daeken

66 ms·

661.
by daeken 13y ago
No, this was not a good response. It was well written and took responsibility for bad code, but it failed to address the elephant in the room: why were keys not immediately rotated? I've said this a number of times lately, but it be
662.
by daeken 13y ago
> As a result, we have begin the process of rotating all customer SSL keys/certificates. AGHHHHHHH! Even if their code was likely to have worked perfectly, this is a huge mistake. And I mean huge. They should've operated u
663.
by daeken 13y ago
When in doubt, always asssume a compromise of anything is a compromise of everything. Golden rule.
664.
by daeken 13y ago
> How was this bug found again? Oh yeah. By analyzing the _open_ source code. It was found by fuzzing. OpenSSL being open has absolutely nothing to do with its security, in a positive or negative way. It's just a poor project.
665.
by daeken 13y ago
> (Not that most academics write good code either, but this is not an academia/industry issue. It is a security expert/non-expert issue.) Security experts write bad code. Non-security experts write bad code. Code, by default,
666.
by daeken 13y ago
The Internet Bug Bounty that Facebook and Microsoft are sponsoring applies to OpenSSL: https://hackerone.com/ibb
667.
by daeken 13y ago
By being a major site that uses SSL. Many such users were notified ahead of time; it's nothing abnormal with responsibly disclosed bugs. As far as I'm aware, no money changed hands whatsoever.
668.
by daeken 13y ago
> maybe this is not leaked or it requires a read at the correct time because these buffers might be trashed by another computation. As far as I can tell, it's certainly possible for intermediate data to be leaked, but it'd requ
669.
by daeken 13y ago
> Price-wise, I think the tech is a tad out of reach for most people right now. That's my thought, too. I'm no stranger to buying expensive music gear just to see what I can get out of it, but £2400 (about $4000) is a huge chu
670.
by daeken 13y ago
1) I think it's highly inappropriate to post photos of someone's house on HN, even if they are possibly acting in a scummy way (who knows, maybe he just has bad luck with cars). 2) He may well be plenty happy with his house and di
671.
by daeken 13y ago
For those who don't know (like me, up until a few minutes ago), Watsi has a feature to allow monthly automatic donations: https://watsi.org/monthly Currently only 84 people are signed up for it -- let's see how fa
672.
by daeken 13y ago
One thing that I'd love to see is a system for adaptive edit/delete windows. Right now it seems to be a fixed length of time (I want to say an hour?), but I think it'd be conducive to better conversation to have flexible win
673.
by daeken 13y ago
The comment you responded to was out of line, but that doesn't mean you should respond in kind. Let's keep the discourse civil.
674.
by daeken 13y ago
> You don't know Brendan, I don't know Brendan, nobody in previous threads comparing him to fucking racists or the Nazis knows Brendan. I know Brendan. I met him on a number of occasions while working at Mozilla and interacted
675.
by daeken 13y ago
Having spent a lot of time doing Xbox emulation, the biggest issue is simple: statically linked XDKs meant that doing high-level emulation was next to impossible. You had to find signatures for every XDK, which isn't viable considerin
676.
by daeken 13y ago
> Sit down with me for 5 minutes and I'll find a whole bunch of personal things about you I don't like either "If you give me six lines written by the hand of the most honest of men, I will find something in them which wil
677.
by daeken 13y ago
Look up the demoscene. http://shadertoy.com is a good start.
678.
by daeken 13y ago
Interesting as this is, #13 is not "Relativity", it's the mass-energy equivalence.
679.
by daeken 13y ago
Very much looking forward to getting one of these units and breaking it. Always a fun exercise.
680.
by daeken 13y ago
Were you backing a project at the UK Kickstarter, or are you in the UK backing a US Kickstarter? What payment backend is used depends on where the project is based, not the backer.
681.
by daeken 13y ago
"Fat" as a description of a person is as medically valid as "stupid". That is to say, not at all. "Overweight", "obese", and others are actual medical terms that have real definitions, quite unlike &
682.
by daeken 13y ago
This doesn't really follow, to me. If you count out the piano part, you get the groups of 3 pretty quickly, then the group of 4 that sits in the middle is immediately apparent. Counting the drums, to my ear, gives (5+4+4+3)/4, no
683.
by daeken 13y ago
Most of Tool's most interesting drum parts (to me, at least) aren't really weird time signatures, just weird polyrhythms. The Grudge is a fun one.
684.
by daeken 13y ago
I'm also a big fan of odd time signatures, especially those that change. A great example of this is Dream Theater's "The Dance Of Eternity": https://www.youtube.com/watch?v=9ftRhsvvfBw In ~6 minutes, t
685.
by daeken 13y ago
I've been on IRC non-stop since 1997; it's where the majority of my closest friends and I keep in touch. I also run an IRC channel for the class I teach, and it's the primary communication means for most students. As for YC,
686.
by daeken 13y ago
You don't pull the plug on those in a vegetative state. They have brain activity and a functioning brain stem -- generally they're just on a feeding tube.
687.
by daeken 13y ago
Most router administration pages are CSRFable, meaning it's trivial to exploit them from the "outside" via those on the inside.
688.
by daeken 13y ago
Actually, the reason that I very much remember this is that my mom has never let me live it down! (It was my brother's toy computer, which cost a fair amount, for our family.) Edit: And I never said that I was successful, but simply t
689.
by daeken 13y ago
Even if they spent every last cent of that money on security, they would still have bugs. You never get rid of all of them. People that talk about security spending miss the inherent imbalance in security: a defender has to find every bug;
690.
by daeken 13y ago
Each person will only toggle A to the 'on' state twice.

More ›