ngneer

25 ms·

301.
by ngneer 6y ago
Having been in security for 15-20 years or so, I can relate to other comments on the thread. The result is niche, impractical, templated, and, paper mill or no, does not advance the field in my mind. I wonder if the author learned anything
302.
by ngneer 6y ago
Could VMMs employ the approach for scheduling mutually trusting VMs on sibling hyperthreads?
303.
by ngneer 6y ago
VRs can be off chip (MBVR stands for motherboard VR) versus on chip (FIVR stands for fully integrated VR). In both cases, there exists a protocol called SVID that allows the processor to send voltage control commands. The MSR is merely the
304.
by ngneer 6y ago
Indeed. CLKSCREW is the progenitor of that work. Note that in the context of security, it only matters if undervolting can cross security boundaries. This was possible on Intel systems at the time of Plundervolt but has since been fixed.
305.
by ngneer 6y ago
Have they perhaps figured that part out? And suddenly the computer is "broken"? Count on me to do that when the time comes...
306.
by ngneer 6y ago
Not sure kicking butt is the right description. See Intel amicus brief describing how Qualcomm applied their No License No Chips NLNC policy, to shift profits to royalties such that Intel and others could not compete on price without sellin
307.
by ngneer 6y ago
Highly recommend "The Five Civilized Tribes" by Grant Foreman to better understand the period, as well as "A Traveler in Indian Territory" to add some color. The OHS or Oklahoma Historical Society has a wealth of informa
308.
by ngneer 6y ago
And security!
309.
by ngneer 6y ago
Yes, you may prove such a statement about a program. But you will not be able to prove that about the physical system where the program is running (assuming you want to run your program and not just reason about it as a mathematical object)
310.
by ngneer 6y ago
A lot of comments on this thread ponder the difference between logical and physical, between software and hardware bugs. There is absolutely no difference. As a kind reminder, computation is a physical process, period. Any proofs of correct
311.
by ngneer 6y ago
You can prove it in your model of the system, but you are limited to the model. If your model of the system is the same as the adversaries' then your security design may work. Of course, the real definition of security is financial. No
312.
by ngneer 6y ago
No, there is no difference. Locks and software implement or abide by control laws. In your analogy, if you give perfect software an input and it behaves as expected, then that is the same as walking up to a locked door, trying to open it an
313.
by ngneer 6y ago
I have used Graphviz successfully to communicate with other software engineers about non-trivial state machines in the program. Specifically, C# Stateless allows exporting DOT files. Does anyone know if graphing nested nodes has already bee
314.
by ngneer 6y ago
Maybe they need weaker encryption for the masses who pay nothing, like DES
315.
by ngneer 6y ago
Flexo vs. Bender
316.
by ngneer 6y ago
publicity stunt
317.
by ngneer 6y ago
The missing figure is how many hours those hackers spent. Most of the companies that were on HackerOne when last I checked are using the platform as a kind of a substitute for contracting with a pen test firm. Things like "will you bre
318.
by ngneer 6y ago
Though you are small and do not have an official chief privacy officer or CISO, do you have personnel that are champions of those desires? If not, nurture or acquire. If so, listen to them. This is 2020. If you look at Zoom, you can argue t
319.
by ngneer 6y ago
Please help me understand the point. Is it to show that nVidia chips can be used to create game AI using GANs? Or is it to aid in game design? Wouldn't a human be in a better position to do both?
320.
by ngneer 6y ago
Security is about control. Shame on the malware writers for having left a single point of failure.
321.
by ngneer 6y ago
I use Emacs and love it, but the problem as a newcomer is that basic questions never have basic answers. The answer is either in the form of a complex incantation, or requires one to come to grips with new abstractions.
322.
by ngneer 6y ago
I wish I had that kind of time and exploratory spirit on my hands. Good job!
323.
by ngneer 6y ago
I remember going in for an interview not knowing the salary range that would be on offer, but having at least an idea of my worth in the field. During the interview, right after explaining the benefit I could bring to the company, the most
324.
by ngneer 6y ago
I remember Frama-C for its slicing. I have recently become interested in Datalog driven approaches, such as Souffle, for static analysis of large codebases. Anyone with experience or thoughts along those lines?
325.
by ngneer 6y ago
I have used it, and it is quite flexible. However, it inevitably fell behind when newer instructions came out, and it is not very well maintained. I have submitted two issues (#398, #407) that have been open for a year with no comment...
326.
by ngneer 7y ago
NSO seems to be making an argument that arms dealers typically make. Perhaps they could point out real examples of defensive uses. Otherwise, enough. Hafsiku lehitamem.
327.
by ngneer 7y ago
Technology alone cannot solve the use of technology to promote interests of parties in a zero sum game.
328.
by ngneer 7y ago
For me, the desire to better understand the innards.
329.
by ngneer 7y ago
Great question. Things have gotten ridiculously complex. You might look into https://wiki.osdev.org/UEFI
330.
by ngneer 7y ago
von Neumann saw that code is data. Now what? We like the power of computation too much to give it up, and yet cannot avoid the pitfalls of complex interpreters. Compartmentalize though we may, control is not easy to tame.

More ›