brl

32 ms·

271.
by brl 18y ago
In the paper itself, they reach the opposite conclusion: "Question. Suppose that a criminal creates by our method his own rogue Certification Authority that is trusted by all browsers. Are then only websites with certificates from the CA w
272.
by brl 18y ago
"Q: How many certificates are affected? A: Zero. No end entity certificates are affected by this attack. The attack, when it worked, was a potential method for a criminal to create a new, false certificate from scratch. Existing certificate
273.
by brl 18y ago
Out of all the hypothetical scenarios you could have chosen, you picked one where it is not only possible to intercept your encrypted data but really quite obvious how to do it.
274.
by brl 18y ago
What about prior discovery that occurred before all the other certificate authorities began to harden against theoretical attacks like this? MD5 based signatures and monotonically increasing certificate serial numbers used to be the rule,
275.
by brl 18y ago
Yes, but prior discovery is a real problem. If Jake and Alex hadn't told us that they had successfully pulled this off we would never have otherwise known. In that case they would be in silent and permanent possession of something like th
276.
Creating a rogue CA certificate with MD5 hash collisions(phreedom.org)
107 points by brl 18y ago|55 comments
277.
by brl 18y ago
Yeah, that talk is excellent. For a double dose of optimism about the human race, follow it up with the Hans Rosling TED talks. First he shows you some visualizations of economic data to convince you that we're not hopelessly fucked, then
278.
by brl 18y ago
Prepare to be astonished.
279.
by brl 18y ago
I really doubt that intelligence agencies such as the NSA and GCHQ have any secret and powerful ways to break cryptography at all. I know that everybody thinks that they do, but where is the evidence for this? Even during the 60s and 70s w
280.
by brl 18y ago
I will never EVER work in a communal work environment again. I can only work in a space somewhere between an 'office with a closed door' and a sensory deprivation tank.
281.
by brl 18y ago
Except for the emphasis on lambdas and closures which might be a conceptual hurdle for somebody coming from a language where they aren't used very often.
282.
by brl 18y ago
I'm well into my 30s as well and I am currently learning faster than ever. At some point I went from believing that I knew everything about programming to realizing that I actually know almost nothing. That's when the real learning proces
283.
by brl 18y ago
Some things get easier, but that particular hill is as high and as steep as you want it to be. One thing that is true is that you need at least 10 years of full-time experience to become competent at the design and architecture of large sys
284.
by brl 18y ago
It's not '>=' it's '>>=' the Haskell monad binding operator. (I also agree, that logo is pure awesomeness)
285.
by brl 18y ago
You're allowed to redistribute the JRE with an application if you do it for the reason that we're doing it: http://java.sun.com/j2se/1.5.0/jre/README
286.
by brl 18y ago
That's complete nonsense. A software company will always choose the price they believe will generate the most revenue. If they are acting rationally they would choose exactly the same price regardless of whether the software cost $100 to pr
287.
by brl 18y ago
I would have to agree with this. We released the first version of our software for Linux and OS X only. It wasn't a deliberate plan to target 'trend setters', we simply didn't finish the work we need to do on Windows yet. Since we are in
288.
by brl 18y ago
Our application is written in Java which is a compatibility nightmare on Linux. There are half a dozen alternative Java implementations which are all slow and broken but that doesn't stop the important Linux distributions from preferring t
289.
by brl 18y ago
I don't think very many people really make excuses like this. Most (if not all) of the people I know pirate quite liberally and they do it without apologizing or feeling the need to rationalize anything. Even though those who have their in
290.
by brl 18y ago
"How does the GPL scare customers in a way that the BSDL does not? This is a big claim to make without supporting arguments." That's easy to support. The GPL wing of the free software movement is famous for being unreasonably prone to solv
291.
by brl 18y ago
Well, it does happen sometimes. It's very cheap and easy to file a patent reexamination. You just need to dig up some prior art, pay about $2000 and you're good to go. You can even do this as a defense against an infringement allegation an
292.
by brl 18y ago
That's an interesting question too, but not really related to what I was asking and probably off-topic for this thread. I'm serious. If somebody has no money and wants to use some expensive commercial software, what is the cost to the copyr
293.
by brl 18y ago
Probably because the whole world is tired of listening to RMS blather on about what he thinks is ethical (the rhetoric on his website) and what he thinks is not ethical (every other opinion).
294.
by brl 18y ago
Pirating software is not 'stealing' by legal definition or any other one. It is also not an issue of morality or ethics. If you cannot make money selling your software because everybody pirates it and nobody wants to buys it you are not a
295.
by brl 18y ago
No, we don't, but maybe we should. Why should somebody who can't afford software not be allowed to have it?
296.
by brl 18y ago
Are you by any chance an INTP? What you describe is a strong indicator for that personality type. http://www.intp.org/intprofile.html "The drive to understand things that are not yet understood is a very powerful force in the life of an
297.
by brl 18y ago
I hear that Lambourghini's are pretty good but I'm 35 years old and I've never had a drivers license so I might not be the best person to ask.
298.
by brl 18y ago
More threads about cars please!
299.
by brl 18y ago
Of course I can perform a MITM attack on a wireless network. You might try thinking about the communication layers above PHY. Almost any of them will do.
300.
by brl 18y ago
Yeah, this book is great even if you don't have a formal math background. As somebody who didn't even finish high school I'm finding this book very easy to learn from because it is so well written.

More ›