nybble41

31 ms·

241.
by nybble41 5y ago
If your scenario involves reusing keys then what you are breaking is not a one-time pad. You're showing that if you implement something vaguely similar to OTP, but lacking the one element that makes OTP secure, it fails the IND-CCA2 ga
242.
by nybble41 5y ago
The NLE video editor function of Blender also gets good reviews. It can be used independently of the 3D modeling & rendering features. [0] https://www.blendernation.com/2020/08/30/video-editing-with-...
243.
by nybble41 5y ago
"Importing" in Darktable just means letting Darktable know where to find the RAWs. Copying them from the original location into a separate library is optional. If you routinely move the RAW files after working on them you may find
244.
by nybble41 5y ago
The irony is the good parts of "democracy" aren't actually the democratic bits at all, but rather a basic respect for civil liberties (a.k.a. natural laws) which are subject to neither democratic votes nor authoritarian decre
245.
by nybble41 5y ago
If the service wants to make sure the keys can't be copied then it will need remote attestation for either the whole system or just the TPM (what you called "key attestation") to ensure that the client isn't cheating.
246.
by nybble41 5y ago
> there's no reasonable expectation of privacy in a public space This is not a public space, it's a privately-owned Chromebook. It is not reasonable that merely accessing the school's (mandatory) web services from a priv
247.
by nybble41 5y ago
If you control the clients then there is no need to assert anything, truthful or otherwise. Go ahead and store the keys in a TPM if you want—the server has no reason to know or care about that. This does not require any key attestation.
248.
by nybble41 5y ago
One might use a smaller version as a space heater, rather than for primary heating. In that context it isn't really competing with heat pumps; space heaters are usually resistive. It looks like the same company still makes some product
249.
by nybble41 5y ago
> for some it's a form of charitable giving It would be four times as effective to just donate all of the lottery entry money directly to charity—and it wouldn't even measurably affect your chances of winning.
250.
by nybble41 5y ago
> in the absence of that it's legitimate for the issuer to assume that when the client asserts that a key was generated in hardware that it was telling the truth You want the credentials to be non-extractable. The client wants to ex
251.
by nybble41 5y ago
> key attestation (where you verify that the key was generated on a legitimate TPM) This is the same problem, just one level further down. The scheme depends on hardware acting against the desires of its owner—whether we're talking
252.
by nybble41 5y ago
Sounds like CPS is due for some major policy changes. Schools should not be teaching students that this sort of intrusive infringement of their privacy is something to be tolerated.
253.
by nybble41 5y ago
> In this situation, whichever account logged in first is the account that "owns" the session and has policies applied. So if you log in to your personal account first, and then into the corporate account, the corporate policie
254.
by nybble41 5y ago
> As a normal user, on a Windows box, if you log into say a corporate Microsoft 365 account with your corporate credentials that device may get managed by the domain (pending any admin approvals needed on the management end) in some fash
255.
by nybble41 5y ago
> Certainly you WANT the school district to do some filtering for the school accounts, right? a) No. Filtering (if there is any) should be limited to their own network or a school-issued device, not some device the school system doesn&#x
256.
by nybble41 5y ago
> they absolutely do need to disclose this stuff to the students In this case the student is not the owner of the Chromebook. They need to disclose this stuff to, and obtain consent from, the parents before taking control of the devi
257.
by nybble41 5y ago
Here it means "number used once". Jargon is context-sensitive that way—and we're discussing cryptography, not the UK's legal system.
258.
by nybble41 5y ago
> But mostly, the device simply deleting the tokens when the user clicks logout is good enough though. The issue with "simply deleting the tokens" is that this offers no way to force another device to log out. You can only lo
259.
by nybble41 5y ago
That approach requires remote attestation (or you can't trust the TPM / secure enclave), which is far too much to ask unless you actually own the device being used to access the service.
260.
by nybble41 5y ago
> an obvious weakness in the capitalist model... by inducing scarcity on something that is inherently NOT scarce Which is actually NOT part of the capitalist model at all, but rather social engineering (i.e. socialism) where the governme
261.
by nybble41 5y ago
Is this sarcasm, or did you just reply to the wrong comment? As an opt-in measure under the control of the user these changes are not unreasonable for certain security contexts, but to the extent that they prevent users from loading the mod
262.
by nybble41 5y ago
> e.g. by patching the kernel's text at runtime to remove the instructions Or simply by marking the module as GPL even when it isn't. There is plenty of precedent for stronger measures (like embedding a copyrighted & tradem
263.
by nybble41 5y ago
> I don't know about you but I pretty much never know the size of my data at compile time. Whole-program optimization (LTO) can deal with that. Also, Rust inlines across modules much more aggressively than C++ does, even without LTO
264.
by nybble41 5y ago
Part of the problem is that the multiply() function takes variable-size matrices as inputs and isn't inlined because it's declared as an external function and so could, in theory, be called from another compilation unit. If it&#x2
265.
by nybble41 5y ago
I agree with you there. All the data is right there, in fairly open (if not exactly standard ) formats. They even include an index document and basic descriptions of the data formats. One would think their competitors would want to make it
266.
by nybble41 5y ago
> You can’t un-screw a system by just telling the people inside who were selected for their mendacity and corruption to “make the right choices”. Of course not, but it's still the politicians (on both sides of the aisle) who are ult
267.
by nybble41 5y ago
> Like anyone else, politicians respond to incentives. Sure, but it's not like they don't have a choice. Regardless of any incentives, they're the only ones actually empowered to make these decisions. Lobbying, offers of b
268.
by nybble41 5y ago
> Is there a Nextcloud / Owncloud alternative to Docs / Sheets for collaborative editing? Yes, NextCloud and Owncloud both integrate with OnlyOffice Community Edition[0][1] which supports collaborative editing of text documents
269.
by nybble41 5y ago
> If they give you 30 days like OP, you have to remember all the different places you need to download content from. Google Takeout (takeout.google.com) should give you almost everything in one place. It's a good idea to do this per
270.
by nybble41 5y ago
Nepal is one at UTC+05:45, but there are also Eucla in West Australia at UTC+08:45 and the Chatham Islands at UTC+12:45.

More ›