just-ok

15 ms·

121.
by just-ok 6y ago
This is a great post, expressing thoughts that have been brewing in my mind much better than I could. I couldn't agree more with the fundamental thesis that 280 characters cannot lead to meaningful discourse as your exposure to differe
122.
by just-ok 6y ago
> Advertising companies ignore it because they're not legally obliged to honor it. Ironically enough, they don't ignore it. They instead just use it as another bit of entropy to differentiate you from everyone else who doesn&
123.
by just-ok 6y ago
Sure, I'll bite. Even though I take issue with all of these as they're more-or-less a form of lying, these two stand out: > selling goods with a high markup is scummy > selling cheap goods with a high markup is scummy Th
124.
by just-ok 6y ago
I have definitely personally seen many instances in which you get a discount paying in cash in California. Maybe they get away with it because they technically frame it as charging extra for paying with a card?
125.
by just-ok 6y ago
As another example, if you’ve ever used Google Maps on iOS, you know how absolutely neutered it is if you don’t log in with your Google account.
126.
by just-ok 6y ago
Ideally, we’d be able to differentiate between local parsing (which I’d deem acceptable) and a remote request, but that quickly enters a gray area. How long after parsing do we validate a request? Is it even viable for a compiler to track t
127.
by just-ok 6y ago
Not only that, but this also works! a, *b, c = (1, 2, 3, 4) a == 1, b == [2, 3], c == 4
128.
by just-ok 6y ago
That's all well and good, but as a privacy-conscious user I still want to (a) know about it and (b) be able to control/disable it.
129.
by just-ok 6y ago
Yep, mental exhaustion is undoubtedly a thing! I'd love to see how heart rates change with something like test question difficulty. Since sweat is generally a product of heat and occurs when your heart works harder during exercise, I w
130.
by just-ok 6y ago
Which only works if haven’t hit any in-page anchor links ;) otherwise, you’d snap right back to a particular section after a refresh.
131.
by just-ok 6y ago
> low power consumption Hmm, well the visual cortex makes up almost a third of our entire brain, and the brain uses ~20% of our daily energy. I’d hardly call that “low power”! Though granted I don’t imagine you can break a sweat just fro
132.
by just-ok 6y ago
This is basically because (one of?) the only times our eyes don’t do saccades is when they’re tracking motion. In other words, you can’t move your eyes smoothly unless you’re following something (like prey or a finger). In this case, you’re
133.
by just-ok 6y ago
You absolutely can, but this leads directly to vonquant’s point (and antris’ follow-up)[1]: without the source, how far do you trust Facebook to not just pull a UI trick? It’s paranoia all the way down ;) [1]: https://news.ycombi
134.
by just-ok 6y ago
Well the crux of E2EE is authenticity, so yes. Key distribution is a fundamental problem of public-key cryptography: you can’t get my public, authentic identity key without trusting someone to not tamper with it along the way. We implicitly
135.
by just-ok 6y ago
This is an awesome write-up; I’m shocked at the level of effort that went into Snap’s obfuscation process. It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing
136.
by just-ok 6y ago
> What's the term for encryption that a middle man cannot decrypt? I don't know if there's a term, but short of exchanging public keys in person there will always be a theoretical attack vector because there's always
137.
by just-ok 6y ago
Don't forget the human element: users still have actually do the verifying (e.g. checking public key fingerprints of recipients) that the source code enables!
138.
by just-ok 6y ago
Yep! Absolutely true, and one of the reasons why Encrypt-then-MAC is the only generic composition method scheme that always provides certain security properties (specifically, security against chosen-ciphertext attacks given that the &quo
139.
by just-ok 6y ago
> The Diffie–Hellman exchange by itself does not provide authentication of the communicating parties and is thus vulnerable to a man-in-the-middle attack. [1] Whoever controls key distribution can control the encryption channel; witho
140.
by just-ok 6y ago
Any centralized E2EE service has the (public) keys; that's the only way to distribute them to users. You have to trust (or verify, in the case of Signal) them to deliver authentic keys rather than MitM'ing you.
141.
by just-ok 6y ago
This could be the case for literally any E2EE service that controls key distribution (including WhatsApp, Signal, etc.), especially when there's no way to verify key fingerprints (here Signal differs because it does have a way, and i
142.
by just-ok 6y ago
> A good MAC algorithm doesn't leak anything about the plaintext. Though this may be true for specific MAC algorithms, it's a very dangerous and incorrect assumption to hold in general. MACs are designed for integrity and n