thadt

10 ms·

121.
by thadt 2y ago
> With that definition, SQS, Kafka, and Sequin are all systems that guarantee exactly-once processing. The term processing captures both the delivery of the message and the successful acknowledgment of the message. This terminology confu
122.
by thadt 2y ago
Nah, mhio is saying that the blog post has a typo: > Postgres 13’s gen_random_uuid() which generates a V6 UUID that’s secure... gen_random_uuid gives you a version V4 UUID, not a V6 UUID (it's even in the code comments in the snippe
123.
by thadt 2y ago
Good work. But - this is an implementation bug right? If the underlying stream of packets gives you a distinguisher (in this case, slightly larger packets), then this attack works. So adjusting the chaff and payload packet sizes to some fix
124.
by thadt 2y ago
^ This. Physical media is continuously degrading. Large storage systems work by regularly reading, verifying, and replicating data - it is always doing backups and restores. If this isn't happening actively and regularly, your data wil
125.
by thadt 2y ago
Not that the image itself is particularly useful or descriptive (it's not), but because the review office is rather quite conservative when deciding what to release, and anything suggestive of a real device is usually right out. In thi
126.
by thadt 2y ago
Good news then, since the article is discussing the discovery of that exact feature.
127.
PQC for Non-Cryptographers(keymaterial.net)
1 points by thadt 2y ago|0 comments
128.
by thadt 2y ago
> Example applications of the Universal Protocol: > ...your smartphone can generate a cryptographically secure response to any query about your financial history or health, while keeping your underlying data private and in your own co
129.
by thadt 2y ago
Yes. Whatever else y'all PQC devs do, please just make this the standard. If some group wants to manage their seeds by Shamir horcruxing them into ASN.1 encoded shards etched into silver medallions worn under the cloaks of their hooded
130.
by thadt 2y ago
While sntrup761x25519-sha512 is a QC secure key exchange, sending a key over it doesn't count. It's not really a "pre-shared" key unless the sharing is done using organic, locally sourced sneakers. Unless FIPs, and the
131.
by thadt 2y ago
Strong pre-shared keys will continue to remain secure, even against a quantum computer. Wireguard, for example, provides the ability to add a pre-shared key for endpoints, which it mixes in during key exchange. Wireguard sessions collected
132.
by thadt 2y ago
Theoretically? Sure. By holding your response to a fixed deadline, you're still using a variable time operation under the hood, but turning it into a fixed time operation, being careful not to leak that timing information to an externa
133.
by thadt 2y ago
Not Nickel-63 - Beta particles don’t go very far in air, and are shielded by almost anything. You’ll be unlikely to be alarming on beta emitters anywhere, unless they’re right up against your specialized Beta detector.
134.
by thadt 2y ago
Not "threads are more ergonomic than async/await", but "threads and channels can be ergonomic". I've been a big fan and user of async/await in various languages for over a decade now, and it can absolute
135.
by thadt 2y ago
These are valid concerns, and I can absolutely see situations where I would want to do both of those things that KeyPassXC is doing (skipping user verification and exporting private keys). But security isn't a one-stop shop. Doing user
136.
by thadt 2y ago
If they were the only ones noticing, I might agree. But there are some groups I trust to know their hardware inside and out, and one of those is RadGames[1]. [1] https://www.radgametools.com/oodleintel.htm
137.
by thadt 2y ago
I dunno, I'd make the bold claim that most rocks will repel almost all tigers when deployed energetically enough.
138.
by thadt 2y ago
Hmmm, some recent protocols (thinking of MLS[1] here) have moved into a middle territory where they have a lot of options for piecing together a cryptographic suite, but then version that whole suite within the protocol. You can still chang
139.
by thadt 2y ago
> the point of signatures is to show that something belongs to you Which is exactly the point. Since a signing public key is (somehow) tied to an identity, then being able to recover a public key from signatures means that if you can rea
140.
by thadt 2y ago
Sure, they could have - but didn't. Probably because they were strongly biased toward nonces being generated by a counter, and separating an external 'message counter' from the internal 'block counter' is a nice s
141.
by thadt 2y ago
You either die a hero or live long enough to see your name in the decade old git blame.
142.
by thadt 2y ago
Yep. If the client gives up its full list of currently cached intermediate certificates it certainly reveals information about its connection history. Clients would probably need to use per-site certificate caching. But in general your poin
143.
by thadt 2y ago
Geez, turbolaser X-Wing before it even gets in the air. Can y'all just give us a SCW death-match debate on this? Jokes aside, it would be interesting to have your optimistic take on the current PQ security trajectory. Do you think that
144.
by thadt 2y ago
Interesting. It does seem that being more agile in PKI deployment is going to be a requirement in the next few years as we grapple with rolling out a potentially interesting variety of PQ signatures and hybrids. Especially considering explo
145.
by thadt 2y ago
Flying a drone from inside a bunker is, for all intents and purposes, playing a video game. Call of Duty and Flight Simulator have been training very capable pilots for years now. If you want to see the (near) future of warfare, hop on an
146.
by thadt 2y ago
Ardupilot is quite good, but I would say it's kinda similar to Linux in terms of an operating system for your drone. It can be configured to work with a wide array of hardware and operations, but its 'off the shelf' interface
147.
Flutter 3.22(medium.com)
3 points by thadt 2y ago|0 comments
148.
by thadt 2y ago
As a counterpoint to the horror stories, I've had a few relatively good experiences with protocol buffers (not gRPC). On one project, we had messages that needed to be used across multiple applications, on a microcontroller, on an SBC
149.
by thadt 2y ago
Related - a week or so ago I was playing with ASCON[1], a sponge based cipher and hash function aimed at embedded systems. A passing thought was that it might be handy to use as a random number generator. When I read this post a couple days
150.
by thadt 2y ago
Suggestion - what about just not doing it? Like the article says - it's all physics. No matter fast and precise she is, a small 10 year old girl will have a harder time generating sufficient power to get the break without some risk. An

More ›