tytso

47 ms·

331.
by tytso 13y ago
Um, so you realize that the BEAST attack is pretty TLS (and heck, pretty implementation specific --- it only works against certain websockets implementation). That's because it is a chosen-plaintext attack, so it is dependent on TLS
332.
by tytso 13y ago
I can't _prove_ that there were people who was purposely delaying consensus to give their product more time to make it to market. But there were those who had their suspicions...
333.
by tytso 13y ago
I was chair of the IPSEC working group at the IETF, and I think I know what John Gilmore was referring to with respect to the question of the Initialization Vector. The person who expressed a concern with a per-packet IV (which by the way
334.
Think like the NSA(plus.google.com)
3 points by tytso 13y ago|0 comments
335.
by tytso 13y ago
Um, you do realize that pretty much every single mail service provider is "scanning" their customer's email to screen out spam, right? That's also an algorithmic analysis of the body of the e-mail, and it's provid
336.
by tytso 13y ago
If Matt protested, he did so quietly/privately. I wasn't aware of the fact that he had stepped down until the authors of the paper described in http://factorable.net showed up and pointed out we had a really bad prob
337.
by tytso 13y ago
Not only did it happen before, just TODAY I had to fight back an attempt by a Red Hat engineer who wanted to add a configuration option which would once again allow RDRAND to be used directly, bypassing the entropy pool: https:/&#x2
338.
by tytso 13y ago
I am so glad I resisted pressure from engineers working at Intel to let /dev/random in Linux rely blindly on the output of the RDRAND instructure. Relying solely on an implementation sealed inside a chip and which is impossible t
339.
by tytso 13y ago
One thing which I haven't seen anyone mention yet. Nokia, like Skype, was a non-US company, which means Microsoft could use cash which is trapped in Europe. So you have to take the purchase price and discount it by as much as the US
340.
by tytso 13y ago
Note that "git rev-parse --show-cdup" return the empty string if you are at the top of the git repo. So "cdg" as defined above will drop you in the hope directory if you are already at the top of your git tree.
341.
by tytso 13y ago
Why not put something like this in your .bashrc or your .profile file instead? function bd () { OLDPWD=`pwd` NEWPWD=`echo $OLDPWD | sed 's|$.*/'$1'[^/]*/$.*|\1|'` index=`echo $NEWPWD | awk '
342.
by tytso 13y ago
My comment which I made on SVN's G+ page: I'm not actually worried about the demographics in the sense of the Bitergia analysis. If you actually look at the number of newcomers showing up in each of the graphs (the 0-1 year bar),
343.
by tytso 13y ago
The main reason why emacs can't be an operating system (or at least a decent one) is that it doesn't support multi-threading. And even if you added multi-threading to emacs, the fact that all of the elisp code out there has no lo
344.
by tytso 13y ago
The difference between "bottom 5%" and "bottom 5% IN EACH GROUP" boils down to whether the "bell curve" is imposed on a per-small-team level, or a per-department level, or across the entire company. The last
345.
by tytso 13y ago
You can avoid this by making it a deep dark secret that you are firing the lowest 5% --- or that the reason why certain people are put on a PIP, subject to a "resource action", or "has found new opportunities outside of XXX&q
346.
by tytso 13y ago
You are assuming that monetary compensation is the only motivator for employees. And that's simply not true. Once people have enough that they can feed their family and put their kids through college, money isn't as important a
347.
by tytso 13y ago
"Stack ranking" as it has been reported to be used at Microsoft, is multiple things conflated together. Some of these things are, by themselves, not necessarily bad. The problem is that people hear the words "stack ranking
348.
by tytso 13y ago
It's 6.004, and it looks like they are still teaching it, which I was pleased to discover. Students are no longer asked to carry around the suitcase-sized breadboard "nerd kit" and they aren't using 74XX TTL chips any
349.
by tytso 13y ago
Well, back when I was an MIT undergraduate, one of the core CS classes handed us a breadboard and a bunch of 74XX TTL chips, and we needed to construct a general register and stack computer from that. (We did get some PC boards that gave u
350.
by tytso 13y ago
Sure, but why isn't all data encrypted at rest? And access to the keys heavily logged? There are ways to allow sysadmins access to backup, and repair file systems, and yet still not have any access to the (plaintext) data stored on
351.
by tytso 13y ago
But the sites aren't really _broken_. There will be a warning displayed to the user, but the user can always say, "give me the site anyway". And users do hate it when they hit a web site which trashes their machine with m
352.
by tytso 13y ago
My experience is that third party blacklists (especially for e-mail spam) have a much worse false positive problem. As I said in another comment, economics is working against you. There is relatively little or no cost to a blacklist prov
353.
by tytso 13y ago
The problem with the block list business model is that false positives have a much lower negative cost to the black list provider than false negatives. Users who find that some spammer doesn't get blocked, will get really annoyed, and
354.
by tytso 13y ago
>A function that does one thing and one thing only is: >- generally short >- testable > ... This is true only if the function decomposition is intelligently done. The problem is that with callbacks, the function decomposition
355.
by tytso 13y ago
It's going to be up to individuals and to a lesser extent, teams, about how much stack ranking really is an important consideration. First of all, I haven't seen any evidence of the "fire the lowest X% of the stack rank"
356.
by tytso 13y ago
I see some excuses on the fundraiser page, e.g., "it's a journal", but that's about it. They don't say anything about what CPU (because they want the fastest), they don't say anything about the thermal engine
357.
by tytso 13y ago
The reason why I'm not jumping at the Ubuntu Edge is that it's vaporware. Things like "Fastest multi-core CPU" doesn't fill me with much (well, any) confidence. That says to me that they haven't done any of t
358.
by tytso 13y ago
Fun fact. In the 1960's the MIT Campus Police were elevated to be State Police officers, because back then the students were protesting, and as State Police officers they had the power to order the Cambridge City Police off of MIT gro
359.
by tytso 13y ago
I remember reading with great amusement an article written by an X.400 proponent, sometime in the late 80's, asserting that X.400 would start to dominate SMTP once the telecoms got the price of sending an X.400 message under a dollar p
360.
by tytso 13y ago
The really huge question is what will the battery life be. A pocket-sized device which only has 3 hours of battery life is not going to be interesting to me.

More ›