rudolf0

43 ms·

361.
by rudolf0 12y ago
Look into OpenResty ( http://openresty.org ). I'd also recommend Lapis ( http://leafo.net/lapis/ ), which provides a Rails-ish MVC framework over OpenResty.
362.
by rudolf0 12y ago
The plausibility of a vulnerability in AES which reduces the search space by more than half of the key bits is essentially 0.
363.
by rudolf0 12y ago
It's sad to see so many applications use SHA1/SHA256 when they really need to be using HMAC-SHA1/HMAC-SHA256.
364.
by rudolf0 12y ago
That seems ridiculous for 2 reasons. First, ciphertext is ciphertext. They'd probably be able to determine it's a block cipher and what the block size is, but that's about it. They're not going to be able to tell AES cip
365.
by rudolf0 12y ago
Yes.
366.
by rudolf0 12y ago
Exactly. And if the first cipher is a secure cipher, with no obvious sign it'll be broken any time soon (like AES), why not just use it instead of wrapping it over some homebrew solution?
367.
by rudolf0 12y ago
Can't agree with you more, both for refactoring code and editing prose. I find it also sometimes helps to perform the revisions while in a somewhat altered state of mind (be it mood, setting, music, minor inebriation, or otherwise). It
368.
by rudolf0 12y ago
Theoretically, what do you think would happen to the Bitcoin market if their entire hot and cold wallet were stolen at once? Would the value crash to the tens of dollars? I'm not sure the thieves would be able to significantly profit o
369.
by rudolf0 12y ago
The way I see it: the NSA is a necessary evil in many ways, and not all of their activities are unethical. I have no problem with the leaking of documents regarding domestic surveillance or breaches into private companies in allied nations;
370.
by rudolf0 12y ago
It's pretty amazing how detailed and helpful Rust's error messages are. rust_dangling.rs:6:5: 6:6 error: cannot borrow `v` as mutable because it is also borrowed as immutable rust_dangling.rs:6 v.push(6);
371.
by rudolf0 12y ago
The complexity and intensity of this kind of "metagaming" in sandbox-style MMOs can become absolutely mind-bending. I was "head of intelligence" for a large player organization in an open MMORPG similar to EVE. Our organ
372.
by rudolf0 12y ago
>Snapchat also benefits from a close relationship with Google, which hosts Snapchat’s operations on its cloud. Snapchat is now the biggest customer of Google App Engine, and will be for the foreseeable future. That's interesting, I
373.
by rudolf0 12y ago
Communist is one thing, but I can't imagine anyone having any sympathy for a self-identified Stalinist. Would this article have painted him in the same light if he said "National Socialist" instead of "Stalinist"?
374.
by rudolf0 12y ago
"Don't be evil" still sometimes holds true. :)
375.
by rudolf0 12y ago
I understand, but I think medical technology is inevitably moving in the direction of some degree of consistent self-testing and monitoring, and I expect small biopsies of suspicious masses will eventually be implemented in a way that cause
376.
by rudolf0 12y ago
This is a good writeup, but is anyone else getting really sick of the term "silver bullet"? I have been seeing it everywhere since 2013, and the "there's no silver bullet!" truism is growing very trite very quickly.
377.
by rudolf0 12y ago
If this technology came with a feature to easily biopsy all the growths and tumors, and send them to a lab, do you think it would be beneficial then?
378.
by rudolf0 12y ago
I've never had any issue with dry eyes. I started taking fish oil (algae oil actually, but the active ingredients are identical) a month before my LASIK surgery and continue to take it today, and I've still never had any problems
379.
by rudolf0 12y ago
There's a slight difference. Even in the 20s, I believe there was a proposed mechanism of action for X-rays to emit harmful ionizing radiation. Has there been any alleged mechanism of action for how ALA and EPA may cause harm?
380.
by rudolf0 12y ago
I am well aware of that misuse, as I've exploited it during a CTF before. :) I would consider using the raw byte-output version of a function a very blatant example of "improper implementation". Also, I agree regarding encryp
381.
by rudolf0 12y ago
I suspect they were just interested in interrogating Gwern for what he knew about some of the market operators and various schemes related to them. It's possible they might've planned to use some of his drug purchases and position
382.
by rudolf0 12y ago
Yes, but you at least have the money and resources available to have better security. If you choose to squander those resources and not dedicate a large enough budget to your security department, that's your fault. Small companies typi
383.
by rudolf0 12y ago
I would argue that while crypto most certainly works that way (use only when definitively proven), security in general is a bit more lax in terms of requirements. Despite hashes being cryptographic primitives, user password hashing is less
384.
by rudolf0 12y ago
A properly implemented, simple pepper can only help password security and can't hurt it. Obviously you first must be using a good, slow algorithm (bcrypt, scrypt, or PBKDF2 with high work factor), but a pepper will only help you. (Le
385.
by rudolf0 12y ago
You have to look at it from a regulatory and compliance standpoint. While I agree from a technical standpoint that the average company's data is probably going to be safer at Slack than in some internal system, the accountability risk
386.
by rudolf0 12y ago
Not sure why you're being downvoted. Every bcrypt implementation I've seen always adds a salt as part of the algorithm itself.
387.
by rudolf0 12y ago
If you're small, cloud may be better, but if you're large it often isn't.
388.
by rudolf0 12y ago
The default cost for most libraries and languages is between 10 and 12, which is considered too low for 2015 but still pretty good. As long as they're at the default or above it, I wouldn't be too concerned about an attack against
389.
by rudolf0 12y ago
It's refreshing to 1) see a breach notification including the actual password hashing algorithm, 2) see they're using a strong one like bcrypt (presumably with a reasonable cost factor). Regardless, this is an example of why cloud
390.
by rudolf0 12y ago
This article doesn't seem to mention that penetration testing in general is a booming business, and there are many firms out there with the same success rate. Neither Mitnick nor his company are special in any way.

More ›