dguido

11 ms·

61.
by dguido 7y ago
Blackhat ought to make a statement about it, otherwise the Time AI weirdos will just abuse Blackhat's brand unchecked online.
62.
by dguido 7y ago
There's an article from PC Mag with a few more details: https://www.pcmag.com/news/370119/black-hat-attendees-sponso... Here's a video of Robert Grant giving an introduction to his Time AI nonsense from
63.
by dguido 7y ago
Fun fact, Moloch's initial development was funded by DARPA Cyber Fast Track! Glad to hear it's working out for people in DOD.
64.
by dguido 7y ago
The SWC benchmark is not an effective way to test bug detection tools. The SWC only contains contrived examples that are not representative of vulnerabilities in real code. As such, it fails to capture important outcomes like false positive
65.
by dguido 7y ago
Manticore is tested extensively against real contracts from our clients, a database of purposefully challenging code samples and mutants we've developed, and the Ethereum VMTests, a version of the state tests you linked. It has found m
66.
by dguido 7y ago
FWIW I agree with the intent of this statement. The odd lesson we've learned is that extreme testability can overcome broken tools to create secure code. It's not the outcome you would expect since the orthodox in security enginee
67.
by dguido 7y ago
If you're looking for push-button vulnerability detection for Ethereum smart contracts, then you want to use Slither ( https://github.com/crytic/slither ), not Manticore. Manticore's detector features were shoe
68.
by dguido 7y ago
It's a limitation of Github Pages, which we use for securely hosting a static-content-only website.
69.
by dguido 7y ago
No worries! That paper is a great resource that we'll insert into the post somehow.
70.
by dguido 7y ago
Is that covered in the last paragraph of the public exponent section? I think Ben linked to an older ImperialViolet explanation over that paper, which maybe we should fix.
71.
by dguido 7y ago
Thanks for pointing that out! I think we made the wrong call too. Will and I updated that bullet to strongly recommend recovery codes, and note they provide an acceptable usability/security tradeoff.
72.
Getting 2FA Right in 2019(blog.trailofbits.com)
260 points by dguido 7y ago|217 comments
73.
by dguido 8y ago
There's an FAQ in the AlgoVPN documentation that addresses this question ( https://github.com/trailofbits/algo/blob/master/docs/faq.md#... ): > Why aren't you using OpenVPN? > OpenVPN
74.
by dguido 8y ago
The slimy marketing around centralized VPN services is why I consider it a point of pride to include the following as a "feature" in the AlgoVPN readme ( > Anti-features > * Does not support legacy cipher suites or protocols
75.
by dguido 8y ago
My first question for e-mail service providers is always, do you support SPF, DKIM, and DMARC for mail delivery?
76.
by dguido 8y ago
Algo does not have a relationship to Wireguard, but Trail of Bits does. We made a substantial donation to them prior to including Wireguard support in Algo. You can find us on their donation page here: https://www.wireguard.com&#
77.
by dguido 8y ago
Hello, CEO of Trail of Bits here -- we performed the security review of the Bitcoin Cash / Bitcoin SV code. Your characterization of the issues as "bandwidth denial of service" is incorrect and does not properly describe the
78.
by dguido 8y ago
There's an extensive discussion on twitter about this research paper in the following three threads: https://twitter.com/trailofbits/status/1084791374468259846 https://twitter.com/trailofbits&
79.
by dguido 8y ago
Thank you! I wish more articles would at least link to the complaint. Here are the important bits: > On 12/12/2018 at approximately 10:30 a.m., Tan contacted his supervisor, advised he was resigning from Company A, and gave his
80.
by dguido 8y ago
We did a high level comparison of all the binary lifters out there and posted it in the mcsema readme: https://github.com/trailofbits/mcsema#comparison-with-other-... tl;dr the lifters you should consider using are mcs
81.
by dguido 8y ago
https://livepeer.org/ has a functional product
82.
by dguido 8y ago
https://polyswarm.io/ has a functional product
83.
A Guide to Post-Quantum Cryptography(blog.trailofbits.com)
8 points by dguido 8y ago|0 comments
84.
by dguido 8y ago
At least they are not using the blockchain. :-x
85.
by dguido 8y ago
And people always criticize me for avoiding OpenVPN in AlgoVPN. Here's the entry from my FAQ: OpenVPN does not have out-of-the-box client support on any major desktop or mobile operating system. This introduces user experience issues a
86.
How smart contract upgrades fail in practice(blog.trailofbits.com)
59 points by dguido 8y ago|15 comments
87.
by dguido 8y ago
Please submit an issue and I'll fix it! -AlgoVPN developer
88.
by dguido 8y ago
My choice is typically between "should I use a hosted provider" vs "should I host my own." IMHO there is not a vast amount of difference between hosted VPN providers. They all suffer from generally the same issues. Here
89.
by dguido 8y ago
It's not a Google project, it's a Jigsaw project. There's a huge difference, since one is run with extremely low resources and employees between the entities are not shared. Don't trust code that comes from Jigsaw. In my
90.
by dguido 8y ago
Hello! Developer for AlgoVPN here. We have many successful reports of using Azure for AlgoVPN. I would appreciate it very much if you could file an issue and include the full details of what happened, including any communications you receiv

More ›