Hacker News: maxed

New comment by maxed in "Self-contained Python scripts with uv"

maxed — Sun, 30 Mar 2025 15:46:15 +0000

I took a closer look; uv installs the inline required packages in it's cache directory `~/.cache/uv` (if they are not already there). So the packages will probably exist until the cache is cleared with for example `uv clear`.

It's not that the inline requirements make a new `.venv` directory or something, uv seems to link the packages to a central location and reuse them if already there.

Open letter calling for digital autonomy and independence from Big Tech

maxed — Mon, 10 Mar 2025 15:52:00 +0000

Article URL: https://www.cs.ru.nl/~jhh/open-letter-big-tech.html

Comments URL: https://news.ycombinator.com/item?id=43321869

Points: 1

# Comments: 0

New comment by maxed in "In memoriam"

maxed — Sun, 23 Feb 2025 21:22:38 +0000

Is Hacker News also affected by this act?

New comment by maxed in "Leaking the email of any YouTube user for $10k"

maxed — Wed, 12 Feb 2025 15:59:23 +0000

It does not make sense to value these kind of (web) bugs by their potential price on the grey market. I think its better to value these bugs by their potential impact, although that is hard to express in money.

In this case there were 4 billion email addresses on the line from being scraped, imagine if this was exploited and the data was leaked. The news would hit the headliners which would definitely be bad for Google's reputation and stock price.

However, the impact of the leak is not that high as it only consists of a channel <> email address mapping, and therefore I think 10k is a fair price

New comment by maxed in "Cracking a 512-bit DKIM key for less than $8 in the cloud"

maxed — Sun, 12 Jan 2025 12:35:01 +0000

Sorry, I somehow made a typo in the quoted text, the RFC says

  Verifiers MUST be able to validate signatures with keys ranging from 1024 bits to 4096* bits

So mail providers MUST support up to 4096 bits if they follow the latest RFC.

New comment by maxed in "Cracking a 512-bit DKIM key for less than $8 in the cloud"

maxed — Sat, 11 Jan 2025 13:29:17 +0000

I tested this last year, they properly reject mails signed with DKIM keys from <1024 bits

New comment by maxed in "Cracking a 512-bit DKIM key for less than $8 in the cloud"

maxed — Sat, 11 Jan 2025 13:19:55 +0000

The latest RFC does require it though (RFC8301):

  Verifiers MUST be able to validate signatures with
  keys ranging from 512 bits to 2048 bits, and they MAY be able to
  validate signatures with larger keys.

I did my master thesis on this topic one year ago and found that all popular mail providers nowadays support 4096 bits, and some even up to 16384 bits.