dchest

79 ms·

1. 931.▲
   by dchest 11y ago

   Correct, I provided browser (using window.crypto) & Node (crypto) compatible implementation in the bug report: https://github.com/antelle/kdbxweb/issues/5
2. 932.▲
   by dchest 11y ago

   Cryptographic attacks become better, some of them become practical. RC4 attacks were not considered practical until recently, and now everyone runs with their heads on fire replacing it. The best answer is to listen to what security people
3. 933.▲
   by dchest 11y ago

   I don't know of any published attacks on XorShift128+, which is used in most browsers for Math.random. What I know is that it's not a cryptographically secure PRNG, though, so all you have to do is sit and wait for one ;-)
4. 934.▲
   by dchest 11y ago

   No, it's not worse for your scenario. (That wasn't my assertion) However, this is an alternative to KeePass/KeePassX, so the typical behavior of KeePass users is to generate passwords with it, not reuse bad passwords. For exa
5. 935.▲
   by dchest 11y ago

   Do not generate passwords with it, it uses insecure Math.random: https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd3... https://github.com/antelle/keeweb/blob/master&#x
6. 936.▲
   by dchest 11y ago

   Sorry, you sound like those crypto nuts from various cryptography mailing lists. Curve25519 has been discussed to death during CFRG selection process (see https://news.ycombinator.com/item?id=11161315 ). If you (or these &qu
7. 937.▲
   by dchest 11y ago

   So? Curve25519 provides secure parameters for ECC, why not use it everywhere? How's that not secure? Is RSA secure? Is it because there were 3 people involved?
8. 938.▲
   by dchest 11y ago

   Actually, before fixing dead penalty, the US should resolve the Mars-Milky Way chocolate bar mix-up.
9. 939.▲
   by dchest 11y ago

   To be fair, MD5 was broken in 1996. If your content addressable system uses crypto broken 10 years ago, of course, you can't guarantee integrity :-) who is to say how much compute power state level adversaries bring to bear Not enoug
10. 940.▲
    by dchest 11y ago

    None. Accidental collision resistance of SHA-1 is 2^80. SHA-1 is "cryptographically broken": it's estimated that you can produce collision with about 2^60 operations, however nobody has produced them yet.
11. 941.▲
    by dchest 11y ago

    Which basically means that it guarantees the integrity of message , where "guarantee" is defined as computational infeasibility to produce different messages with the same hash value. You know this stuff, why are you arguing sema
12. 942.▲
    by dchest 11y ago

    I love this feature! Most of the time I use the old version of Twitter for Mac, but every time go to twitter.com and see "While you were away", I realize that I miss quite a few interesting/important tweets.
13. 943.▲
    by dchest 11y ago

    https://en.wikipedia.org/wiki/Tofu-dreg_project
14. 944.▲
    by dchest 11y ago

    https://www.google.com/search?q="christmas+tree+fire"&source...
15. 945.▲
    by dchest 11y ago

    OMG, people! "Public" in "public key" doesn't mean that you should share it with the whole world, it's just because it's an antonym of "private key", meaning that the other party you want to co
16. 946.▲
    by dchest 11y ago

    I started using Snabbdom, which is also tiny, but has a nice module/hook API: https://github.com/paldepind/snabbdom (plus 'style' module supports transitions/animations).
17. 947.▲
    by dchest 11y ago

    Thanks, I thought I missed some XSS unknown to me in that code. Agree with you about React and other frameworks making it hard to accidentally introduce XSS.
18. 948.▲
    by dchest 11y ago

    Could you please point out where the XSS issues are?
19. 949.▲
    Snabbdom – a virtual DOM library with focus on simplicity and modularity(github.com)

    2 points by dchest 11y ago|0 comments
20. 950.▲
    by dchest 11y ago

    It is worse, and this has been discussed to death: when you go to www.facebook.com, what UX will help people distinguish between trusted certificate (all good) and untrusted (active attack)?
21. 951.▲
    Maquette – Minimalistic Virtual DOM library with animated transitions(maquettejs.org)

    16 points by dchest 11y ago|0 comments
22. 952.▲
    by dchest 11y ago

    Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1238354
23. 953.▲
    by dchest 11y ago

    I've heard a different number: 75 ¢ per device, which goes to "partners".
24. 954.▲
    by dchest 11y ago

    Amazon bought one of the Starfield roots from GoDaddy. See their roots here: https://www.amazontrust.com/repository/
25. 955.▲
    React.js the simple way(medium.com)

    3 points by dchest 11y ago|0 comments
26. 956.▲
    Freezer(github.com)

    1 points by dchest 11y ago|0 comments
27. 957.▲
    by dchest 11y ago

    Hehe, I didn't mean to sound negative! Agree with the other poster that it's quite fun. Oh, and I also forgot to mention that the guy used `tar` for compressing one file. I'll see myself out.
28. 958.▲
    by dchest 11y ago

    This thread is officially dumb. One guy miscalculates 75 Mbit as ~75 MiB, another guy fills ~70 MiB file with ASCII "1"s.
29. 959.▲
    Once upon a time, memory allocators made sense(github.com)

    142 points by dchest 11y ago|117 comments
30. 960.▲
    by dchest 11y ago

    Thanks! When I saw the title, I new somebody on HN would come up with a few shell commands for this :-)