ngneer

17 ms·

151.
by ngneer 2y ago
I have worked in critical infrastructure and am familiar with SCADA systems. US power infrastructure is relatively distributed and privatized, rendering cybersecurity collaboration and compliance efforts difficult. There are no shortcuts to
152.
by ngneer 2y ago
Yes. We feel this pain all the time in the realm of security. Main problem is the incentives are backwards. You would not pay your municipality to dump garbage on your lot, you pay them to take it away. And yet IT shops go for complex gadg
153.
by ngneer 2y ago
I think there are special cases, like Yao's millionaire problem, where you compute a simple predicate to compare two numbers. I do not know whether such a notion will save you much, though. Because as soon as you can compute a simple i
154.
by ngneer 2y ago
https://clin.larvol.com/all-data
155.
by ngneer 2y ago
Must be difficult debugging a system with a 45 hour round trip each step of the way. And here I thought debugging a system on customer premises was tough. Hats off!
156.
by ngneer 3y ago
That is just one view, namely the authors' view. You may wish to consider recent perfect 10 vulnerabilities for comparison, as these are far more likely to cause problems.
157.
by ngneer 3y ago
No. As a sober hardware security researcher, most exploited vulnerabilities that would affect an average person are far more mundane and mostly software driven.
158.
by ngneer 3y ago
True, but you are missing the point. A system is secure that acts in its user's best interests. In the case above, 2FA is not in the user's best interest, as defined by the user.
159.
by ngneer 3y ago
Great quote. Nice to have memory tagging to help with the debug process these days. Not surprising to see these mistakes being made about 50 years later, as the fundamentals have not changed. Doing the same thing and expecting different res
160.
by ngneer 3y ago
I am new to control theory, since it was not taught in CS curriculum. Other than reading Maxwell's On Governors and Norbert Wiener to get a sense of the history, there is a lot to explore. I have recently been working with ControlSyste
161.
by ngneer 3y ago
The Moon is a Harsh Mistress
162.
by ngneer 3y ago
Logical compartmentalization like you suggest is a fine approach, but even better is to not allow physical access. Unless the car is in maintenance mode at the shop, the chassis should be sealed tight. Maybe the manufacturer decided to favo
163.
by ngneer 3y ago
Yes, the simplest solution sometimes really is the right one. Cheaply isolate sensitive targets from easily accessible areas. Your $5 solution is enough to avert these issues, and makes the attack a lot more expensive. The job is to find a
164.
by ngneer 3y ago
Allow me to offer a different opinion. There is little sense in applying logical security when physical security is lacking. CANBUS should not be accessible by taking apart headlights. Communication buses must be protected from physical acc
165.
by ngneer 3y ago
So, PUFs?
166.
by ngneer 3y ago
Okay. Phase 1 trial, you say. A couple more such items in the news this week. One new FDA approval after a Phase 2 study, and one publication in Nature on a study in mice. https://scitechdaily.com/scientists-engineer-human-t
167.
by ngneer 3y ago
The Inuit have come up with an innovative solution for a teaching kids to control anger in playful manner. YMMV. As to the original post, seems dubious at best. Succumbing to anger is simply punishing yourself for others' mistakes. Ang
168.
by ngneer 3y ago
Exactly!
169.
by ngneer 3y ago
Interesting perspective, but not enough for me to be sold. I never understood how one can be at work and expect to be enjoying lovely scenery at the same time. Those are mutually exclusive for me, especially when coding or hacking. My mind
170.
by ngneer 3y ago
Odds are against security. While it is natural to want to automate, programs have a hard time understanding and reasoning about other programs.
171.
by ngneer 3y ago
This is a good book. Themes therein are as relevant as ever.
172.
by ngneer 3y ago
I know. It was a hypothetical question. I cannot imagine an LLM reasoning well enough to perform security analysis. I made up the function, so no concern over intellectual property.
173.
by ngneer 3y ago
Great tool for visualizing complexity and dependencies. Entropy is the wrong term, though. For me (and likely many others) it conjures Shannon's seminal definition as an information measure. Entropy is a number.
174.
by ngneer 3y ago
I was not trying to state otherwise. It is just that there is such a massive body of work out there (e.g., on CSF or take your pick), that highlighting one discovery seems like a drop in the ocean without much context. You may as well point
175.
by ngneer 3y ago
Look no further on how to Elevate the Makeup Experience with AI: https://www.forbes.com/sites/forbestechcouncil/2023/11/17/ad...
176.
by ngneer 3y ago
Can you imagine a health news (HN) forum randomly posting links about computer science, software engineering and related topics?
177.
by ngneer 3y ago
I am fortunate to be in a field that AI has not caught up with. I interview security researchers. Would ChatGPT spot a vulnerability in a function it has never seen before?
178.
by ngneer 3y ago
Invent warp drive?
179.
by ngneer 3y ago
Keep Up the Good Work. I used to think ICs would grant the individuals in society more and more power, that could hopefully be leveraged to do some good (for a broad enough and sufficiently universal definition of good). What a shame to see
180.
by ngneer 3y ago
Okay. Sounds like your demand exceeds your supply. This bodes well for your candidates, whose skills are in demand. But you are also not paying infinity dollars for them, right? I was just stating that, all else being equal, if there are mo

More ›