ctz

30 ms·

1. 271.▲
   by ctz 12y ago

   As far as I can tell (I can't read O'Caml very well) the crypto library underpinning this makes the same mistake that all PKCS#1 signature verification functions have had at some point or another: they unpick the padding by hand[1
2. 272.▲
   by ctz 12y ago

   This is exactly what facebook do. They've done it several times over, such that a plaintext password goes through about 8 steps before making it into a database.
3. 273.▲
   by ctz 12y ago

   Hooray! Mechanism and not policy! This is an excellent improvement for the web.
4. 274.▲
   by ctz 12y ago

   I think the internet would benefit from more competition in protocols, especially those to do with security, and especially those that have historically done a bad job (TLS, DNSSEC, PKIX). These are obviously hard to design, with a bunch of
5. 275.▲
   by ctz 12y ago

   Disappointing that Lua is going down the same broken road of having limited integer types. But, then again, Lua was always about a small, simple base than correctness at all costs.
6. 276.▲
   by ctz 12y ago

   Google cache: http://webcache.googleusercontent.com/search?q=cache:0PUMGvU... (Server is not responding at the time of writing, from two locations.)
7. 277.▲
   by ctz 12y ago

   > CBC IV does not in general have to be unpredictable. Yes, it does. If not, you lose IND-CPA. That is, if it is predictable the attacker gets to test guesses for the plaintext of other blocks. Read Duong and Rizzo, "Here come the
8. 278.▲
   by ctz 12y ago

   http://melpon.org/wandbox/permlink/XsgfjNU0oTsj0GaN nonlocal was added to fix this problem. lists make a difference because they are a mutable container for other values, not because name resolution changes when y
9. 279.▲
   by ctz 12y ago

   I love ARM semihosting for this reason. It's obviously insanely slow, but unlike a UART it doesn't need any extra hardware and the target is halted while the slow bit is taking place.
10. 280.▲
    by ctz 12y ago

    The same goes for android.permission.INTERNET. Apps can open arbitrary URLs in the browser (which load without user intervention).
11. 281.▲
    by ctz 12y ago

    My source for that figure was the World Bank[1], which gives a GNI per capita of 400USD PA for the Democratic Republic of Congo. [1]: http://data.worldbank.org/country/congo-dem-rep
12. 282.▲
    by ctz 12y ago

    I suggest looking at the world beyond your immediate environs. 6 cents vs 6 dollars is the difference between a person in a low-income economy spending 0.1% vs 18% of their income on a website.
13. 283.▲
    by ctz 12y ago

    There is no language in the world which, in general, prevents bugs becoming security vulnerabilities.
14. 284.▲
    by ctz 12y ago

    Counting gates vs transistors is about a factor of four or more difference.
15. 285.▲
    by ctz 12y ago

    This observation likely explains my experience!
16. 286.▲
    by ctz 12y ago

    > denying of health insurance All the health insurance I've ever had has had cover for pre-existing conditions, required no medical details or medical examination. As far as I can tell, insurance companies have surprisingly little
17. 287.▲
    by ctz 12y ago

    I guess this is part of ARM's IoT push.
18. 288.▲
    by ctz 12y ago

    Samsung Tab 3 10.1 was also Intel-powered.
19. 289.▲
    by ctz 12y ago

    Is an IRC chatlog the best evidence we have that "this really happened"?
20. 290.▲
    by ctz 12y ago

    'reliability rate of one unrecoverable error in 1017 (sic) bits read' So about 4 unrecoverable errors per sector. Seems legit. Do people not read their own copy?!
21. 291.▲
    by ctz 12y ago

    This is the first EMV payments terminal I've seen that allows PIN entry using a touch screen. Is that really allowed by EMV, as a tamper-evident PIN pad?
22. 292.▲
    by ctz 12y ago

    You cannot physically fit a whole SSL datagram (max size 16KB) into 8KB of RAM. SSL requires multiple passes over the data to (eg) decrypt and verify a datagram. At this point, you cannot use standard SSL at either the server side or clie
23. 293.▲
    by ctz 12y ago

    Every product link in this announcement being a 404 is the quality I've come to expect from Fitbit. (Now on my fourth Flex in just under a year, with the first three dying in precisely the same way. Fitbit replaced them all under warr
24. 294.▲
    by ctz 12y ago

    This would require a vast, vast upgrade of client power to achieve the same communications performance. If you could achieve it all, SSL would also likely decrease reliability over a spotty GSM link.
25. 295.▲
    by ctz 12y ago

    You should look up the word 'intent' in law.
26. 296.▲
    by ctz 12y ago

    One of the problems is that you can set your search provider as DDG, and the query still goes to Apple too. GP posits that this is an essential part of doing a web search.
27. 297.▲
    by ctz 12y ago

    > you can't have that and not share your searches with Apple Why on earth not? Why can't the search box just talk to DDG?
28. 298.▲
    by ctz 12y ago

    > Also, if you live in the EU, leaded solder will be extremely difficult to come by. Source. I live in the EU and 60/40 is still the most common solder for hobbyists, and is sold everywhere.
29. 299.▲
    by ctz 12y ago

    I don't disagree with any of the points you make, but it feels like you're advocating the author skips straight to acceptance in their experience of the Grief of TLS. If we had more people sitting in the anger, depression and barg
30. 300.▲
    by ctz 12y ago

    http://jbp.io/2013/07/07/tls-downgrade/ An old writeup of mine on TLS downgrade, if anyone's interested.