floody-berry

21 ms·

61.
by floody-berry 13y ago
They must have gotten it all out of their system with Diablo II, because they rewarded the hell out of hackers there. The only players who suffered were the ones who tried to play legitimately.
62.
by floody-berry 13y ago
It seems more likely that they don't realize it's even important until they get hammered for details on what they used. Some PR person asks an engineer and he says "Yeah, it's fine, we hash/encrypt the passwords.." and only after they event
63.
by floody-berry 13y ago
It was perhaps unnecessarily blunt, but that is the root problem with most of these leaks: Someone who doesn't know what they're doing implementing a scheme that is only slightly more secure than storing the passwords in plaintext. It turns
64.
by floody-berry 13y ago
https://www.livingsocial.com/createpassword : "LivingSocial passwords were hashed with SHA1 using a random 40 byte salt." Shocker!
65.
by floody-berry 13y ago
people actually pay you just to make shit up?
66.
by floody-berry 13y ago
Even though MOBAs are inherent breeding grounds for trolls due to the captive nature of the game, Riot has done themselves (and everyone else) no favors in how they've dealt with things. For a game that was released in 2009 they've done an
67.
by floody-berry 13y ago
http://hashcat.net/oclhashcat-plus/ MD5 is 2-3x as fast as SHA-1 MD5 is 5-7x as fast as SHA-256 I don't know why anyone would assume they are using anything better than MD5/SHA-1 considering the history of incidents like this.
68.
by floody-berry 14y ago
I made a quick test for the C versions to try out flags and such: https://gist.github.com/floodyberry/5335542 I found out gcc supports -fprefetch-loop-arrays, although it is not guaranteed to have a positive effect. In this case, it does
69.
by floody-berry 14y ago
The Haskell assembly is using the 3-op AVX instructions, but not 256bit registers. The example is simple enough that it may not make a difference (2-op vs 3-op instructions), but in a more complex function with register spills it could have
70.
by floody-berry 14y ago
The first C example is pretty disingenuous as they explicitly added loop unrolling and prefetching tuned to x86-64 to the Vector library, then compared the basic C versions with with "-funroll-loops" (and no prefetching based on the icc/gcc
71.
by floody-berry 14y ago
DNSSEC amplification is still pretty high. When I ran dnssecamp[1] last year, I got similar numbers to the example run cited (2000+ servers providing 30x amplification, scaling up to 95x amplification for the worst offenders). [1] http://d
72.
by floody-berry 14y ago
The pro-religion / anti-religious criticism crowd here seems much more vocal than the opposition as well. Both sides seem to have lost out to the Guns vs Pools debate in any case.
73.
by floody-berry 14y ago
Everything that doesn't have assembler versions of all their constant time code (even NaCl under x86/x64) will be vulnerable then. It's possible that compilers start to "optimize" the branchless constructs, but it would almost be malicious
74.
by floody-berry 14y ago
The C versions (mostly reference implementations) in NaCl are constant time. The assembly code is there for performance.
75.
by floody-berry 14y ago
Encryption implies that an authorized party can also decrypt/read the encrypted data. In that sense, "one way" + "encryption" is an oxymoron. Further, "one way encryption" appears to only exist so nobody has to explain to regular users (and
76.
by floody-berry 14y ago
"hashed and salted" is not necessarily time consuming, it really matters what process they used. Their post gives no confidence that the passwords cannot be trivially cracked.
77.
by floody-berry 14y ago
You only need to generate collisions for the keyspace used. Brute forcing 20-30 bit collisions in any hash function is trivial.
78.
by floody-berry 14y ago
Murmurs main issue (in an attacker controlled context) is how it incorporates the seed in to the hash, not unexpected collisions on non-malicious data. Further, _any_ hash, even cryptographic, will not protect you if it is not used with a r
79.
by floody-berry 14y ago
If you aren't going to have a cut off point for what is considered solving the problem and what is considered ancillary, then you can define new languages where a zero byte input stands for whatever solution you want, simultaneously one-upp
80.
by floody-berry 14y ago
It has been loyal insofar as the character's names are the same and occasionally including lines verbatim from the books (although sometimes in the wrong place). I don't actually know if them myriad of changes, small and large, made the fil
81.
by floody-berry 14y ago
Science knows what color is, how we perceive color, and it is trivial to show that someone can or cannot see color. Firsthand experience from meditation is only evidence that using your attention in certain ways has various effects on the b
82.
by floody-berry 14y ago
I'm still missing what makes it unfair. Are other modes of AES potentially faster? Does AES provide something that stream ciphers don't? Are Salsa20/Chacha20 unable to be compared to anything because they're native stream ciphers that look
83.
by floody-berry 14y ago
What makes the comparison unfair?
84.
by floody-berry 14y ago
David Musser's (author of Introsort) paper "A Portable Cache Profiler Based on Source-Level Instrumentation"[1] looks at the cache behavior for Intro, Merge, and Heapsort in it's examples section. Not directly correlated, but possibly inter
85.
by floody-berry 14y ago
djb's "Cache-timing attacks on AES" paper includes the code he used to carry out his attacks: http://cr.yp.to/antiforgery/cachetiming-20050414.pdf
86.
by floody-berry 14y ago
Hey now, religion isn't just sourced from bronze age goat herders! To name a few, there's 19th century con-men (Mormonism), 20th century shysters (Scientology), 21st century street magicians (Sathya Sai Baba).. we should be so lucky that re
87.
by floody-berry 14y ago
All the top users on Digg aggressively dugg each others submissions, that is undeniable. What's more, because of the "I'll vote your shit up if you vote mine up" mentality, and the ability to easily follow users to see what they submit and
88.
by floody-berry 14y ago
Even with PAE, many Windows versions hard limit the available RAM to 4GB (or less). So his answer isn't even correct given the reality of many operating systems & hardware. http://en.wikipedia.org/wiki/Physical_Address_Extension#Oper..
89.
by floody-berry 15y ago
Optimizations off in the release build would be one thing, but it's like this in the latest patch. Over a month of being out and 4+ patches and still needing? optimizations disabled does point to a bit of incompetence.
90.
by floody-berry 15y ago
If you actually play the game? Probably nothing. You need armies of bots to make anything with how badly item stores and duping dilute the economy. The economy has been a joke for years now; I'd actually be surprised if bots weren't the maj

More ›