ademarre

24 ms·

181.
by ademarre 12y ago
Is scrypt even implemented without a salt? If not, then it doesn't matter. And if so, why?
182.
by ademarre 12y ago
> you'd need to build an expensive (but potentially feasible) rainbow table of possible scrypt output I don't think that's feasible. "Expensive" is an understatement. To compute the rainbow table you need to do
183.
by ademarre 12y ago
You can create your own dice word list by selecting 7776 words and indexing them with a base-6 ID.
184.
by ademarre 12y ago
> But you don't necessarily have an up to date copy. You would if you designed your build process that way. I think it's a good idea to eliminate all third party build-time dependencies. In practice this means keeping a Git
185.
by ademarre 12y ago
The article cites CouchDB as how this kind of thing can play out differently for open-source software. The first example that came to my mind was Oracle's acquisition of Sun Microsystems, and the subsequent MySQL forks (e.g. MariaDB).
186.
Patent infringement claimed against OAuth 2.0(datatracker.ietf.org)
2 points by ademarre 12y ago|0 comments
187.
Code-used Time-used Shapes(benchmarksgame.alioth.debian.org)
1 points by ademarre 12y ago|0 comments
188.
by ademarre 12y ago
Is there any chance this could be dangerous to the human and not just his device?
189.
by ademarre 12y ago
> Better they plug in a bad device you control vs one carrying a truly malicious payload. In this case the bad device you control is a truly malicious payload whose damage can be measured in dollars.
190.
by ademarre 12y ago
It demonstrates that you can use the address bar for animation. I imagine there might be a scenario where you'd want to try this for a progress bar or some other kind of status indicator.
191.
by ademarre 12y ago
It would be helpful to see this graphed over time. Also, how do you rule out service quality problems at the server's end?
192.
by ademarre 12y ago
Is it just me, or is the Superfish fiasco being covered disproportionately against the other big security story this week, the NSA/GCHQ SIM heist? https://news.ycombinator.com/item?id=9076351
193.
Homeland Security: Lenovo Superfish Adware Vulnerable to HTTPS Spoofing(us-cert.gov)
3 points by ademarre 12y ago|0 comments
194.
by ademarre 12y ago
That's good. It seems too few consumers get a clean Windows experience, and this fiasco has quickly become the chief example. You'd think MS would want to address that, perhaps by hardening their OEM licensing.
195.
by ademarre 12y ago
Crawling and indexing truly are fundamentally different things, and search engines have mechanisms to block both . https://support.google.com/webmasters/answer/93710?hl=en > You can prevent a page from appear
196.
by ademarre 12y ago
> search engines that explicitly dishonor the spirit and purpose of instructions not to crawl pages If you believe that to be true, then you should be arguing for a solution to that problem. A robots noindex meta would work perfectly
197.
by ademarre 12y ago
Google and the other search engines offer a standard mechanism for websites to tag such content so it won't be indexed. That's a much better solution for the man in the article. As it is now he has to make a request to every searc
198.
by ademarre 12y ago
But what of the entities that publish this information online in the first place? Why are the newspapers not accountable?
199.
The Equation Group's Sophisticated Hacking and Exploitation Tools(schneier.com)
2 points by ademarre 12y ago|0 comments
200.
by ademarre 12y ago
Right. That paragraph about the extensions makes me question the credibility of his claims. Disappointing. I haven't experienced the performance problems he describes, and I use the Chrome dev channel for my main browser. I've not
201.
by ademarre 12y ago
This looks similar to the method employed here: https://eager.io/blog/how-long-does-an-id-need-to-be/ (HN discussion: https://news.ycombinator.com/item?id=8539866 )
202.
by ademarre 12y ago
> Open Image Spec ... As we continue to grow the contributor community to the Docker project, we wanted to encourage more work in the area around how Docker constructs images and their layers. As a start, we have documented how Docker c
203.
by ademarre 12y ago
Doing many requests over the same connection is very common.
204.
by ademarre 12y ago
You're probably right; spec conformance is a problem. What should be done about it? If the spec itself isn't all that bad, then we should try to improve implementations. Maybe tools can be developed to help detect implementation f
205.
by ademarre 12y ago
Good question. I dug up the e-mail from 2012 and here's what the Google Security Team told me: > We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. S
206.
Bruce Schneier and Edward Snowden at Harvard Data Privacy Symposium 1/23/15(youtube.com)
1 points by ademarre 12y ago|0 comments
207.
by ademarre 12y ago
With the exception of vector #6, this is pretty much a list of implementation flaws, not protocol flaws. It's as if he's trying to say that the protocol isn't written defensively enough or foolproof enough for implementors, a
208.
Accountability as a Security System(schneier.com)
3 points by ademarre 12y ago|0 comments
209.
by ademarre 12y ago
Your experience speaks to this observation: With very few exceptions, consumer hardware companies are bad at software.
210.
by ademarre 12y ago
Care to elaborate on DNSSEC? I've been interested in seeing wider adoption of DNSSEC for things like DANE.

More ›