anaphor

52 ms·

481.
by anaphor 13y ago
Not really considering you have to buy certs if you want people to use your site, it doesn't have any sensitive data on it (not even source code or binaries), and they haven't finished cleaning it up to their standards yet.
482.
by anaphor 13y ago
Maybe you should consider donating
483.
by anaphor 13y ago
Parent might be referring to the fact that it can easily give false positives, but I'm not sure.
484.
by anaphor 13y ago
FWIW if you're doing explicit recursion for something then it's usually either: a) Going to be bounded by a small number or user controlled b) Something you would have to use recursion for in any language, like a recursive descent
485.
by anaphor 13y ago
Protecting against sidechannels doesn't mean the code has to be obfuscated. You do need to reimplement some things that are usually pretty simple (like string comparison) but it does not mean you can't abstract that away into a li
486.
by anaphor 13y ago
The QuickCheck model is at least as good as unit tests and is more likely to actually find bugs and corner cases . The resulting code is no more complex either. The only drawback I see is that it requires you to design your code in a very
487.
by anaphor 13y ago
Here is a good way I've found to debug network based code: Step 1: write shell scripts to capture certain kinds of network traffic with tcpdump and output a pcap file (e.g. have a certain function to capture HTTP traffic of a certain k
488.
A Security Market for Lemons(schneier.com)
2 points by anaphor 13y ago|0 comments
489.
by anaphor 13y ago
Can't the replay attack mentioned in the article be mitigated by using nonces? Why doesn't anyone do this? I'm genuinely confused by this.
490.
by anaphor 13y ago
Also I'm not sure how you can mention information theory in the context of programming and not mention PCM or the Shannon-Nyquist sampling theorem...
491.
by anaphor 13y ago
Doesn't djb espouse a similar viewpoint wrt sandboxing? Not to say she doesn't have any original ideas for how to achieve it, but it's hardly a novel concept.
492.
by anaphor 13y ago
It has little to do with the type system. Variadic arguments can be typed given a type system that supports it.
493.
by anaphor 13y ago
<3 Ghostery. I assume the comments are your typical "all hackers should die! One of them stole my yahoo account once!" stuff?
494.
by anaphor 13y ago
Direct link to the CRA response http://www.cra-arc.gc.ca/gncy/sttmnt2-eng.html "Regrettably, the CRA has been notified by the Government of Canada's lead security agencies of a malicious breach of taxpayer da
495.
by anaphor 13y ago
Okay yeah I agree with you there. The pain of destructuring cons cells is somewhat mitigated by the various forms that allow pattern matching, but it's still basically the same. So I think that is actually a good argument for introduci
496.
by anaphor 13y ago
It has pedagogical value to define things in terms of a very small kernel language. You will find things like alists in fairly advanced books on lisp (e.g. Lisp In Small Pieces) simply because it reduces the number of extra concepts you nee
497.
by anaphor 13y ago
I think the parent was saying car and cdr are confusing because they don't actually map to registers (i.e. address register and decrement register). On the other hand you don't have to think too hard about the composed versions of
498.
by anaphor 13y ago
by default ctrl+f6 will switch focus. You can remap that to something more convenient though (it's called shift-focus).
499.
by anaphor 13y ago
Yeah DrRacket is fairly slow unless you have a powerful computer. I recommend just using a text editor and making use of XREPL, see: http://docs.racket-lang.org/xrepl/index.html?q= tl;dr, open up the normal repl by typ
500.
by anaphor 13y ago
More like an expression parser that doesn't handle precedence or unary operators FYI, I recommend using the precedence climbing algorithm if you do need to do expression parsing: http://eli.thegreenplace.net/2012/0
501.
by anaphor 13y ago
and the base station can _disable_ encryption completely without any warning given to the cellphone user.
502.
by anaphor 13y ago
How do you feel about ordering complex numbers?
503.
by anaphor 13y ago
Just to be clear, I wasn't disagreeing with you, I was disagreeing with the article. Their method over SSL/TLS is just as broken as you say.
504.
by anaphor 13y ago
And anyone with $1500 and some free time can intercept your GSM communications and read the plaintext anyway. See: http://youtu.be/rXVHPNhsOzo
505.
by anaphor 13y ago
>why do many companies use SMS as secondary auth (for the "2" in 2-factor)? Because they don't know about TOTP or HOTP, and they instead decided to use a terribly insecure protocol as the basis for user authentication? The
506.
by anaphor 13y ago
Why is this article promoting a seriously flawed form of 2 factor auth? SMS based 2fa is easily broken compared to protocols based on a shared secret and invalidated using time or some kind of nonce counter :/ Edit: ah nevermind, it&#x
507.
by anaphor 13y ago
No, you use a shared secret which both you and the server can use to generate a one-time password. You send the OTP (over something like TLS still, yeah) and the server checks that it is valid and makes sure it can't get replayed.
508.
by anaphor 13y ago
Have you ever used a functional programming language?
509.
by anaphor 13y ago
Actually it's a procedure because it has a side-effect.
510.
by anaphor 13y ago
https://www.crypto101.io/

More ›