mirashii

38 ms·

481.
by mirashii 12y ago
You should seriously consider trying a language with a more complete and robust type system that is checked at compile time. If you like the fact that these kind of corner cases can be logged, imagine if you can find them before you ever hi
482.
by mirashii 12y ago
Perhaps it doesn't in the antitrust case, but in the context of a response to a comment with false statements implying the opposite, it does.
483.
by mirashii 12y ago
It's less irrelevant when the OP used the particular phasing of "mandates", which is quite hyperbolic and doesn't actually forward the discussion, thus the corrections.
484.
by mirashii 12y ago
> and that Google mandates the browser be Chrome and the search be Google for all Chrome web browsers (largest desktop market share) and Android devices (largest mobile market share) No, they don't. You're free to use any brows
485.
by mirashii 12y ago
First, I think the main link should probably be to the WSJ publication, instead of this Fortune one which offers even less detail and analysis. Second, I think it's incredibly shameful to be so damned misleading as the WSJ was with the
486.
by mirashii 12y ago
Steam has in-home sharing, which is the same idea but PC games. It's actually pretty nice letting the desktop in the other room do the heavy lifting/run windows and playing some of the games on a laptop. I haven't tried any l
487.
by mirashii 12y ago
No link to the journal article, and absolutely no real content in the awful summary. Consider finding a better news outlet than dailymail.
488.
by mirashii 12y ago
Also known as: test whether or not you have f.lux on.
489.
by mirashii 12y ago
I think that there's pretty little that can be done in terms of infrastructure improvements to the internet that will really help. We have more than enough bandwidth to stream these things at full resolution, but latency will always be
490.
by mirashii 12y ago
Looks like a fun class. Anyone know if the wargames are opensourced anywhere, and if there's any other class material not mentioned on the site?
491.
by mirashii 12y ago
> It prevents your computer from loading undesired piece of JavaScript in case of a MITM attack. Only if the site you were visiting was over HTTPS, which it was not in the Github attack. Saying that you should remove this certificate if
492.
by mirashii 12y ago
The man on the side they're performing, according to analysis, seems to be letting the initial SYN through to the original server, you get the SYN-ACK back from the actual Baidu server. Then after your ACK and HTTP GET, the other packe
493.
by mirashii 12y ago
You can really only use a method like this to say where a server is not (it can't be halfway around the world because the speed of light limits it), but this is assuming you're communicating directly with the server. The method us
494.
by mirashii 12y ago
> don't want your computers to be used as part of the DDoS like we've seen against GitHub. Let's not conflate two mostly unrelated things here. Removing this root certificate does nothing to stop this attack against Github
495.
by mirashii 12y ago
The details on the shutdown are pretty spare. While the cloud market is perhaps still a bit immature, there are obviously many companies, both venture-backed and not, who are making plenty of money today. With a client list like they advert
496.
by mirashii 12y ago
I think you've misunderstood the nature of the attack. It's not Baidu or any other site that's being redirected to Github. A Baidu analytics javascript file is being replaced with a malicious file which loads Github via an AJ
497.
by mirashii 12y ago
I think it's one thing to say "Where and how you can apply these we can discuss in more detail later, but for now assume that you can do x, y, and z only" and another to omit details altogether to later correct (if corrected
498.
by mirashii 12y ago
These sorts of fundamentals are glossed over or not mentioned throughout, though. For instance, both in and after the section on integration, the fact that \int (f+g) = \int f + \int g. No explanation or limitation is placed on that informa
499.
by mirashii 12y ago
While, like most people here, anything that claims to disrupt the textbook industry gets me excited on instinct, even a cursory glance shows some major issues with this that leaves me questioning whether someone who hasn't taken these
500.
by mirashii 12y ago
Honestly, if you start by saying you're not well versed, how can you confidently make a statement about whether it is possible or not? Large scale DDOSes are usually the most damaging when they're high bandwidth (Layer 7 attacks c
501.
by mirashii 12y ago
Nullifying DDOS doesn't take ingenuity, it takes a big wallet, which Github no doubt has, but let's not pretend that its some engineering feat. If it was, a small company being ddosed would have a chance at fending it off all the
502.
by mirashii 12y ago
A per-user salt doesn't prevent brute forcing bad passwords. The purpose of a per-user salt is to prevent brute forcing all of the passwords simultaneously. Without it, you could just hash a password once and check against all the pass
503.
by mirashii 12y ago
There isn't a work factor high enough or password complexity high enough that it doesn't justify a reset, in my opinion. People will use bad passwords, and we can't really stop that. Allowing offline attacks against them will
504.
by mirashii 12y ago
And thus why we have Yubikeys and other hardware tokens.
505.
by mirashii 12y ago
Is there some reason that you don't just hash the whole column or table though? It does everything you described, except also makes even the bcrypted passwords available in the event of a db dump. It just seems like a half-measure wher
506.
by mirashii 12y ago
Out of curiosity, does anyone know if this is a common action by judges, or something out of the ordinary?
507.
by mirashii 12y ago
Certainly storing your key with an HSM is superior and protects against a slightly large class of attacks, but in terms of getting the same protection as salt+pepper was designed for (limiting the damage of a DB-only compromise), encryption
508.
by mirashii 12y ago
Because it's harder to implement and easier to mess up than using standard encryption, and has unknown characteristics due to the fact that it's rolling your own crypto. Why would you spend the time and effort to implement it when
509.
by mirashii 12y ago
Not at all. "don't roll your own crypto" is a downside that can lead to things completely falling apart or weakening the system overall. The real downside is that there's a better, proven way to do the same effective thi
510.
by mirashii 12y ago
Surprisingly, they didn't force a password reset on all accounts. Even though the passwords are hashed and salted, targeting a couple users and checking for weak passwords can now be done offline, with no rate-limiting or network calls

More ›