er4hn

10 ms·

91.
by er4hn 2y ago
This would be more fun if you could share what that item is.
92.
by er4hn 2y ago
One perpetual source of concern that I have is how will this work in practice? NIST has not standardized algorithms as of yet. NSA has come out in opposition of hybrid schemes (note that NSA is also a big fan of CsfC, which uses entirely se
93.
Biscuits – A Tasty Solution for AuthZ(er4hn.info)
2 points by er4hn 2y ago|0 comments
94.
by er4hn 2y ago
There's a lot more that goes into building CPUs than lithography machines. A lot of it also hard to replicate across spaces and may not even be possible to note. That's why Intel's strategy for making new manufacturing facili
95.
by er4hn 2y ago
If this were to happen to an OSS product it would likely get a CVE, but it's less likely to get a report on the controller's behind this and a well written page with pretty graphics unless a security researcher wanted to bolster t
96.
by er4hn 2y ago
All good fiction is a statement on reality.
97.
by er4hn 2y ago
I haven't been a maintenance worker, but I've worked as an SWE in a company with a large IT dept. Sometimes it's faster to work around them to find solutions to doing your job. Both sides have good intentions but the IT dept.
98.
by er4hn 2y ago
This appears to be a State Compromise Extension Attack ( https://en.wikipedia.org/wiki/Random_number_generator_attack ) which is something that PRNGs that are not CSPRNGs can be subject to. At this point it feels like ha
99.
by er4hn 2y ago
SPHINCS+ is a complete signature scheme that carries that idea to it's completion. Shameless plug for where I explain it: https://er4hn.info/blog/2023.12.16-sphincs_plus-step-by-step...
100.
by er4hn 3y ago
> We have a post on this coming soon! The short version is that Polar is a logic language based on Prolog/Datalog/miniKanren. And logic languages are a particularly good fit for representing the branching conditional logic you
101.
by er4hn 3y ago
This was actually my first thought. This will confuse many people in the cybersec community.
102.
by er4hn 3y ago
I'm not a big proponent of AI, but running code locally is far far better for privacy than giving all your data to a remote service you don't control.
103.
by er4hn 3y ago
This data appears to be 2021 top 100 companies. Lisa Su is solely listed as a board member of Cisco for example, since AMD had yet (I think?) to eclipse Cisco's market cap at the time.
104.
by er4hn 3y ago
This looks really nice as a hobbyist project. That being said - I can't see this being usable in an enterprise space. There's no TPM requirement so someone able to get access to the HSM could dump the keys from memory. The worst p
105.
by er4hn 3y ago
Ross Anderson embodied a lot of positive principles in the security community. His book on Security Engineering (2nd edition is the biggest book on my bookshelf) patiently laid out principles of good security design, and tied it to examples
106.
by er4hn 3y ago
It's incredible how Arthur C Clarke foresaw the downsides of full codebase rewrites and putting all organizational weight behind untested and cutting edge technologies all the way back in 1951. Truly prescient sci-fi writing.
107.
by er4hn 3y ago
lcamtuf _is_ a security professional. He created p0f, AFL, wrote Silence on the Wire, and has done cybersec jobs from engineering to executive leadership. He has taken to posting mildly trollish stuff ("poasting") on Xitter, but t
108.
by er4hn 3y ago
https://corecursive.com/066-sqlite-with-richard-hipp/ is an interesting interview with the lead developer for SQLite about the inspiration and work that went into that testing as well.
109.
by er4hn 3y ago
A coworking space I signed a contract for starting on March 1st sent me an email on 02-28 telling me my membership starts tomorrow and welcome on board.
110.
Keytrap DNSSEC CVE Annoucement(lists.thekelleys.org.uk)
1 points by er4hn 3y ago|0 comments
111.
by er4hn 3y ago
Don't forget Lucasfilm Games, nee LucasArts. They published a lot of games, both star wars properties and otherwise. They're now owned by Disney as well.
112.
by er4hn 3y ago
Are you thinking of Room 641A? https://en.wikipedia.org/wiki/Room_641A
113.
Hot Take – Analysis of Security in Popular Messaging Apps(er4hn.info)
2 points by er4hn 3y ago|0 comments
114.
Understanding Sphincs+ PQC, Step by Step(er4hn.info)
1 points by er4hn 3y ago|0 comments
115.
by er4hn 3y ago
My personal favorite: A man yells in the street: "Nicholas is a moron!". He is taken away by the police on charges of lese majeste (insulting the monarch). He tells the policemen "Please let me go, I meant another Nicholas!&q
116.
by er4hn 3y ago
A better title might be "Apple fixes iOS bug that would let a single Flipper Zero perform Denial of Service attacks against every iPhone in it's radius."
117.
by er4hn 3y ago
I agree that some is inevitable, but as that amount increases it will provide a drag in what the organization is able to accomplish. This becomes even worse as an organization is remote locally and globally spread out.
118.
by er4hn 3y ago
Thanks I appreciate this. I know I co-inflated different concepts. I should update my blog post once the comments here dry up and I can go through them.
119.
by er4hn 3y ago
Thanks for the comments everyone. You're not the first ones to give me feedback about co-inflating the two. In my mind saying that something is "hard to" write down is still pretty similar to saying it is not written down. Fo
120.
by er4hn 3y ago
I think this is valuable for those outside of Qualcomm to understand why they have the role that they do in the mobile space. Having worked there as well I have two observations: - So much of that wall of patents was undergrad level CS conc

More ›