dchest

79 ms·

871.
by dchest 10y ago
> I certainly wouldn't go anywhere near another NIST DRBG.. OK, this is an instant red-flag to me to get out of the conversation.
872.
by dchest 10y ago
Haven't looked at the code, but my guess is that it calculates SHA256 of chunk, checks if this digest already exists, and if not, only then it encrypts and adds a new chunk. Since SHA256 is take of plaintext, it indeed deduplicates, bu
873.
by dchest 10y ago
Why would you use a PRNG with unknown cryptographic properties, not designed by a cryptographer, as opposed to one of the NIST's DRBG or a good stream cipher, such as ChaCha? Weakness: https://eprint.iacr.org/2006/
874.
by dchest 10y ago
No, no, no, don't use ISAAC.
875.
How to evaluate a claim that a certain person is Satoshi Nakamoto(docs.google.com)
1 points by dchest 10y ago|0 comments
876.
by dchest 11y ago
https://github.com/Tarsnap/spiped
877.
by dchest 11y ago
Exactly, which is why it's great for community! This means that open source packages will be more valuable than commercial binary blobs due to the ability to audit source code.
878.
by dchest 11y ago
will decrease the over all quality of golang libs Really? How exactly this will decrease the quality of open source libraries?
879.
by dchest 11y ago
It's not compiler's job to shape community or enforce ethical values (unless it's GCC, haha). If people don't want to share binaries, they are free to share sources.
880.
by dchest 11y ago
Thanks!
881.
by dchest 11y ago
Note that accepting HTTP/2 connections over TLS requires the “Application-Layer Protocol Negotiation” (ALPN) TLS extension support, which is available only since OpenSSL version 1.0.2. Using the “Next Protocol Negotiation” (NPN) TLS e
882.
by dchest 11y ago
Wow. While the bias was tiny, I expect more from crypto software. Calling it a "non-problem" is very strange. Edit: submitted another patch https://github.com/SpiderOak/Encryptr/pull/263
883.
Xstream – small and fast functional reactive stream library for JavaScript(staltz.com)
2 points by dchest 11y ago|0 comments
884.
by dchest 11y ago
It reduces key space for most symmetric algorithms, but completely breaks RSA and ECC making them run in polynomial time.
885.
by dchest 11y ago
This is incorrect, exit nodes are not involved with hidden services. Edit: the original comment I replied to stated that exit nodes could sniff traffic. Reply to new comment: The connection is encrypted to the service's public key, wha
886.
by dchest 11y ago
It is encrypted, but when you're going to facebookcorewwwi.onion you only know that you're connecting to server that knows the corresponding private key, of which "facebookcorewwwi" is a hash. Which is already good. Howe
887.
by dchest 11y ago
— Can you change it? — No. — It won't replace passwords.
888.
by dchest 11y ago
Imagine you're on the run from mafia and communicating with your parents via a messenger. You sent your current location and after a few hours mafia people approached your parents and took their phone. Now, if you sent an message that
889.
by dchest 11y ago
It's not TLS.
890.
by dchest 11y ago
As I said, one config mistake or running a script which uses /usr/bin/git and you're subject to RCE. For example, many GUI programs, such as Atom editor, when not launched from terminal, don't know your PATH.
891.
by dchest 11y ago
Vulnerable git ships with Xcode, not OS X "out of the box". (What point is moot?)
892.
by dchest 11y ago
No, vulnerable git ships with Xcode.
893.
by dchest 11y ago
Hmm, wait, it's Git-58, not Git-63. Edit: OK, Xcode 7.2 security notes mentions Git vulnerability CVE-2015-7082 (older than the ones in questions), and Xcode 7.3 doesn't mention any fixed vulnerabilities in Git, so I guess it&#x27
894.
by dchest 11y ago
Did you read the linked article?
895.
by dchest 11y ago
This is in the linked post. Do this to disable it: sudo chmod -x /Applications/Xcode.app/Contents/Developer/usr/bin/git
896.
by dchest 11y ago
Looks like no: https://opensource.apple.com/source/Git/Git-58/src/git/revis... Function is path_name, nlen type should be size_t and there shouldn't be integer overflow in the first loop.
897.
by dchest 11y ago
Sure, but your /usr/bin/git is still vulnerable. You're one config mistake (or maybe running a "malicious" script) away from executing.
898.
by dchest 11y ago
From the linked paper: "Resulting performance degradations are in the range 13-24% for typical Linux workloads, and reach 138× in some corner cases. Energy waste is proportional. "
899.
by dchest 11y ago
Indeed, it's stupid that such high-tech device ships with dead animal skin.
900.
by dchest 11y ago
That's numerology, you just have many outputs of SHA1 with different inputs.

More ›