femto113

21 ms·

181.
by femto113 7y ago
I see lots of ways to mitigate requesting the keys from disclosing much information: - could set the false positive rate higher than the chance of encountering a case in the wild (which makes it smaller) - phone could be programmed to somet
182.
by femto113 7y ago
Bloom filters could work that direction as well: phone produces a filter of observed keys and uploads it to the service, service checks all positive keys to see if they're in the filter. I think the main point of doing the checking on
183.
by femto113 7y ago
The system doesn't need to ship every key to every phone, much more compact structures like Bloom filters could be used instead. If we assume about 1000 positives per day and each positive uploading 14 days of keys at 4 keys per hour
184.
by femto113 7y ago
If you can come up with a formal proof of correctness for an evolving API then you are clearly operating on a higher plane of software development than us mere craftspeople, and I certainly wouldn't presume to talk you out of trying.
185.
by femto113 7y ago
My snarky tone was unwarranted but I'm not actually assuming cluelessness here, nor did I come there quickly. I find in practice that TDD and what I think of as "testing" are quite orthogonal. > With the Ruby backend, we s
186.
by femto113 7y ago
Did it not occur to them to, I don't know, "test" the API when they make changes? A compiler or stricter type system may help prevent certain careless errors, but not all (or even most) of them, while a proper test scheme wi
187.
by femto113 7y ago
> To handle [compound primary keys] in DynamoDB, you would need to create two items in a transaction where each operation asserts that there is not an existing item with the same primary key. There are other approaches--in cases where I&
188.
by femto113 7y ago
I've not read anything yet that actually matches the headline of Amazon "not paying the tax". All I've seen is that users can now purchase content without going through Apple's in-app payment pipeline and instead u
189.
by femto113 7y ago
The problem with that strategy is that some percentage of the people who become sick need acute care or they will die, and acute care is effectively a fixed resource over short time frames. There are a limited number of hospital beds, vent
190.
by femto113 7y ago
Overhead in SLU today “at least I can finally find an empty conference room”. For non Seattle folk SLU is South Lake Union, home to many Amazon buildings as well as Google and Facebook
191.
by femto113 7y ago
This sentence from the doc referenced sums it up well I think: > A naive implementation of this feature may allow an attacker to determine the existence of textual content across an origin boundary. Security & privacy implications of
192.
by femto113 7y ago
At Amazon "Program Manager", in this case really was a TPM or "Technical Program Manager". TPMs are effectively serial project managers, often charged with shepherding complex projects that require the efforts of more t
193.
by femto113 7y ago
Marvel at the feat of operations, not the engineering. The techniques used to process this information over the years have mostly been quite banal. Look behind the scenes and much of it is just batch processes written in old school langua
194.
by femto113 7y ago
The availability of developers' keys on github can be quite useful, a few jobs ago I leveraged this to auto-provision ssh bastion hosts with public keys for all of the collaborators of a repo. Much easier than getting people to send t
195.
by femto113 7y ago
Take a look at Magento (open source e-commerce). I'll leave it to you to decide whether it's reducible to notions like "good" or "bad" but it's definitely fascinating in a WTF sort of way. https:/&#
196.
by femto113 7y ago
followed by 14 books in the vein of "How to Crack the Coding fMRI"
197.
by femto113 7y ago
I worry that addiction to stock buybacks is a terminal disease for companies like IBM. Imagine what $65B invested in R&D over the last eight years could have yielded in the future instead of being poured down a financial sewer.
198.
by femto113 7y ago
If you layer credit into the wormhole it seems like you don't even need "losses" in the sucker funds. In essence Medallion establishes that it is "low risk", it is then able to borrow money more cheaply than other
199.
by femto113 7y ago
I've got a slightly different take on messes, and using another RL analogy I call it "don't put your dirty dishes in the sink." If you have a couple dishes you can't wash right away it is tempting to put them in th
200.
by femto113 7y ago
In the end the availability comes down to fleet size. car2go worked best here when they blanketed Seattle with Smart Cars, the fleet peaked around 750 and they were easy to find. After they switched to Mercedes exclusively the fleet was s
201.
by femto113 7y ago
> It it far more efficient of resources to have cars be used most fo the day, rather than sitting idle. This is better and more easily addressed by car sharing services like car2go than autonomous cars. The more I use them the more I wi
202.
by femto113 7y ago
I've always been weirded out by C's 4 character constants, but they're useful for this sort of thing: printf("%d\n", 'GET ') 1195725856
203.
by femto113 7y ago
It’s a step on the same path that led to being able to spoof a CA for MD5 signed certs. https://www.google.com/amp/s/techcrunch.com/2008/12/30/md5-c...
204.
by femto113 7y ago
One reason is that it is theoretically possible to use memory instead of computation to attack the combined hashes by pre-generating a large number of collisions under one algorithm and then simply checking those using the other one, which
205.
by femto113 7y ago
Concatenating two hashes is an algorithm. Mathematically concatenating two 128 bit hashes is not any stronger than a single 256 bit hash (and is likely weaker), but if it’s all you have (or all you can afford to compute) two weak hashes is
206.
by femto113 7y ago
Not impossible, but assuming there's not a mathematical flaw that affect both algorithms the difficulty is roughly the product of the difficulty of finding a collision in each. AFAIK no one has come up with a joint collision for MD5+
207.
by femto113 7y ago
While a meaningful accomplishment, suggesting the algorithm is in a "shambles" seems hyperbolic to me. For one thing there's a non-trivial practical leap between formulating two colliding identities and forging an existing o
208.
by femto113 7y ago
I imagine there's plenty of prior art available. Certainly by the time the Apple II was in schools if not before.
209.
by femto113 7y ago
Don't try to buy a "TV", buy a "monitor". The ones sold for digital signage may be your best bet depending on the size you're looking for.
210.
by femto113 7y ago
Now I personally can't stand to work for big companies, but it's definitely not because its a bad financial move. Might as well write a post about "downsides of not picking the right lottery numbers". I know more peopl

More ›