, but relevant for your point. I found EasyEDA, developed by the people from JLCPCB, to be very easy to use for hobbiest boards. Their integration with their SMT assembly service was also pretty neat for my usecase


JFTR, LibrePCB Fab[0] service provides integration with few PCB manufacturers.

[0] https://librepcb.org/blog/2022-09-08_partnership_with_pcbway...


This sounds better to me than EasyEDA since I don’t want to be _stuck_ with JLCPCB (though a friend uses them and I’ve really only heard good things about them, so I’ll probably use them for my next project anyway…)

Does EasyEDA lock you into JLCPCB? I don’t have anything against partnering with fab houses since it can really help accelerate the project, but I feel a little weird about using something that’s so deeply tied to another product that I “don’t need.”

I feel like I should give EasyEDA a chance though either way, because it can’t be worse than Fritzing.


There is no lock-in. The only connection from the user perspective is one-click ordering without downloading and uploading gerbers.


What's wrong with KiCad?


There is is some trouble with ordering smt service from jlc directly from kicad. But you can just import kicad into easyeda and export for production. Annoying extra step anyway. Kicad ftw


Since nobody has mentioned it yet, KOReader is an open source reader application for ereaders, kindles & others, and has the ability to reflow PDF's. While not perfect, it can work good enough to read well formatted PDF's.


KOReader reflows pdf's for ereaders using k2pdfopt, see https://www.willus.com/k2pdfopt/

Kindles need to be jailbroken to use koreader, and Amazon apparantly makes that harder with each device :-/

I have this as a right-click action for files matching *.pdf in my file browser (thunar):

    k2pdfopt -ui- -dev kp3 %F
So if I right-click on a pdf I can immediately reflow it into a kindle-readable version.

(%F is the quoted file name, in your terminal you would `k2pdfopt -ui- -dev kp3 'something.pdf'`)


> Amazon apparantly makes that harder with each device

Alternative phrasing: Amazon is continuing to fix security bugs in Kindle device.


What threat is the security for?


The technical detail about latest WatchThis hasn't been published yet, but the previous KindleBrake seems to be using malicious JXR image payload via built-in browser. That sounds like pretty serious security flaw to me.


I'm no expert, but I know cancer cells promote adding blood pathways towards them, so it might be that they have an "uneven share" of the nutrients transported to them, and thus die out later than the healthy tissue.


as a Dutch person currently following driving lessons, I was thaught this technique a few weeks ago


Wow that really is ingenious! Wonder what other ways, maybe with high pitched audio, are possible.


Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: