staticassertion

363 ms·

1. 4471.▲
   by staticassertion 9y ago

   What power, specifically, are you missing in extensions?
2. 4472.▲
   by staticassertion 9y ago

   Seems like something that should be mentioned in the README. Users of this library, by default, are vulnerable. I'm not sold on the 'race a goroutine' solution either, but I'm not much of a Go programmer.
3. 4473.▲
   by staticassertion 9y ago

   Nothing seems to state that it isn't vulnerable to timing attacks. Everything seems to be. That's unsurprising, since it's all pure go.
4. 4474.▲
   by staticassertion 9y ago

   Did a quick ctrl + F in the readme to look for how they handle timing attacks in Go. As this is a pure Go implementation, I'm curious - how are these attacks mitigated, or is that left to consumers of the library?
5. 4475.▲
   by staticassertion 9y ago

   What if they actually were inspired by one of them? Why not give some background and context to a crowd that may not be familiar with various icons?
6. 4476.▲
   by staticassertion 9y ago

   This is silly. Your argument is still "It's a bottle therefor stop making a big deal about it" - it's someone's job to care about it. They explain the problem they set out to solve, how they solved it, a background
7. 4477.▲
   by staticassertion 9y ago

   Ever since that paper was linked to on Ars everyone thinks ASLR is done for. ASLR was always vulnerable to cache timing attacks. ASLR can not protect you in the case that you can arbitrarily compute on the target machine - this is not new,
8. 4478.▲
   by staticassertion 9y ago

   DEP isn't relevant. If you're compiling your own kernel this is a completely viable security technique. Where it fails is in distros. AFAIK most linux distros do something similar (based on Grsecurity patches) but it's useles
9. 4479.▲
   by staticassertion 9y ago

   I agree. This comes up a lot when discussion C/C++ - is it the compiler's fault, the developers, etc? The reality is it's irrelevant. Rust-the-language is safe but no one uses rust-the-language they use rustc. The end result
10. 4480.▲
    by staticassertion 9y ago

    Yes, and I really want to read the actual pdf :(
11. 4481.▲
    by staticassertion 9y ago

    Transactions.
12. 4482.▲
    by staticassertion 9y ago

    Yes, exactly. Thanks very much. Do you know if Facebook/ Youtube are still in PHP / Python?
13. 4483.▲
    by staticassertion 9y ago

    Can you source some of these? Genuinely curious.
14. 4484.▲
    by staticassertion 9y ago

    I don't really know a thing about that sort of network, but if you can assume a reliable network, the machine reading the packets going down shouldn't matter. The sender won't get an "ACK", will know the other machi
15. 4485.▲
    by staticassertion 9y ago

    Take a lesson - always write parsers in C and then execute them as root, and be sure to send as much malicious content to them as possible. Bonus points for hooking it up to the internet.
16. 4486.▲
    by staticassertion 9y ago

    Good points! I also appreciated your writeup on this class of attacks.
17. 4487.▲
    by staticassertion 9y ago

    > Generally speaking if a attacker has an account on your system you are already hosed. Keep in mind that software is moving towards a sandboxed world, especially with containers. Local attack surface is becoming increasingly valuable.
18. 4488.▲
    by staticassertion 9y ago

    Take note of the Grsecurity section. We already have the technology necessary to mitigate or significantly reduce the impact of these vulnerabilities. Solid writeup.
19. 4489.▲
    by staticassertion 9y ago

    Totally. There are multiple known soundness issues with rust already. Still, the language is definitely miles ahead when it comes to safety (within its niche).
20. 4490.▲
    by staticassertion 9y ago

    Rust has no top level concurrency model. The standard library provides an abstraction over OS threads, and that's about as much as there is. The ownership model is sort of concurrency-model-agnostic. Currently the popular Rust concurre
21. 4491.▲
    by staticassertion 9y ago

    I think what's interesting about this is that the one on the right looks ridiculous and complicated. At some point a human being has to know how to use it, and rather than a trivial interface, it's a complex one. Many would likely
22. 4492.▲
    by staticassertion 9y ago

    > On the gripping hand, it's also yet another bit to differentiate me from everyone else, and expecting polite and ethical behavior from advertising corporations probably really is doomed to failure. Yeah, I considered bringing this
23. 4493.▲
    by staticassertion 9y ago

    P is a really cool language, and I've been keeping an eye on it. Unfortunately, the documentation has been pretty perpetually out of date, and the language is still a moving target. So you can't just "get started" in P,
24. 4494.▲
    by staticassertion 9y ago

    I think you're putting too much blame on Microsoft here. DNT was always garbage, the fact that as soon as anyone used it (it becoming default for IE being the push in this case) it would fall apart just shows that it was always doomed.
25. 4495.▲
    by staticassertion 9y ago

    > Rust made an explicit design decision to make unsafe the default You mean 'safe the default'.
26. 4496.▲
    by staticassertion 9y ago

    Using browser supported methods should be more efficient. Content security policy (what's used in ublock) means requests don't even get made, and the browser 'knows' this, whereas if your DNS just keeps getting blocked y
27. 4497.▲
    by staticassertion 9y ago

    Literally nonsense. But, in fact, totally representative of the crazy lengths people go to to justify why Tavis's tweet that he found ~a vulnerability~ is somehow dangerous.
28. 4498.▲
    by staticassertion 9y ago

    You could look at SMACK TLS as a few dozen examples of implementation specific features due solely to the complexity of representing TLS state machines. These aren't protocol weaknesses, they're weaknesses in the implementation du
29. 4499.▲
    by staticassertion 9y ago

    And Soylent can be fine for those things. It's simple to see that it's faster than cooking a meal. Does that mean you'll spend that time better? No. It's simple to see that your calories are measured out for you - does t
30. 4500.▲
    by staticassertion 9y ago

    > You can't really ship all of the grsec, because some compile time settings break userspace apps. Other options disable things you want on laptops, like power management registers. Basically your need to opt-in to grsec and you ne