AlyssaRowan

16 ms·

91.
by AlyssaRowan 12y ago
UUIDs can also be collided. Did you want some form of public key referencing that only a private key can answer, perhaps? As already pointed out by ivoras here, magnet: links are close to exactly what you're looking for. It also remind
92.
by AlyssaRowan 12y ago
I feel the way I communicate has been influenced strongly by voice training - I've noticed in particular I say "I feel" a lot in similar circumstances. (Apparently, valuing emotions above thought is some paragon of femininity
93.
by AlyssaRowan 12y ago
Indeed, I wouldn't be shocked if the existing micro-USB standard for charging mobile devices in the EU is replaced/supplanted with USB 3.1 Type-C. It'd make a lot of sense, all round.
94.
by AlyssaRowan 12y ago
Interesting. I know far, far less about the regulatory side than the practical side. I gather it's focused mainly on merchants, but the card providers themselves founded it? I'm not sure what I can say except not every bank seems
95.
by AlyssaRowan 12y ago
Not long now. I think that will mostly depend on whether they give the issues a name and a logo! <g> (Seriously though, that does seems to get people off their arses!) You might want to get ready to change passwords for sites that hav
96.
by AlyssaRowan 12y ago
It was, part of it. RC4 had a CVE score below 4 (which many interpreted as an issue they could argue around, i.e. "we need to support Windows XP!"), but BEAST had a score above 4 (auto-fail). And what was the (horrible!) recomme
97.
by AlyssaRowan 12y ago
Let's be crystal-clear: All of these fail PCI compliance, because they have RC4 enabled. These sites have no business processing anything, let alone personal or financial info. Yes, having RC4 enabled is now an instant PCI compliance f
98.
by AlyssaRowan 12y ago
Exactly! I wouldn't be too surprised if they do… it looks doable. Although you might not want to get your ship too close to one with an accretion disk - it'll burn up. (If you do, at least use an all-black paint-job and look styli
99.
by AlyssaRowan 12y ago
Really, is this just consensus? I'd be more interested if it were analysing the malware to name it, not what the various labs are calling it. This malware definitely isn't called kkrunchy. .kkrunchy is farbrausch's perfectl
100.
by AlyssaRowan 12y ago
The next version is called Signal, so there you go. The reasons make sense - SMS as a transport is almost unworkable, there's a lot of crap involved with MMS bugs that it would be good to rip out, and it can never be compatible with
101.
by AlyssaRowan 12y ago
But, you must admit, quite sensible. Their actual network is *.nsa.ic.gov, and all that fun stuff on Verizon Business. (Amongst other things.)
102.
by AlyssaRowan 12y ago
Um, more like EC2 and cado-nfs needed quite a bit of handholding to bust through 512-bit RSA keys. For example, the script out at the moment only works for 1.0, not 2.0.
103.
by AlyssaRowan 12y ago
I can echo this; I actually am using a Pi2 as one of my daily drivers. Using the official adapter. No power issues at all.
104.
by AlyssaRowan 12y ago
Last I checked, I don't write infinitely big functions.
105.
by AlyssaRowan 12y ago
Careful. ₄Be compounds are not your friend. Do not breathe or touch ANY beryllium dust - ever - at all. If you're doing anything with it wear gloves; if you even might snap or machine it, you need to work in a fume chamber.
106.
by AlyssaRowan 12y ago
This, 100%. They also plan to adopt Certificate Transparency, I believe. And it'll hopefully be trivial to set up, once the scripting is all finished. No excuses, people. Give it a few years and we'll be seriously talking about tu
107.
by AlyssaRowan 12y ago
I wonder, why the gender gap? Could it be associated in some way with these products' resemblance to existing products with a strong marketing differential between genders? Men might think of protein shakes: you know, whey protein GMC-
108.
by AlyssaRowan 12y ago
The agl draft is actually an out-of-date, expired first draft, but it did the job to get it kickstarted! https://datatracker.ietf.org/doc/draft-agl-tls-chacha20poly1... AEAD_CHACHA20_POLY1305 is however about to be an
109.
by AlyssaRowan 12y ago
The NSA's Information Assurance wing considers itself responsible for the security of classified US Government systems only —specifically not unclassified US Government systems, or any civilian systems whatsoever, which they feel fa
110.
by AlyssaRowan 12y ago
Spear phishing, as its nicknamed? If something is sophisticated enough to work , don't knock it! There's no fundamental difference between the basic techniques used by malicious hackers, organised crime, pentesters or nation-stat
111.
by AlyssaRowan 12y ago
Not at all. GCHQ are not usually ones to try just one approach. They often try every approach at once: partly because they can; but mostly for compartmentation; to overwhelm layered defences; and to decrease sensitive source exposure by com
112.
by AlyssaRowan 12y ago
Thanks TLS WG! Great to see this one out the door. Yes, this is a die-die-die draft, not a gentle transition. It will not go gently into the night, but it's well past time to disable RC4 in browsers and servers completely. There have
113.
by AlyssaRowan 12y ago
In terms of Curve25519: it seems so, yes. That is what CFRG's current draft recommends to the TLS Working Group for a 256-bit curve, along with the X25519 key exchange defined with it. There's a slot waiting in WebCrypto for it, t
114.
by AlyssaRowan 12y ago
Not just that - they have some kind of attempt at an implant against all of those, with varying success. (In a way, it actually leaked their capabilities!)
115.
by AlyssaRowan 12y ago
Wrong: actually, hard disks also have some unallocated sectors on the platters for both bad-sector replacement and firmware storage, and this is also completely masked out from the (S)ATA interface. Bearing in mind I don't have a prope
116.
by AlyssaRowan 12y ago
There's a specific reason I said to send an ATA reset first! IRATEMONK (for it is that) isn't that smart. Doesn't need to be. If you want to test more thoroughly, or actually dump the object for analysis, as wongarsu says b
117.
by AlyssaRowan 12y ago
Actually, I think they quite like high-uptime Linux peers for their C&Cs.
118.
by AlyssaRowan 12y ago
That doesn't really explain the US researchers infected with this.
119.
by AlyssaRowan 12y ago
UR = UNITEDRAKE ("Regin", basically?). And that'd probably be rmgree5@nsa.gov: that's the format their addresses are in. This does seem to be, broadly-speaking, NSA's top-dollar brand-new 0-day-laden (at the time) m
120.
by AlyssaRowan 12y ago
Great. Now your sandbox needs secure zeroisation. Yes, actually proving all parts of the compiler's data transforms going down to assembly kind of is what I'm after, if we can get it…

More ›