ademarre

18 ms·

121.
by ademarre 11y ago
Are these certificates exclusively for ELB and CloudFront? Does anyone see a way to download a certificate for manual installation on a server (EC2 or otherwise)? https://docs.aws.amazon.com/acm/latest/userguide&#x
122.
by ademarre 11y ago
Thanks for pointing that out. It was updated after initial publication. Originally it said: > This was cleverly demonstrated by Nat McHugh, who used the broken hash function MD5 to create two images with the same hash...
123.
by ademarre 11y ago
Nice write-up, but it's slightly misleading or confusing to not explain that Nat McHugh's image collisions were chosen-prefix attacks. The post makes it sound like the images were the product of some unexplained collision, and the
124.
by ademarre 11y ago
If it were up to me I might stylize the name in uppercase "IO" or lowercase "io", and encourage the user community to do the same. "Io" looks too much like "lo" (lowercase L). And being a proper noun,
125.
by ademarre 11y ago
Let's remember the context of this discussion. We are talking about hash functions in cryptographic protocols. No one is proposing that you use a hash function to test the equality of two values when you're not constrained to the
126.
Application Security Verification Standard 3.0 [pdf](owasp.org)
16 points by ademarre 11y ago|0 comments
127.
by ademarre 11y ago
You are dramatically undervaluing collision resistance. > Imagine if your '==' operator only worked 99 times out of a hundred. Imagine if the probability of your '==' operator failing was 2^(-128). I would be fine w
128.
by ademarre 11y ago
A hash function with a fixed output length and arbitrary input length necessarily implies that collisions exist. So in a very strict sense, you are correct that equality of hash output doesn't prove equality of input. But that's m
129.
by ademarre 11y ago
I accidentally upvoted your comment, but I meant to downvote. Sorry. If fear of collisions is the reason you don't use a crypto hash function, then you are using a broken hash function. A hash doesn't satisfy all the requirements
130.
by ademarre 11y ago
Related previous discussion: https://news.ycombinator.com/item?id=9917712
131.
by ademarre 11y ago
There's Handycipher[0] from 2014. I remember learning about it from Bruce's blog[1], but haven't a clue how secure it is. [0] http://eprint.iacr.org/2014/257.pdf [1] https://www.schneier.com&#
132.
by ademarre 11y ago
> I find that amazing that the TelCos would even contemplate charging their customers and at the same time using them as products. Nothing the telcos might do would be amazing to me anymore.
133.
by ademarre 11y ago
It would be helpful to know the default work factor for the bcrypt hash in that Python library, since none was provided. Apparently it's 12: https://pypi.python.org/pypi/bcrypt/2.0.0
134.
by ademarre 11y ago
It took me a moment to realize the name derivation was pretty + ping. My eyes first grabbed onto "typing", then "pretty", and for an instant considered if it might be a portmanteau of those. I didn't catch on until
135.
by ademarre 11y ago
Another patent-encumbered video compression algorithm.
136.
by ademarre 11y ago
This exposes a weakness in the "double-submit cookie" CSRF defense technique. https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(...
137.
by ademarre 11y ago
> If you can steal somebody else's cookies (which are not Channel-bound) then that's true. If you can only steal or predict somebody else's session ID's, the HMAC provides protection. Session fixation. You don'
138.
by ademarre 11y ago
Unfortunately no. An attacker can inject a signed cookie just as easily as an unsigned one. A signed cookie can prove integrity, that its data hasn't been tampered with; it can't prove that it is coming from the browser it was iss
139.
by ademarre 11y ago
You can trick people, and possibly even search engines. I've wondered if blackhat SEOs could abuse such URLs to discredit content on competitors' sites. I believe it can be a negative signal when sites stuff too many keywords in t
140.
by ademarre 11y ago
The closed Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1106470
141.
by ademarre 11y ago
This is a good move. As an aside, I thought this was a funny appeal to authority: > SSLv3 has been obsolete for over 16 years and is so full of known problems that the IETF has decided that it must no longer be used. <link to RFC 75
142.
by ademarre 11y ago
Cool, but the tagline is redundant and awkward: > a music programming language for musicians I would suggest dropping one of the musics : "a programming language for musicians".
143.
by ademarre 11y ago
This is informative, and looks like a fun project! But if you're simply looking for random bits on the Raspberry Pi, don't overlook that it already comes with a HW RNG built in.
144.
by ademarre 11y ago
So, Facesmash [1] instead of Hot or Not [2]. [1] https://en.wikipedia.org/wiki/History_of_Facebook#Facemash [2] https://en.wikipedia.org/wiki/Hot_or_Not
145.
by ademarre 11y ago
Interesting. I hadn't thought of that before, but those examples seem to embody the struggle in the transition from classic print design to modern digital mediums. I imagine someday we'll see more typefaces versioned like software
146.
by ademarre 11y ago
How far away are we from using this practically? e.g. /dev/random
147.
by ademarre 11y ago
And the HN thread: https://news.ycombinator.com/item?id=1002723
148.
An Easier Way to Create Tiny Golang Docker Images(iron.io)
1 points by ademarre 11y ago|0 comments
149.
by ademarre 11y ago
Wonderful work! > We update the map every year, draw in new buildings, paint in new colors of houses etc. It would be cool to have a time slider control to see how the city has changed over time. Similar to what Google Earth does for s
150.
by ademarre 11y ago
Okay. Technical considerations aren't the only things that matter. Correct. It's good to recognize that API design accommodates both technical and "political" considerations, but to argue that the concept is one or the o

More ›