colmmacc

10 ms·

61.
by colmmacc 2y ago
M1 is also both.
62.
by colmmacc 2y ago
At least on criminal matters, pardons over-ride the judicial branch.
63.
by colmmacc 2y ago
Back in 2010 when we were building Amazon Route 53, we had a really big problem to solve. DDOS attacks. DNS is critical, and it uses UDP, which is a protocol that allows attackers to spoof their source IP address. We knew that DNS services
64.
by colmmacc 2y ago
The Elephant Man is great, but does have a surreal sequence, and is entirely in black and white. I'd vote for the The Straight Story , which is literally a Disney movie, being more mainstream.
65.
by colmmacc 2y ago
My understanding of the ECPA and other acts is that you can't intercept, decode, or receive by other intentional means any information or communications that aren't "generally accessible" without permission. It's pr
66.
by colmmacc 2y ago
By this interpretation it would be perfectly legal to abuse a wifi encryption vulnerability to spy on your neighbors, because that doesn't involve accessing a computer of theirs. My understanding, and IANAL, is that decrypting things t
67.
by colmmacc 2y ago
I think many in cryptography would see cracking a key as a precondition to "actually exploiting it" ... because you've only gotten a cryptographic secret, not "actual data". But I think many others, and many in law
68.
by colmmacc 2y ago
It's more like the door has a weak lock that can be picked. Just like many real world doors do. Here's how it would go in court: "Are you aware that this key could be used to decrypt information and impersonate X?" &quot
69.
by colmmacc 2y ago
Bug bounties are a form of consent for testing and usually come with prescribed limits. Prescribed or not, actually getting user data tends to be a huge no go. Sometimes it can happen inadvertently, and when that happens it's best to h
70.
by colmmacc 2y ago
Let's say you local coffee shop is featured in a local news piece and the blithe owner happened to get photographed holding the store key. That's now easy to clone from public information. Would you be comfortable actually doing i
71.
by colmmacc 2y ago
Secrets themselves are often regarded as sensitive information, and often also categorized in the highest classifications for information protection. This stuff isn't just a game, and in my experience it's not how law enforcement
72.
by colmmacc 2y ago
I read the article, and I don't think it changes it. If you crack someone's key, they might be well within their rights to pursue a criminal prosecution. Of course it would also have a Streisand effect and there's reasons not
73.
by colmmacc 2y ago
Breaking a 512-bit key for a good demonstration is very valuable security research, even if it's been done before. It's also legit to call out "Hey, here's a list of folks still using 512 bit, they should move off."
74.
by colmmacc 2y ago
The only true random sources in the universe are quantum. But it's not practical or performant to hook your workload up to a raw quantum measurement like the spin of a fundamental particle, or radioactive decay. Instead we take sources
75.
by colmmacc 2y ago
When I wrote a Random class for use at Amazon, I made SecureRandom (which couldn't be seeded, and was a multi-source DRBG) the default, and you had to intentionally choose InsecureRandom. This is how it has to be, and in this case ther
76.
by colmmacc 2y ago
This is how many live-update and hot-patching systems work. Some changes are easy and reliable; if you need to add a new condition or a few instructions, you can build your new basic block of instructions elsewhere and then atomically inser
77.
by colmmacc 2y ago
I'm super proud of the work that the aws-lc team have been doing. Insanely powerful optimizations on many platforms (not least Graviton!) ... and those optimizations are formally generated or formally verified (see https://g
78.
by colmmacc 2y ago
I'm not a farmer, just friends with some. Driving through tiny towns in rural America you often see small-time John Deere dealerships and repair shops. They are very very well established. I've heard that they have trade-in and fi
79.
by colmmacc 2y ago
I became a US citizen because I wanted to be able to vote and be a full participant of my community, and it's easier to be in the same line as my wife and child at the airport. But even though I am not a criminal, it was also on my min
80.
by colmmacc 2y ago
I did transition year in 1996/1997, and I think we were only the second class to do it in my school. We took another European language for a year, and I did Art, Home Economics, Metalwork, and Woodworking classes that had no aptitude f
81.
by colmmacc 2y ago
It's not the Nobel Prize in Fundamental Physics though, and maybe this is correcting a bias that has been present for too long. Just because something isn't quantum or astronomical doesn't mean it's not physics. Physics
82.
by colmmacc 2y ago
Long before the CAP theorem paper I remember learning the same thing in the context of routing protocols like BGP and it being an "aha moment". It really helped me understand that there is no single version of the state of distrib
83.
by colmmacc 2y ago
I love this work! but my heart breaks that this DRBG won't see much use in many commercial and government environments. Businesses with Federal government customers are often required to use FIPS validated or at least FIPS compatible i
84.
by colmmacc 2y ago
I've worked at Amazon (and AWS) for over 16 years and have made many friends, and it's how I met my wife. What's always kept me here is that it's been fun the whole time, with meaningful problems and opportunities that m
85.
by colmmacc 2y ago
I'm skeptical that the US government would go so far, but why the difference between Apple and Nvidia? You can walk between their headquarters in California, and they are both incorporated in Delaware.
86.
by colmmacc 2y ago
The rationale is that while you may own the land, you don't own the artifacts, and the state has an interest in ensuring that history is recorded and preserved professionally. In effect, archeology is a licensed occupation, but then so
87.
by colmmacc 2y ago
If you look at say 3G -> 4G -> 5G or Wifi, you see industry bodies of manufacturers, network providers, and middle vendors who both standardize and coordinate deployment schedules; at least at the high level of multi-year timelines. T
88.
by colmmacc 2y ago
What do you think of a domineering bully who demeans, berates, and manipulates a vulnerable partner? It's not hard to find examples of relationships where over years a person preys on someone else's insecurities and tells them eve
89.
by colmmacc 2y ago
I very much doubt that the CCP has a backdoor into Signal the app; but it is worth keeping in mind that if an actor can observe traffic, e.g. cellular traffic records or network flow logs, they may be able to correlate senders and receivers
90.
by colmmacc 2y ago
Only the Senate approves judicial appointments. The Presidency and the Senate are the least representative elected institutions. Trump lost the popular vote quite considerably, twice, and the Senators who approved his appointments represent

More ›