jlebar

61 ms·

601.
by jlebar 12y ago
To be specific, if you can create an arbitrary primage for sha256, you could pwn all digital signatures that sign a sha256 of the message. So in particular, you'd own all TLS connections and certs that use sha256.
602.
by jlebar 12y ago
To be clear, I was totally making up this proposal; I wasn't aware that there was a spec. Nothing should be read into the fact that I used "hash" and they use "integrity".
603.
by jlebar 12y ago
The issue is that, if jquery.org can plausibly be hacked, then jquery's CDN can presumably also plausibly be hacked. This would allow an attacker to serve whatever she wanted to any page which used this CDN, even pages protected with
604.
by jlebar 12y ago
Huh! That looks awesome. :)
605.
by jlebar 12y ago
IMO this highlights the need for hash-verified script tags: <script src="https://jquery.com/whatever.js" hash="sha256,deadbeef..."> The browser would refuse to load the script if its hash didn
606.
by jlebar 12y ago
> Corporations get taxed ~15% + 14% hotel tax. Individuals > get taxed ~30% already on their Airbnb income Greatly simplifying things: (Big) corporations in the US get taxed 15%, and then when they pay dividends to shareholders, that
607.
by jlebar 12y ago
I think the issue is that "female" can refer to any species, whereas "woman" refers only to humans. So when someone obliquely refers to women and someone responds "oh, you're talking about females!", the
608.
by jlebar 12y ago
> Haptic feedback? Agreed, awesome idea, but no reason it can't be on my phone and buzz my leg instead of my wrist. It's frequently lost upon this crowd (I'm guilty of this myself) that half of the population in the West f
609.
by jlebar 12y ago
As another commenter has said, Firefox doesn't use Rhino. Here's the relevant code in Firefox's JS engine. http://dxr.mozilla.org/mozilla-central/source/js/src/jsmath....
610.
by jlebar 12y ago
> What would happen if the Chinese took the same attitude with nuclear power? I'd bet it would be pretty calamitous, as you imply. I can't say I'm comfortable with the idea. However, would it kill 300,000 people every yea
611.
by jlebar 12y ago
What people don't think about, because it's not an acute disaster like a nuclear accident, is that coal power plants kill a /lot/ of people. According to this article, coal power in China killed 300,000 people last year,
612.
by jlebar 12y ago
If you're interested in these sorts of micro-optimizations, you may find Mozilla's nsTArray (essentially std::vector) interesting. One of its unusual design decisions is that the array's length and capacity is stored next to
613.
by jlebar 12y ago
> There's no reason for a stack that is (linux kernel + > android hal + web runtime) to require more resources than > (linux kernel + android hal + dalvik and a java toolkit). Correct, but likewise there's no good reaso
614.
by jlebar 12y ago
Boldness aside, this sentence struck me: > I have confidence in our approach of mobile-first, cloud- > first, and in our primary innovation emphasis on platforms > and productivity and the building of capability in devices > a
615.
by jlebar 12y ago
Thanks for the reply! > When your friend makes their measurement of particle B, they entangle > themselves with it in the same way. So when you meet up with your friend, > your wavefunctions are in (anti)phase; the universe as a
616.
by jlebar 12y ago
If I understand this correctly, this proof is used to exclude one of the two given explanations for the "Kochen-Specker Paradox"? The article says the KS "paradox" implies that either > 1. Each measurement of a partic
617.
by jlebar 12y ago
SaaS: Science as a Service.
618.
by jlebar 12y ago
> I don't know how people's desires can be "wasteful". In a world where people paid for the true cost of their energy use, this argument might fly. But in most of the world today, this isn't the case, not by a l
619.
by jlebar 12y ago
> Liberal economists support reducing or eliminating the corporate income tax if you offset it with drastically higher personal income tax on wealthy people along with an elimination of the capital gains tax rate, and you prevent corpora
620.
by jlebar 12y ago
There is a broad consensus among liberal and conservative economists that a corporate tax rate above zero is a dumb idea. It is irksome that some large corporations pay basically zero and others don't, but the ideal solution isn't
621.
by jlebar 12y ago
> JSON does all the things Transit does, with fewer types. (And less stupidity) I really hate comments like this. These guys took the time to show the world this thing they created to fill a need they had, and this comment takes a dump o
622.
by jlebar 12y ago
I thought Han Unification meant that (most of the common) CJK characters were represented by the same Unicode code points, and that the way to differentiate like this is by specifying metadata that indicates the "language". Obviou
623.
by jlebar 12y ago
> no one has yet, it appears, made the <video> element work for this use case. 4chan has, and it's significant not only because they have a lot of traffic, but also because their implementation has to be pretty solid -- 4chan
624.
by jlebar 12y ago
Before everyone gets up in arms about Mozilla not working on this: As I wrote the last time this came up, deterministic builds are a nice thing, but they're only a small piece of the puzzle of protecting users from the state-sponsored
625.
by jlebar 12y ago
FWIW I think the sieve is a great example. Fibonacci is trite and a toy, whereas this is nontrivial and shows off a lot of what's powerful about Haskell (infinite lists, list comprehensions, pattern matching with cons...). It's c
626.
by jlebar 12y ago
This isn't a fundamental problem with the idea here, but one thing I don't like is that it makes hashcash.io a point of failure in your form submission. If the site goes down, either you can fail open (spammers get to comment) or
627.
by jlebar 12y ago
If you are powerful enough to MITM arbitrary sites on a user's machine, you can do /much/ better than get users to solve captchas. At the very least, you can replace all ads on the Web with ads you make money from. And/
628.
by jlebar 12y ago
> Do you count the number of lines or characters before you move? I think most people use commands like f) (move to to the next ')' on the current line) more often than something like 12k (move twelve chars to the right), becau
629.
by jlebar 12y ago
This a thousand times. I'm not accusing these guys of being dishonest, but we know that the three-letter organizations do this sort of thing, both with and without the knowledge of web hosts. It seems like these guys (and anyone else w
630.
by jlebar 12y ago
> If it were unlimited music streaming, that'd be pretty much fine. To be fair, it's unclear how you'd actually implement this. Would you suggest a special bit on the TCP packet saying "this is for music streaming&quo

More ›