daeken

90 ms·

841.
by daeken 13y ago
Jim Stickley is -- being kind -- a hack. He was on the Today Show showing off my hotel lock exploit without credit, and got zero details correct. Gotta respect his ability to press-whore (I tend to think I'm fairly good, but he puts me to
842.
by daeken 13y ago
Here's a great breakdown of why this paper is junk science: http://scienceblogs.com/startswithabang/2013/05/21/the-e-cat... Simply put, they didn't actually exclude external sources of power, nor did they properly measure before and after
843.
by daeken 13y ago
I don't believe parent is referring to parents leaving the workforce, but single parents supporting children. That is, either a solo mother or father raising one or more children.
844.
by daeken 13y ago
Totally agreed. This is neat, but I can't see myself signing up for it. Inspired by Candy Japan ( http://www.candyjapan.com/ ) I was researching how to do a "Lego of the month club"; a service that would send you a grab-bag of Lego each mo
845.
by daeken 13y ago
Get the plate, note the direction they're heading in, and call the police. That's what they're there for, and you may just save a life (or lives).
846.
by daeken 13y ago
Yes, I do include myself in that.
847.
by daeken 13y ago
The "to proven criminals" is key. Many people in the industry make a lot of money selling to governments and private companies like Vupen.
848.
by daeken 13y ago
Selling vulns/exploits may be distasteful, but it's not illegal.
849.
by daeken 13y ago
I use them as well, but I find that I have a hard time trusting them. They haven't done anything to lose my trust, but nor have they done anything to gain it; they could just as easily be logging my every move, and I'd never know. But I c
850.
by daeken 13y ago
Ahh, quite right. Sorry about that. And yeah, I agree on SHA-224; it's okay in certain circumstances (you're rarely going to be able to pull off 2^31 (average) requests), but it's almost definitely not the right choice.
851.
by daeken 13y ago
> other hash functions that are not, like SHA-512/256 I think you meant SHA-224/384. Both SHA-512 and -256 are vulnerable to length extension because their internal state is dumped and resumable. With SHA-224/384, you only get a trunc
852.
by daeken 13y ago
> That is what it is like for exceptionally gifted children who are mainstreamed. Funny story: I was in special ed classes for my last year of high school. Half my teachers wanted me to be in the hyper-accelerated program, half my teac
853.
by daeken 13y ago
Very possibly. And either they're going to take 10x the time (and cost you far more at the end of the day) or they're way underpricing themselves.
854.
by daeken 13y ago
Sure, any time!
855.
by daeken 13y ago
In a perfect world, you're absolutely right. In practice, you couldn't be more wrong. > You're wrong. If a JavaScript app is structured properly, especially one delivered as a signed browser plugin, it can run completely client-side wi
856.
by daeken 13y ago
Absolutely no less than $1600/day. If you're doing reversing work or special-case driver stuff (can't speak to virtualization, but I'd assume similar), at least $2000/day. This sort of work is very niche, which means that if you're establ
857.
by daeken 13y ago
I agree only in the case of a legally-compelled disclosure. For all other cases, there are a million simple means by which you can break it.
858.
by daeken 13y ago
Is there any chance you'd be willing to throw up the original post somewhere? It'd be nice to have along side my points for comparison purposes, just because it's changed so much. If not, that's cool.
859.
by daeken 13y ago
> Allow me to quote from the blog post As I said, that point (the one you quoted me on originally) does not make mention of signing, and the quote you gave there did not exist when I wrote the comment, as you well know. This is silli
860.
by daeken 13y ago
In the vast majority of cases, governments are not your adversary, or are very far down the list of priorities. They may have to follow the law, but the majority of other adversaries don't; that's why we are concerned about XSS, buffer ove
861.
by daeken 13y ago
You're arguing for a theoretical world, we're arguing from a practical one. I've spent enough time down in the trenches finding attacks in extremely well-reviewed code, that adding a massive new attack surface is not a thrilling proposit
862.
by daeken 13y ago
> The blog post says that it is necessary for code to be loaded as a local, signed browser plugin. This does not make JS source pushed down on every access. When this response was written, the blog post said nothing of the sort. In fac
863.
by daeken 13y ago
In theory, yes. There's nothing inherently more secure about Tor than an app running in the browser. However , XSS attacks are everywhere, it's trivial for servers to shoot code down to the client to evaluate, etc. In practice, an app d
864.
by daeken 13y ago
Only change seems to be a reference to the W3C Web Cryptography Working Group. Which is a bit funny, since that's who pushed the draft referenced in the HN thread I linked (the one I said was horribly broken). Edit: Magikarp is correct, th
865.
by daeken 13y ago
> He address that with using plugins and verifiers. Not the ideal solution obviously. As noted in the second point of my response in the root of the thread, this isn't just a non-ideal solution, it's a non-solution. It doesn't solve th
866.
by daeken 13y ago
> If you can't trust the server, how can you trust the JS it sends? This is the fundamental issue here. The trust model is purely, irrevocably broken. This isn't something you can paper over.
867.
by daeken 13y ago
So, first it should be noted that this critique (and the original article) are from 2011. Not a lot has changed since then, but it's worth noting. Secondly, I'm an ex-Matasano employee and still friends with tptacek et al; just throwing m
868.
by daeken 13y ago
As a security professional as well as developer, I agree with the OP. Simply put, you're going to screw things up no matter what you do. Be smart about it, plan for the worst, and seek outside feedback into your security processes; you're
869.
by daeken 13y ago
> Quite frankly scaling is about the nicest problem to have if you're a startup. I'm certain I stole it from someone here on HN years ago (whoever it was, I owe you a beer!), but I've always called this a "Maserati Problem". That is, i
870.
by daeken 13y ago
I use "fortnight" and I'm born and raised in the US.

More ›