aabbdev

3 ms·

1. 1.▲
   by aabbdev 1y ago

   Shipped a timing leak via early-exit memcmp + secret branch. Flatline is a single-header toolbox for constant-time C (CT compare/select/lookup/div) guided by B.I.D.—no Branch on secrets, no secret Index, no variable-latency o
2. 2.▲
   Think memcmp is safe? Think again(github.com)

   2 points by aabbdev 1y ago|1 comments
3. 3.▲
   by aabbdev 1y ago

   A Postgres extension is currently in development to provide transparent database optimization with custom type uuid45 and optional helpers ;)
4. 4.▲
   by aabbdev 1y ago

   You can always treat IDs as UUIDv4, while actually storing them as UUIDv7—combining the benefits of both. From your perspective, they’re just UUIDv4
5. 5.▲
   by aabbdev 1y ago

   Hi, I’m the author of uuidv47. The idea is simple: keep UUIDv7 internally for database indexing and sortability, but emit UUIDv4-looking façades externally so clients don’t see timing patterns. How it works: the 48-bit timestamp is XOR-mask
6. 6.▲
   UUIDv47: Store UUIDv7 in DB, emit UUIDv4 outside (SipHash-masked timestamp)(github.com)

   194 points by aabbdev 1y ago|88 comments