codahale

24 ms·

91.
by codahale 17y ago
I want to be excited about this, but there are big gaps in this spec. For example, "blah"[0] should return an Object instance which represents "b". Could be a Fixnum. Could be a String. Could be a JPEG of some ASCII art representing the ess
92.
by codahale 17y ago
Ah yes, The Financial Post . The newspaper I turn to for all of my climatological analysis. It's like International Journal of Climatology , but with better op-eds and stock listings.
93.
by codahale 17y ago
Robinson's Mars trilogy, Watts' Blindsight , Sterling's Heavy Weather and Distraction , Vinge's Rainbows End . Off the top of my head.
94.
Thoughts on Dynamo's "flawed architecture"(dizzyd.com)
24 points by codahale 17y ago|1 comments
95.
by codahale 17y ago
Scala is the clear king of speed. Actors are more lightweight than threads, and a shared nothing approach means no locking, so concurrency can be maximized. Ah, another person who's never come close to examining Scala's actor implementati
96.
by codahale 17y ago
So, in the 4-8 million years since H. sapiens began to diverge from what would become chimpanzees and gorillas, we gained the ability to walk and run, use tools, and use language. The females of our species stopped having estrus, the male
97.
by codahale 17y ago
Yeah. "We let Twitter (via Kevin Rose) know about this before it went live but we think somebody saw the Test!" is a total numbnuts disclosure policy. If one finds a vulnerability, follow the rfpolicy[1] or similar. Send an email to securit
98.
by codahale 17y ago
Exactly. First, check http://svn.debian.org/wsvn/ for the package you're lusting after. (In this case, pkg-ruby has the ruby1.9.1 package at 1.9.1.243-2 on trunk.) Then, use svn-buildpackage to build yourself the damn package. Finally, in
99.
by codahale 17y ago
No, it will add millisecond-accuracy jitter to the timing of your algorithm. And the attacker will continue to be able to extract microsecond-accuracy data from your timing attack. You need profoundly accurate hardware and a real-time opera
100.
by codahale 17y ago
Nope.
101.
by codahale 17y ago
Leonid Volnitsky's git-prompt is the best git-enabled Bash script I've found. http://github.com/lvv/git-prompt/tree/master
102.
by codahale 17y ago
Perhaps it'll mean more if someone else says it: Although nanosleep() takes a timespec struct that allows you to give an accuracy with nanosecond precision, nanosleep doesn't really give anywhere near that level of accuracy. Under Linux, t
103.
by codahale 17y ago
You're better off just using a constant-time algorithm which uses the same number of operations for all inputs. Few systems, if any, have sub-nanosecond-resolution timers, let alone thread schedulers which have quanta of that size.
104.
by codahale 17y ago
You don't really need to. You can guarantee that the right HMAC and the wrong HMAC both take exactly the same amount of time to compare by using a constant-time algorithm like the one in the article without dealing with non-portable, unreli
105.
by codahale 17y ago
Whoops! Correction: Yodlee does support non-US banks, including some in Canada, UK, Australia, and some Asian countries. No idea why Mint doesn't do it. I had always assumed it was because they were share-cropping on Yodlee's architecture
106.
by codahale 17y ago
Again, you should read the Crosby et al. paper ( http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf ) and the Brumley & Boneh paper ( http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf ). However complicated you think the in
107.
by codahale 17y ago
You got it. Yodlee doesn't support non-US banks; Mint's built on top of Yodlee; ∴ Mint doesn't support non-US banks. (Full disclosure: I work for Wesabe.)
108.
by codahale 17y ago
You may want to read this: http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf Adding jitter will not defeat timing attacks unless the jitter is dependent on the input, like blinded RSA.
109.
by codahale 17y ago
Ah, that's a very good point. I've updated the post to return early, since figuring out the short-circuiting behavior across a handful of languages is obviously not my strong suit. Thanks for pointing that out, sophacles.
110.
A Lesson In Timing Attacks (or, Don't use MessageDigest.isEquals)(codahale.com)
113 points by codahale 17y ago|30 comments
111.
by codahale 17y ago
These benchmarks don't seem to take HotSpot compilation into account, which means some of those numbers are for interpreted Java bytecode and some of those numbers are for native code and you don't know which are which. The behavior of the
112.
by codahale 17y ago
Hmm. This might be a good way to deal with entropy starvation on VM guest OSes. Kind of a niche concern, but one I happen to have.
113.
by codahale 17y ago
A serving size is 2Tbsp, which is what I put on a serving size of bread (1 slice) when I'm paying attention to how much I'm putting on. Like I said, though, I tend to slather it on (mainly because Nutella is so damn good )—so I'm really ge
114.
by codahale 17y ago
I don't think you've read the OP. It addresses self-control: evidence exists to support the idea that human have a limited amount and range of focus of self-control, and can suffer from self-control fatigue: http://www.stolaf.edu/people/hu
115.
by codahale 17y ago
You're ignoring the fact that the food industries in Europe and America are very different. When Italy has an Applebee's in each strip mall then Italians will be as fat as Americans. People are people; neither you nor Europeans are magica
116.
by codahale 17y ago
Wheat bread's about 75 calories a slice, so 150 for just the bread. I don't know about you, but I put it on thick—maybe a serving-and-a-half per slice, which according to the Nutella website is 570 calories. So 720 total. Not 1,000, but clo
117.
by codahale 17y ago
1,000 calories, considering the modern possibilities, isn't that much. I mean, that's a bit less than two slices of toast with Nutella. Weight loss programs have to focus on preempting and managing appetite. There's a wealth of studies co
118.
by codahale 17y ago
Oh, gross. They just pass the plaintext right through to RSA. No OAEP, just bang right into the BigInt. There's some random gibberish appended to the plaintext ("hey, this needs some salt"), but they're not padding a damn thing. Bleichenbac
119.
by codahale 17y ago
FWIW, JRuby does not have a GIL, plus you get to use java.util.concurrent.* classes in your Ruby code.
120.
by codahale 17y ago
http://shoulditellpeoplehowjadediamaboutthisinternetmeme.com

More ›