josh2600

37 ms·

361.
by josh2600 7y ago
I was wrong, my engineer said that derangements are the answer to the convergence.
362.
by josh2600 7y ago
Ok, I talked to the engineer. I got it mostly right but everyone shoots to the right as soon as the lights go out. The question is "what's the probability you die?". Edit: You can also challenge people to think about the prob
363.
by josh2600 7y ago
Let's say that the project is a very large, somewhat famous public open source piece of software that has been coded on by many, many different people with different coding styles.
364.
by josh2600 7y ago
Yeah, adding a button to a codebase is an awful test. If someone made it to an onsite and you don’t know whether they can add a button in swift, something failed in your screening process. If you’re testing how someone navigates a codebase,
365.
by josh2600 7y ago
Someone on my team once asked an iOS engineer to add a button to a codebase during an onsite interview. That is actually a horrible test to complete in 45 minutes if the codebase is large (and particularly hard if it’s not super well mainta
366.
by josh2600 7y ago
The worst thing about heartbleed is that it introduced marketing into vulnerability disclosures :(.
367.
by josh2600 7y ago
Am I reading this right? It looks like this bug lets you read any part of an intel chip's processing payload in-flight? That's gnarly if true.
368.
by josh2600 7y ago
Also true of social security numbers, especially with the credit bureau hack.
369.
by josh2600 7y ago
I was musing philosophically. I know why Facebook is first and google isn’t on the chopping block. It’s because people don’t have the same relationship with google. No one is accusing google of colluding with foreign powers to sabotage demo
370.
by josh2600 7y ago
You are crazy if you think Facebook won't have much of an impact on the 2020 election... It's the ad targeting platform of choice for people who want to target specific demographics. Why wouldn't Facebook have a deep impact o
371.
by josh2600 7y ago
Is that really true about Asia considering that google was secretly working on a conformist search engine for Asia? Again, I think this is complicated.
372.
by josh2600 7y ago
I think I agree with you, but I also feel like a few missteps out of alignment with that narrative and google would be up for anti-trust conversation just like Facebook. I’m mostly musing about how your relationship with regulators has a lo
373.
by josh2600 7y ago
I have trouble understanding why we should break up Facebook but not google. Is it because we think google is less evil than Facebook?
374.
by josh2600 7y ago
Have you read the client code? How would you know? Just because the protocol is well-formed doesn’t mean the totality of the implementation is trustworthy. #ShowUsTheCode
375.
by josh2600 8y ago
The solution to tether existing is for the US government to release a fiat convertible cryptocurrency pegged to $1 with all of the compliance of traditional banking. Financial institutions would use it, the government could tax it, and all
376.
by josh2600 8y ago
It’s been a while since I’ve read a paper abstract that made me feel completely out of my depth. Can you give a little more context here?
377.
by josh2600 8y ago
https://www.crunchbase.com/organization/whisper-3 Whisper is trying to do this. It's a super hard problem space to work on (for a variety of reasons, most notably power constraints for in-ear/near-ear devices
378.
by josh2600 8y ago
... because https only protects the payload in flight, not at rest, and not the origin and destination ip. It depends on your threat model. Please don’t come back and tell me “oh but you can use a vpn”. We have yet to build a real vpn that
379.
by josh2600 8y ago
FYI, if you get service from a reseller on top of att, you’ll still have att level wait times for service outages since sonic will have to call att. In some areas your wait times will actually be longer because att deprioritizes support for
380.
by josh2600 8y ago
The openness of the code is always relevant to the security of the system. To pretend otherwise is dishonest. Good day.
381.
by josh2600 8y ago
Just to be clear, code running on a remote server is not code running in the client. Just because the server attests to the client doesn’t mean the client is running that code. You still have to do all of the threat modeling for the atteste
382.
by josh2600 8y ago
Just to be extra clear, the chances of someone lying to the NSA in a letter are really, really low. Given that we can compare the response to the NSA to what is expected and it matches, we can make some inferences that the software running
383.
by josh2600 8y ago
I see. I will include that disclaimer in all threads I comment on about Signal in the future. Thanks for explaining this to me. I've been a fan of Signal since it was RedPhone and TextSecure and my professional relationship with Moxie
384.
by josh2600 8y ago
Did you notice how you can compare the NSA letter to the source code and realize the effect is that they're the same? If you didn't have the NSA letter, would you be able to verify the source code? If another project got an NSA le
385.
by josh2600 8y ago
I have 0 control over the Signal project in any way shape or form. The fact that Moxie advises MobileCoin has nothing to do with his work at Signal. I can't force Moxie or anyone at Signal to do anything. Moxie and I have a close profe
386.
by josh2600 8y ago
I am going to say this one more time because I think it's a real point and I think you're dismissing it out of hand is unreasonable: there are things that can be learned from the server. It's one thing to tell people that you
387.
by josh2600 8y ago
The question boils down to "what can an attacker learn by owning the server" and right now you don't know. You can pretend that doesn't matter, but it's not inane or FUD. You have to model the whole system to unders
388.
by josh2600 8y ago
It would be great to audit all of the software running on all of the routers I use. I hope that we someday move to a model where all routers run open-source attestable software. Let me phrase this another way: if there's nothing to hid
389.
by josh2600 8y ago
You’re just pretending the server is outside of scope. In reality you have to consider the security model of the whole system. The server is not outside of scope.
390.
by josh2600 8y ago
As just one example, you have no idea what metadata logging the server is doing. This is just the surface.

More ›