ctz

27 ms·

1. 241.▲
   The Harmful Consequences of Postel's Maxim(tools.ietf.org)

   65 points by ctz 11y ago|32 comments
2. 242.▲
   by ctz 11y ago

   DNSSEC root key shares.
3. 243.▲
   by ctz 11y ago

   Practical use of client certs usually implies support for renegotiation too.
4. 244.▲
   by ctz 11y ago

   Pushing a new tag is a vastly smaller privilege than pushing arbitrary objects.
5. 245.▲
   by ctz 11y ago

   You're right, of course. But CVE-2015-4000 was announced and extensively discussed a number of weeks ago: https://weakdh.org/
6. 246.▲
   by ctz 11y ago

   Here's a writeup of CVE-2015-1788: https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang... It's embarrassing rather than terribly dangerous. edit: Please note: there are other issues in this
7. 247.▲
   by ctz 11y ago

   > Every modern machine is a Modified Harvard Architecture. Well, this is just not true if you consider all modern computing systems rather than just desktop computing. Every modern microcontroller is either Harvard, or pure Von Neumann.
8. 248.▲
   by ctz 11y ago

   Yes, the majority of the world lives in the east. That means they should target (eg) Mandarin -> English instead of English -> Mandarin. Which is precisely what they're doing. Their aim is to maximise their learning audience.
9. 249.▲
   Benchmarking Modern Authenticated Encryption on €1 Devices(jbp.io)

   3 points by ctz 11y ago|0 comments
10. 250.▲
    by ctz 11y ago

    If this was even a remotely feasible problem with modern cryptographic hashes, DNSSEC, TLS, SSH, package management systems, most authentication systems, etc. would all be dramatically broken. If I had this capability I wouldn't waste
11. 251.▲
    How Transparency Will Change the World(scientificamerican.com)

    1 points by ctz 11y ago|0 comments
12. 252.▲
    by ctz 11y ago

    The risks section of an S-1 will always focus upon the worst case outcomes; if they don't and those outcomes are realised, investors will sue. Other recent S-1s have similar dire warnings, with almost identical language.
13. 253.▲
    by ctz 12y ago

    What's the current state of the art for realtime + internet? I would have thought that once you get to the first other network device, whatever realtime guarantees your device offered would be toast. And stuff like packet loss or a T
14. 254.▲
    by ctz 12y ago

    Relying on CNNIC to not falsify notBefore is exactly the right approach. Give them all the rope they need to hang themselves.
15. 255.▲
    by ctz 12y ago

    For technology, the currency difference is almost entirely lost in poorer buying power and tax inclusive pricing. eg. a 5K iMac is 2499 USD and 1999 GBP. That makes it about 3000 USD. Using that basis, the £50 tablet would retail in the U
16. 256.▲
    by ctz 12y ago

    Well, just this week a purchased a HP Stream 7 Signature edition for £50 (~=$50). Microsoft is definitely in the market.
17. 257.▲
    by ctz 12y ago

    I wonder if compression with just a preset dictionary (i.e. no learning from the plaintext) would produce reasonable compression ratio. That would be interesting because it would be entirely BREACH resistant.
18. 258.▲
    by ctz 12y ago

    You'll also notice that exactly none of the problems fixed in this advisory have any tests, either to check for regressions or for similar problems elsewhere. This is just negligent.
19. 259.▲
    by ctz 12y ago

    Writes through a null (or low valued) pointer can actually be easily exploitable on some embedded systems. https://cansecwest.com/csw07/Vector-Rewrite-Attack.pdf
20. 260.▲
    by ctz 12y ago

    I have a secret. I want to share this secret with only my best friend. I do this by telling the secret to everybody I meet, whether they look like my friend or not. Eventually I meet my friend, and tell them too. This is confidentiality
21. 261.▲
    Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS(isg.rhul.ac.uk)

    52 points by ctz 12y ago|5 comments
22. 262.▲
    by ctz 12y ago

    http://en.wikipedia.org/wiki/Vienna_Convention_on_Diplomatic...
23. 263.▲
    by ctz 12y ago

    I don't think anybody knows about the hardware yet. The photo of the prototype is an Atmel ATMega: not an ARM core, no BLE radio; extremely unlikely to be involved in the final design. I'd expect they'll use one of the Cortex
24. 264.▲
    by ctz 12y ago

    http://www.mayoclinicproceedings.org/article/S0025-6196(14)0... It'll cost you $31.50 to rent for 24 hours. Elsevier thanks you for your custom.
25. 265.▲
    by ctz 12y ago

    Mifare Desfire EV1 RFID tag[1]. [1]: http://uk.farnell.com/nxp/mf3mod4101da4-05-1/rfid-read-write...
26. 266.▲
    by ctz 12y ago

    NXP is the most paranoid and ridiculous company I've ever had the displeasure of dealing with. Even after signing two separate NDAs with different parts of NXP, they still wouldn't give us complete sets of datasheets for parts we
27. 267.▲
    by ctz 12y ago

    Let's encrypt is the exact same trust model as conventional CAs selling you a DV certificate. Apart from that, the trust model in the public CA system does not and cannot vary by CA: you trust them all, equally, all the time.
28. 268.▲
    by ctz 12y ago

    It evaluates its arguments once. That means min(expensive_calculation(x), expensive_calculation(y)) works how it reads. A compiler might be able to avoid this if it can prove expensive_calcluation is pure, but this is usually not done unle
29. 269.▲
    by ctz 12y ago

    ASN parsing code, in general, does not check for presence of trailing bytes (see Bleichenbacher's original signature forgery attack, and CVEs passim). Should they? Yes. Do they? No, it is a frequent implementation error. In NSS, th
30. 270.▲
    by ctz 12y ago

    I was reading the X509 certificate verification code, rather than the TLS code: https://github.com/mirleft/ocaml-x509/blob/master/lib/certif...