absherwin

15 ms·

91.
by absherwin 13y ago
I'll paste it into another tab in a browser that has me logged into the account or I'll log into the account after pasting the link. Whichever you prefer. If you have another proposal, as long as it's something reasonable, I'm happy to ente
92.
by absherwin 13y ago
1. I proposed a few examples: Crypto flaws that you could exploit by giving you the ciphertext (only 1 person has asked), cross-site request vulnerabilities, and attacks from a malicious network. I also invited you to propose your own attac
93.
by absherwin 13y ago
The instructions are in a note. If I understand your attack, you'd need to set up a clone website that resends the password in the clear, have a malicious network redirect me to it and get me to enter my password. I'm happy to enable to you
94.
by absherwin 13y ago
That would work for a sufficiently broad definition of common. You're welcome to try. The challenge is that it'll take a long time unless you have incredibly fast hardware or are very good at guessing.
95.
by absherwin 13y ago
In that case is it possible to design a secure application? Can you design an application used by real world people that will remain secure even if the infrastructure that controls it is taken over? If a server is taken over, the best one c
96.
by absherwin 13y ago
I'll happily do that. When can I swing by to chat? Different systems are secure against different threats. Sticky notes are secure against people who can't get physical access to their location. The question in this case is what attacks thi
97.
by absherwin 13y ago
No, I've invited you to propose attacks and help you carry them out. Do you want to try to use a malicious network to inject code to steal my password? Find a vulnerability in one of the endpoints to take control of the server? Try to find
98.
by absherwin 13y ago
I'd expect them to propose a scenario that could be tested either with software or a miniature. You're under no obligation to but examples are persuasive. Feynman's ice water demonstration convinced far more people than his well-reasoned ap
99.
by absherwin 13y ago
How is the frequency of upgrade relevant to the security of the system? If given a new version, people tend to upgrade and I take control of your software update mechanism, how is the security risk any less? You'd presumably argue that we s
100.
by absherwin 13y ago
I agree it only proves security up to a certain value. Would you be happier if I increased the reward? Regardless, what do you think of someone who publicly calls something a terribly insecure idea, and then reacts with snark and doesn't ac
101.
by absherwin 13y ago
We can argue about the merits of downloadable solutions but that isn't a flaw in this application. I'm willing to make it easy for you: You can even have the database to let you crack it without first having to break into my server. I agree
102.
by absherwin 13y ago
This isn't a product launch. It's a demonstration to focus discussion.
103.
by absherwin 13y ago
I'm uncomfortable with arguments that are equivalent to PerceivedBenefit(X)>RealBenefit(X) and RealBenefit(X)>0 but NegativeBenefit(Actions|PerceivedBenefit(X))>RealBenefit(X) so X should be banned. Since PerceivedBenefit(X) and
104.
by absherwin 13y ago
What's an alternative implementation that encrypts the data at rest and is more resilient to a compromised server?
105.
by absherwin 13y ago
Having a server compromised is bad. Which is worse, the ability to read plaintext on the server silently or forcing a code change to be distributed to every user, however subtle? That said, the key for security is to design an app where com
106.
by absherwin 13y ago
Yes, you need to trust me. I'd argue it's easier to trust me if the crypto is happening on the client since if I change it, I could be caught. The probability of being caught in any one instance is very low but over many instances is high.
107.
by absherwin 13y ago
NP. Checking code is a good. It's not the clearest code since the initialization is located separately from the main RNG function. If you actually tried to read the inline minified version of SJCL, I'm sorry but impressed.
108.
by absherwin 13y ago
SJCL fills its initial entropy pool with crypto.getRandomValues()
109.
by absherwin 13y ago
Network security is a problem but breaking https doesn't seem trivial in the wild. That's why I'm inviting people to try exploits on a real app and willing to use a malicious network to let them break it.
110.
Challenge HN: Break my in-browser crypto for $1000
88 points by absherwin 13y ago|152 comments
111.
by absherwin 13y ago
A chattel is moveable property (i.e. not land). So a chattel currency is any currency that involves transferring property such as gold, flour, etc. Re: Slavery use. Slaves were called chattel because they were property; that was the disgrac
112.
by absherwin 13y ago
Right. Any statement that the program is in an infinite loop will usually be subject to error. Of course, the real question anyone asked to develop such a program would be what runtime is equivalent to an infinite loop. Any real-world progr
113.
by absherwin 13y ago
Writing a program to determine if another program will complete, error, or run indefinitely is quite doable given reasonable constraints: Run the program! One need only specify some reasonable length either equivalent to infinity for such a
114.
by absherwin 14y ago
Reinventing the wheel would be a major problem if our goal is to solve the education problem with this discussion. No one here has done even the basic work I would expect of someone trying to understand teacher evaluation as a solution and
115.
by absherwin 14y ago
It's not contrary at all. It's the same point. The changing mix is merely a difference of degree. The key argument you raise is that discrimination has a cost. I don't have the numbers offhand to determine whether the cost of monitoring exc
116.
by absherwin 14y ago
I'll bite. I won't discuss my experience in my posts since I don't want to argue from authority but will do so below. But first, I should point out that you're committing a similar sin to that which is alleged in the article. What you real
117.
by absherwin 14y ago
To build intuition, let's consider a hypothetical society. We divide a group of people in two. The first group rolls a die with 100 sides labeled from 1 to 100 in even increments. The second group rolls a die with labeled 1 to 110 in even i
118.
by absherwin 14y ago
Both sides are right but they seem to be concerned with different things. Grouping data points does mask volatility. This doesn't make the effect any less real on the societal level. If we seek to improve student performance, skewing the po
119.
by absherwin 14y ago
True but 150MM records with 70 degrees of freedom would likely be doable with 16GB of RAM and almost certainly with 32 as most of the variables are likely boolean and so can be stored in a single byte which Stata supports unlike R and SAS.
120.
by absherwin 14y ago
This sort of program has existed since the 70's. Excelsior, Charter Oak, and Thomas Edison all offer similar programs across a wider range of fields than Wisconsin is. The news here is that a school with a name is offering such a program.

More ›