dsacco

62 ms·

451.
by dsacco 9y ago
> Day-to-day spending also is not swayed by advertisements. There are real reasons behind the choices I make, and those ideas, opinions and motivations don't source their information from advertisers. I'm not charmed by entrea
452.
by dsacco 9y ago
> Claiming certs have no value is to claim knowledge has no value. No it isn’t, because it’s not intended to be literal. Instead, it’s shorthand for saying, “certifications have approximately negligible positive utility compared to lea
453.
by dsacco 9y ago
Performance art does not preclude prosecution for a crime.
454.
by dsacco 9y ago
There are two problems. First, you would not describe a web application as “isomorphic” if it’s an abstraction over a client and a server which both share the same code. The proper way to use this term would be to say that there is an isomo
455.
by dsacco 9y ago
Yes, I see the issue now. I wasn’t referring to bits being halved. I was referring to bit-security (i.e. 128-bit versus 64-bit).
456.
by dsacco 9y ago
Ah, I see what you mean. Yes, I didn’t intend to refer to the bits themselves as items; rather I was referring to the bit-security.
457.
by dsacco 9y ago
I’m confused by your comment, because it doesn’t seem like we’re disagreeing. The end result of Grover’s algorithm is that a 2^ N keyspace can be searched in a worst case of 2^ N /2 steps instead of 2^ N steps. So yes, it does halv
458.
by dsacco 9y ago
Two reminders, for anyone reading this and wondering about the implications for cryptography: 1. Grover's algorithm is applicable to symmetric cryptosystems, like AES. It searches for secret keys in a quantum-optimal manner. Shor'
459.
by dsacco 9y ago
This is a great comment. I don’t necessarily agree with the conclusions, but I like the argument and I’m impressed it’s being presented dispassionately. It’s tiring to see breathless anti-big company rants or conspiracy theories about dysto
460.
by dsacco 9y ago
> Now just cut out the HFT frontrunners and I can actually the price I see on the terminal. High frequency trading is not front-running. High frequency traders 1) do not have a fiduciary duty to other traders in the market, which is a
461.
by dsacco 9y ago
> If this was such a great service why is IEX becoming so big? This is not an informed thesis. This is just an appeal reducible to the following statement: “A thing cannot be a good service if it has a large and organized opposition.”
462.
by dsacco 9y ago
To put it succinctly: 1. All trading strategies profit by identifying market inefficiencies. 2. Market inefficiencies occur (in general) when the price of a security is inaccurate. 3. By correcting the inefficiency, the strategy profits con
463.
by dsacco 9y ago
> I am not sure to agree with you, specially considering that the mainstream algorithms now in use are generally suggested by intelligence agencies themselfs. What you’re now suggesting is very close to conspiracy territory. Most crypt
464.
by dsacco 9y ago
> Not at all, what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. To be brutally frank with you: most people are not qualified to implement their
465.
by dsacco 9y ago
> Look at the recent INTEL spectre failure, you can see how extremely complicated systems were flawed at their very bottom and few young enlighted minds were able to shake our world. Are you aware that virtually all of the researchers
466.
by dsacco 9y ago
It’s an argument attacking the probable inconsistency of the parent’s argument. More generally speaking, it’s an argument that reiterates my original point - security is a context-specific discipline, and it is fully legitimate for people a
467.
by dsacco 9y ago
> Sometimes I ask myself if this generalized crypto mono-culture is something being implanted in our brain to spare NSA money. I’m in the industry - I work on cryptography research and I review cryptographic protocols for security and
468.
by dsacco 9y ago
> If someone gets into an email server, they only get the mailboxes on that server. By centralizing slack, they've made it the ultimate target worthy of people with 0-days. So you’re opposed to Gmail and Outlook as well? Do you ru
469.
by dsacco 9y ago
Yes, that would be fine and is fully realizable. In the client-server model of end-to-end encryption, a server self-hosted by the user is isomorphic with a user's client. They're effectively the same thing. The tricky part here is
470.
by dsacco 9y ago
Taking your criticism to its logical conclusion, are you asking for end-to-end encryption on every online mode of communication in order to consider it secure? When security engineers and cryptographers analyze an application, they frame th
471.
by dsacco 9y ago
> Would allowing organizations to manage their own key(s) suffice? No. Slack does not implement searching logic on the client. If the key is only known to the client, and the search logic is only known to the server, you can't sea
472.
by dsacco 9y ago
> Is there anything that they could be doing with your data or money that would make you think twice about using prime? Realistically speaking, probably not, no.
473.
by dsacco 9y ago
> The destination building require a lot of paperwork in a very specific format just to deliver something. The paperwork is always a little different. Automating this sounds like a business worth several million in annual revenue, easi
474.
by dsacco 9y ago
> Certain types of market manipulation are encouraged by exchanges in order to provide liquidity. This is unequivocally false, and we can’t look just past this claim because it’s “secondary to your point.” High frequency trading (and m
475.
by dsacco 9y ago
> Firstly, I'm aware of human-based captcha-defeating systems. You describe captchas that "cannot be outsourced to a mechanical turk-based API". I'm wasn't aware such systems existed, that sounds scary. Do you h
476.
by dsacco 9y ago
> Wow. That's starting to get really shady. Yes, there is a massive amount of crawling that happens in the service of financial forecasting. Satellite imagery, drones, web pages, API endpoints, receipt data (free financial aggrega
477.
by dsacco 9y ago
That's a fair point, and it's conceivable this could work. But if the scrapers have had a legitimate source of truth in your data for a meaningful amount of time before you pull the trigger on this, it will get significantly har
478.
by dsacco 9y ago
I think this is a good example of "poisoning the well" in practice, and I was in a similar position as you describe when I was working in incident response at a consumer bank a few years ago. That said, this is a very particular s
479.
by dsacco 9y ago
> When you detect a scraper - through what ever means - you don't block it, as that would tip it off that you are on to it. Having written bespoke scraping systems professionally, I think you overestimate the applicability of this
480.
by dsacco 9y ago
This is lame. Security research is a wonderful thing. This is not that. If and when a vulnerability is ready for public disclosure, then fine: make a webpage with a cute logo and name, informal details of the issue and links to formal paper

More ›