amluto

36 ms·

421.
by amluto 5mo ago
Nope -- that gives neither public-key capabilities nor forward secrecy.
422.
by amluto 5mo ago
Am I the only one who thinks that the AD bit is about as useful as the RFC 3514 evil bit? We have this elaborate, complex, and extremely fragile cryptographic system behind DNSSEC and we distill it down to one single bit that we carry over
423.
by amluto 6mo ago
> You can get them with computationally secure primitives, but then there's no point in using QKD in the first place. I don’t entirely agree. You can build a computationally secure authenticated channel using symmetric primitives (e
424.
by amluto 6mo ago
Hahaha. You wish :-p
425.
by amluto 6mo ago
It is indeed a bit sad that Cloudflare had to turn off DNSSEC completely. But I completely understand that they don't have a production-ready, tested path to override DNSSEC validation for only some domains.
426.
by amluto 6mo ago
In my opinion, QKD (implemented correctly) performs key exchange, basically like Diffie-Hellman except that it’s secure even against an adversary with unlimited computing power. If I had a quantum computer and a quantum network anyway, may
427.
by amluto 6mo ago
> QKD is an ongoing field of research where new issues are routinely being discovered. This always bothers me a bit. QKD is on a very solid theoretical footing — if you have an authenticated classical communication channel and an actual
428.
by amluto 6mo ago
I disagree. VMs are better isolated to precisely the extent that (a) the attack surface is lower and (b) the implementation is simpler and thus less buggy. Hardware virtualization has a strong effect on (b), but it’s not at all a foregone c
429.
by amluto 6mo ago
I disagree. If the codegen / optimizer is trying to preserve the rule that futures don’t have side effects until polled, then it seems fine to assume that the future being wrapped also follows that rule. So if I call a foo() that viola
430.
by amluto 6mo ago
Only for code that can’t be tested in an isolated environment, and designing code that can’t be tested in an isolated environment is generally a mistake for quite a few reasons.
431.
by amluto 6mo ago
I amused myself by removing codex-rs’s web search tool and then asking it to search for “foo”. It wrote a Python script to do the search.
432.
by amluto 6mo ago
Open the Wallet app (the double-tap-power view doesn’t work). Ask to delete one card at a time (which requires two taps which a short mandatory wait between them due to the animation). Tap again to confirm. Then wait an obnoxiously long t
433.
by amluto 6mo ago
There is a major issue with current AI tools that they want to effectively grant access to everything their user has access to. The whole sandbox structure is wrong (although various people have vibe coded assorted improvements).
434.
by amluto 6mo ago
async fn bar(input: u32) -> i32 { let blah = input > 10; // Preamble let result = foo(blah).await; result * 2 // Postamble } > If only we were allowed to execute the code up
435.
by amluto 6mo ago
The flow for removing cards is also a fantastic exercise in slowness.
436.
by amluto 6mo ago
Sigh. 1. I would hope the default seccomp policy blocks AF_ALG in these containers. I bet it doesn’t. Oh well. 2. The write-to-RO-page-cache primitive STILL WORKED! It’s just that the particular exploit used had no meaningful effect in the
437.
by amluto 6mo ago
> There may be some magic they do to better optimize within-user-searching. It's something that they could hide in implementation details so we can't be sure unless they spill the beans but it's feasible - especially with
438.
by amluto 6mo ago
Isn’t the model needed rather similar to what’s needed for sensor fusion in general? If you can extract features from each sensor that you expect to match to features from a different sensor, then you can collect a bunch of samples of this
439.
by amluto 6mo ago
And yet these are still (apparently) implemented as search queries instead of direct database queries.
440.
by amluto 6mo ago
I’m not sure this has much to do with vision as opposed to fancy self-calibration software. At least a few years ago, Tesla cars would be in self-calibration mode for a while after delivery while they calibrated their cameras. I think the
441.
by amluto 6mo ago
That’s sort of orthogonal. But if GitHub actually invoked an LLM on initial page load, that would be about par for the course, and it would be amusing for GitHub to then complain that they’ve grown so quickly that their systems can’t keep
442.
by amluto 6mo ago
For literally decades, I’ve observed that there are systems that make each operation cheap and systems that work hard to scale out. The former frequently seems to wildly outperform the latter. GitHub, for example, seems to implement the mai
443.
by amluto 6mo ago
Rivian enabled this feature a while back via OTA, and it was bad . It only ever triggered while entering or exiting a freeway, and it’s really quite distressing when you are trying to merge onto a freeway and the car tries to nudge you of
444.
by amluto 6mo ago
I find this impressive: in my experience, codex-rs loves to add tests even when not prompted. Of course, it’s a bit of a crap shoot as to whether the test tests useful behavior. (My favorite so far: it created an empty file in /home&#x
445.
by amluto 6mo ago
Another mistake: > The data they took with the attempt of purchase is the card is still usable (not cancelled) The payment flows should not distinguish between a nonexistent card, a cancelled card, and a valid card that needs 3D Secure.
446.
by amluto 6mo ago
A hardware accelerated DMA-capable cipher implementation is an odd thing, and it’s generally not useful on its own. You might want to set up a whole chain of operations (encrypt, checksum, send to network, for example), but I’ve never enco
447.
by amluto 6mo ago
IIRC some versions of cryptsetup require access to these APIs. It doesn’t help that the historically dominant userspace implementation of most of this stuff was OpenSSL, which is also terrible.
448.
by amluto 6mo ago
I like how the vulnerability is in the path that (a) attempts to write the password in reversibly encrypted form to disk [0] and (b) has a weird fallback path that writes it in clear text. Sigh. [0] cPabel seems to be from 1996. We’ve know
449.
by amluto 6mo ago
Just imagine if Huggingface used Vercel and paid their prices. It would cost them quite a few dollars for every decent-size model download. (Or AWS egress prices, or any comparable service.)
450.
by amluto 6mo ago
The cppreference description seems questionable to me: > Implicitly creates a complete object of type T (whose address is p) and objects nested within it. The value of each created object obj of TriviallyCopyable type U is determined in

More ›