BoppreH

8 ms·

61.
by BoppreH 4mo ago
[Mythos 5] does sometimes still engage in reckless or destructive actions in service of a user’s goals, and our interpretability analyses indicate that it is aware that these actions are transgressive while it engages in them.
62.
by BoppreH 4mo ago
1. People come to him with breaches that are not public yet. 2. He validates the breaches through a network of volunteers who check if the credentials are real. 3. He provides an easy-to-use service for free. What is your alternative? Havin
63.
by BoppreH 4mo ago
Yes! It's called a hybrid cryptosystem, and what most projects are planning to use. The algorithms at risk are the asymmetric part (RSA, ECC, DH), not the symmetric parts (AES, ChaCha), so what is done for encryption is "generatin
64.
by BoppreH 4mo ago
Interesting development. Merkle Tree Certificates throw away decades of cruft, but also decades of battle testing and ancillary tools. I trust the teams involved, but this will be a hell of a project. Still better than the alternatives that
65.
by BoppreH 4mo ago
To answer your "if it's possible at all" question: it's full of hard engineering problems, but none of it looks unsolvable, and the investments are there. And even if there was only a 10% chance of QC breaking crypto, th
66.
by BoppreH 5mo ago
Where do we go now for the answers validated by the community? How do we build knowledge? The answers that Claude gives might look good, but without community edits, votes, and comments it's a lot harder to evaluate. I don't see
67.
by BoppreH 5mo ago
The screenshots in the post include many old applications, sometimes jarring to modern sensibilities. I think it's fair to have a discussion here about the evolution of application UI too, no?
68.
by BoppreH 5mo ago
> You were forced to change your workflow and everybody else is having to be forced to adapt because they changed a metaphor that has remained stable on the desktop for over 40 years All of the "positive" items I listed come wi
69.
by BoppreH 5mo ago
If that's a problem for you, you have much to gain with better window management shortcuts. On KDE I have the Windows key + left click set to drag a window from anywhere , and win + right click to resize depending on the quadrant the
70.
by BoppreH 5mo ago
With a better API we could have a progress bar that goes through the TCP/IP stack: advance when the domain is resolved, when a handshake is finished, when the request is sent, when the response starts streaming back, when the response
71.
by BoppreH 5mo ago
Probably! To quote William Gibson, "the future is already here — it's just not very evenly distributed". I'm sure you can find some of these features all the way back in The Mother of All Demos, the difference now is tha
72.
by BoppreH 5mo ago
Sometimes I see it complaining _on every keypress_. Certainly annoying, but much better than the old "invalid field" red text at the very bottom, leaving you to scroll back up and guess what's wrong.
73.
by BoppreH 5mo ago
We also lost clearly identifiable buttons, loading bars (replaced with throbbers), status bars that tell you what you're hovering over and what the program is doing, stable UIs to develop muscle memory, etc. But we did gain some nice t
74.
by BoppreH 5mo ago
> The fact that a subscription designed to cancel itself But it wasn't? TFA is describing a technical issue that kept cancelling a subscription. This is not a "we've noticed that you haven't been using the service and
75.
by BoppreH 5mo ago
> A hard lesson you learn building a complex system is that its reliability is the minimum of the combined reliability of its critical parts. It's worse than that, the combined availability is the product of all components in th
76.
by BoppreH 5mo ago
> Brazil does not "fuel" cars on sugarcane any more than the US fuels its cars with corn. In Brazil "ethanol" is sold separately from normal gasoline, and as far as I know it's entirely made from sugar cane, with
77.
by BoppreH 6mo ago
- Figure 3 has "elboly actuators" for the elbow joints (zero hits on Google for the term). Could it be just the illustrations? I'm not knowledgeable enough to judge the text contents.
78.
by BoppreH 6mo ago
There are also scanners that you can deploy to identify vulnerable servers, like https://sshcheck.com/ . Clients are harder to check, but you can always observe your logs.
79.
by BoppreH 6mo ago
Late edit: PQC migration also includes sometimes changing configuration files/library invocations to enable the new algorithms, and ensuring that your processes still work during the migration, where you might have both pure classica
80.
by BoppreH 6mo ago
That's because of the difference between Confidentiality goals and Authenticity goals. If I send you a document encrypted with classical crypto today, an attacker could grab a copy, wait a few years, then decrypt with a quantum compute
81.
by BoppreH 6mo ago
Disclaimer: what follows is my opinion. There's a good consensus that for key exchange/encryption (TLS, SSH, age, etc) the way forward is ML-KEM 768 together with some classical algorithm, like X25519. The public keys are larger (
82.
by BoppreH 6mo ago
Many people in this thread are skeptical about quantum computers, and that's fair. This migration is a big part of my current job, and even I think that there's a non negligible chance that we won't see commercially available
83.
by BoppreH 6mo ago
That's true for their CDN ( https://blog.cloudflare.com/post-quantum-for-all/ ), but there's a lot more to do, with a 2029 target ( https://blog.cloudflare.com/post-quantum-roadmap/ ).
84.
by BoppreH 6mo ago
I have another comment[1] on this post with more practical instructions, but the `ssh-keygen` is a good question. The cryptography community is still focused on migrating encryption/key exchange algorithms, for fear of data being cap
85.
by BoppreH 6mo ago
> But what I don't see is what I can practically do now, as either someone who is a CTO/Big Cheese™ or a lowly engineer? Migrate! The major TLS and OpenSSH applications already support PQC, for example. 1. Make sure you have th
86.
by BoppreH 6mo ago
Definitely, but then the damage is limited to the encrypted data that those actors managed to intercept some years before. Compared to QC arriving to an unprepared world, that's a very limited impact.
87.
by BoppreH 6mo ago
It reminds me a lot of Y2K. The fix is simple, but finding the places where it's needed and doing it in a compatible way are absolutely non-trivial problems. The best we can hope is the same as Y2K: the plethora of articles convince bu
88.
by BoppreH 6mo ago
Some Hardware Security Module manufacturers were smart enough to include FPGAs in their products, which they can now use to accelerate PQC algorithms without a hardware refresh. The trouble is that PQC already has inherent size/perform
89.
by BoppreH 6mo ago
I agree that this is our profession's Achilles heel. But I see one more cause: binaries and processes are black boxes unless they deliberately implement an interconnect feature. Try to extract the list of playlists from a Spotify clien
90.
by BoppreH 6mo ago
Isn't that exactly what people had been accusing Anthropic of doing, silently making Claude dumber on purpose to cut costs? There should be, at minimum, a warning on the UI saying that parts of the context were removed due to inactivit

More ›