thirsteh

29 ms·

91.
by thirsteh 12y ago
That (using ==) is what py-bcrypt does, written by Damien Miller, a fairly well-known OpenSSH and OpenBSD hacker. It has definitely attracted some "smart" comments from "experts," as does anything that uses == in a secur
92.
by thirsteh 12y ago
Haskell looks pretty similar to Python :)
93.
by thirsteh 12y ago
So the same as the U.S., then?
94.
by thirsteh 12y ago
While I agree with these arguments, the purpose of Go is to Get Stuff Done (TM), and the main purpose of Haskell is to foster PL research and semi-formal methods. It's not really fair to say Haskell is unpopular because it crammed a bu
95.
by thirsteh 12y ago
Yeah, you could have said the same about Haskell. 'forkIO' in Haskell and 'go' in Go are essentially identical. You could also argue that Haskell's STM is even safer than using CSP channels (which also exist in Hask
96.
by thirsteh 12y ago
Related: http://throwingfire.com/storing-passwords-securely/#notpassw...
97.
by thirsteh 12y ago
It would be quite surprising if it did, since Node's HTTP parser isn't Node/JavaScript, but highly optimized C.
98.
by thirsteh 12y ago
Program termination/exception is clearly preferable to arbitrary code execution.
99.
by thirsteh 12y ago
There are a ridiculous number of serious vulnerabilities in C code related to lack of bounds checking and manual memory management. This isn't really opinion so much as fact. I understand what you're saying, but you're also d
100.
by thirsteh 12y ago
The premise of this conversation is flawed: A language isn't "insecure" or "secure." It's placed at a certain point in a safety spectrum ranging from "Do anything with no safety" to "Safely heat
101.
by thirsteh 12y ago
It's hard to tell what you mean by "low-level operations." A lot of systems programming, particularly the GNU suite, just deals with manipulating files, sockets, and so on, and Haskell can do that just fine. Example: http:&#
102.
by thirsteh 12y ago
Which is relatively inconsequential as long as there's a clear boundary between things that can be manipulated by a user and the C code. It'd be better if it wasn't C at all, sure, but, from a security perspective I'd ta
103.
by thirsteh 12y ago
Rust... or pretty much any other language than C. C is scary from a security perspective because it is both incredibly easy to write code that has subtle but very serious bugs leading to e.g. arbitrary code execution, and it is easy to ex
104.
by thirsteh 12y ago
You seem to be arguing against yourself. If 'strings' were written in a safe language, compromising the system would be extremely unlikely. Or are you seriously arguing that languages that are safer than C aren't Turing compl
105.
by thirsteh 12y ago
That makes sense. I wish he'd stop writing obviously linkbait titles like "Haskell is Exceptionally Unsafe" when what he means is that there are some really obscure safety implications for typeable exceptions. I completely ag
106.
by thirsteh 12y ago
Yes, Denmark. It was scrapped after about a year since the government found out the Danes were buying fatty products in Germany and Sweden. Classic Danish government.
107.
by thirsteh 12y ago
Having read numerous rants by Harper against Haskell, it really just seems like he's upset Haskell turned out to be the "popular" language. He is an accomplished computer scientist and a major contributor to Standard ML (i.
108.
by thirsteh 12y ago
I appreciate you telling your story, and apologize for insinuating that it was a useless organ rather than an organ that you can live fine without in most cases .
109.
by thirsteh 12y ago
Indeed: Client fingerprinting--when you're doing nothing unusual as well as when you're doing something "secret"--is just as deadly with Tor enabled, even if your true IP address isn't visible.
110.
by thirsteh 12y ago
[citation needed]
111.
by thirsteh 12y ago
Sure, the gluten-free, organic approach is to drink a lot of lemon juice and keep your gall bladder. But medical science has established that it is an almost completely useless organ, and that it may harm you in some cases. So aside from th
112.
by thirsteh 12y ago
It's also generally ineffective, and little more than a checkmark on a compliance sheet. Just because something is encrypted doesn't mean it's not trivially accessible and readable. Encryption, when it applies to systems that
113.
by thirsteh 12y ago
It was a node.js app. You didn't need to add .cfm to the paths to make it a joke. /me ducks
114.
by thirsteh 12y ago
To make it easier to reason about whether the program will terminate. This is an important part of writing high-assurance software. From the actual patent text ( https://www.google.com/patents/US7788659 ): "Because
115.
by thirsteh 12y ago
You might as well ask the same question about anything the U.S. does, given that the U.S. undisputedly has "more important" and unresolved domestic problems. In the words of Carl Sagan: "Just now, there a great many matters t
116.
by thirsteh 12y ago
I hope your wife finds a job at a company with an adult management team. The stress level you get from an environment like you describe isn't worth the cost.
117.
by thirsteh 12y ago
And what happens when it's patched to fix a real issue? Your site will just break. Just don't trust so many third parties with your site's security: Host jQuery (and other things) yourself.
118.
by thirsteh 12y ago
But even an AZ is not necessarily one physical data center; it may be many.
119.
by thirsteh 12y ago
Not if you never click on ads anyway.
120.
by thirsteh 12y ago
So this is a piece of JavaScript. What happens when a bot blocks that JavaScript from running and/or emulates it but returns a result that indicates the user is human?

More ›