dchest

45 ms·

601.
by dchest 9y ago
They don't maintain the branch name, or even the history of the branch: they just tell what are the parent commits of the commit; as mentioned above, this history can be a "lie". Fossil's history is immutable — once the
602.
by dchest 9y ago
Nope. A branch in git is just a pointer to the tip of the branch: $ cat .git/refs/heads/master 170ec1365f9fc0ca281e72e6789d1df281d168ae From it, you can infer the commit history which gitk shows, but if you delete
603.
by dchest 9y ago
I think the most common mistake I've seen is that people forget to use constant-time comparison function to verify MAC. AE/AEAD interfaces just have an open() function which returns NULL instead of the decrypted message if MACs do
604.
by dchest 9y ago
It's not recommended not because it's insecure, but because it's easy to get wrong. XSalsa20Poly1305 can also be implemented in a streaming/buffered fashion, it's just that most libraries implement the easier to use
605.
by dchest 9y ago
As implemented in jedisct1's libraries, it allows authenticating associated data, unlike XSalsaPoly from NaCl.
606.
by dchest 9y ago
Norton Commander (and its clones, such as Volkov Commander, DOS Navigator) was very popular in ex-USSR — almost every computer running DOS (the majority of PCs in ex-USSR back then) had nc running as the main user interface to the PC, and w
607.
Reddit 1.0 source code(github.com)
251 points by dchest 9y ago|114 comments
608.
by dchest 9y ago
Analysis of Intel’s Ivy Bridge Digital Random Number Generator http://www.rambus.com/wp-content/uploads/2015/08/Intel_TRNG_...
609.
by dchest 9y ago
DMCA takedown process is specifically created so that hosting providers don't need to verify any claims in the notice, they only need to take the content down and notify the user who published it, so that the user could provide a count
610.
by dchest 9y ago
I'm sorry about your troubles, but you probably didn't even have permission from the authors of screenshots to publish them on your website (again, according to current unfortunate copyright laws), so you might as well consider yo
611.
by dchest 9y ago
That's true, never ever use photos of people from free stock websites/creative commons photo dumps. Paid photostocks require photographers to submit scans of signed model release forms. This is unfortunate for tiny/unprofitab
612.
by dchest 9y ago
"Public domain" image stocks absolutely don't guarantee or even check that the images they host have proper licensing, indeed. I've seen some images that had Creative Commons Attribution licenses posted on these without
613.
by dchest 9y ago
Proper/secure composability is designed not by exposing all internals, but by explicit APIs. For example, UNIX file descriptions and using them as stdin/stdout/stderr is a properly exposed API for reusable components, while t
614.
by dchest 9y ago
Whoa, why do you link to a website distributing malware here?
615.
by dchest 9y ago
Nothing wrong with it. In fact, I wish spawning processes was more common. It's beneficial for security.
616.
by dchest 9y ago
You're right, it's applies to everything. There's also a problem with trust in CPU, and specifically, knowing which operations are constant time. See: https://bearssl.org/constanttime.html
617.
by dchest 9y ago
Most web servers on the Internet store unwrapped base64-encoded secret keys. Most SSH hosts store their secret keys encoded in base64 (/etc/ssh/). Then, there's JWK which supports unwrapped secret keys. Basically, you ca
618.
by dchest 9y ago
You seem to be confusing encoding (base64 for example), and encryption (AES for example). I don't. Where a side channel attack studying the decryption speed/power use can reveal information, the encoding of said encrypted data
619.
by dchest 9y ago
Base64 is commonly used in cryptography to exchange keys. Note that if you're encoding or decoding secret data, such as keys, you most likely want a constant-time encoder (example: https://boringssl.googlesource.com&#x2F
620.
by dchest 9y ago
They are caused by performance optimizations with disregard to security (likely not intentional, but caused by not considering security aspects of optimizations carefully).
621.
by dchest 9y ago
Sure, you can write an article demonstrating exploitation of Ubuntu containers and call it "Escaping Ubuntu containers".
622.
by dchest 9y ago
Why? The article demonstrates exploitation of Docker containers.
623.
by dchest 9y ago
Since getting the salt must be possible by supplying only username, one security disadvantage of such scheme is that by getting the salt of the target the attacker can precompute password guesses and store them. When the password verifier d
624.
by dchest 9y ago
Keccak is certainly not optimized for current consumer hardware, it's much faster in hardware implementations, and none of the currently available consumer hardware contains one (which means that when using it as proof-of-work or passw
625.
by dchest 9y ago
Physical objects are sold. Software (GPU drivers) is subject of copyright law — it's licensed.
626.
Round 1 submissions to NIST post-quantum crypto competition(csrc.nist.gov)
35 points by dchest 9y ago|1 comments
627.
by dchest 9y ago
AFAIK, they are using Stellar Consensus Protocol, not Stellar itself. Nobody uses MobileCoin yet.
628.
by dchest 9y ago
function readUtf8String(memory, pointer) { let s = ""; for (i = pointer; memory[i]!==0; i++) { s += String.fromCharCode(memory[i]); } return s; } This doesn't read UTF-8, th
629.
by dchest 9y ago
You stripped the most important part from links, the thing that the comment you replied to was pointing out.
630.
by dchest 9y ago
What you said is irrelevant to the discussed topic. With GPLv2, the hardware vendors must ship source code -- that is, follow the license. GPLv3 doesn't change this fact nor was it created to make this requirement, as it was already pr

More ›