jfindley

24 ms·

241.
by jfindley 10y ago
There's been a few TCP sequence related vulnerabilities over the years, but this is slightly different - it's actually a problem with how ACKs are processed, making it far easier than it should be to conduct a well-known attack ty
242.
Off-Path TCP Exploits: Global Rate Limit Considered Dangerous [pdf](cs.ucr.edu)
44 points by jfindley 10y ago|1 comments
243.
by jfindley 10y ago
Agree WRT network performance, the basic instances are unreasonably slow (only 70 Mbps for a micro), and requiring users to pay for a big 8 core server for wirespeed Gbe, and a huge 40 core beast for 10Gbe (and rather poor 10gbe at that) is
244.
by jfindley 10y ago
As others have said, similar to DO. It has a few more options available, though, including better support for booting your own OSes if you don't want to use a prepackaged one, and dedicated instances (last I checked DO didn't do
245.
by jfindley 10y ago
While I agree with many of the points made, his estimation of the number of round trips is way off. For a start, TLS negotiation requires several round trips before you even start speaking HTTP. Secondly, browsers (depending on vendor,
246.
by jfindley 10y ago
That is the least of the problems with it. It's very, very odd. On top of the craziness Matthew notes in his article, the code actually appears to use ROT13. Twice. I have no idea why.
247.
by jfindley 10y ago
Yes I did look for Alfa in the list, I wasn't surprised it wasn't there, as in my experience it'd be so far off the top of the chart, the others would look tiny in comparison. I loved our Alfa, but my word was it expensive
248.
by jfindley 10y ago
bcrypt is limited to 72 characters (admittedly this is not that big a practical limitation), and scrypt is an excellent KDF, but wasn't designed as a password hash, and thus doesn't have great GPU defence. In practice, they'
249.
by jfindley 10y ago
The work factor also increases the work the server has to do to handle users logging on, which is a big cost both in UX and hosting fees. In practice, reasonable work factors for bcrypt are between 10 and 12. What application could tolera
250.
by jfindley 10y ago
Yes absolutely this - I was just trying to explain how salts should implemented - in the real world always use something like bcrypt or scrypt that does all this for you.
251.
by jfindley 10y ago
Because something with a cryptographic hash, like sha256, you can do millions (or in some cases billions) of hashes per second on the same GPU. Password hashes, like bcrypt, PBKDF2 and scrypt, are massively slower. That doesn't mean t
252.
by jfindley 10y ago
You're massively overestimating the strength of bcrypt here. olcHashcat on a single modern GPU will do several thousand hashes per second, depending on work factor and GPU speed.
253.
by jfindley 10y ago
What? No. Don't use a fixed salt. Each record should have a unique, random salt. You then store salt:hash(salt+password). There are numerous guides on how to do this properly, for example https://www.owasp.org/index.
254.
Useful new strace feature(jvns.ca)
12 points by jfindley 10y ago|0 comments
255.
by jfindley 10y ago
Yes. Please don't insinuate that others haven't read the article. It might be worth reading the HN guidelines here: https://news.ycombinator.com/newsguidelines.html Also, from the article, please note paragraphs
256.
by jfindley 10y ago
Moving the SSH port is a bad idea. The article falls into a number of common pitfalls here. A connection to your SSH server does not usefully equate to someone "trying to hack" your server. If I had $1 for every time I've h
257.
by jfindley 10y ago
Slightly OT, but that link is astonishing . That anyone can think adding 100ms of latency to a 10Gbe switch, even under heavy contention is a good feature is absolutely staggering.
258.
by jfindley 10y ago
I think people interested in AAC probably aren't using it at low bitrates, so I'm not sure how meaningful that is. At more reasonable bitrates for people who care about quality (and thus are using AAC over MP3 in the first place)
259.
by jfindley 10y ago
I think that's misrepresenting the article somewhat. It mentions video in several places, because a lot of the issues stem at least in part from the complexities introduced by trying to be a general purpose container, but there are ma
260.
by jfindley 10y ago
I've heard numerous complaints from people with deep technical knowledge in this domain that Ogg is a terrible format - for example, see: http://hardwarebug.org/2010/03/03/ogg-objections/ MP3 is use
261.
by jfindley 10y ago
"... except for the time invested" Fundamentally, as individuals, time is all we have. Using it wisely is important.
262.
by jfindley 10y ago
Perhaps I missed it, but I didn't see anything indicating what image formats it supports. I assume it supports JPEG and PNG, but does it support all the various versions of TIFF (there are a lot of these)? Does it support raw images
263.
by jfindley 10y ago
For MySQL, it depends a bit what you're hoping to get out of scaling. Scaling for performance reasons: Past a certain point, many workloads become difficult to scale due to limitations in the database process scheduler and various inte
264.
by jfindley 10y ago
> A company can build up a reputation in the security industry, produce world class hardware and software, and charge a sharp premium on it, because security is _so_ important and protects some of our most valuable assets. Hmm. I think
265.
by jfindley 10y ago
Somewhat OT, but does anyone happen to know which font that is? I like it a lot.
266.
by jfindley 10y ago
I read an interesting study a while back about architecture in London, taken with a sample of professional architects and a sample of general population, all based in London. All the architects in the study hated the old Edwardian terraces,
267.
by jfindley 10y ago
Many of my points have a security element to them. Such as inability to verify if files have been tampered with, inability to audit beforehand what the script will do and ease of MiTM attacks. My point with the PGP argument is that you can
268.
by jfindley 10y ago
I don't think that's nearly as clever a counter-argument against curl|bash as they appear to. A few points of the shortcomings of curl|bash vs RPM and others: * curl|bash is not transactional. If you have an install/upgrade
269.
Google XSS analysis(sites.google.com)
2 points by jfindley 11y ago|0 comments
270.
by jfindley 11y ago
Doesn't appear to mention metadata at all. While metadata is somewhat tangential to the actual encryption, it's still a vital part of a truly secure messaging platform - who we talk to reveals quite a lot about us. I'm not su

More ›