Nando Sola @mr_solo@mastodon.social

worth reading "Everything you should know about certificates and PKI but are too afraid to ask" #pki #x509 #asn1 https://smallstep.com/blog/everything-pki.html -- I use a certificate to orchestrate #MirageOS #unikernels https://github.com/hannesm/albatross

If you really want to help Firefox succeed, file a bug on https://webcompat.com/ when you find a broken website. Don't just switch back to Chrome; let Mozilla know there's a problem so they can try to fix it.

When browsers lose market share, they fall into the "compatibility death spiral." Sites don't bother to test, they break, and users flee to the browser that "just works." Mozilla is fighting this battle every day, and it just got harder.

Impresionante recreación, a modo de cámara fija, de la erupción que destruyó Pompeya: https://www.youtube.com/watch?v=dY_3ggKg0Bc

code review tips based on "lessons learned" from more than 6000 programmers at more than 100 companies https://www.ibm.com/developerworks/rational/library/11-proven-practices-for-peer-review/index.html

https://slides.com/jochenbedersdorfer/clojure-for-java-developers/#/

#Clojure for #java developers is a good comparison in what makes Clojure old for the brain compared to Java.

Researchers at UCLA Riverside discover GPUs can be victims of the same kinds of attacks as Meltdown and Spectre, which have impacted Intel and AMD CPUs.
https://www.networkworld.com/article/3321036/data-center/gpus-are-vulnerable-to-side-channel-attacks.html

Sadly, my #35C3 talk was rejected. As promised, you can expect a blogpost about it soon:

We need to tell a story better than cyberpunk
hacker narratives in popular culture

Hackers' calls for the free and neutral internet, open technology and community-driven infrastructure are ignored by most of the public. We're instead seen as black hats trying to set the world on fire and political troublemakers. Is it because we don't present our values in ways accessible to regular people?

Por culpa de @mr_solo hemos estado @roberto_fernandez y yo leyendo sobre Rust todo el vuelo de vuelta a Bilbao.

Gotta love how FP twitter has degraded into "I AM RIGHT, HERE'S A SNARKY COMMENT WHY!" instead of actually having any substance. Yes, an occasional rant can be fun, but heck, this has become a frigging circle jerk. Post some papers or interesting pieces of code. #Haskell

Don't forget that with a static type system, you can *choose* what you want to track statically. This makes your modeling choices explicit. Saying "I don't have this issue in dynlangs" is usually missing an implicit "because I chose to look the other way"

As you have probably already heard: there is a new HyperThreading side-channel attack which was outlined in the original Spectre paper as a possible variant: leverage port contention on execution engines which is shared between Hyper-Threads. Paper should follow.

Announcement:
https://seclists.org/oss-sec/2018/q4/123

PoC:
https://github.com/bbbrumley/portsmash

So if you haven’t done it already: disable SMT/HyperThreading!

My new colleagues at IBM Security wanted to hear more about #OpenBSD so I updated my "OpenBSD and you" presentation https://home.nuug.no/~peter/openbsd_and_you/

When I see a new "open source" software infrastructure startup with 20 employees, no significant community interest and a BoD full of VCs, I automatically wonder when they will shut down.