tptacek

36 ms·

721.
by tptacek 3mo ago
You can get a SOC2 done for mid to mid-high thousands.
722.
by tptacek 3mo ago
Not really. The more expensive the auditor, the more they'll work with you to craft something that will avoid exceptions. There's no real "rigor" involved in SOC2! The "audit" here is in audit in the accounting
723.
by tptacek 3mo ago
It's hard to tell if you're being serious here. At the end of the day, Lavabit's security came down to... the FBI's inability to read an ultra tiny font? That's not the actual story (like, that happened, but all it
724.
by tptacek 3mo ago
The introduction to this piece was easy to follow, but as soon as he got into recapitulating it with algebra he lost me (because I'm bad at math). But he includes the GPT5 prompts for his conversation, which are easier to follow: http
725.
by tptacek 3mo ago
The model is very capable of checking this counterexample, was my point.
726.
by tptacek 3mo ago
I don't understand why you're scare quoting "implicit search".
727.
by tptacek 3mo ago
Depends on what you mean, but my subtext was that a lot of steganographic designs have turned out to be detectable; it's a design-level concern, where most consumer encryption problems are implementation issues.
728.
by tptacek 3mo ago
Can you flesh that out? If I've missed something and oversimplified the design here, I'd want to clarify that!
729.
by tptacek 3mo ago
We're talking about exactly the same threat. What I'm pointing out is that state adversaries won't have to "notice" this; all they'll have to do is plug the device into a standard commercial forensics scanner p
730.
by tptacek 3mo ago
We're both saying the same thing: you can make the KDF irrelevant if you (as you just specified) use an AES key as an input. The entire point of KDF is that humans don't do that.
731.
by tptacek 3mo ago
Thanks! Per-seat licensing here checks out.
732.
by tptacek 3mo ago
You can eliminate the problem entirely by using a random full-allowed-character-set password. The whole point of KDFs is that the password/passphrase is predictable (usually: by being generated from a seed dictionary).
733.
by tptacek 3mo ago
The security track record of steganography is not great.
734.
by tptacek 3mo ago
Can you check again and share where you're getting that number?
735.
by tptacek 3mo ago
I'm generally pretty fatalistic about avoiding state-level adversaries. So, in a sense, it doesn't really matter how one thinks a security countermeasure is going to stack up against an IC attacker. The important thing is that peo
736.
by tptacek 3mo ago
This is 2 years old, but goes deep into the details of how the "0 click" market works, roughly what kind of money you'd be sitting on, and what it takes to actually get that money: https://securitycryptographywhate
737.
by tptacek 3mo ago
This is self-soothing, not a real security plan. It doesn't matter how competent a security agency is, because there's a whole ecosystem of vendors selling into that space; knowledge of how to attack encrypted disks like this is o
738.
by tptacek 3mo ago
If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners
739.
by tptacek 3mo ago
This is an axiomatic response to an empirical argument.
740.
by tptacek 3mo ago
I'm noticing you didn't answer my question.
741.
by tptacek 3mo ago
You apparently work in the field. Do you take these "price lists" seriously?
742.
by tptacek 3mo ago
Are you doing the "LLMs don't know how many R's are in 'Raspberry'" thing here? A bunch of people on the original thread about the Conjecture were like "we need to wait and see if real mathematicians verif
743.
by tptacek 3mo ago
Because your question doesn't make sense; this isn't how implicit search works.
744.
by tptacek 3mo ago
[flagged]
745.
by tptacek 3mo ago
It's not really the job of an encyclopedia to be an up-to-the-minute reliable news source. Over the long term, the benefits of the reliable sourcing policy likely outweigh temporary issues like this.
746.
by tptacek 3mo ago
Why are you asking them which basic computer science graph traversal algorithms a frontier model used?
747.
by tptacek 3mo ago
That's not what happened here. This isn't a proof; it's a counterexample. The model was perfectly capable of verifying its correctness. You could have verified it by hand if you wanted; the verification is trivial. Finding it
748.
by tptacek 3mo ago
Is your premise here that no other mathematician was ever equipped or motivated to do a "brute-force computer search"? Or is it instead that you think Anthropic dedicated an entire data center's worth of compute to the task o
749.
by tptacek 3mo ago
I think when we're at the point of No True Intellectual Achievementing Smale's Mathematical Problems for the Next Century, everyone's premises have drifted too far apart for discussion to be reasonable.
750.
by tptacek 3mo ago
You think Alpoge just had the solution for the Jacobian Conjecture in his back pocket, just sort of waiting to deploy at his next gig?

More ›