dfranke

26 ms·

1. 211.▲
   IBM partially backs down on Hercules patent threat(esr.ibiblio.org)

   13 points by dfranke 17y ago|0 comments
2. 212.▲
   by dfranke 17y ago

   I'm sure I'll be corrected if I'm wrong, but my understanding is that public key cryptography is very processor intensive. Because of this, instead of using your private key to sign every bit of communication, you use the public/private ke
3. 213.▲
   by dfranke 17y ago

   It's more likely than not that there's a harmless explanation for this one, but with the rash of these stories lately I think it's past time to declare that the PKI trust model is broken.
4. 214.▲
   Mozilla shipping SSL root certificate, has no idea how it got there(groups.google.com)

   122 points by dfranke 17y ago|46 comments
5. 215.▲
   by dfranke 17y ago

   I must have written this before I had my coffee and now it's past the edit period. "Right answer" was only agreeing with the first sentence of the parent post. The rest I think is wrong for the reasons stated.
6. 216.▲
   by dfranke 17y ago

   Ding ding ding! Right answer. The reason that IPv6 has seen minimal adoption so far is that the market has no reason to care about it yet. When will it start caring? 541 days from today, give or take. That's when IANA is projected to ru
7. 217.▲
   by dfranke 17y ago

   http://www.freelunchproject.com/
8. 218.▲
   by dfranke 17y ago

   The fat lady is getting hoarse.
9. 219.▲
   by dfranke 17y ago

   The fact that you're even considering that sort of hack probably means that you should be more strongly considering looking elsewhere.
10. 220.▲
    by dfranke 17y ago

    That sounds like something that someone on the Chinese government's payroll would say.
11. 221.▲
    by dfranke 17y ago

    China has guns. ICANN doesn't.
12. 222.▲
    by dfranke 17y ago

    Bernanke's proposed mechanism is to make use of the fed's newly-granted power to pay banks interest on their reserves, as incentive to maintain them. Edit: In other words, print money in order to pay the banks not to print money.
13. 223.▲
    by dfranke 17y ago

    Right, you beat me to it. Captial requirements are there to prevent banks from going insolvent. Reserve requirements are there to prevent the money supply from spiraling out of control. These are completely different objectives.
14. 224.▲
    by dfranke 17y ago

    There's a huge difference between 10% and 0%. A 10% reserve requirement means the credit supply can expand to 10x the amount of the original deposits (100% + 90% + 81% + 72.9% + 65.61% + ... = 10). A 0% reserve requirement means it can e
15. 225.▲
    by dfranke 17y ago

    They should name that color "Hooloovoo".
16. 226.▲
    by dfranke 17y ago

    Nope, coincidence. Been looking at this for a few weeks. Thanks for telling me, though: I'll take into consideration anything that looks like a spike from the media attention.
17. 227.▲
    by dfranke 17y ago

    Here's something you can do even with small dollars and without being an accredited investor: find some public firms with lots of "toxic assets" on their books, e.g. mortgage REITs. See if you can find some that most people are afraid to t
18. 228.▲
    by dfranke 17y ago

    I think "prosodic" is the word he meant.
19. 229.▲
    by dfranke 17y ago

    I'm 24, which means I'm just young enough to only know about Gorbachev's premiership through history textbooks. This is not the first time I've seen him back in the headlines, but it's still an incredibly weird feeling every time that I do
20. 230.▲
    by dfranke 17y ago

    See comment #3 on the blog :-)
21. 231.▲
    by dfranke 17y ago

    Ooh, interesting question. First number I was able to grab: Citigroup lost $7.8B in 2009. In 2007, their CEO's $24.8M in compensation from the previous year ($1.2M salary, $13.2M bonus, $10.4M stock grant) was denounced as scandalous. Edi
22. 232.▲
    by dfranke 17y ago

    Prompted by today's XKCD, most likely.
23. 233.▲
    by dfranke 17y ago

    Provided that the code is intact when you initially retrieve it, that solves the MITM issue. But then you're tied to that computer, and if that's acceptable, then you're far better off just using a password-keeper that uses real crypto.
24. 234.▲
    by dfranke 17y ago

    1. The biggest negative is that there are no positives: as TimMontague already pointed out, you might as well just use phrase + password as your password. To anyone who knows about this site, the output is no more secure than the input. 2.
25. 235.▲
    by dfranke 17y ago

    > even looks like it's in JS to prevent most MitM attacks! The JS is delivered over cleartext HTTP. A MITM attack can substitute malicious JS code that will deliver your password to a third-party server.
26. 236.▲
    by dfranke 17y ago

    I glanced over the JS source and didn't find any evidence that the site is malware. Unfortunately, that's about the best thing I have to say about the security of using this method.
27. 237.▲
    by dfranke 17y ago

    Graft.
28. 238.▲
    by dfranke 17y ago

    All public results against SHA-1 are collision attacks. Password hashing doesn't rely on collision-resistance, only one-wayness. Not even MD5 has any published preimage attacks against it. The known weaknesses in these functions have not
29. 239.▲
    by dfranke 17y ago

    I wasn't able to convince my boss to let me open-source it.
30. 240.▲
    by dfranke 17y ago

    In any language with sane FFI, scrypt is pretty easy to write new bindings for. At my previous job I wrote a complete scrypt plugin for Openfire in a weekend, and only a couple hours of that was for writing the JNI bindings.