mcosta's comments

On: QUIC is not quick enough over fast internet

[mcosta]

Zscaler is not chosen, it is imposed by the corporation

On: Bootstrappable Builds

[mcosta]

Then the trust is in your silicon. Not only the CPU. The network card, hard drive, memory controller, PCI bus...

On: Google took three months to remove scam app that s...

[mcosta]

The intended purpose for a "crypto app" is to scam its users. So it checks out.

On: Orca: WebAssembly Apps Without the Web

[mcosta]

Then what is Orca useful for?

[pookha → mcosta]

Maybe replacing containers...I had a better developer experience and a better overall quality of life when I deployed war files into a servelet container (tomcat). I wasn't patching operating system vulnerabilities across a jagged sea of micro service images or patching vendor supplied images either (literally had to do that with Kafka). I deployed a fucking war file. That's it. And I'd also imagine that a WASM module\app would have a much snappier start time without having to lug around the overhead of a container...And "Alpine Linux" can go ahead and kiss my ass (no offense).

On: A Swiss town banned billboards. Zurich, Bern may s...

[mcosta]

Where is that contract and when did I signed it?

[Doxin → mcosta]

"The social contract" is a very well defined and explored concept[0]. It's not a literal contract. Being intentionally obtuse about word definitions isn't going to convince anyone of anything.

[0] https://en.wikipedia.org/wiki/Social_contract

[account42 → mcosta]

I'm sure if you commit a crime the Judge will also let you go if you point out that technically you never agreed to the laws of the country you live in.

On: The Google employees who created transformers

[mcosta]

Now is Active directory + Office 365 + Teams

On: French court issues damages award for violation of...

[mcosta]

Roman law vs Common law

On: Code Verify: An open source browser extension for ...

[mcosta]

HTTPS guarantee the source, not that meta is sending you the same code as everyone else. With this, an adversary at meta must compromise Meta and Cloudflare.

[cookiengineer → mcosta]

By that logic the extension from the very same vendor is automatically compromised, too.

If a website is compromised, no extension will fix this.

Only a rollback to a specific known-to-be-legit hash in IPFS.

And meta won't embrace IPFS, ever.

[dboreham → cookiengineer]

The idea is you install the extension ahead of time when you do trust the source.

[cookiengineer → dboreham]

What is the difference to resource integrity and certificate pinning which is already implemented among every single Browser via the HSTS policies?

Also, do you really think meta's products will have static assets for eternity from the point of installing an extension? Absurdly unlikely.

[ametrau → mcosta]

I think you would still have big problems if you had an adversary at meta. Bigger than this.

On: It Can Be Done (2003)

[mcosta]

Once again the confusion between "HTML document" and "Web App" bites again. A NYT article does not needs client side state.

On: Final Decision on Chromebook Case in Denmark

[mcosta]

> It would be good to see checks on Google's dominance in schools, currently achieved via attractively priced hardware and free proprietary platforms built for this purpose.

Is this an excuse to use Windows on schools? I mean... if you use expensive hardware on closed and paid proprietary platforms, then that problem goes away.