← Feed

Posts

• View post

  There are problems that are merely far out of reach of current technology, and then there are problems explicitly created to be forever unsolveable. The cost of destroying a planet is insignificant compared to the cost of breaking a secure 256-bit cipher. Grover’s algorithm only helps if you don’t care about getting the result in your lifetime.

• View post

  I can’t stand websites that log you out for inactivity. My machine is more secure than the website’s servers!

• View post

  Christopher Peikert quoted me to Daniel Bernstein. I provided @sophieschmieg@infosec.exchange with additional information about the recent Classic McEliece attacks. I’ve also reported multiple “you’re using AEADs wrong” vulnerabilities, and figured out how to quickly set up a quantum-safe secure link over a 300 bytes per second communication channel. I even know enough to pick lattice cryptosystem parameters that, for some applications, would likely be a better fit than the standard ones. I...

• View post

  @r@glauca.space @whitequark@social.treehouse.systems I would not be willing to deal with user-provided images unless I was at a company with lawyers on staff. If I’m not, I’m either outsourcing the whole task or not allowing user-provided images or videos. Text only.

• View post

  @ireneista@adhd.irenes.space Ah, I thought you were complaining about the amount of boilerplate required.

• View post

  @ireneista@adhd.irenes.space Vulkan is designed to be used by large programs and libraries for which the boilerplate is irrelevant.

• View post

  If an IPS is found to break some feature of TLS, browsers should force that feature on in the next update, with no opt-out. “Nobody can connect to the Internet” is, hopefully, enough to force changes.

• View post

  RE: https://defcon.social/@thedarktangent/116823753926022604 As this post shows very well, hosting user-generated content has very real economy of scale. Abuse prevention and response is very expensive to do well, and the consequences of not doing it well are severe. Even end-to-end encrypted apps like Signal still need to be able to respond to abuse reports!

• View post

  If I had a project like Mesa or virglrenderer, I would pay a premium for a CI service that offered bare-hardware runners for various embedded boards that are safe to run on not-yet-reviewed contributions.

• View post

  @ariadne@social.treehouse.systems I wonder if this reaches the legal threshold for harrassment.

• View post

  @dalias@hachyderm.io Is splice even useful nowadays?

• View post

  @kkarhan @froge @fj @signalapp @delta @thunderbird @monocles @gajim @torproject @tails @tails_live @guardianproject @Mer__edith Signal has been asked for data before. I believe they responded that they have the timestamp the user registered and the timestamp they last logged in, and nothing else. The CLOUD Act does not allow the US government to force Signal include a backdoor into its clients.