ctz

53 ms·

1. 451.▲
   by ctz 14y ago

   why not use a library that does TLS with an AEAD cipher, like AES-GCM? Some possible reasons: * lack of confidence in TLS's design and designers (for example, TLS1.2 still allows compression and fails to counsel against its use). *
2. 452.▲
   by ctz 14y ago

   I also had this idea (with more of a feedback-based efficiency training tool, but still). I did get quite concerned with the privacy implications of logging somebody's vehicle location, though.
3. 453.▲
   by ctz 14y ago

   For cars sold in the EU, the position of the ODB-II port is mandated.
4. 454.▲
   by ctz 14y ago

   Front page looks broken on chrome for android: http://imgur.com/k2mNFVc
5. 455.▲
   by ctz 14y ago

   Please explain how I can patch webkit bugs on my iPhone.
6. 456.▲
   by ctz 14y ago

   You should distinguish RCE and the ability to mount working, reliable exploits. RCE is possible here, and its best to consider that a fatal security failing in and of itself rather than hoping a particular set of countermeasures will be co
7. 457.▲
   by ctz 14y ago

   Are you saying that there is an equivalent attack for the AES-GCM TLS 1.2 ciphersuites? If so, paper please :)
8. 458.▲
   by ctz 14y ago

   Did it affect any languages other than PHP? The linked article suggests that it was PHP only (and this agrees with zend_strtod being the problem function and not any C library implementation of strtod(3)).
9. 459.▲
   by ctz 14y ago

   I think a known subset of websites having their HTTPS broken as a result of their CA misbehaving is much more preferable to a single CA having effectively broken all HTTPS for all internet users since 2011. It's not a clear dichtomy, thou
10. 460.▲
    by ctz 14y ago

    HTTPS is certainly a better option than no HTTPS. But we shouldn't forget that its trust model it is fundamentally and irrecoverably broken -- it has hundreds of single points of complete failure (to wit, DigiNotar and Comodo who both sile
11. 461.▲
    by ctz 14y ago

    Email transport is done in plaintext on the public internet -- it provides no confidentiality or integrity.
12. 462.▲
    by ctz 14y ago

    unbreakable? "military-grade RSA encryption"? The keys have 6.2 bits of entropy!
13. 463.▲
    by ctz 14y ago

    For Android the regions you can select to save offline are severely restricted. In my recent vicinity I could select as much ocean as I desired, but no land. The regions it is available in are undocumented.
14. 464.▲
    by ctz 14y ago

    This sorely needs some instructions. Tapping around the page produces no obvious results.
15. 465.▲
    by ctz 14y ago

    > Any specific reason as to why AES-CBC? If seeking is required wouldn't AES-CTR be a better choice? Or are you making assumptions that the payload size is small enough that decryption of the whole object is feasible? Choosing nonces is
16. 466.▲
    by ctz 14y ago

    I do wonder if they went with the awful upper-case main menu in the end.
17. 467.▲
    by ctz 14y ago

    I find myself rooting for the lawyers involved on both sides, which makes me slightly uncomfortable.
18. 468.▲
    by ctz 14y ago

    And for the proxy's private key (which you are henceforth relying on for all transport security) to be kept secure. Given my recent experience with products like websense, this is a very poor bet to make.
19. 469.▲
    by ctz 14y ago

    Not one cell had touchscreen that works without stylus. Incorrect: LG Prada. For me, pointing to one or two features of the iPhone as proof of it being innovative misses the target. I regard Apple products as innovative and success
20. 470.▲
    by ctz 14y ago

    400K or 40K seems more likely. Firstly, webkit is ~4M lines. Secondly, nobody would write '4000K' instead of '4M'.
21. 471.▲
    by ctz 14y ago

    This is really cool. It seems like this would benefit from being built around a Raspberry Pi than an Arduino -- that way you could avoid the dependency on an external PC and expensive software -- and make the whole thing portable.
22. 472.▲
    by ctz 14y ago

    Use of SHA-1 for this signature/MAC purposes in new applications is deprecated and will be disallowed from next year (source: NIST). I repeat: do not use SHA-1 in new applications. Do not use this module.
23. 473.▲
    by ctz 14y ago

    Could you explain how to pass through immigration using a passport stored in the cloud?
24. 474.▲
    by ctz 14y ago

    This is a side project of mine which I've been failing to finish for several months. Feedback, comments, pull requests and bug reports keenly welcomed!
25. 475.▲
    Show HN: Flashover - online flash decompiler(flashover.ifihada.com)

    2 points by ctz 14y ago|1 comments
26. 476.▲
    by ctz 14y ago

    PKI has nothing to do with SSH keys. Github's use of SSH does not use certificates, and github has no certification infrastructure.
27. 477.▲
    by ctz 14y ago

    I did a similar thing in 2003 -- codes from 200 chocolate bars could be collected for a free xbox (5GBP shipping, normal cost 160GBP). This coupled with a 5 bars for 1GBP offer in a local supermarker meant I got an xbox and 200 bars of cho
28. 478.▲
    by ctz 15y ago

    filesizeformat (1234567890 = 1.15 Gb) This should be either 9.20 Gb or 1.15 GB.
29. 479.▲
    by ctz 15y ago

    The server doesn't store the decryption keys. However, the server does serve the crypto code which makes any perceived security boundary between the server and client bogus. Cool trick though.
30. 480.▲
    by ctz 15y ago

    "Over pictures have been processed since December 1st, 2011" I think they need to hire a proof reader.