ngneer

25 ms·

331.
by ngneer 7y ago
For perspective, RPC was invented in the 50s and 60s.
332.
by ngneer 7y ago
You beat me to it. Sounds like you would be opening yourself up to a variant of CSRF. One user could upload untrusted data that would be fed into an unsuspecting user. You should never feed or consume an untrusted pickle.
333.
by ngneer 7y ago
Second that. And yet, the B2C asymmetry was and is there regardless of whether one is "forced" to relinquish control over part of their machine. The current attestation models are an extension of the power imbalance. Intel, being
334.
by ngneer 7y ago
Agreed about the evil of DRM and treacherous computing, but do not conflate the shift in trust to a remote party with the attestation mechanism itself, which can be neutral. The idea behind attestation is that hardware signs a quote regardi
335.
by ngneer 7y ago
Intel cannot manage your machine remotely with AMT. Your IT department can. See Black Hat talk on ME for details. https://i.blackhat.com/USA-19/Wednesday/us-19-Hasarfaty-Behi...
336.
by ngneer 7y ago
I think we are on the same page. I was referring to the specific SGX implementation that relied on existing processor infrastructure, and you are making the argument that no system can be secure that is built on a faulty implementation. No
337.
by ngneer 7y ago
You just made their list.
338.
by ngneer 7y ago
Right, but side channels in Intel products were known. It is unreasonable to expect the literature to account for every single aspect of your design. Had the side channel threat been taken more seriously at the time, it would presumably hav
339.
by ngneer 7y ago
What is correctly? You have to understand that SGX was built on an existing infrastructure, without rebuilding the chip. Intel architects ignored side channels for years. So the security specification was being met, except it had ignored a
340.
by ngneer 7y ago
Coming at it from a different and lay angle, could a cure be devised that would be even more contageous, spreading around fast and eliminating the virus?
341.
by ngneer 7y ago
Costner would be pleased...
342.
by ngneer 7y ago
Interesting point. How would you plot the likelihood of infection?
343.
by ngneer 7y ago
This was on HN several days ago, is it a double post?
344.
by ngneer 7y ago
Not sure I understand the significance of a last digit of 9 for a prime implying the next prime is likelier to end with a 1 and not a 9. After all, base 10 is arbitrary. Can someone explain whether similar such "conspiracies" occu
345.
by ngneer 7y ago
Speaking of Shannon, unless we were the intended recipient, wouldn't an advanced civilization protect the transmission, so that we would not be able to eavesdrop and/or interpret it?
346.
by ngneer 7y ago
More secure, because a single home is, on average, not a lucrative target.
347.
by ngneer 7y ago
Not an expert, but $100K claimed by the owner seems rather much. A third party assessment would be good to procure. Given the touted popularity, cost would be amortized, too. Maybe the owner derived what they had hoped out of the business.
348.
by ngneer 7y ago
Thank you. Apparently, the stockholders agree with my assessment.
349.
by ngneer 7y ago
When the market rewards secure design, you can make that complaint. Since the market does not reward secure design, expect investments in security to be commensurate. You cannot have it both ways.
350.
by ngneer 7y ago
You are dealing with two separate feedback mechanisms. One allows the creation of revenue via consumer purchases. That is the quantity companies hope to increase, and limiting a consumer to authorized components allows for higher margins by
351.
by ngneer 7y ago
Sister bar is da best :)
352.
by ngneer 7y ago
I want the same for pianos :)
353.
by ngneer 7y ago
This may be the single most important information security problem worth solving on our planet. This is not about who gets to see the latest movie at what resolution, it is about vendors and farmers fighting for control of the plant, in thi
354.
by ngneer 7y ago
Great post. A well distilled argument as to the perceived virtues of open hardware and the actual root of the trust problem. The post strikes a great balance between showing the problem of complexity and yet highlighting a feasible step in
355.
by ngneer 7y ago
So true. The Spectre and Meltdown flaws have nothing to do with the abstract machine that a processor implements. You might as well claim that the vulnerabilities are the result of the ISA (which itself was born to smooth over differences a
356.
by ngneer 7y ago
I said nothing of the sort. Only that the manner in which the security expert commented on their practices came off high and mighty. Knowing how to secure a system is not enough, knowing how to get there matters.
357.
by ngneer 7y ago
Interviews should be personalized. That they are conducted en masse with little consideration for applicant background is an artifact of the difficulty of adequate personalization. Targeted ads are valued precisely because they are targeted
358.
by ngneer 7y ago
The original tech report is from 2008. Anything newer?
359.
by ngneer 7y ago
How arrogant to comment that these hospital systems should have been secured by now, given that WannaCry has hit hospitals in the past couple of years. Shows a lack of understanding of the economics of security. I agree with the point made
360.
by ngneer 7y ago
Wow. Incredible to see the new heights of complexity that the von Neumann architecture has led to. Corruption of data leading to corruption of control leading to control flow guarantees through the addition of cryptography. Wow.

More ›