Emily Stark

I'm not checking this hellscape much anymore. Find me on 🦋 (estark at bsky dot social)

@tqbf @dadrian this was also, apparently, the thought process of teachers in our school district. “Hey guys, should we do school the day after Halloween?” “Fuck no, let’s drink all night and let the parents deal with the kids’ Nov 1 sugar hangovers”

@dadrian @estark37 Emily Stark is already 100% sold on this holiday you didn't even have to notify.

I HAVE DECLARED TOMORROW TO BE A HOLIDAY tell your manager, you have it off.

Wow, I appreciate @acm_ccs being frank about review ethics! #CCS

A proposed CA/Browser Forum ballot would radically shorten the max validity period of #TLS certificates over the next few years github.com/cabforum/serve…

@ericlaw @googlechrome Can you file a bug with cert please?

Um @googlechrome ?

@musalbas @distractedm1nd @ekr____ @taoeffect This was how the initial deployment of CT worked, but is no longer true for Chrome. SCTs are audited probabilistically.

@distractedm1nd @ekr____ @taoeffect x.com/musalbas/statu…

All of us recognize the little🔒 you get when visiting a website, telling you your connection is secure. It's there to guarantee that the conversation between your device and the website is 🎀 end-to-end encrypted 🎀. Except you're not as safe as you think.

@distractedm1nd @ekr____ @taoeffect And the way Chrome has implemented SCT auditing means that all Chrome clients "see" the same tree head; in other words, a log can't target individual Chrome clients with a split-view.

@distractedm1nd @ekr____ @taoeffect I'm not going to dispute that CT has nuanced security guarantees (emilymstark.com/2022/08/23/cer…), but the tweet you quoted is pointing out that there are, in fact, deployed forms of gossip in the wild. Also doesn't seem fair to ignore that Chrome does do (probabilistic) SCT auditing.

@prdonahue @thedanigrant @GrantSlatton @ptrschmdtnlsn It's sometimes more trouble than it's worth for us to do non-deterministic behavior like this because it can be confusing/hard to debug. (user reports cert error, site operator can't reproduce)

@prdonahue @thedanigrant @GrantSlatton @ptrschmdtnlsn I don't think we (on Chrome at least) have considered this for upcoming expired certs, but I think Google has done it for some server-side cert changes.

the number of outages that happen due to TLS cert expirations make me doubt the feasibility of laws with sunset clauses if netflix can't do it perfectly, i don't trust congress to either gonna accidentally let the "no murdering" law have a 12 hour outage

@benadida The DRM angle is that it creates an ecosystem in which users are limited in the software and hardware they can use to create/edit content. You can strip off the metadata, sure, but then your content is no longer "legitimate". It's not literally DRM, but spiritually similar IMO.

@benadida ... contains much less fraught solutions if the goal is for skilled analysts (rather than the mass consumer user base) to be able to distinguish. Like even just having the metadata in the image but not displaying it to end users would be preferable IMO.

We need affirmative sourcing of images online. Some thoughts. We can do this in a privacy protecting way. benlog.com/2024/09/27/aff…

@benadida ... resources should go into flagging mis/disinformation, and/or giving nuanced context around questionable content, rather than affirmative indicators.

@benadida I really try not to shoot things down without presenting an alternative, which I don't have. But I vaguely feel that technology is putting the cart way before the horse, solutions must be customized to the UI and user base of each social media platform, and the bulk of the...

It's a common misconception that we need to move from AES-128 to AES-256 to counter quantum attack. In this great talk @sejaques explains why, and shows a few new arguments why Grover's algorithm is even less practical than we already understood it to be. youtube.com/watch?v=eB4po9…

Update: flights grounded due to an “IT issue” so I might, in fact, just be living in SFO forever, Crowdstrike-style

I will be at TPAC this week! Planning to attend WebAppSec, WebAuthn, various breakouts, and the hallway.