ngneer

15 ms·

1. 211.▲
   by ngneer 3y ago

   Please do, it is an insightful comment. Complexity is the enemy of reliability, 100%. I wish engineers were better at resisting it. Sadly, many stars must align for complexity to decrease.
2. 212.▲
   by ngneer 3y ago

   "the leak of information related to server initial setup and configuration" How valuable can this be?
3. 213.▲
   by ngneer 3y ago

   This reminds me of optical TEMPEST work from early 2000s, but for network gear http://www.applied-math.org/optical_tempest.pdf
4. 214.▲
   by ngneer 3y ago

   This feels potentially a bit duplicitous. YouTube is filled with copyright infringing material, which Google capitalizes on to bring in viewers to ads. Granted, they have hosting costs. I wonder what the legal situation is for such instance
5. 215.▲
   by ngneer 3y ago

   Needing more training data seems wrong. Imagine the space of all programs. Can we agree that one can only train a model on a given subset of that space? Now, imagine wanting a program P that solves a particular problem, and that the program
6. 216.▲
   by ngneer 3y ago

   Ditto. What a terrible statement to open with. Not instilling me with a lot of confidence. Shannon's Maxim states that the enemy knows the system...
7. 217.▲
   by ngneer 3y ago

   This highlights subtly different thinking processes in the security industry. Real world adversaries think "this is an interesting asset, how can we get to it, with our available primitives?" whereas academic researchers think &qu
8. 218.▲
   by ngneer 3y ago

   I think it is less about a server fingerprinting a client and more about one website using broken browser isolation to fingerprint other websites being visited. In the example, they leak whether a pixel is black or white by scaling it to fi
9. 219.▲
   by ngneer 3y ago

   Ah, that we agree on!
10. 220.▲
    by ngneer 3y ago

    I really like your analysis, spot on. Including the viewpoint that a checklist is a human scoped form of redundancy, allowing us to build reliable systems out of unreliable components. While there is nothing that can force the human to chec
11. 221.▲
    by ngneer 3y ago

    There are a lot of poor quality products out there, and security products are no different. They too follow a distribution. I am not sure why the parent comment uses the second person. I too find security products to be a liability sometime
12. 222.▲
    by ngneer 3y ago

    I agree with you that an automatic default implementation is far better than leaving it to a human. I also agree with your examples on where and when it could be done. Lamentably, security is not free. Input sanitization is required because
13. 223.▲
    by ngneer 3y ago

    That is for sure a broken system. I would not feel comfortable telling users they are wrong, even if the numbers were 10 out of 1000 or less. But we might be talking about different things. I gave the example of developers building a hopefu
14. 224.▲
    by ngneer 3y ago

    Interesting viewpoint. I can see why it indicates the "correct" way is not easy or foolproof enough, but this is all it says. Ease of use is certainly an important aspect of design. I just think "not good enough" and &qu
15. 225.▲
    by ngneer 3y ago

    I agree, it is akin to requiring people to come up with high entropy passwords, another "brilliant" idea. However, the fact that there is no other choice and no magic language is what makes it a good example. Input sanitization is
16. 226.▲
    by ngneer 3y ago

    Presumably pilots know to do that? I absolutely agree that psychological acceptability is key for building secure systems, and that the human factor must not be neglected. I also agree that process and culture around security are deeply bro
17. 227.▲
    by ngneer 3y ago

    Exactly. HTML has structure. It is not the same as flat text, although you can flatten and edit it as such. As an example sentence, take the following: "The French equivalent for the English "Good Evening!" is "Bonsoir!&
18. 228.▲
    by ngneer 3y ago

    I was hoping to see an explanation for why the pattern is prevalent, but the author does not know. "One of my fundamental rules of system design is when people keep doing it wrong, the people are right and your system or idea is wrong.
19. 229.▲
    by ngneer 3y ago

    Are you working on P != NP? Jokes aside, this reminds me of working on a grad school thesis. I tend to find the biggest whiteboard (you can use any medium though) and lay out everything that is known and unknown about the problem. This help
20. 230.▲
    by ngneer 3y ago

    I would be curious to see what Shannon thought of this...
21. 231.▲
    by ngneer 3y ago

    I personally find the Sieve of Eratosthenes to be quite beautiful.
22. 232.▲
    by ngneer 3y ago

    The only thing growing faster than the number of transistors is the number of pages in the specification. Ditching legacy is a good thing.
23. 233.▲
    by ngneer 3y ago

    Sometimes those who have gotten on the bus will try pushing out those who have not. Since when do corporations invite regulation?
24. 234.▲
    by ngneer 3y ago

    Cool, thank you! Interesting about the encoding proximity for flows with shared microcode. I wonder if that simplified the decoder.
25. 235.▲
    by ngneer 3y ago

    Any insight into how CALL/RET opcodes were decided or why they are in different groups? Is it merely that these would have been free opcodes? Digging up some stack history: https://en.wikichip.org/wiki/intel/m
26. 236.▲
    by ngneer 3y ago

    Deep, no. Useful, yes, but very rarely, and the SNR is quite low. Inventory management is one example where a video can help avoid stupid mistakes. View it as supplementary documentation for cases where there is no product or admin guide.
27. 237.▲
    by ngneer 3y ago

    I hope Prolog makes a comeback! There are two Datalog based designs that are interesting for me at the moment. One is Biscuit for authorization tokens and the other is Souffle for static analysis. The latter defines an abstract machine to a
28. 238.▲
    by ngneer 3y ago

    I tend to agree with your analysis. But that is precisely my beef with the term. You seem to be saying that the term fits _because_ it describes a population that violates security expectation, _because_ it is "generally not smart, exc
29. 239.▲
    by ngneer 3y ago

    Right. I think the "they're fucked" threw me off, because "they" sounds impersonal, as though talking about others without having had the personal experience. However, that very phrase should have alerted me to the
30. 240.▲
    by ngneer 3y ago

    I am very sorry for your loss. This is clearly a sensitive and emotional subject for many, thus my comment. I did not mean to offend you, but can see that I have, and apologize for that. I should have known better. Thanks for sharing the li