cperciva

6 ms·

31.
by cperciva 3mo ago
My paper demonstrating a side channel attack on RSA via hyperthreading was rejected from the crypto preprint archive on the basis that it was "not cryptography". (Reviewers at J.Crypto subsequently sat on it for a year and then su
32.
FreeBSD 15.1-Release Now Available(lists.freebsd.org)
10 points by cperciva 4mo ago|0 comments
33.
by cperciva 4mo ago
FreeBSD 15.1! Scheduled to be announced 2026-06-16 00:00 UTC; just need to get some release documentation polished now.
34.
by cperciva 4mo ago
Square root of the population is because that's what it takes to normalize large vs small countries. Imagine slicing a country into quarters; each slice has a quarter of the population and half the radius.
35.
by cperciva 4mo ago
It would be interesting to see a map which was not minimizing [distance to capital] but instead minimized [distance to capital]/sqrt([national population]). The latter would be more robust against Sybil attacks.
36.
by cperciva 4mo ago
arguably the whole scheme should be replaced by finer-grained feature detection. This seems like a strange thing to say. Fine grained feature detection was around long before "microarchitecture levels" and never went away. The
37.
by cperciva 4mo ago
True. The amount of free float increasing dramatically will probably also depress the share price.
38.
by cperciva 4mo ago
Now with this incredible deal, SpaceX is now GAAP profitable under the existing rules, and they get to join the index next year without a rule change. Didn't they also run up against a "minimum free float" rule?
39.
by cperciva 4mo ago
That information should still be in the commit messages. "No functional change intended." appears widely in FreeBSD commit logs when code is being refactored (or, rarely, restyled). And the issue isn't whether you can reme
40.
by cperciva 4mo ago
I've done this with code review. "Another LLM reviewed the attached code and produced the attached report. What do you think?" Lots of "the other LLM clearly hallucinated this part". To be fair, it has never accu
41.
by cperciva 4mo ago
Is that true for every type and format Yes, OTC for everything. I've heard that some pharmacists ask more questions about types which are commonly abused by body builders but that's about the extent of it. Funny story since you
42.
by cperciva 4mo ago
One issue here which is obvious to me is that access to insulin should not be gated on paperwork . I can walk into any pharmacy in Canada and say "I'm diabetic and need insulin" and the pharmacist will sell it to me. They&
43.
by cperciva 4mo ago
There's a wide gap between "ignored" and "received the attention they deserved".
44.
by cperciva 4mo ago
They don't hand out Nobel prizes for glossed over topics. Leaving aside the fact that the Economics prize isn't actually a Nobel Prize, topics which historically haven't been given enough attention are exactly where the hi
45.
by cperciva 4mo ago
That solves the traffic tampering problem, but not the "malicious peer" problem. You want to be able to sync files without accidentally sharing root privileges.
46.
by cperciva 4mo ago
"Cameraless eye tracking" is understating the key insight here. They don't even need to track which direction you're looking! The only thing they need to measure is the difference between the two directions , and para
47.
by cperciva 4mo ago
Plenty of us are simultaneously far and near sighted. I can't drive without glasses, but until I got progressive lenses I couldn't use my phone with my glasses on.
48.
by cperciva 4mo ago
No, but that's why almost nobody runs it outside of strict trust boundaries. This security section would make more sense if rsync was like curl, which routinely deals with hostile counterparties. If the other side of your rsync is hos
49.
by cperciva 5mo ago
I've heard a guideline of 3% of the value of the structure plus 0.5% of the value of the land .
50.
by cperciva 5mo ago
claim was the purchase was unauthorized and the person showed up in person to a class Certainly a person showed up in person to a class, but how do you know it was the person whose credit card was used?
51.
by cperciva 5mo ago
I write "reported by gcc16 -pedantic" when I'm fixing a bug, because it's useful to flag "this is how they issue became visible" in case readers want to use the same tool on their code. The fact that it's
52.
by cperciva 5mo ago
the head of something Note that "FreeBSD Foundation" != "FreeBSD Project". Obviously they're connected, but the FreeBSD Foundation supports the FreeBSD Project; they don't direct it. Governance of the Fr
53.
by cperciva 5mo ago
F/OSS is like GNU/Linux; the second part is the part which matters, but the first part keeps getting pushed by noisy people so we put up with it to keep them happy.
54.
by cperciva 5mo ago
The exploit already succeeded at that point, creating the setuid /tmp/rootsh is just a way of making it permanent.
55.
by cperciva 5mo ago
FreeBSD 15.1. Released BETA2 on Friday, next Friday is BETA3 and the following week is scheduled to be a Release Candidate.
56.
by cperciva 5mo ago
The exploit is injecting environment variables, but yes, close enough. You need someone to call execve as root in order to become root, but you don't need a setuid binary.
57.
by cperciva 5mo ago
Indeed, I was thinking about this precise issue when I made the point that corresponding issues get handled much better in FreeBSD than in Linux.
58.
by cperciva 5mo ago
I don't think so? It's a buffer overflow in the system call.
59.
by cperciva 5mo ago
Reducing clock speeds, even if they could do that -- and I'm not sure they can, given how Nitro is designed -- would be problematic since a lot of customer workloads assume homogeneous nodes. But they did load-shed. Perhaps not soon
60.
by cperciva 5mo ago
The key words there are "when they're actually coordinated". Debian doesn't own the Linux kernel, and the kernel developers don't bother with coordinated disclosure, so the happy path of coordinated disclosure onl

More ›