mentat

49 ms·

631.
by mentat 12y ago
That is what "comprehensible" means. That the intent of the communication can be understood.
632.
by mentat 12y ago
> That's true, but the market prices that kind of risk, and the market cares a lot about substitutes, and the typical developer taking basis points for their participation is eminently replaceable by other developers. If all you&#x2
633.
by mentat 12y ago
My understanding of the issues with P-256 is that it's very easy for mistakes in the ECC implementation around certain points to leak information whereas with other curves it is not. Not quite "backdoored" but certainly not o
634.
by mentat 12y ago
That depends on how the package is specified doesn't it? You can snapshot the full chain of versions with dpkg and explicitly specify them all. It should be too hard to wrap this into something like Gemfile.lock
635.
by mentat 12y ago
There are and have been real GPU HW bugs that this could be triggering. I just had my main logic board replaced twice due to these with a similar trigger.
636.
by mentat 12y ago
I can tell you they do. Within seconds of clicking on a compromised URL they had locked down my account requiring a text to unlock it. I was deeply impressed.
637.
by mentat 12y ago
It works because they aggressively monitor for session stealing attempts and immediately shut them down. So it's long lived but with an impressive amount of monitoring that really isn't within reach for non-Google companies.
638.
by mentat 12y ago
If you don't have a hardware bound key as part of the KDF then you will be subject to extraction and parallel breaking. It may take more computing power with scrypt but it will be doable. KDFs enforce round constraints relative to the
639.
by mentat 12y ago
I'm sorry but this doesn't make any sense. If you merely read the code for another open source implementation before implemented something totally different that shares a separate publicly documented configuration language it&#x27
640.
by mentat 12y ago
You can't make that claim without then undermining the licenses of many / most GNU software implementations, even say GCC.
641.
by mentat 12y ago
Which in turn is derived (on purpose) from the various sources as composed together by Joseph Campbell in "Hero with a Thousand Faces". Narrative is even more absurd to call duplicate than a totally new implementation in a differe
642.
by mentat 12y ago
A public documented configuration language is a far cry from the source code for the implementation.
643.
by mentat 12y ago
Thank you for being very explicit about that.
644.
by mentat 12y ago
The value of software development is the multiplicative application of innovation / creation. Security guarding will never have that (without adjacent technological innovation.)
645.
by mentat 12y ago
Because doing good cannot be made coherent with making money? Or that you have to optimize for one or the other? This seems quite limiting and contrary to human history as well.
646.
by mentat 12y ago
That is "in theory". In fact there have been region wide failures at the AWS services level, though none recently that I know of.
647.
by mentat 12y ago
Amazon's position on this is that you should be pulling from S3 for anything that's deploy critical. I tend to think they're right.
648.
by mentat 12y ago
GP is actually making a factual statement not just waving his hands around. Data at rest encryption doesn't matter if one can gain execution control with supervisor level privileges (or control another processor or part of the process
649.
by mentat 12y ago
I think this is also the case for vulnerabilities as well unfortunately.
650.
by mentat 12y ago
Very much so. I wasn't thinking through the library (and library equivalent) implications.
651.
by mentat 12y ago
It was the top comment when I made this one which was confusing.
652.
by mentat 12y ago
I don't understand how this is the most important thing one can say about this article. No remotely reasonable person would take this as an endorsement of feeding honey (or royal jelly) to an infant.
653.
by mentat 12y ago
PKCS11 and Hardware Security Modules (HSM) have been around for a long time. There's in wide use in companies like NetFlix and Square including "over the network". This is not new.
654.
by mentat 12y ago
Have you looked at this? http://howistart.org/posts/go/1
655.
by mentat 12y ago
Or one can just use the DHS to illegally coordinate crackdowns like they did for Occupy.
656.
by mentat 12y ago
Uber fare is supposed to include tip.
657.
by mentat 12y ago
A lot of money laundering was done by large US banks who were not held criminally responsible.
658.
by mentat 12y ago
So what the process for handling misclassification? http://cs.stanford.edu/people/karpathy/ilsvrc/val/ILSVRC2012... is definitely a grand piano not an upright which is the "official" answer. Ed
659.
by mentat 12y ago
This reads like the only reasons why jitneys were regulated was to protect entrenched interests of railways. That seems to not be a particularly good thing then or now.
660.
by mentat 12y ago
The lack of interconnect between Africa and South America is interesting. Wouldn't that be a better route with other transatlantic failures than moving to Pacific transit? Surveillance issue?

More ›