zrm

92 ms·

781.
by zrm 8y ago
The scary thing about a global passive adversary is that the attack is undetectable. Active attacks are harder to defend against but they're also harder to keep secret.
782.
by zrm 8y ago
> Nothing has any defence against global traffic analysis. It's possible to guard against global traffic analysis by establishing permanent fixed-bandwidth links between each node and sending traffic along them even when they aren&#
783.
by zrm 8y ago
One way to help that avoids this is to operate a bridge node. Bridge nodes are used as entry points into the Tor network for people in regions where Tor is blocked, so efforts are made to keep the addresses of bridges confidential. Which ma
784.
by zrm 8y ago
> I wonder how many of them is fishing, so that they redirect you to fake sign in page and steal your password. Or spammers trying to verify that your email address is active. Presumably the spammers can charge more for verified targets.
785.
by zrm 8y ago
> It would also be useful in finding hash collisions which would give an attacker access to a user's account without needing the actual password If it's practical to find a hash collision, your hash algorithm is broken. > wh
786.
by zrm 8y ago
> This just makes the password the hash of the user's passphrase. There are some other advantages that others have already mentioned, but even if that was all it did it would still be useful in inhibiting an attacker from learning t
787.
by zrm 8y ago
Nothing should be doing this. Insecure legacy systems that wrongfully expect to see the plaintext of the user's password should be replaced with properly functioning ones. But just because they haven't been yet is no excuse to act
788.
by zrm 8y ago
Passwords should be hashed client-side anyway, so the real issue there is how to encode the password hash in a way that satisfies the legacy system. But this is usually plausible, e.g. by base64 or hex encoding the hash to avoid disallowed
789.
by zrm 8y ago
> I thought it was cheaper to buy Dell/HP and let them deal with any support issues. Is it really cheaper to build your own, considering there's no support? This has changed somewhat with the decline of Moore's Law. Compan
790.
by zrm 8y ago
> based on the assumption that legitimate users have no practical need to do multiple encoding of the same text. Things can legitimately be encoded multiple times because encapsulation is a thing and multiple independent stages may each
791.
by zrm 9y ago
EPYC is already four NUMA nodes per socket though.
792.
by zrm 9y ago
Comparing like with like can give you a better idea of what's going on even if the prices aren't the same. It's a matter of isolating the architecture from the other factors. If a 40 core 2P Intel system is faster than a 32 c
793.
by zrm 9y ago
> I’m more impressed by Xeon Gold vs EPYC perf. The hardware used in this benchmark isn't very well chosen. All the systems have a different number of cores (Power 16, AMD 32, Intel 40), and the AMD system has the additional disadva
794.
by zrm 9y ago
> There's a flip side to this: in part thanks to this lack of regulation, anything outside the popular protocols tend to be blocked in an increasing number of network. That is definitely not the result of a lack of regulation. The n
795.
by zrm 9y ago
> You cannot use an untrusted computer to reliably log out. You could conceivably have a login sessions page and access it from a trusted computer to force logout of a session from an untrusted computer. But it seems the bigger problem w
796.
by zrm 9y ago
> To maintain the performance of DNS, you'd want a connectionless protocol. What you're looking for is DNSCurve. The only reason people are interested in DNS over TLS is the garbage middleboxes that intercept and interfere with
797.
by zrm 9y ago
> I think that cutesy names like this are fine for personal use, but for commercial use you're better of using a more standardised schema for naming. The thing to keep in mind when doing this, too, is that DNS is a hierarchy. Use th
798.
by zrm 9y ago
Does this mean we can have Open Firmware again?
799.
by zrm 9y ago
You're thinking of distributed . Decentralized is broader than that. Really anything that isn't centralized like Facebook is. Obviously a lot of this is very squishy and overlaps a lot even within the same system. Look at DNS. It
800.
by zrm 9y ago
> On IPv4 it's a bit of a problem because of the number of legacy middleboxes that block things they don't know, some olders routers have problems with DF (always fun to debug). The DF bit has been part of IPv4 since day one. T
801.
by zrm 9y ago
> On IPv6 it is strongly recommended not to block ICMPv6 since it routes highly important information back to the sender or forwards to the receiver (like when MTU is reached) The same is true for IPv4. Path MTU discovery is not new for
802.
by zrm 9y ago
> Not unless the bounties are large enough to attract the attention of a hedge fund. Which they should be if the alternative is a much larger loss to the company's share value. The shareholders come out ahead to pay five million on
803.
by zrm 9y ago
> Having a financial incentive to mess up AMD might explain why they only gave 24 hours' warning, though. A good way for companies to prevent this is to have a generous bug bounty program. Money is still transferred from the shareho
804.
by zrm 9y ago
As far as I know they are not required to provide the state with this information either, which they are incentivized to do even less because customers are very much going to hate it, even more than they would dislike paying the sales tax
805.
by zrm 9y ago
The market value of putting off paying $18 in sales tax for six months at 2% interest is $0.18. Not a lot of people will be signing up to fill out paperwork for ~$0.18. Especially when, because it happens at scale, it only means the state h
806.
by zrm 9y ago
Disguising the true cost of a purchase is not something I would file under advantages , and neither will Newegg when their customers stop doing business with them after discovering that they've unnecessarily foisted this accounting bu
807.
by zrm 9y ago
This is incredibly ham-fisted. If you're going to go through the trouble of doing the accounting and submitting the numbers to the state, just collect the sales tax and remit the money . Doing it this way has no apparent advantage at
808.
by zrm 9y ago
Both of those are the wrong way to do it. :) O_TRUNC for the reasons you stated and unlink because it causes a race between the unlink and the copy when a new process that tries to use the library will either fail because it doesn't ex
809.
by zrm 9y ago
The way the article attempts to address this is unsatisfactory: > Secondly, this only works because the benefits are externalities, they are public and not owned by the miners. So there is no incentive for Miners to switch to such a syst
810.
by zrm 9y ago
What if the "useful work" is to work against a collective action problem or similar, where the existing problem is that everybody wants something to happen but coordination is too expensive or there are "tragedy of the comm

More ›