mbrubeck

33 ms·

241.
by mbrubeck 11y ago
Rust also has macros, which can easily be defined next to their use: http://doc.rust-lang.org/book/macros.html Syntax extensions are more like plugins for the Rust compiler.
242.
by mbrubeck 11y ago
The fix, for anyone who is curious: https://github.com/servo/servo/pull/5936
243.
by mbrubeck 11y ago
Did you build with optimizations enabled ( ./mach build --release )?
244.
by mbrubeck 11y ago
I think Retric's point was that private companies are supposed to make fighter jets, but they often fail to produce usable results. See the now-decade-old F-35 program for the latest example.
245.
by mbrubeck 11y ago
Another related step from the Chromium developers: https://groups.google.com/a/chromium.org/forum/#!topic/blink...
246.
by mbrubeck 11y ago
In the attack described here: http://media.hacking-lab.com/scs3/scs3_pdf/SCS3_2011_Capkun.... the attacker has two devices communicating by radio. Device A is near the keyfob, and device B is near the car. Each
247.
by mbrubeck 11y ago
Yep - here's a presentation on these relay/repeater attacks by some researchers who actually build some: http://media.hacking-lab.com/scs3/scs3_pdf/SCS3_2011_Capkun....
248.
by mbrubeck 11y ago
Theoretically you could use quantum key distribution, but in practice this usually requires a fiber-optic connection. https://en.wikipedia.org/wiki/Quantum_key_distribution Edit: Nope, I am wrong, as the comments below
249.
by mbrubeck 12y ago
My sympathy; this is a tough situation and you don't deserve to be in it. Some words of hope: In a surprisingly short time, you will be able to look back at this with some much-needed distance. You'll have moved on to better thin
250.
by mbrubeck 12y ago
The New York Times article links to scientific studies on the long-term effects of marijuana use, measuring factors like memory loss. ("Lose 20% of my intelligence" is not supported by any of those studies, though.)
251.
by mbrubeck 12y ago
These were already against the guidelines: > Please don't submit comments complaining that a submission is inappropriate for the site. https://news.ycombinator.com/newsguidelines.html
252.
by mbrubeck 12y ago
https://news.ycombinator.com/item?id=9317002
253.
by mbrubeck 12y ago
In this example the dichotomy is between String (which is guaranteed by the type system to be valid UTF-8) and OsStr (which might be in an unknown encoding or otherwise not decodable to valid Unicode). This is exactly when you want a system
254.
by mbrubeck 12y ago
As recently as a year ago, even "google chrome" turned up an adware ad as the first "result" in a Google search: https://twitter.com/mbrubeck/status/459715935272566784
255.
by mbrubeck 12y ago
This has been around for a while; it was previously called Firefox.html and was discussed here: https://news.ycombinator.com/item?id=8730903
256.
by mbrubeck 12y ago
There are trust metrics for web-of-trust systems that are resistant to attackers who can create unlimited dummy identities that trust each other. For example: http://www.advogato.org/trust-metric.html
257.
by mbrubeck 12y ago
Using the scheme above, a password of "a" would result in a hash H('a' ^ x ) where x is the first byte of the secret salt. The attacker can simply test all possible values of x (there are only 256) to determine the
258.
by mbrubeck 12y ago
(And more importantly in practice, the implementations of these algorithms aren't designed to keep the salts secret.)
259.
by mbrubeck 12y ago
> At worst case scenario you've literally added no security at all with the pepper. Yes, I think this is the most likely failure mode (though not necessarily the only one - crypto can fail in very suprising ways!). But even this is
260.
by mbrubeck 12y ago
PBKDFs like bcrypt assume the salt is a random value that is not re-used and is not required to be secret. You are re-using part of it, and require that it is secret. That's the worrying part, and it's one of the reasons that
261.
by mbrubeck 12y ago
> 2) It's not abusing the algorithm, it's using a longer salt (in the concatenation case). But PBKDFs like bcrypt and scrypt are not designed to keep the salt parameter secret; in fact they assume the attacker knows the salt.
262.
by mbrubeck 12y ago
From your blog: hashed_password = scrypt(password, salt + pepper) store(hashed_password, salt) Why aren't you storing the (N, r, p) parameters too? Is it because your library's "scrypt" function automat
263.
by mbrubeck 12y ago
I've already seen one person in this thread taking "S+P" literally, and suggesting `bcrypt(cost, salt + pepper, password)`, which has a very obvious and critical problem. Other "peppering" schemes in the comments
264.
by mbrubeck 12y ago
> bcrypt(password, salt+pepper) I hope it's obvious that no one should never do this, since the output would contain the "salt+pepper" bits in cleartext alongside the hash, defeating the entire point of the "pepper&qu
265.
by mbrubeck 12y ago
Careful. If an attacker is ever able to observe the output for a very short password - one byte, say - then only one byte of your secret salt is used, and the attacker could begin brute-forcing the secret salt starting with the first byte.
266.
by mbrubeck 12y ago
Yes. Most importantly it uses WebGL, which isn't available on any versions of IE before IE11: http://caniuse.com/#feat=webgl List of officially-supported browsers: http://developer.playcanvas.com/en&#x2
267.
by mbrubeck 12y ago
Mozilla's own web sites and services (like www.mozilla.org) are written with Python/Django, making Mozilla a significant user/contributor in the Python web ecosystem: https://wiki.mozilla.org/Webdev/GetIn
268.
by mbrubeck 12y ago
All the major browser vendors (except maybe Apple) are doing similar things, like https://docs.webplatform.org/wiki/Beginners (created by MS/Google/Opera) and http://www.html5rocks.com/ (run
269.
by mbrubeck 12y ago
Salts aren't meant to be secret; they are generally stored next to the hashes (and used in a known, standard way). The purpose of the salt is to raise the cost of brute-force attacks, by forcing attackers to brute-force each password
270.
by mbrubeck 12y ago
DOM events do form an inheritance hierarchy. For example, TouchEvent and MouseEvent both inherit from UIEvent. But for compatibility reasons, we can't make arbitrary changes to legacy APIs. So rather than, say, change MouseEvent to b

More ›