ngneer

32 ms·

361.
by ngneer 7y ago
Same with security, unfortunately.
362.
by ngneer 7y ago
Not this. This is merely a configuration issue. Intel left an interface open that should not have been left open. A processor is a large distributed system and undervolting does not go well with secure computation.
363.
by ngneer 7y ago
KV is missing the point. The problem is not really with generating the documentation, so much as it is with the software engineer lacking understanding of what they are writing about, what the security processes should be. That is why the e
364.
by ngneer 7y ago
How does it compare to SGX?
365.
by ngneer 7y ago
As another example, you should never unpickle untrusted data. The machine for parsing pickles is too powerful. https://stackoverflow.com/questions/25353753/python-can-i-sa...
366.
by ngneer 7y ago
You raise a good point. The thing to realize is that the incoming packet data, like all data, is code. "Code written for which machine?" you might ask. Well, think of that data as code that is executed by the parser. If you think
367.
by ngneer 7y ago
https://xkcd.com/1354/ In Heartbleed the parser parsed an incoming field specifying length, but failed to correlate it with the rest of the request. Had the parser been written to a stricter specification, that would n
368.
by ngneer 7y ago
Yes, parsers for incoming packets and file formats, for example. If they are poorly written, you end up with Heartbleed, for example. I should maybe add that the LangSec folks try to provide formal footing for what an adversary can achieve
369.
by ngneer 7y ago
Mainly its contribution has been the linguistic study of bugs, and the recognition of the importance of well defined recognizers as opposed to shotgun parsers. That is the contribution to theory. In practice, people still write shotgun pars
370.
by ngneer 7y ago
Security is the study of control. LangSec and PL have their role to play, but, as others have noted, cannot be expected to guarantee security.
371.
by ngneer 7y ago
Thanks for sharing. A great reminder of the beauty of the field.
372.
by ngneer 7y ago
That is precisely my point. Differential privacy would NOT make any difference, and I was pointing the many folks who are working on it to the much simpler issues that are in fact being encountered in the field. This past IEEE S&P had q
373.
by ngneer 7y ago
Ugh. To whomever is currently wasting their time and effort on differential privacy, take a good long look.
374.
by ngneer 7y ago
A man in the middle attack can be avoided with mutual authentication. The fault lies with the companies that entrusted so much to a single individual.
375.
by ngneer 7y ago
Intel software development teams have to comply with internal legal process, meant to safeguard against that.
376.
by ngneer 7y ago
My wife tells me uefy does local storage. Worth checking out.
377.
by ngneer 7y ago
True. The market cannot reward what it cannot see.
378.
by ngneer 7y ago
The article reads like a brute force approach to secure design, sprinkling randomization everywhere. Performance results are promising, though.
379.
by ngneer 7y ago
Citation?
380.
by ngneer 7y ago
I wonder if the OP can comment on whether GoldMine ended up biasing their decision to hire in an unintended way. In hiring security researchers, we have been finding that a lengthy technical exercise is terrific to properly gauge applicant
381.
by ngneer 7y ago
This is 2019 and the security community has yet to deliver a proper solution to prevent the existence of such bugs. The mismatch between programmer intent and code behavior is appalling. Sure, super smart coders can avoid the bugs, much lik
382.
by ngneer 7y ago
Information security is about control, too. https://dl.acm.org/citation.cfm?id=2898379
383.
by ngneer 7y ago
I was wandering with a friend at night at the Weizmann and was curious to see the view from atop one of the buildings. The next thing we know, campus security is ordering us to come down, concerned we were there to liberate the animals. Ane
384.
by ngneer 7y ago
Took me a while to figure it out, but Varier balans by Peter Opsvik is the best for me. It is a bit pricey, at $400 or so, but well worth it in my mind. Already I have purchased three, one for home, one for the office, and one for my father
385.
by ngneer 7y ago
I remember studying this problem in the context of anonymity a few years back, defining immeasurability as the property whereby an adversary cannot distinguish between different node counts, for example. The tank problem is related to mark
386.
by ngneer 7y ago
ROI
387.
by ngneer 7y ago
Information asymmetry. I would humbly posit that this is one of the biggest challenges that the information security community has to tackle on the face of the planet, and it is not just a technological one. Farmers are at the mercy of equi
388.
by ngneer 8y ago
How come GPU instruction set architectures are relatively under-documented compared to x86? If anything, better results can be attained if more is known, https://research.google.com/pubs/archive/45226.pdf
389.
by ngneer 8y ago
Yes. These days gRPC is a new technology. And yet RPC has been around in one form or another since the 1960s.
390.
by ngneer 8y ago
I know people who did that via custom driver, it depends on sound card capabilities.

More ›