cyphar

81 ms·

871.
by cyphar 7y ago
It's a bit of a cheat to argue this is stateless, given that the profiles (which stateful pieces of information which contain information about password complexity rules for each site, as well as which version of the password you'
872.
by cyphar 7y ago
> But in general my take is that the set of footguns for append is a subset of the prepend ones, and I hope that more folks go towards appending in the future. But length-extension attacks are only a problem for H(private || public-but-e
873.
by cyphar 7y ago
I'm a software developer and I always find that grabbing a whiteboard and drawing diagrams or other such information is very useful when trying to agree on a solution (or even agree on the problem). I work remotely and very rarely see
874.
by cyphar 7y ago
It's a bit of a shame the article failed to mention the browser which started implementing various fingerprint resistance techniques many years ago -- the Tor Browser Bundle. Unlike Brave they don't randomise your fingerprint, the
875.
by cyphar 7y ago
While you are correct that the spiral rule is an over-complicated (and sadly, popular) rule for C declarations, that doesn't really answer GP's point -- that putting the types after the binding results in much less messy type sign
876.
by cyphar 7y ago
There are mainstream efforts to do the legwork to allow Linux kernel modules to be written in Rust and a fair few core system libraries (the most obvious example being librsvg) and applications have undergone Rust rewrites. And of course th
877.
by cyphar 7y ago
> When Rust calls into C code it completely loses almost all of its safety guarantees. Not really, it means that if there is a memory safety bug it must be either in an unsafe block or foreign C code (which also must be called in an unsa
878.
by cyphar 7y ago
Whiteboards are absolutely indispensable for communicating ideas quickly in a small group of people. It's effectively just a bigger (and easier to erase) version of grabbing a scrap of paper to scribble something down when explaining o
879.
by cyphar 7y ago
> you cannot host your own global social network with millions of users, your own search engine with billions of web pages indexed, your own online shopping marketplace, not to mention your own online banking, insurance company, med lab
880.
by cyphar 7y ago
The Schengen Agreement allows for temporary border controls in certain circumstances. That's why (for better or worse) several EU states were permitted to set up temporary border controls in response to the migrant crisis a few years a
881.
by cyphar 7y ago
> You have all the exact code, but running it yourself has no meaning because users and all their data will not migrate to your installation. Free software licenses are mostly about your rights. You can host your own instance with y
882.
by cyphar 7y ago
> The only thing that non-A GPL allows them to “hoard” that the AGPL does not are their own modifications. The point of the GPL family of licenses is not to solely make the author's "hard work available to the community".
883.
by cyphar 7y ago
No, the GNU AGPL doesn't have anything to do with copyright of APIs question (at least, no more than any other copyright license given these court decisions). After all, the GNU AGPL was published in 2007 -- long before this whole lega
884.
by cyphar 7y ago
If you want a quick way to test if your olive oil is actually extra virgin olive oil, get a green laser. When it passes through sufficiently pure olive oil the laser will change colour and become red, and then become green again when it pas
885.
by cyphar 7y ago
> Uh, there is glaring sunlight between Labor and liberal in Australia at a federal level. Look at their history of fiscal policy. Carbon tax, NBN, selling off public assets etc. It's rubbish to say they're not that different.
886.
by cyphar 7y ago
> In Bell's thought experiment, the angle between the axes of two particles is well known before any particle is fired. Why do you say the following? The relative angles I'm referring to are of the measurements (or rather, th
887.
by cyphar 7y ago
> If the source is responsible for the correlation, what other explanation do we need? Why isn't it enough that the source is responsible for the correlation? Ah, okay -- that's a very good question (I skipped over a bunch of c
888.
by cyphar 7y ago
The nature of the source is the reason they are correlated in that particular way (that is effectively what entanglement is achieving, at least in this simple example). In particular, the source in the classic Bell inequalities produced p
889.
by cyphar 7y ago
That covers the civil side of things, but GPs point about criminal charges still applies. Yeah, they might have signed an NDA but I don't think those can restrict what can be uncovered during discovery (but I could be wrong -- IANAL).
890.
by cyphar 7y ago
The difference is that entangled particles cannot be modelled using a local hidden-variable theory of quantum mechanics (that's what the Bell inequalities and experimental evidence have shown). The reason why this is the case is a more
891.
by cyphar 7y ago
Most of Bell's thought-experiments result in fairly unintuitive answers, so it's quite understandable that the distinction would be unclear to someone who hadn't seen this problem before. The description of the game in the ar
892.
by cyphar 7y ago
This virus isn't airborne. It's spread through respiratory droplets.
893.
by cyphar 7y ago
> I can't trust WHO now related to Covid-19, especially after what happened to stock. The stock market is an indicator of investor confidence. How investors feel about a particular event is not necessarily accurate, and has basicall
894.
by cyphar 7y ago
> > Neither Signal nor SSH in their most common mode of use have a "PKI" in the sense you mean, which is my point. > I assume then that you exchange the public keys of your Signal contacts over SMS. Over perhaps you scp t
895.
by cyphar 7y ago
WireGuard has been extensively audited many times for the past 4-5 years, including several formal proofs[1]. I would argue no other VPN has been as thoroughly audited (not to mention that the codebase size means that an entire-codebase aud
896.
by cyphar 7y ago
Boost requires attribution in the source form (you can't remove the copyright notice from the source repo when redistributing). The second paragraph of the license: > The copyright notices in the Software and this entire statement,
897.
by cyphar 7y ago
Yes, it's effectively like free -- though C++'s "auto" is probably a closer idea. The main difference to C's free is that you simply cannot double-free a value (without using unsafe). That's because a value is
898.
by cyphar 7y ago
All copyright licenses (except CC0) require attribution for the work in all copies (verbatim and derivative). Please just use something like MIT, BSD, or Apache-2.0 (or the GPL family if that's your preference) which have clearly under
899.
by cyphar 7y ago
Can you elaborate on the threat model a little bit? I'm struggling to understand how you can protect against this in a way where an attacker that both knows the relevant encryption key (whether public or secret, depending on whether th
900.
by cyphar 7y ago
C99 has effectively identical types in the standard library (uint8_t ... uint64_t, and ditto for int8_t ... uint64_t). There are very few modern C codebases where I haven't seen these used (personally I use them because it's much

More ›