RT @Pinboard: Delete all you want; I’m an archivist! http://t.co/PZHD0WrTRE

Posted on Twitter over 11 years ago and archived here at /twitter/2014/08/19/tweet-501920654803755009/ in the Twitter collection.
Proximate posts in the Twitter collection
newer Twitter post from August 21, 2014, 502451737660116992 21 August 2014
this post Twitter post from August 20, 2014, 501920654803755009 20 August 2014
older Twitter post from August 18, 2014, 501506567653441538 18 August 2014
Proximate posts in the General collection
newer For the wall? 21 August 2014
this post Twitter post from August 20, 2014, 501920654803755009 20 August 2014
older httpshaming: Evernote checks for update over unencrypted HTTP, and the update packages are also downloaded over HTTP. But it’s signed code, right? What could go wrong? It’s trivially easy to perform a man-in-the-middle attack to prevent future updates from ever being received, or to redirect the user to unsigned or malicious code, that may or may not run. There is a DSA signature on the file at the update URL, and there’s signatures on the files and a certificate OU deep within the app contents… but that all assumes the user can get to the update, and download it securely. Good news for persistent threats, bad news for the millions of Evernote users who want to get critical security updates. This looks easy enough to fix.   (Submitted by Phillip Knoll) 19 August 2014