jjnoakes

30 ms·

331.
by jjnoakes 5y ago
I want to point out to unfamiliar readers that use-after-free in a rust generational array is a logic bug, where as use-after-free in just about any other non-rust context is undefined behavior. Rust's safety is helping here, not by pr
332.
by jjnoakes 5y ago
An open relay is different from what you describe. My email account is not an open relay just because I can spam whomever I want from it, and neither is my twilio account. And I don't need to send sms spam. If it was blocked on the way
333.
by jjnoakes 5y ago
I get that just fine. I just disagree with it, and I disagree with the analogy to an open mail relay.
334.
by jjnoakes 5y ago
> If you operate an open relay for email - your IP address is going to be blacklisted very quickly. Same here This doesn't sound like an open relay (since the incoming message can't be forwarded to arbitrary destinations), this
335.
by jjnoakes 5y ago
Maybe I'm dense but couldn't an attacker just put a qr code sticker over every space that all pointed to their own space? Then everyone would be paying for the attacker's parking. I suppose this is harder to pull off with a l
336.
by jjnoakes 5y ago
Depends on the language and library. But even for exceptional exceptions, you may still want or need to retry or branch based on what was thrown.
337.
by jjnoakes 5y ago
Wouldn't that naturally happen once you make mistakes without a license?
338.
by jjnoakes 5y ago
I am excited about rust supporting more platforms so that this kind of thing can be done more widely without sacrificing another kind of portability.
339.
by jjnoakes 5y ago
In security contexts, you have to make your claims carefully and explicitly. Assumptions don't play nicely there. And getting access to private keys can happen by means other than the user volunteering them.
340.
by jjnoakes 5y ago
> You absolutely cannot fake a message being cryptographically signed without providing a broken verification function. How about by obtaining the private key?
341.
by jjnoakes 5y ago
Again, I'm not going to come up with an exact formula. The point stands without one. You can calculate using any history you like. Weigh past damages based on time between, or time in the past. Be creative.
342.
by jjnoakes 5y ago
By some amount proportional to the damage caused, of course. The more times you cause damage, and the higher the damages, the higher your rates go over time. I think my point is pretty clear without me coming up with a precise formula: inst
343.
by jjnoakes 5y ago
Why is that the only way? Seems to me you could just raise rates after someone caused actual damage instead.
344.
by jjnoakes 5y ago
You can just update rates after the fact if necessary. I don't really see the problem with that. People with a bad history may get higher rates, just not based on risk analysis but based on their actual history.
345.
by jjnoakes 5y ago
A counterpoint (not necessarily my view but a view nonetheless) would be that if everyone pays into a single required insurance pool then the risk doesn't need to be accurately determined a priori. Each individual's rates might be
346.
by jjnoakes 5y ago
I think you need a way for the prover to commit to the colors of every vertex before you choose which edge you want revealed.
347.
by jjnoakes 5y ago
> You've usually given up any right to them not happening on a work computer at some point during new employee onboarding if not sooner. Perhaps for anything that happens on the computer itself, but I'd be surprised if this cov
348.
by jjnoakes 5y ago
> You can change your server code at any time and your users would be none the wiser. I'm my only user, that's why I'm discussing self-hosted apps here...
349.
by jjnoakes 5y ago
I disagree. The cost of just deploying my contract might pay for years of self hosting at current transaction rates. It might eventually amortize out to cheaper over many, many years, but that assumes no changes are ever needed. How likely
350.
by jjnoakes 5y ago
Is that true though? If two people run self hosted apps that can communicate, all you have to verify is the data passing between. What assurances are you missing?
351.
by jjnoakes 5y ago
To me the two words (feature and assurance) are synonyms in this discussion. I meant both above.
352.
by jjnoakes 5y ago
I thought I did... That quoted paragraph doesn't negate my point which is that I do get the same (or very similar) assurances elsewhere, so I think the comparison is valid.
353.
by jjnoakes 5y ago
There are easy mitigations for those things though. My self hosted apps run on immutable infrastructure and are replicated and load balanced. Still stupid cheap and easy.
354.
by jjnoakes 5y ago
Why can't you verify the code you run locally?
355.
by jjnoakes 5y ago
I get mostly the same features with self-hosted and local traditional apps for a fraction of the price and much lower general financial risk as well.
356.
by jjnoakes 5y ago
Sorry, not following. The recourse I was referring to was a fork and modification of the transactions in question.
357.
by jjnoakes 5y ago
See the DAO hack for precedent.
358.
by jjnoakes 5y ago
A list of compromises or exploits isn't a source for the claim that there aren't legal repercussions or avenues of recourse that could be pursued.
359.
by jjnoakes 5y ago
> And there are no legal ramifications or manners of recourse/restitution. I'd appreciate a source on that... Both seem unlikely to me. More difficult perhaps, but impossible you say?
360.
by jjnoakes 5y ago
Non-interactive in this context, I think, means Alice does something and then Bob verifies it (perhaps with some piece in the middle that both Alice and Bob observe) but there is no back-and-forth, only that single one-directional flow of i

More ›