tytso

25 ms·

151.
by tytso 7y ago
/dev/random and /dev/urandom are world-writeable by design. This allows anyone to contribute to randomness via "cat ~/my_secrets > /dev/random". Of course, my_secrets might not be very secr
152.
by tytso 7y ago
+1. I use MoneyDance as well; I especially like the Dropbox and Android integration.
153.
by tytso 7y ago
The article is only talking about major upgrades (e.g., going from Oreo to Pie). It is not talking about security updates, which are minor releases. People seem to be mixing up these two things. They are different.
154.
by tytso 7y ago
3 months is a long time.... how long is someone supposed to wait for a response before you just move ahead? If the answer is "forever", it becomes trivial to perform a denial of service attack on a standard. Mozilla specificall
155.
by tytso 7y ago
AlexandraSalvaterra's github page shows that she is not a member of the Github Google organization. So I don't believe she is an Android OS Dev working for Google, or that this should be considered an official statement. The art
156.
by tytso 7y ago
There was an attempt to address Mozilla's concerns[1], but Mozilla never responded, unfortunately. If the Mozilla community chooses not to respond, that might cause people to consider whether or not their position should be given much
157.
by tytso 8y ago
Re: users giving up Facebook but moving to Instagram, Malinda of Google Translate Sings called it in her "Honest 2018 Christmas Song": https://youtu.be/70QwQ5kgxzk?t=33
158.
by tytso 8y ago
War story time. File based encryption[1] (which used ext4 encryption) was supposed to have been released with Android M. It slipped by a full year because of this issue which Linus identified. At the time, we didn't have xfstests
159.
by tytso 8y ago
Google is expanding to create 25,000 GOOD JOBS! But since it didn't extort $$$ out of politicians, the politicians can't as easily take advantage of it. If you can get high-tech companies who are willing massively expand to crea
160.
by tytso 8y ago
The opposition is not because some high tech firm, whether it is Google or Amazon, is expanding in NYC. The opposition is because of the Massive tax breaks and other $$$ giveaways New York was going to hand over to Amazon. I don't rec
161.
by tytso 8y ago
This is described as "like Chrome Secure Shell", but the major difference is that with the Chrome Secure Shell application, the ssh client runs in the browser, so it's actually secure; where as Shellvault is an architected (b
162.
by tytso 8y ago
I actually think the specific promises are a good thing. They are measurable, concrete actions that are time bound --- "By such and such a date, we will have done thus and so." Like concrete OKR's, you can tell whether or
163.
by tytso 8y ago
You didn't read the post carefully, apparently. Previously there was no penalty for skipping the mandatory training. (The fact that such training is "mandatory" is required by US law. Like most companies, such training
164.
by tytso 8y ago
After interviewers are trained, they will perform at least two "shadow" interviews where they tag along an experienced interviewer and they want the interviewer conduct the interview and then are asked to write up an interview rep
165.
by tytso 8y ago
The problem with FizzBuzz is that it's too well known. So it's basically something which has very little signal because people can just google it and memorize the solution. Two of my favorite phone screen questions (now unfortuna
166.
by tytso 8y ago
I'm not sure what you are asking. Each interviewer on the interview panel writes up a large amount of notes on their interview. The C++/Java/C/Python code written by the interviewee, what hints were given, what blind
167.
by tytso 8y ago
What happens is the hiring committee will disregard the interview report, and send feedback to the interviewer, saying "don't do that". (There are generally 4-6 interviewers on an interview panel, so if one interviewer does
168.
by tytso 8y ago
Well I had the privilege of working with Paul McKenney who invented (and patented) Read-Copy-Update (RCU). He came to IBM as part of the Sequent acquisition, and was part of the Linux Technology Center, which was in the Systems and Techno
169.
by tytso 8y ago
I don't know that I would call Linux "one of the first". Usenet had been around for a long time, and there were plenty of projects that were enabled via Usenet and mailing lists. For example, perl predates Linux by four yea
170.
by tytso 8y ago
I was at the IBM LTC from 2001--2009 as an STSM, and my understanding was that DE's could absolutely get promoted to Fellows. So assuming that Fellows are "just" the highest rank of the research rank is not really accurate.
171.
by tytso 8y ago
Note that the Titan Security Key and the Titan M chip are two different things. In both cases the firmware is created and signed by Google in the USA, but the hardware used for the secure element in the Pixel 3 handsets and the Titan Secur
172.
by tytso 8y ago
Every single root escalation bug could potentially leak huge amounts of data. And the definition of a successful exploit is one where you don't find out for a long time, or perhaps, not ever. So does that mean that every single time yo
173.
by tytso 8y ago
The post talks about Spanner using "a specialized hardware solution that uses both GPS and atomic clocks to ensure a minimal clock skew across servers." But what it fails to mention is that is that this time is distributed using
174.
by tytso 8y ago
Not really; international business class for a couple could easily run into the 20k territory depending on time of year.
175.
by tytso 8y ago
I'd use as level 4: I don't care how much my (primary) house costs. Beyond that there might be, "I don't care how much my second (third, etc.) house costs". And of course, there's the level where someone asks,
176.
by tytso 8y ago
I use Yubikeys to store my GPG and SSH private keys. This way even if my laptop gets 0wned, the attackers won't be able to get my private keys. It basically is a more convenient form factor then using a Smartcard (which was how I ha
177.
by tytso 8y ago
There are at least two U2F keys I was able to find on Amazon which were under $10 USD: https://www.amazon.com/dp/B01N6XNC01 https://www.amazon.com/dp/B01L9DUPK6 The latter is an open source /
178.
by tytso 8y ago
I'm not so sure it had a large following (do you really think it had as many users as say, G-Mail?). However, it is clear that it had a very _vocal_ following, and many of the people who used Reader were people who used it to follow d
179.
by tytso 8y ago
At the time Linus was the sole author/contributor of git, and he needed a replacement for BitKeeper in a hurry. BitKeeper had been made unavailable for Linux kernel development because the proprietor of BitKeeper was really unhappy th
180.
by tytso 8y ago
How do you decide whether or not you trust the hardware RNG? Do you trust RDRAND? Some people do, other people are convinced it may be backdoored by Intel at the request of the NSA. Worst of all, there is no way to tell which belief is

More ›