dchest

80 ms·

901.
by dchest 11y ago
This issue in Seafile was lovely: https://github.com/haiwen/ccnet/issues/35 /* truly random sequece read from /dev/urandom. */ static unsigned char salt[8] = { 0xdb, 0x91, 0x45, 0x
902.
by dchest 11y ago
Scroll down, there's "When this is what you really need:" and a mixing console.
903.
by dchest 11y ago
QUIC is replacement for TCP, not HTTP.
904.
Patch: Implement leftpad syscall(lkml.org)
1 points by dchest 11y ago|0 comments
905.
by dchest 11y ago
Yes, you can agree to transfer all of your property to Microsoft in exchange for a Windows license. But including this in EULA will not work though, as there are limits on what you can agree to without signature or notary.
906.
by dchest 11y ago
In this case, every giving would be stealing. If I gave you something, you didn't steal it from me. Likewise, if I gave you the right to impersonate me in particular circumstances, it's not a criminal offense if you do.
907.
by dchest 11y ago
What is wrong with the following function The implementation is wrong: you're using Object when you want to use Map. Object is not suitable for this, and seems like you know it, and it's in language specs.
908.
by dchest 11y ago
What you want is to use is a map, not a JavaScript object. Here you go: const m = new Map(); m.set("__alpha__", 10); m.set("__bravo__", 20); m.set("__proto__", 30); for (let k of m.keys())
909.
by dchest 11y ago
Useless Use Of Cat.
910.
by dchest 11y ago
"Each file is broken into chunks and encrypted by iCloud using AES-128 and a key derived from each chunk’s contents that utilizes SHA-256. The keys, and the file’s metadata, are stored by Apple in the user’s iCloud account. The encrypt
911.
by dchest 11y ago
Passwords-based systems assume input, and most UI frameworks use text strings for inputs. Binary password is usually not called a password, it's a key .
912.
by dchest 11y ago
Your old browser version doesn't support template literals.
913.
by dchest 11y ago
Correct. Sparkle is an open source updater framework used by many Mac applications for built-in updates. When a vendor publishes an update, it signs it with a private key (which should be kept secret). When the app downloads the update, it
914.
by dchest 11y ago
With private key for Sparkle updates signing: https://github.com/mailru/icq-desktop/blob/master/mac/ICQ/ds... Facepalm.
915.
by dchest 11y ago
I can also replace react with 2 lines of code: module.exports = require('react'); module.exports.DOM = require('react-dom');
916.
by dchest 11y ago
ESLint catches more errors.
917.
by dchest 11y ago
Why would you force your users to have inferior font smoothing? This is really bad, don't do it. Subpixel rendering is there for a good reason, don't turn it off. http://usabilitypost.com/2012/11/05/
918.
by dchest 11y ago
If you update index.html and style.css, GitHub pages will apparently publish them simultaneously (atomically), but with S3 you upload index.html, then style.css — one of them will be "published" later than the other. (Analogy: Git
919.
CacheBleed: A Timing Attack on OpenSSL Constant Time RSA(ssrg.nicta.com.au)
219 points by dchest 11y ago|18 comments
920.
by dchest 11y ago
That's a bad advice. http://sockpuppet.org/blog/2014/02/25/safely-generate-random...
921.
by dchest 11y ago
Python's uuid4 is cryptographically secure, as far as I know. One UUID needs ~16 random bytes, my laptop's /dev/urandom gives about 14 MB/s (user-space PRNG can be much faster if needed). Ah, Java...
922.
by dchest 11y ago
15 per second for 40% CPU? ಠ_ಠ This is very strange. On my laptop: ~ $ python -m timeit -s 'import uuid' 'uuid.uuid4()' 100000 loops, best of 3: 14.2 usec per loop Which gives more than 70000 random UUIDs per
923.
by dchest 11y ago
Such as? This doesn't hide IDs, as parent poster mentions. You could as well just use IDs without any transforms.
924.
by dchest 11y ago
Just generate a random string (make sure to use the proper generator, e.g. https://gist.github.com/dchest/751fd00ee417c947c252 ). If the result is shorter than, say 100 bits, you'll have to check for collisions (e.
925.
by dchest 11y ago
The are not secret and not unguessable, they use some homegrown cipher, calling the result of encryption a "hash" for some reason ( http://carnage.github.io/2015/08/cryptanalysis-of-hashids/ )
926.
by dchest 11y ago
I'm worried about given that they do exist what is the risk to me? What is the likelihood that my account has been broken into? ¯\_(ツ)_/¯
927.
by dchest 11y ago
Looks like you didn't understand the sadness of the issue I was reporting. The author of the software constructed his own random number generator from two primitives: Salsa20 stream generator and Math.random. The last part is what make
928.
by dchest 11y ago
:-)
929.
by dchest 11y ago
Eh, okay? Your choice, dear Touche, your choice.
930.
by dchest 11y ago
Last time I checked I think they used some kind of user-space RC4-based PRNG, but it was seeded properly from window.crypto.

More ›