zrm

90 ms·

871.
by zrm 10y ago
> I doubt there's much point writing a new API for TCP itself that exposes all the bells and whistles, because the design of TCP is dated. Rather, there should be more standardized APIs for applications to more easily use replaceme
872.
by zrm 10y ago
That happens with UDP already and is another reason everything ought to be encrypted with session keys. But the normal TCP solution of the OS holding released ports in TIME_WAIT for a couple of minutes still works as ever.
873.
by zrm 10y ago
Basically the same as SOCK_DGRAM works except that send() and recv() expect/provide the TCP header before the transport payload. If a user process calls bind() on some address/port then it gets all TCP packets for that local addre
874.
by zrm 10y ago
Couldn't this work against any wifi? Impersonating a public access point gives you some extra unencrypted information so you know the server IP and can more easily infer when a password is being entered, the same things you conceal by
875.
by zrm 10y ago
Suppose you have 10000 posts tagged with #MIPS #assembly, 8000 tagged with #x86 #assembly and 6000 tagged with #arm #assembly. Then you have 10000 tagged with #MIPS and 24000 tagged with #assembly.
876.
by zrm 10y ago
Can anyone explain the reason why C or C++ compilers can't do this? Obviously the language specs allow you to do the unsafe thing, but suppose we add some "-Wreference-lifetime" flag to gcc that warns if it can't statica
877.
Windows DRM Social Engineering Attacks and TorBrowser(myhackerhouse.com)
2 points by zrm 10y ago|0 comments
878.
by zrm 10y ago
> Each title belongs to about five categories on average? Only if each category contains one title on average. More likely each title belongs to more than a hundred categories on average.
879.
by zrm 10y ago
If you do it that way you could add hardware encryption support to the network card and be back to using DMA.
880.
by zrm 10y ago
Imagine you're not bandwidth-limited and you want to transfer multiple files. One is on Disk A, one is on Disk B, one is on NFS, etc. Sending them all at once exploits parallelism, and the transfer on the faster disk doesn't get s
881.
by zrm 10y ago
Cloudflare et al don't terminate TLS using their own root certificates installed on the client, which means that doesn't expose you to KCI of all servers. And they don't MITM the TLS connection, they terminate it. The diffe
882.
by zrm 10y ago
Compromising TLS is an infection vector. People regularly download programs from trusted websites and run them. Some apps automatically download updates from the vendor's site via TLS. AV scanners do not have a 100% detection rate. Let
883.
by zrm 10y ago
That is a bad idea. If you MITM the connection locally it triples the computational cost for both encryption and handshake operations. Then more websites don't use TLS because it's three times as slow for the user. It also prevent
884.
by zrm 10y ago
> How is that a problem? The problem is it has the wrong default. The equivalent in NaCl is crypto_box(), which requires the sender's private key to authenticate the message. If you really wanted anonymous messages then you could ge
885.
by zrm 10y ago
> the "Envelope Encryption" functions like EVP_SealInit() That thing is a footgun. Those functions encrypt a block of data to a public key without authentication . And encourage you to encrypt to more than one public key at th
886.
by zrm 10y ago
> This is his innovation -- other libraries tend to offer only the primitives and rely on the user to chain them together in ways that make sense and never in the ways that don't. It's a little bit more than that. When you look
887.
by zrm 10y ago
> "Applications that do not implement the Tor protocol SHOULD generate an error upon the use of .onion and SHOULD NOT perform a DNS lookup." The RFC is still a "Proposed Standard" and that sentence is probably a mista
888.
by zrm 10y ago
Because https://*.onion and ftps://*.onion are different. And it lets you do things like tor2web by just appending a DNS domain to the end of the onion domain, without requiring any special client support. And more thi
889.
by zrm 10y ago
Blocking outgoing traffic is generally a mistake. It prevents the device from retrieving updates, assuming there are any. And if there are no updates then there had better also be no undiscovered or unpatched vulnerabilities, which isn&#x27
890.
by zrm 10y ago
> For many use cases, either of the two can be written as an emulation over the other. Between select/poll/epoll/kqueue/etc and each other that is easy. You have a few functions like "register(ctx, fd, event)&quo
891.
by zrm 10y ago
Why do these flags exist if they should never be used?
892.
by zrm 10y ago
The difficult thing with IOCP is that it requires architectural changes to the application and there are platforms that have no reasonable equivalent to it. So portable applications that use IOCP semantics are hard to support on those platf
893.
by zrm 10y ago
> You do need to define some "trustworthy" machines which get to see a constant (and known) address - or troubleshooting and debugging the network will be horrible. In enterprise environments you could get the addresses from a
894.
by zrm 10y ago
There are ways to fix that. One of the interesting ones is to have every socket call to bind() without an explicit address allocate a random new IPv6 address. Then there is nothing to correlate the address with because every other socket on
895.
by zrm 10y ago
Routers that don't do NAT don't need to do connection tracking. Firewalls do, but it's possible to put the firewall in the endpoint.
896.
by zrm 10y ago
> 1) There is a field MTU in the IP header. You don't need this in every packet, you only need it in one packet (or once every few minutes). Instead of putting a field in every packet that only <1% of them need, we could create a
897.
by zrm 10y ago
>If they are doing NAT, they need to understand the transport layer protocol too. And this is why we need IPv6.
898.
by zrm 10y ago
> I agree you could harden a cryptocurrency, I was merely pointing out that Bitcoin is not. (And would require reaching consesus or having a fork to become one.) You're treating Bitcoin as a black box. The thing people care about fo
899.
by zrm 10y ago
The problem with that attack is that Bitcoin is not very high bandwidth which makes it easy to put behind an anonymizer. You could DoS the anonymizer but now you're into large collateral damage and the anonymizer may not be in a countr
900.
by zrm 10y ago
AM3+ motherboards start at ~$50. LGA2011 motherboards start at ~$170.

More ›