brianmwaters_hn

9 ms·

31.
by brianmwaters_hn 12y ago
I think you're both right. There are side channel attacks against remote hosts (timing-based padding oracle attacks agains TLS come to mind). But for the case of PGP, which is mostly for encryption at-rest, attacks like this don&#x27
32.
Hacker Who Helped Disrupt Cyberattacks Is Allowed to Walk Free(nytimes.com)
69 points by brianmwaters_hn 12y ago|61 comments
33.
by brianmwaters_hn 12y ago
Another one: you guys are using a DV certificate, which is really less than ideal for an app like this, that needs to be trusted by its users.
34.
by brianmwaters_hn 12y ago
I don't think you're missing anything. That's the same idea I got. There's no mention of authentication or encryption, whatsoever. Other than the obvious problems with putting plaintext secrets at a publicly-accessible U
35.
by brianmwaters_hn 12y ago
The concept of the URL is really important in order for the web to work... it's what enables linking. Domain names are part of URL's, so there 'ya go.
36.
by brianmwaters_hn 12y ago
What's really interesting beyond just type coercion and "increment," is the way addition, multiplication, and exponentiation were implemented by Church and Rosser back in the 30's (see https://en.wikipedia.org
37.
Use after free in FreeBSD OpenSSL(freebsd.org)
2 points by brianmwaters_hn 12y ago|0 comments
38.
by brianmwaters_hn 13y ago
I saw Greg give a nice talk at Racket Con this year. He was really humble and talked about the challenges of writing a Markdown parser. Didn't know he wrote Cakewalk! Cool!
39.
by brianmwaters_hn 13y ago
Why is there a scarcity of comments here questioning the Bloomberg article? For that matter, why was there a scarcity of discussion questioning Reuters' December '13 article about RSA and Dual EC? Neither provided any evidence for
40.
by brianmwaters_hn 13y ago
Well, that's great, except, according to the article at the top of this thread, that's maybe not so great, depending on what kind of questions they asked you. So, what kind of questions did they ask you?
41.
by brianmwaters_hn 13y ago
> And this is not a problem that is specific to Gandi. Even with other online services, it's often quite easy to bypass automated security measures if you go through a human being, whether through the support system or through good
42.
by brianmwaters_hn 13y ago
What about having your test hardware hooked up to a development machine, that folks can VPN into? Is that even feasible?
43.
by brianmwaters_hn 13y ago
There are no details given. I know; the author says up front he's (she's?) not a security person. It looks, though, like the user can inject arbitrary JSON into their client side code. Not very interesting; I'm sure they&#x27
44.
The ACLU's NSA archive(aclu.org)
1 points by brianmwaters_hn 13y ago|0 comments
45.
by brianmwaters_hn 13y ago
I don't know why you think this. Penetration testers do this sort of thing every day, within limits.
46.
by brianmwaters_hn 13y ago
Did anybody else notice what is written on the upside-down calculator about 1/8 down the page?
47.
by brianmwaters_hn 13y ago
That's true, I think he just got it, even though the award is for 2013.
48.
by brianmwaters_hn 13y ago
I think the way they choose to introduce him in the blurb below the video is funny: "inventor of Paxos and developer of LaTeX." But Leslie Lamport has a Turing Award!
49.
by brianmwaters_hn 13y ago
The video won't play at all in my browser. FF24 on Gentoo.
50.
by brianmwaters_hn 13y ago
For me, every work day starts by strapping on a pair of steel-toed boots and a hard hat, climbing high up some steel structure (usually hundreds of feet), building an anchor, and rappelling in to get done whatever needs gettin' done. I
51.
by brianmwaters_hn 13y ago
Wow, that's a harsh view on the CISSP and infosec pros in general. Though I'm not necessarily disagreeing with you.
52.
by brianmwaters_hn 13y ago
What a shame; I just recently started taking on an interest in computer security and signed up for the list. In just the few weeks I was on there, I learned about a vulnerability in a device I had recently bought. I am cherishing the opport
53.
by brianmwaters_hn 13y ago
Yes. Some further research I did since this thread started has shown that in some phones, even the microphone and camera are under the direct control of the baseband processor. In others, it's not. But in most phones, the CPU and BB sh
54.
by brianmwaters_hn 13y ago
I would have to agree with you somewhat. Perhaps this is just FUD. However, I will say that a lot of the FSF's/GNU project's platform is based on the idea that, with unchecked closed-source code running on a device, such back
55.
by brianmwaters_hn 13y ago
Actually, my interpretation (which admittedly is based off of limited knowledge of hardware, the Linux kernel, and operating systems in general) was that the baseband processor itself doesn't have a kernel driver, per se, because it&#x
56.
The TCP/IP Guide(tcpipguide.com)
3 points by brianmwaters_hn 13y ago|0 comments
57.
by brianmwaters_hn 13y ago
I'm really surprised nobody's mentioned that this is an exercise from K&R (a.k.a. "The C Programming Language"), a must-read for any C programmer! https://en.wikipedia.org/wiki/The_C_Programming_
58.
by brianmwaters_hn 13y ago
> The Scouts are a great organization on a local level... > However, the BSA at a national level is a pretty awful organization. Thank you for pointing this out. I've been trying to explain this to people for years. When I was a