jjnoakes

55 ms·

601.
by jjnoakes 8y ago
It doesn't have to be negative to get downvotes. Sometimes irrelevant discussion items are downvoted to keep them in the periphery.
602.
by jjnoakes 8y ago
So that when you make a mistake, instead of random memory corruption, you get a leak or a slower GC cycle.
603.
by jjnoakes 8y ago
Even if you try to separate what each 'this' refers to, there is still only one sentence, so the sentence becomes meaningless if you do that.
604.
by jjnoakes 8y ago
You should look at the actual code, not the abbreviated snippet in the post. The actual code puts values in those variables. And the jre initializes variables to zero, not undefined values (unrelated to the post but a correction to your com
605.
by jjnoakes 8y ago
I'm stupid when it comes to this stuff. But how would that work if the traders making the profits withdrew their profits? You can't claw it back after the money leaves your accounts... right?
606.
by jjnoakes 8y ago
I disagree with "no practical difference" (since I demonstrated one), and layered approaches to security are usually encouraged, not dismissed as "bad engineering". Regardless, I will keep this 2FA difference in mind goi
607.
by jjnoakes 8y ago
Let's say a service you still use loses a database backup from 2 years ago, and they don't realize it was lost. Scenario 1: The service stored passwords in some way and TOTP seeds in the database and uses TOTP to authenticate user
608.
by jjnoakes 8y ago
Looks like SQRL is aiming higher than just 2FA, they try to be the entire login process. Thanks for the link, but not sure it's quite what I'm looking for.
609.
by jjnoakes 8y ago
Since TOTP seeds are long-term shared-secrets which are all that is needed to complete 2FA, and rarely/never rotated unless someone knows they were compromised, even years-old database compromises (old backups, etc) means current TOTP
610.
by jjnoakes 8y ago
If you don't know of the database compromise (which could have been a backup or old dump, and not necessarily a live system breach), you may be "owned", but unless the TOTP seeds (or equivalent 2FA master keys) are in that db
611.
by jjnoakes 8y ago
If you know of the database compromise, sure. If your database contents are exposed (or a dump or backup is exposed) unbeknownst to you, those TOTP secrets won't be invalidated, and attackers which get their hands on that have more tha
612.
by jjnoakes 8y ago
TOTP has a downside when compared to SMS as well. In cases where server security was breached and databases (or database backups or dumps) were accessed, if the TOTP seeds were part of the database (not sure how likely that is, but I'm
613.
by jjnoakes 8y ago
I am not on any side in this battle, but the issue was closed only once, and after users disagreed with the author's reasoning for why it behaved the way it did, the author fixed it the same day it was closed... Doesn't seem as ba
614.
by jjnoakes 8y ago
I'm surprised they think they can close speculative leaks with more hardware. I'm no expert but I can imagine side channels based on timing (for example, if you can force a speculative path to do X amount of work if some secret bi
615.
by jjnoakes 8y ago
If the alternative is buying a new car instead, leasing is no different. If your situation changes and you'll go over the lease mileage, buy it out instead. If the alternative is buying a used car, then leasing is definitely different,
616.
by jjnoakes 8y ago
The difference between 123k and 500k is ~4x, not ~20x, no?
617.
by jjnoakes 8y ago
Digging is addressed by the article.
618.
by jjnoakes 8y ago
I tend to need checklists while I'm away from my computer, and would prefer something quicker on a phone than opening a text editor.
619.
by jjnoakes 8y ago
Sure it does. Write out the example with both orders of assignments (convert it to single assignments only) and run it both ways.
620.
by jjnoakes 8y ago
Right, comparisons with < and > are UB, but I'm talking about ==, which is well-defined. It's hard to tell which operator "tzahola" was originally talking about, but I took "comparing the address" in this
621.
by jjnoakes 8y ago
"Not meaningful" and "undefined behavior" have very different meanings. I agree it's not meaningful, but the standard does define the result of comparing pointers to two unrelated objects with "==", so it&
622.
by jjnoakes 8y ago
> Comparing the addresses of stack variables is undefined behaviour Can you elaborate? I don't think this is true.
623.
by jjnoakes 8y ago
Yeah, I've written such a thing many times as well, in languages like Go which make it easy and languages like C which make it not-as-easy and a few in between. I was more curious if there was a cleaner C++ way of doing it with all of
624.
by jjnoakes 8y ago
It's a shame the parallel recursive file size sum example reads all of the file and directory names into memory first, and then iterates over them in parallel after. A clean concise version of the same example, in a stream-like but sti
625.
by jjnoakes 8y ago
Right, I addressed that in my post...
626.
by jjnoakes 8y ago
I mean 1 dec == 1 unit (1x1^0) 2 dec == 11 unit (1x1^0 + 1x1^1) 3 dec == 111 unit (1x1^0 + 1x1^1 + 1x1^2) etc. Just like the other bases, with "1" instead of "2" or "10". Well, maybe not "
627.
by jjnoakes 8y ago
> binary, the most fundamental number system I think base 1 is a little more fundamental than base 2, no?
628.
by jjnoakes 8y ago
The Linux kernel won't, but most shells happily will. echo 'ls' > test.sh chmod +x test.sh ./test.sh # Works just fine, no header and since the C library routine "system()" executes the co
629.
by jjnoakes 8y ago
I'd love to play with Flutter but issues like this keep me at arm's length. Hopefully when this kind of thing is finally resolved I'll be able to give it a closer look. https://github.com/flutter/flutter&
630.
by jjnoakes 8y ago
The flip side is one has to use a Nim-specific search tool to find occurrences of an identifier.

More ›