thirsteh

43 ms·

391.
by thirsteh 13y ago
This is highly anecdotal, but I've built and been part of very practical/non-theoretical, large Haskell projects (100k+ lines, which is a lot for Haskell). The only big complaint I have is that it's somewhat hard to do loose
392.
by thirsteh 13y ago
If only it were as easy as you made that sound.
393.
by thirsteh 13y ago
Indeed. The irony is that anyone following that (good) advice were affected by this.
394.
by thirsteh 13y ago
"Democracy is the worst form of government, except for all the others." — Winston Churchill
395.
by thirsteh 13y ago
It also isn't much better: https://en.wikipedia.org/wiki/FRA_law Finland has considered laying cable around Sweden to avoid them snooping on all their traffic.
396.
by thirsteh 13y ago
That's not really how it works. Either way, you shouldn't be using just a regular "hash function" anyway. Even basic constructions like PBKDF2 use HMAC constructions where SHA1 and even MD5 are still pretty safe to use (
397.
by thirsteh 13y ago
Many use it because it wasn't developed by the NSA. It is a default in TrueCrypt, for example.
398.
by thirsteh 13y ago
BLAKE2 is a very good alternative if you want software performance: https://blake2.net/ . Just stop what you're doing and look at scrypt, bcrypt or even PBKDF2-HMAC-SHA512 if you're thinking something that involves
399.
by thirsteh 13y ago
You shouldn't be using any of the functions on that page directly, anyway: http://throwingfire.com/storing-passwords-securely/#notpassw...
400.
by thirsteh 13y ago
> But it doesn't have to be in memory, or otherwise stored, anywhere near the bulk account data. If the encrypted password is transferred up the application layers to another physical resource that knows the key, and the passwords (
401.
by thirsteh 13y ago
There's virtually no difference between the two. It doesn't matter if you're using the strongest encryption in the world: the system is automated, meaning it has the encryption key in memory so it can validate passwords, the
402.
by thirsteh 13y ago
Okay, it might not be totally obvious, but File implements io.Reader and io.Writer (you can tell by the Read and Write methods.) Therefore, you can use all the functions that take an io.Reader or io.Writer, i.e. all the functions in http:&
403.
by thirsteh 13y ago
Like I said, I changed the link two minutes after I posted the comment (way before you posted yours, but whatever) because I messed up the link. You can find the listener example here: http://golang.org/pkg/net/#pk
404.
by thirsteh 13y ago
Probably more from OCaml to F# now.
405.
by thirsteh 13y ago
Okay, jgalt212... ( https://en.wikipedia.org/wiki/John_Galt )
406.
by thirsteh 13y ago
Finance firms that are migrating are going to functional languages anyway--OCaml, F#, ...
407.
by thirsteh 13y ago
Dude, I don't think I am.
408.
by thirsteh 13y ago
I changed that a couple of minutes after posting. I just messed up the link.
409.
by thirsteh 13y ago
There are many examples in the Go docs, e.g. http://golang.org/pkg/net/http/#pkg-examples (runnable and editable too!) But I agree that there aren't enough, and that's probably the worst thing about
410.
by thirsteh 13y ago
Weird. I had the exact opposite experience. Extremely easy to pick up, especially if you are familiar with both C and Python, since Python lists are fairly similar to slices. Also, the documentation is far better than e.g. that for Java and
411.
by thirsteh 13y ago
Just to be clear, PFS does not necessarily equal repudiability.
412.
by thirsteh 13y ago
>> Send it to the email account that will be protected by two-factor authentication using the key, and it won't really matter. > Unless, of course, the email is intercepted in transit. > If your email is being sent in the c
413.
by thirsteh 13y ago
It's by far the most accessible two-factor authentication method, and not as insecure you're making it out to be.
414.
by thirsteh 13y ago
Yes it does. The QR code just contains the TOTP key and title. Send it to the email account that will be protected by two-factor authentication using the key, and it won't really matter.
415.
by thirsteh 13y ago
I think you're missing my point. You don't care what happens from the point you get affected until you find it in whatever utility--be it 5 seconds, 10 minutes, or 3 days? No matter how vigilantly you stare at procexp, you're
416.
by thirsteh 13y ago
I don't know (presumably few to none if Google is detecting them), but yes, I agree. You can be exposed but not be vulnerable.
417.
by thirsteh 13y ago
> Tell me how the virus manages to stay out of Sysinternals Autoruns, and I will panic with you. There's a whole category of malware that does just that: https://en.wikipedia.org/wiki/Rootkit The most common (a
418.
by thirsteh 13y ago
Well, if you don't define what "if you know what you're doing" means, it could be anything from "running Chrome" to "using curl on an OpenBSD box and parsing the source manually." But I was referring
419.
by thirsteh 13y ago
https://www.google.com/transparencyreport/safebrowsing/malwa... See "Compromised sites" at the bottom. In my experience, compromised sites and insecure ad networks are by far the most common means of dis
420.
by thirsteh 13y ago
> And I hate the "I can't imagine how to do this, so it's not possible" argument. I can imagine how to do it. But I also know that 99.9% of people don't. > > with the usual suspects--Java, Flash, Adobe Read

More ›