colmmacc

12 ms·

121.
by colmmacc 3y ago
Nuclear power seems like a good option for non-military boats too, like container ships and oil tankers. It's already a very well proven maritime technology.
122.
by colmmacc 3y ago
Fwiw, I found a bunch of clients and libraries that didn't support AES-GCM at all, or only very recently. libssh2 is one example. That's made me nervous to make AES-GCM the only supported cipher as a mitigation.
123.
by colmmacc 3y ago
Fixed!
124.
by colmmacc 3y ago
This paper is the best protocol security research I've seen in a while. Thankfully the consequences aren't too big - everyone should update ssh (which will be a pain!) - but it likely doesn't need to happen at breakneck pace.
125.
Terrapin Attack for prefix truncation in SSH(terrapin-attack.com)
221 points by colmmacc 3y ago|63 comments
126.
by colmmacc 3y ago
How do you think very wealthy people who subsist on rollover loans, secured against their assets, should be taxed? For example, an on-paper billionaire whose wealth is stock ... gets a loan, secured against that stock (which they never sell
127.
by colmmacc 3y ago
I just tried a little personal experiment and I can manipulate my arms into all 3 positions well within 0.5 seconds, without exaggerating the movement. Start with your hands clasped (as in the right most image), then put your arms down but
128.
by colmmacc 3y ago
IMDSv2 doesn't change the URLs, the "/latest/" in that URL is referring to the meta-data profile, rather than the IMDS version. IMDS is a lower level change in the authentication workflow to use a token (which is re
129.
by colmmacc 3y ago
I'm the technical lead for IMDS. Without an IMDS, the alternative is usually hard-coding long-lived credentials, which is much worse. We've looked a few times at different ways that IMDS could vend different credentials to differe
130.
by colmmacc 3y ago
IMDSv2 has been enabled by default since launch, and was made the default in the AWS SDKs at the same time. What's changing now is that IMDSv1 will be disabled by default. Until now customers had to disable it intentionally, either at
131.
by colmmacc 3y ago
I work at AWS on these systems. We do fund research on Graviton. But our main approach to "Confidential Computing" has always been very different and based on the Nitro system. We run our virtualization on dedicated Nitro cards, w
132.
by colmmacc 3y ago
It's very hard to see Blake3 getting included in FIPS. Meanwhile, SHA256 is. That's probably the biggest deciding factor on whether you want to use it or not.
133.
by colmmacc 3y ago
I'm not a space person, so this may be a very basic question but how is this same rocket supposed to launch from locations on the Moon or Mars? The propulsion force is obviously less because the gravity is less there, but that really e
134.
by colmmacc 3y ago
If quantum computers become more practical in our lifetimes, we don't want our current secrets vulnerable to that analysis. Scaling a quantum computer definitely isn't as simple as the evolution from valves and transistors was to
135.
by colmmacc 3y ago
I have a very hard time believing that sales-people and trades-people don't take it into considering when negotiating or quoting a price. One of the reasons a car sales person wants to "check your credit" early in the process
136.
by colmmacc 3y ago
By the late nineties using both MD5 and SHA1 for "additional robustness" together in ad-hoc constructions was also en vogue. SSLv2 and SSLv3 are good examples. The outputs match the size of a SHA1, but it wouldn't be that s
137.
by colmmacc 3y ago
I'm ready to believe that remote work can be more productive overall, and definitely more cost effective, but I always have a really hard time with the "I'm just as productive, if not more productive remotely" data and a
138.
by colmmacc 3y ago
RAM stems are already out there ... I think the drumless release, especially on vinyl, is more useful for DJs who want to mix in samples "live" in the room to a dancing crowd. RAM is all about marrying a Disco and DJ aesthetic wit
139.
by colmmacc 3y ago
We generally believe and accept what we encounter repeatedly. Our truth building faculties are premised on nature. The river always swells after a big rain. Advertising and propaganda exploit this and can cement false "truths" in
140.
by colmmacc 3y ago
Similarly ... the entire state of Maine, even its very north-most point, is to the south of Seattle's even southern-most point. A lot of US maps are tilted a few degrees, especially schoolroom maps, making the East coast and Maine seem
141.
by colmmacc 3y ago
DJB's ed25519 has made it into NIST and FIPS now. ChaCha20 too, but only in the context of TLS.
142.
by colmmacc 3y ago
I work at Amazon, so I have that bias, but I'm very very skeptical of that line of argument. Remote work has the potential to save companies truly enormous sums of money, both on real estate, and on reduced salaries. For many companies
143.
by colmmacc 3y ago
Modern messaging protocols, including the Signal Protocol used by WhatsApp, use Diffie-Hellman key agreement for Forward Secrecy. DH requires an exchange between two active parties, who will then agree on an ephemeral session key. Ideally t
144.
by colmmacc 3y ago
I spent a few years in Ireland and the Netherlands lobbying against insecure voting machines. I had so many conversations with politicians and civil servants where these effects were in abundance. In each country I was representing a group
145.
by colmmacc 3y ago
Keystroke timing has been a concern for terminal I/O since the 1980s and folks were using primitive encryption with stelnet and kerberos. Most terminal applications use buffered I/O for password entry, which is still an important
146.
by colmmacc 3y ago
Close but I don't think it's quite 25 years! I added graceful draining to Apache httpd's mod_proxy and mod_proxy_balancer either in 2003 or 2004, and at the time I'm nearly certain it was the first software load balancer
147.
by colmmacc 3y ago
This is an odd set of tests. Apart from the negative cache value, none of the numbers in a SOA record matter at all unless you're doing very old-school secondary DNS setups with AXFR/IXFR, usually with Bind or maybe NSD. That&#x27
148.
by colmmacc 3y ago
Same. I was an early Model S purchaser, and then got a second. I loved its zero emissions, responsiveness and safety rating, but Tesla's antics left me unlikely to ever be a customer again, and to be extremely skeptical for their long
149.
by colmmacc 3y ago
The approach obviously doesn't work at all for unidirectional protocols. This approach also doesn't work when there are multiple equal cost paths, but with different MTUs. Which used to be more common and now tends to only happen
150.
by colmmacc 3y ago
I wrote on twitter that vim is a masterpiece. It's the gleaming precise machine tool on which so much of modernity was crafted. It's so hard to quantify Bram's impact, because he did so much through so powerful a force multip

More ›