btrask

26 ms·

1. 211.▲
   by btrask 10y ago

   Three guesses what the second worst sandbox is. :)
2. 212.▲
   by btrask 10y ago

   Thanks for this comment. It's the first really substantiative response to my core thesis. I don't think the math is on your side. As the defect rate approaches zero, there are diminishing returns to pushing it lower. On the other
3. 213.▲
   by btrask 10y ago

   See the later quote: > (It should also be possible to block or control access to each of these.) The good news is that the capabilities of the sandbox don't need to be every-expanding, the way browsers have been. The sandbox should
4. 214.▲
   by btrask 10y ago

   A sandbox like NaCl doesn't depend on the kernel for security. In fact, it shields the kernel, which is good, because common OS kernels tend to have large attack surfaces of their own. The compiler of the sandbox needs to be reliable (
5. 215.▲
   by btrask 10y ago

   I don't actually have a cite for you, although it comes up in information theory. For example, guessing a password one letter at a time is (dramatically) easier than guessing the whole thing at once. I'd be curious to know what th
6. 216.▲
   Mango combines Ethereum with IPFS as a decentralized back end for Git(medium.com)

   6 points by btrask 10y ago|0 comments
7. 217.▲
   by btrask 10y ago

   It's really just an announcement of an announcement. Or charitably, a confirmation that they don't plan on missing the June release date. I've been checking their mailing list and bug tracker and saw nary a peep about the alp
8. 218.▲
   PayPal has decided that Yabause is illegal and infringing on Sega's copyright(yabause.org)

   5 points by btrask 10y ago|0 comments
9. 219.▲
   make decentralized – A Makefile for the Decentralized Web(github.com)

   4 points by btrask 10y ago|0 comments
10. 220.▲
    The 51% Defense(bentrask.com)

    1 points by btrask 10y ago|0 comments
11. 221.▲
    by btrask 10y ago

    This argument can be made for most/all software vulnerabilities.
12. 222.▲
    by btrask 10y ago

    Ran across this recently: > Call of Duty: Infinite Warfare puts storytelling in a narrative. Infinity Ward breaks ground by exploring weight and its responsibilities. In a time of adversity, the player, as Captain of their warship, must
13. 223.▲
    by btrask 10y ago

    Can PVS-Studio actually find any buffer overflows? These logic errors are important but they're not what people are typically most concerned about these days.
14. 224.▲
    by btrask 10y ago

    We already knew that blockchains are vulnerable to 51% attacks. There are real problems with points of centralization (including the developers), but events like this don't prove anything. Edit: to be clear, the 51% attack I'm ref
15. 225.▲
    by btrask 10y ago

    Agreed. I've thought about adding a JS/Flash clipboard button. For now, if you click a hash, it's easier to copy from the hash's own page. I think there's also potential for better tooling, for example CLI tools tha
16. 226.▲
    by btrask 10y ago

    Thanks, I've made a note to add this to the FAQ.
17. 227.▲
    by btrask 10y ago

    I believe that double-hashing is "equivalent" to single-hashing. See this issue: https://github.com/ipfs/refs-denylists-dmca/issues/2 There are some ways of doing it, depending on exactly what your
18. 228.▲
    by btrask 10y ago

    Yeah, IPFS is a big one. I plan on adding support for computing IPFS hashes to Hash Archive at some point too.
19. 229.▲
    by btrask 10y ago

    Yes, this has been discussed. It has to be done carefully so that it doesn't leak every URL you download, but if done well I think it would be useful.
20. 230.▲
    by btrask 10y ago

    Thanks! Right now we're sort of in a chicken-and-egg situation where everything uses (mutable) URLs, so knowing the hash of a file isn't very useful. The Hash Archive is part of my strategy for promoting content addressing, to hop
21. 231.▲
    Show HN: Hash Archive helps you verify the hashes of insecure downloads(hash-archive.org)

    52 points by btrask 10y ago|20 comments
22. 232.▲
    by btrask 10y ago

    Okay, libraries can't provide new inabilities. But that's why we have linters, static analyzers, style guides, compiler options and warnings, and ultimately code reviews and good taste. I think the big problem (and sometimes benef
23. 233.▲
    by btrask 10y ago

    We could really use a decentralized spell checking service. I'm thinking a blockchain, maybe Ethereum. Edit: Poe's law.
24. 234.▲
    by btrask 10y ago

    Actually, there is: https://en.wikipedia.org/wiki/Setcontext A library I personally recommend, which supports several platforms and back-ends: http://byuu.org/library/libco/
25. 235.▲
    by btrask 10y ago

    It sounds like this perlasm is the state of the art in maximally efficient high level languages. (Half joking.) I feel like if you took something like qhasm and extended it to be a full language rather than sort of a hack, you would end up
26. 236.▲
    by btrask 10y ago

    With sufficient sandboxing, and depending on the needs of the site in question, this is actually possible to do securely. When you use sandboxing properly, the security of your application doesn't depend on how complex it is or how man
27. 237.▲
    by btrask 10y ago

    With fewer features, new engines like Servo could be built faster.
28. 238.▲
    by btrask 10y ago

    Well said. This is the classic latency versus throughput tradeoff. Game developers are right to prefer SoA. Web developers are right to prefer AoS.
29. 239.▲
    by btrask 10y ago

    This article seems to be from the perspective of using databases, whereas I expected from the title it would be from someone who created database software. Since learning how databases work from the ground up, my understanding of all so
30. 240.▲
    by btrask 10y ago

    This is just a list of more things for them to clamp down on. I'm thinking about going in the opposite direction, and broadcasting all of my personally identifying information (credit card, SSN, etc). Obviously I would have to set asid