mehrdada

65 ms·

571.
by mehrdada 11y ago
This can happen only because of a design flaw in the security architecture of Android (L). Unlike iOS and like traditional PCs, the disk encryption key is always in memory when the device is booted and nothing is really protected if you ge
572.
by mehrdada 11y ago
Technically, having biased information can't be worse than having no information (i.e. you can choose to ignore it if you know it is biased and you can try figuring out how and in what direction it is biased). What's worse in this
573.
by mehrdada 11y ago
> assuming iOS/Windows Phone isn't an option Well, they are options. If one judges every alternative that might include the tiniest bit of inconvenience as "not an option", any try would be hopeless. In fact, I woul
574.
by mehrdada 11y ago
nit: all AES variants are 128-bit block ciphers, i.e. they transform 128-bit data blocks. AES-192 and AES-256 take 192-bit and 256-bit keys but still operate on 128-bit blocks. (Rijndael itself supports varying block sizes, but the AES stan
575.
by mehrdada 11y ago
Yes, I stand by what I said. AES (Rijndael) block cipher operates only on 128-bit blocks, not on data that's divisible by 16-bytes . This is an important distinction. Calling AES used in CTR/CBC/etc. mode without mentioning
576.
by mehrdada 11y ago
I have nothing against the author. I just don't think the text is a proper intro to cryptography and I also think it is dangerous for a noob to read this and go implement crypto. That being said, creating a programming language does no
577.
by mehrdada 11y ago
> as an example, imho, the _idea_ conveyed by "salting" is correct I agree, the idea is correct, but it is actually dangerous and incomplete. I know because admittedly, I had personally fucked up IVs and stuff a long time ago a
578.
by mehrdada 11y ago
It's hard to say. I did not read the whole thing, but red flags were glaring. I don't have anything against the author. In fact, I, myself, have implemented poor crypto based on (various levels at various times of) understanding i
579.
by mehrdada 11y ago
Please, please, please, do not implement any crypto after reading this. The simplistic explanation of symmetric encryption (talking about using "salts" to get distinct ciphertext each time to "make attacker's life more d
580.
by mehrdada 11y ago
Reference counting generally suffers from the cyclic reference problem, e.g. if you lose a reference to a doubly-linked-list, the entire data structure leaks and won't get freed. In Obj-C, this problem is tackled via manually annotatin
581.
by mehrdada 11y ago
I merely used automatic reference counting as one alternative automatic memory management technique. Rust, as I understand it, uses a similar alternative, which is, at least on paper, similar to enforcing a max refcount of one on pointers,
582.
by mehrdada 11y ago
I think the question is easier to answer if we view "garbage collection" as automatic memory management in general, rather than a more specific case of automatic memory management via a runtime task colloquially known as the garb
583.
by mehrdada 11y ago
My comment was targeting that particular statement and was not meant to be interpreted as a deficiency in this particular GC design, though if I were to comment about that , I have to say I remain a bit skeptical about how far you can effe
584.
by mehrdada 11y ago
> Today 16 gigabytes of RAM costs $100 and CPUs come with many cores, each with multiple hardware threads. In a decade this hardware will seem quaint. This is a potentially dangerous worldview. While it is true for the server/deskto
585.
by mehrdada 11y ago
> give them credit for prescience because the iPhone hadn't been announced yet Eric Schmidt was on the Apple board. I wonder how much credit goes to their prescience and how much of it goes to their inside knowledge of the facts.
586.
by mehrdada 11y ago
Ideally, you'd want them to use HTTPS to deliver the packages as well. However, I cut free software distribution some slack, because of massive distributed mirroring and delivery by a number of third parties. For Microsoft, it would be
587.
by mehrdada 11y ago
What if an exploit is found in the signed copy? Someone else can host the old version which is still signed and supply it to the user. Are they going to revoke the certificate used to sign it entirely?! Not using HTTPS is a sloppy security
588.
by mehrdada 11y ago
Well, the guarantee needs to be reasonable only as far as you and the courts are alive to sue them. (Corollary: you only need to sustain DDOS attacks when the rest of the internet infrastructure can sustain the traffic).
589.
by mehrdada 11y ago
It does prevent simple rainbow attacks, but it does not prevent a simple bruteforce of the common passwords. It can increase the cost a bit, but still in the realm of feasible. I am mainly trying to warn against the false sense of security.
590.
by mehrdada 11y ago
How so? Run bcrypt on 10000 most common password for each salt. Much easier than trying every password possible for each individual salt.
591.
by mehrdada 11y ago
I don't want to engage in legal interpretation of the contract here, but based on readings of my contract on my side, I feel like making a comment: > They only enforce non-compete if you actually go to a competitor (like rentech,
592.
by mehrdada 11y ago
(Misspelled, corrected.) "First right of refusal". I'm not sure if it is the right phrase in the context of IP assignment, but it was a good analogy to what they asked: basically they'd say whatever you'd invent in
593.
by mehrdada 11y ago
> you'll see lots of edges going from Goldman, Microsoft, Google, and Facebook to Two Sigma. There are very few edges going the other way. Perhaps one reason for it that they don't advertise is the ridiculous non-competes that
594.
by mehrdada 11y ago
> we can't solve the halting problem or verify program correctness We can't solve halting problem or verify program correctness for all programs . For a large subset of all programs, you are able to do both. This is a very imp
595.
by mehrdada 11y ago
FB wasn't his employer, yet. Actually, the moral of the story, as I see it, is these days you can upset whoever you want as long as you are a good engineer. He got another job; probably less boring than a random internship offered to h
596.
by mehrdada 11y ago
There's a more concrete, specific reason, than generic risk that you should consider and discount the stock price of the company you work for accordingly: it is less liquid for you relative to the market, because you cannot trade i
597.
by mehrdada 11y ago
> All combinations of 6 letters .com are taken. Do you mean this literally for any 6 random characters? It rings true for 4, but I believe you can easily find a 5 character domain name even now. In fact, I just registered three five char
598.
by mehrdada 11y ago
Securing Windows Server licenses might be trivial, but believe me, automatically managing an infrastructure consisting a cluster of Windows servers is a pain in the ass compared to its Linux/FreeBSD counterparts (Azure might have helpe
599.
by mehrdada 11y ago
> Dropbox has the most brilliant engineering team in the Valley. That's definitely been my impression having observed the company for years from outside and from interviewing there just a little while ago. Given their engineering ta
600.
by mehrdada 11y ago
The same problems apply to starting a startup later in your life though. I personally think navigating the degree game with those problems is easier than navigating a startup with them.

More ›