romaniv

81 ms·

751.
by romaniv 14y ago
Other languages need to work on making application deployment easier. Often, you can deploy a PHP app without ever opening a terminal. Heck, some hosters didn't even give you access to a terminal.
752.
by romaniv 14y ago
Good point. And it's not just availability, it's privacy and security too. When a service like that becomes popular, it can easily be used by tracking people online. It can also be a lucrative target for attacks, since the impact will affec
753.
by romaniv 14y ago
You need an RSA token for each server you talk to as well. It's not a replacement for asymmetric cryptography.
754.
by romaniv 14y ago
I think the motivation behind RSA tokens is that while you can steal them, you shouldn't be able to silently copy one. That's not something you get with an OTP on a USB stick, unless you invest into tamper-proof hardware. Aside from that, I
755.
by romaniv 14y ago
If anything, prices went up. Asus MyPal (a relatively high-end PDA) was around $400 when I bought it. That is cheaper than modern high-end phones and roughly equal to the prices of mid-level phones. The laptop I'm writing this from costs ar
756.
by romaniv 14y ago
Good point, but why label those as "attempts"? A decade ago PDAs were pretty good devices with decent amount of free apps and an interesting range of possibilities. (For one, they were extensible via cards. Something that's not available in
757.
by romaniv 14y ago
I wouldn't mind at all if Gmail was a traditional multipage app that works without JavaScript. Google Maps is probably a much better example.
758.
by romaniv 14y ago
The way it's commonly implemented, two-factor authentication is definitely not "a step in the right direction". Two-factor authentication using phone numbers is a huge privacy breach, especially when you're dealing with websites that have n
759.
by romaniv 14y ago
Looking at downvotes on the parent post. I am bothered by the fact that participants of similar security discussion so easily downvote or lash out against any questions or ideas that diverge from their favorite mainstream. Seems like a co
760.
by romaniv 14y ago
So here is a question that I've asked and received no good answer. Why size of the salt doesn't matter? Wouldn't salt be used in every hash computation? Wouldn't large (megabytes) salt slow down this computation and require more memory to p
761.
by romaniv 14y ago
Theoretically and even practically, MD5 has other issues. It susceptible to collisions: http://www.mscs.dal.ca/~selinger/md5collision/
762.
by romaniv 14y ago
First, I do not advocate anything here. I asked a question. Second, working with a large string of bits is the same as recursive hashing only if you can pre-compute some small intermediate state of the hash function for that string independ
763.
by romaniv 14y ago
1MB of data will have 16384 SHA 256 blocks. So that's roughly the slowdown I would expect, minus the time it takes to initialize the algorithm for a particular message. That's not that interesting by itself, but it is interesting to think a
764.
by romaniv 14y ago
Computing a hash on 1MB of data is slower than computing a hash of 6-8 bytes of data. Brute-force attacks are based on trying different passwords and seeing that after being salted they generate the same hash as in the database. Therefore
765.
by romaniv 14y ago
It's not an in-depth answer. It does not say, for example, why bcrypt is more secure than nested SHA1. (I believe it has to do with the possibility to efficiently implement SHA algorithms in GPUs.) People are using unsalted SHA1, because so
766.
by romaniv 14y ago
We're speaking about a very specific attack here: bruteforce. And I'm speaking about a very specific type of "salt" (which could probably be called something else, since it's not the same as normal unique-per-password salt): large, database
767.
by romaniv 14y ago
128 bytes is not "large". I was thinking more along the lines of megabyte+. There is no question that it will slow down hash computations, because you would need to process more data. The question is, can you efficiently parallellize this
768.
by romaniv 14y ago
Let's forget about bcrypt for a second. What prevents developers from adding a large DB-wide salt (in addition to normal salt) to every password? Wouldn't that prevent bruteforce attacks regardless of the hashing algorithm?
769.
by romaniv 14y ago
I wonder, why do people saying "just use bcrypt" never, ever bother to elaborate on what benefits it has, and which of them are relevant to the subject of the conversation? Believing in some function without understanding implications of
770.
by romaniv 14y ago
Most advanced visual programming systems I'm familiar with can't be properly read or manupulated by anyone except even tinier minority of people who specialize on working with the particular system.
771.
by romaniv 14y ago
That's exactly what I'm talking about. "Pleasing users" is often used as an excuse for horrible internal design. People cite examples like ls and proceed to conclude that the Unix philosophy is a concept of abstract philosophy not applicabl
772.
by romaniv 14y ago
It’s a lot easier to maintain an orthogonal design when your software isn’t being used. Mentally, I'm translating this to "it's okay to have messy design if your software is used". This is probably the most common excuse for writing bad s
773.
by romaniv 14y ago
It was a peer-to-peer network. Would they sue every single person for sharing with every other person, over and over again? (E.g. if there are 10 nodes, would every one be sued for sharing 9 copies?) That doesn't make much sense.
774.
by romaniv 14y ago
I downloaded half of the Ghosts album from NiN, linked it and then bought the physical album. Not exactly the same, but maybe that's how it should work. Release 50-80% of the work for free. People will download it from you, because you're
775.
by romaniv 14y ago
Set theory is hard science. On the other hand, a grapevine of stored procedures with no code reuse beyond copy-paste aren't any kind of science. I'm not even sure they are any kind of engineering.
776.
by romaniv 14y ago
if you come for money you better show them respect Okay, so he didn't. What are they going to do? Complain about it? Anyway, ethics is about what people should do. If you switch to discussing what people can get away with because of power
777.
by romaniv 14y ago
Knobs are the primary interface in many DAWs because their developers copy hardware interfaces without too much thought. They translate to computer interfaces very poorly. The main advantage of a hardware knob (over slider) is that you have
778.
by romaniv 14y ago
Sounds like "it kind of worked so far, so let's use it forever, with multiple layers of band-aids if necessary". Besides, unles I'm missing something, the two protocols can be used side-by-side, I.e. you can slowly phase one out by the othe
779.
by romaniv 14y ago
Shouldn't there be mathematically solid probabilistic solution? Start at 50% certainty, increase it with every positive message, decrease it with every unit of time. Stop when you're close to 100% or 0%.
780.
by romaniv 15y ago
To the best of my knowledge, stuff like PEX is new outside of academic environments. Moreover, it's highly non-trivial. Here is a collection of other interesting projects from their research department: http://rise4fun.com/

More ›