ekzhang

8 ms·

61.
by ekzhang 3y ago
My concern with the comment is that it speaks from a position of authority and raises a lot of false alarms about the security of the application. The anonymous commenter publicly shared a suspicion of something that is 1) very serious and
62.
by ekzhang 3y ago
That's amazing! Let me know how it goes or if you need anything.
63.
by ekzhang 3y ago
Thanks for the comment, happy to elaborate. You're correct that the IVs are not reused. Replays and dropping messages are not possible due to the indexing of the stream. This is a necessary precaution from a distributed systems sense b
64.
by ekzhang 3y ago
You're exactly right. The IVs are completely predictable, and crucially, that allows us to guarantee that they are not reused. The security of CTR mode of encryption depends on avoiding IV reuse. Once again, I'm very happy to have
65.
by ekzhang 3y ago
The comment says that the IV is reused. The IV is not reused! I am very open to feedback, but false statements about the security of an application need to be taken very seriously, especially when given from a commenter who speaks with a to
66.
by ekzhang 3y ago
Once again, security is very tricky to get right, and I'm very transparent about the security model and encryption of the application. I've discussed this at length and have thoroughly documented the code. The commenter makes fact
67.
by ekzhang 3y ago
The other comments make it fairly clear that this suspicion was unfounded but convinced people otherwise, and I have given a fair response to your comments. I of course appreciate you scrutinizing the application, and while the feedback was
68.
by ekzhang 3y ago
Hey, this is a serious accusation. I would be very careful about raising false suspicions like this publicly. The application does not reuse IVs. For your second point, I am aware of authenticated encryption and the possibility of bit-level
69.
by ekzhang 3y ago
Nice trick! Many people have mentioned that tmux lets you share terminals, though worth noting that it takes a bit of setup, doesn’t render correctly when you have different screen sizes, and requires stitching together a lot of other tools
70.
by ekzhang 3y ago
You need a key to access the terminal, and the key is never sent to the server or over the network, it goes in the browser hash. You could say the same about Jupyter being a web access tool, for instance. sshx only lets you make ephemeral c
71.
by ekzhang 3y ago
I could do it!! It’s on the list (note that sshx is pretty different from all the suggested alternatives though)
72.
by ekzhang 3y ago
tmate is an incredible piece of software! The terminal multiplexing is surprisingly similar to the problem of collaboratively sharing terminals, and forking tmux is a really elegant way to handle that. I took a lot of inspiration from other
73.
by ekzhang 3y ago
Yep, it was a big inspiration for this. tmux won’t sync window sizes properly between viewers though
74.
by ekzhang 3y ago
Thanks! Yeah you can use it anywhere with outbound HTTP network access, whether that’s a local VM, cloud instance, laptop, k8s pod, random managed SaaS, serverless function, Raspberry Pi, …
75.
by ekzhang 3y ago
Yep, it’s a rolling 2 MiB buffer in RAM. Also do some snapshotting for persistence / server fault-tolerance, and that size is much smaller.
76.
Show HN: Sshx, a web-based collaborative terminal(github.com)
242 points by ekzhang 3y ago|62 comments
77.
Collaborative Editing in CodeMirror 6(codemirror.net)
2 points by ekzhang 3y ago|0 comments
78.
A locking war story(swatinem.de)
8 points by ekzhang 3y ago|0 comments
79.
by ekzhang 4y ago
Hm, you're currently able to do this through Pandas. stuff: list[mydataclass] stuff_df = pd.DataFrame(stuff) results = sql^ "SELECT * FROM stuff_df WHERE field = 2" My guess is that this would be a lot faste
80.
by ekzhang 4y ago
Yep, they're prepared SQL statements. Literal string interpolation would be unacceptable in any self-respecting SQL library: it's parameters. Good question though!
81.
by ekzhang 4y ago
That's great! There's nothing I would be happier to hear than this experiment making someone think of query languages a little differently. :)
82.
by ekzhang 4y ago
Thanks for the feedback orf! I agree it looks strange at first, this is very experimental so I played a bit with syntax design choices. Sometimes for DSLs it's nice to have a bit of flexibility. You can compare it to the %timeit, %cyth
83.
Show HN: Inline SQL in any Python program(github.com)
26 points by ekzhang 4y ago|13 comments
84.
Show HN: Redis-rope, a native data type for large strings(github.com)
3 points by ekzhang 4y ago|0 comments
85.
by ekzhang 5y ago
Yep, those are all good use cases where TCP tunneling comes in handy — basically, how can I get someone to connect to me?
86.
by ekzhang 5y ago
See my comment below about differences in goals from remote SSH port forwarding (which I also use regularly). Scaling issues are not a problem for me, but thank you for your concern. The nice thing about scaling is that you only have to wor
87.
by ekzhang 5y ago
Wow, that’s pretty violent. Excuse me! Bore is just a proxy I wrote on a train ride home, and I’m making it public for its own sake. I’d honestly rather you not make intimidating suggestions towards threats like this.
88.
by ekzhang 5y ago
Thanks for the feedback! I’ve actually seen your list before developing bore, and it was definitely an inspiration for me. Super helpful resource :)
89.
by ekzhang 5y ago
The server does have fairly good logging of each connection, including source IPs — feel free to contribute if you see anything that could be improved on this end though.
90.
by ekzhang 5y ago
Thanks for the words of warning! I’ll keep a lookout for malicious uses, especially now that it’s gotten a bit of attention on HN, which was not planned. Feel free to let me know if you see something suspicious, as well.

More ›