dwheeler

81 ms·

931.
by dwheeler 7y ago
I was taught (in the USA) that in the end nothing substantial changed (i.e., it was essentially a stalemate). I think that is more or less true.
932.
by dwheeler 7y ago
> why do clients still send passwords to a server? Doesn't it make more sense to hash the username and password together with some sort of nonce/salt that's sent to the server for validation? You must ALWAYS hash the passw
933.
by dwheeler 7y ago
This is really cool, though it looks like the security impact is nuanced. Unikernel plus: A lot of code, including code with vulnerabilities, can disappear. So some vulnerabilities disappear. Unikernel minus: The unikernel and applicat
934.
by dwheeler 7y ago
I think it's more likely that this conclusion is true than that it's false. However, the fine article says: "We admitted 10 male and 10 female weight-stable adults". That is a ridiculously small population to start with.
935.
by dwheeler 7y ago
I also highly recommend "Reflections on Trusting Trust" by Ken Thompson. But if you read it, please also consider reading my dissertation "Fully Countering Trusting Trust through Diverse Double-Compiling (DDC)" at http
936.
by dwheeler 7y ago
Very interesting! Rust normally prevents a lot of memory safety problems, but those are not the only kind of security problem in a crypto system. Obviously the library has to correctly implement the spec (and expectations of users), which
937.
by dwheeler 7y ago
I've been semi-following the bootstrappable builds stuff in general - that work is already listed on my page https://dwheeler.com/trusting-trust Mescc is obviously an example. Years ago Bellard demonstrated a bootstra
938.
by dwheeler 7y ago
It's "rulebook based" with support for a simple taxonomy. It is a very different domain specific language. I recommend looking at this to see a programmer's view: http://www.ifwiki.org/index.php/Info
939.
by dwheeler 7y ago
That assumes that the only relevant article in the long term is the executable code. But I don't think that's true at all. The Lyons book on Unix, and several books about the Linux kernel, have shown that the source code also ma
940.
by dwheeler 7y ago
It is perfectly reasonable to be skeptical for all the reasons you've noted. However, I see two things that have changed. Most importantly, he has set of specific month and year. He is also stating a specific license, which I don'
941.
by dwheeler 7y ago
Usually closed source simply means it's not open source. Since it is not open source, I I think many people would normally call it closed source.
942.
by dwheeler 7y ago
Awesome! Inform7 is intriguing. You can learn more about it here: http://inform7.com/ What is very unusual about it is that it creates a programming language for interactive fiction that looks very much like natural languag
943.
by dwheeler 7y ago
I agree. We already have JPEG, a format that can be used without obvious patent problems. I don't think the world needs a format with obvious patent problems. Saving some bytes is nice, but when people are streaming videos and audio,
944.
by dwheeler 7y ago
I understood the problem, but I found the page's explanation a little confusing at first. In particular, "lexical differential highlighting" misled me, because the word "differential" made me think that his algorit
945.
by dwheeler 7y ago
Perhaps, but if you want to solve a problem, you need to address the primary cause. If the European rivers never released any single-use plastic it would not have a serious impact on the problem. The vast majority of this pollution comes
946.
by dwheeler 7y ago
The article notes that "Single-use plastic items such as plates, cutlery, straws, balloon sticks or cotton buds, will be banned in the EU under plans adopted on Wednesday...." because "These products... make up over 70% of ma
947.
by dwheeler 7y ago
It'd be nice if there was an easier way to do this (vs. removing a chip!). E.g., maybe a dedicated pinout and an easy way to disable the existing use (since the pins can't be shared).
948.
by dwheeler 7y ago
This is a weird deja vu. I created that page on Wikipedia back in 2003 so that people could find out what it was. At the time there were a huge host of things that Wikipedia didn't cover at all; it's remarkable how much Wikipedi
949.
by dwheeler 7y ago
There are many advantages to Curve25519, but in many cases you need to use RSA. E.g., when you're trying to talk to arbitrary websites securely, you don't get to choose what was used to sign their certificate. There are many circu
950.
by dwheeler 7y ago
The CII best practices badge ( https://bestpractices.coreinfrastructure.org ), which identifies key best practices for OSS projects, doesn't forbid the use of the RSA algorithm. In many situations forbidding the use of RSA
951.
by dwheeler 7y ago
At least own your domain name and be able to easily move your website content to whereever you want. I think for most people it's cheaper and more convenient to use a hosting service, and that's fine... as long as you can change
952.
by dwheeler 7y ago
In general they don't have a right to demand it. However, in this case it is a direct refutation of a previous article that the journal published. At the very least their refutation deserves to be evaluated by a peer review process and
953.
by dwheeler 7y ago
While we're on the topic of static analysis of code that uses Rails... I suggest also using other static analysis tools as they make sense. I lead the Railroader project, an open source security static analysis tool for programs built
954.
by dwheeler 7y ago
I agree, this document is really only useful for historical development. However, it is useful for tracking down some history. I've been trying to track down this expression: "All men are mortal; Socrates is a man; therefore So
955.
by dwheeler 7y ago
I think that's exactly correct. It's more than inertia; they are being paid to not update their polices, so they're incentivized to not do so... even though their policies inhibit the use of standards (their purported goal
956.
by dwheeler 7y ago
Because ISO likes free money. In most cases ISO doesn't pay the authors and reviewers of standards, so instead of posting the document for free, it gets to indefinitely receive 100% of the profit from the work. It's a sweet deal
957.
by dwheeler 7y ago
In a world where there were only a few hundred standards, sure. But today's complex computer systems depend on hundreds of thousands of interfaces, and those interfaces are depended on by millions of organizations. Their business mode
958.
by dwheeler 7y ago
The lede got buried here. This article does not just propose "let's publish everything", it proposes "let's publish everything and have endorsement as a completely separate step." I think that is a far more rat
959.
by dwheeler 7y ago
> Given that Facebook already takes a full copy of all of my contacts (I use WhatsApp) I recommend using web apps, not native apps, for things like Facebook. Your browser will not hand over your contacts list to the world, so preferring
960.
by dwheeler 7y ago
I agree that "set theory" itself is a bit of an overloaded term, as there are in fact many set theories. However, as you're probably well aware, naïve set theory can quickly lead to disaster because it leads to well-known par

More ›