moyix

33 ms·

331.
by moyix 8y ago
Yep, as I mention in this thread ( https://twitter.com/moyix/status/1025393125567737857 ) indistinguishability is the hardest missing piece! You're right that you could try to do some kind of profiling and come
332.
by moyix 8y ago
Yep, there are plenty of applications where crashing is a big deal! But, we think, also plenty where that's not an issue. Note also that the "unused" strategy creates bugs that don't cause crashes (but they could be dete
333.
by moyix 8y ago
This is why the bugs are made non-exploitable by construction rather than by doing a bunch of work to show they're non-exploitable. There's an information asymmetry at work: the injector can craft all bugs in such a way as to en
334.
by moyix 8y ago
I don't know anyone who's done it (it's still a bit too expensive for me to give it a shot) but it appears to be a fairly standard saliva sample kit that you mail in. Yes compared to HDD it's way too expensive to read. H
335.
by moyix 8y ago
> still costs ~1000USD to read the ~ 1Gigabyte human genome This piece is dropping fast though; Dante Labs will currently do it (with 30X coverage) for individuals for $500 [1]. And I believe the price for labs that do a lot of sequencin
336.
by moyix 8y ago
This is correct. Specifically, there's a category of tool called "dynamic binary translators" (including Pin, DynamoRIO, Valgrind, and QEMU) that translate binary code one block at a time, just before it's executed.
337.
Nature journal retracts controversial CRISPR collateral damage paper(retractionwatch.com)
6 points by moyix 9y ago|0 comments
338.
by moyix 9y ago
Perhaps the link could be changed to a news article rather than the Facebook page? For example: http://www.zdnet.com/article/adrian-lamo-hacker-dies/
339.
by moyix 9y ago
That's to replicate the study; presumably if the authors released their trained model it would be much less computationally expensive to run it on your own data?
340.
by moyix 9y ago
Like many traits, height is a mix of genetic and environmental factors. Based on things like twin studies, we know that 60-80% of the variation in height is due to genetic factors [1]. This paper shows that you can predict height from genet
341.
by moyix 9y ago
I don't really see any obvious trend in this graph over the last 13 years: https://www.cdc.gov/flu/professionals/vaccination/effectiven...
342.
by moyix 9y ago
One of my Italian professors from undergrad, Marcello Simonetta, also cracked a 500 year-old code. He found an encrypted letter [1] sent by Federico da Montefeltro, the Duke of Urbino, that showed he had helped orchestrate the Pazzi conspir
343.
by moyix 9y ago
Last I checked, QEMU does not run multiple cores concurrently. Similar to Python, it has a big lock that serializes execution (known as the "Big QEMU Lock", or BQL). So you should not expect speedups... However, there is an effort
344.
by moyix 9y ago
I don't know, but a quick google search finds: https://github.com/bztsrc/qemu-raspi3
345.
by moyix 9y ago
Also (and I know you know this, pm215) you can actually emulate a Raspberry Pi 2 machine (i.e. the bcm2836 SoC) in recent versions of QEMU with the "raspi2" machine type. There are instructions that worked for me here: https:&#x2
346.
by moyix 9y ago
A friend and I wrote a paper about techniques for doing this a while back (never formally published; it was just a class project). My favorite technique for avoiding automated scan environments was to show goatse.cx and then run your code i
347.
by moyix 9y ago
It's interesting to pair this with Adrian Sampson's (an academic who works on hardware architecture) thoughts, particularly his musings about other vectors: > The second thing is that it’s not just about speculation. We now liv
348.
by moyix 9y ago
> It wasn't until the late 1990s (as far as I can tell) that anyone made the leap from covert channels --- which have cooperating agents on either end of the channel --- to side channels, in which the transmitter is unwitting. In th
349.
by moyix 9y ago
There's a twitter thread where some cryptographers speculate on the possibility. The upshot is that it doesn't seem like it will be possible: https://twitter.com/bascule/status/948725249842937857
350.
by moyix 9y ago
As the article says, rushing through a change this large with a performance penalty just to fix KASLR is very unlikely. KASLR is a fairly weak protection that has been broken many times (particularly on Windows – and yet Windows is still ro
351.
by moyix 9y ago
This is a consequence of the PCP theorem, right? https://en.wikipedia.org/wiki/MAX-3SAT#Theorem_1_(inapproxim...
352.
by moyix 9y ago
Stuart Russell is also a proponent of the idea. You'd be hard-pressed to say he's not technical.
353.
by moyix 9y ago
Sure, someone could post a paper like this anonymously. But anonymous papers don't benefit from all the incentives of the standard academic publishing system. As a fun aside, here's an example of one of the few fully anonymous pap
354.
by moyix 9y ago
DeWitt clauses have spread outside of databases too, unfortunately. John Regehr got a nastygram from Coverity/Synopsys when he tried to post static analyzer benchmarks (not even his own; the benchmarks were done by researchers at the T
355.
by moyix 9y ago
FYI, Bargh (the author of this editorial) has been pushing these sorts of priming effects for a long time. Many of these (most famously the "priming people with elderly-related words makes them walk slower" study) have not held up
356.
by moyix 9y ago
Honestly, I doubt that most of these sorts of algorithms would survive concerted attacks – that's why they tend to be closely guarded. Alex Stamos (Facebook's CISO) implies this is why they can't do it client-side: https:&#x
357.
by moyix 9y ago
From the fine article: "We store the photo hash—not the photo—to prevent someone from uploading the photo in the future. If someone tries to upload the image to our platform, like all photos on Facebook, it is run through a database of
358.
by moyix 9y ago
The fact that something was redacted, and where, is included in the proof. So it shouldn't be a problem as long as the verifier takes this into account. A simple thing to do would be to discard any messages with unexpected readactions
359.
by moyix 9y ago
How does that get you non-repudiation? If (e.g.) the NYT decides they want to change the content later, couldn't they just change the content checksum as well? Maybe by checksum you mean a digital signature? I think I'm still not
360.
by moyix 9y ago
It's not possible to do this purely client side (how could it be? If the client can compute it on their own then they can forge it on their own), so a server/protocol modification is inevitable. I'm think what you're say

More ›