This is so true. The idea that a program can approach some optimal bug-free state, never to be modified or refactored again, doesn't resemble any project I've ever encountered.
"we model a scenario where the original code is memory-safe; the ported code is memory-safe; and we consider memory safety and undefined behavior that may arise across the FFI layer between the two pieces of code." I…
I don't think this is true in the general case. Most Solokeys come in a "locked" form-- they will only accept firmware updates that are signed by the manufacturer. You can buy a "hacker" variant that is unlocked (meant…
For those that enjoy stories about the early days of electric guitar, I recommend picking up the book "The Birth of Loud: Leo Fender, Les Paul, and the Guitar-Pioneering Rivalry That Shaped Rock 'n' Roll" by Ian S.…
A Solo key is $20. https://solokeys.com/
https://quoteinvestigator.com/2017/03/23/same/ Not Einstein. It's a quote from a 1981 Narcotics Anonymous pamphlet.
Print it on a shirt, and you have the thing William Gibson dreamed up in "Zero History": "What’s that?" she asked. "The ugliest T-shirt in the world," he said… "So ugly that digital cameras forget they’ve seen it."
Useful reading: https://blog.netspi.com/stealing-unencrypted-ssh-agent-keys-... https://blog.ropnop.com/extracting-ssh-private-keys-from-win...
It's interesting that their ssh-agent runs as a service under an Administrator account. I'd guess this is an attempt to better protect the private key against theft during a local compromise (i.e. unlocked computer left…
regarding "development job... putting me outside the income level": I faced the same situation; after being rejected, all I had to do was file some extra paperwork ("special circumstances") saying that I'd left my job…
The time investment to prove or disprove this statement is more than I'm willing to give. I'd prefer to spend my time working with projects whose maintainers aren't hostile to my privacy.
"Each Bitwarden installation requires a unique installation id and installation key." Sorry, it doesn't count as open source if everyone needs your permission to run it.
Is it legitimate to have a CEO add their name to a patent? My impression is that the "inventor(s)" have to be the people who actually came up with the idea.
Wasn't 212b02125f3 ("x86, fpu: enable eagerfpu by default for xsaveopt") sufficient protection for everyone on a modern CPU?
Look at Stanford Shopping Center in the satellite view sometime: a bunch of rectangles surrounded by an ocean of surface parking. It's much more like a conventional mall than a downtown: It's effectively walled off from…
This is a loophole that exists, yes. 10b5-1 plans set up by the company will sometimes have a rule that no changes are allowed for 30 days, which solves the problem. Not sure how widespread this practice is.
Bresenham's algorithm is very useful when building software that uses stepper motors to follow a particular path (e.g. robotics, plotters, 3d printers, CNC machine). It's especially nice if you're trying to use a wimpy…
I agree the earlier paper shares the same misconceptions. I don't agree that the authors of the present paper are exempt from criticism for this reason.
That's not how SSDs work. You would never be exposed to uninitialized flash pages; they are unlinked from the logical address space until after the block gets erased and programmed with fresh data. Wear leveling doesn't…
Drives that lack cryptographic scrambling are not rare. Search a few vendors' sites and you'll find some that don't support "self-encrypting" capabilities.
Are you claiming that a random-bit-flipping attack such as targeted read disturb can cause corrupted data to be returned even through data scrambling, a first-level LDPC check and a final CRC check on the output? From…
I don't think we can assume that all impractical attacks will eventually become feasable. There are some things that are not just hard, but computationally infeasable. Triggering random bit errors and expecting to pass…
Good modern SSDs do this. Cheap SSDs use only a non-cryptographic scrambler.
The full paper is here: https://www.usenix.org/system/files/conference/woot17/woot17... I am unconvinced. They have not demonstrated an attack on any real-world SSD; instead they have attacked their own FPGA-based…
Leaded avgas is only used in piston-engine propeller planes. Jet fuel doesn't contain lead additives. So still not great, but a bit of googling shows that leaded avgas is less than 2% of total civilian aviation fuel in…
This is so true. The idea that a program can approach some optimal bug-free state, never to be modified or refactored again, doesn't resemble any project I've ever encountered.
"we model a scenario where the original code is memory-safe; the ported code is memory-safe; and we consider memory safety and undefined behavior that may arise across the FFI layer between the two pieces of code." I…
I don't think this is true in the general case. Most Solokeys come in a "locked" form-- they will only accept firmware updates that are signed by the manufacturer. You can buy a "hacker" variant that is unlocked (meant…
For those that enjoy stories about the early days of electric guitar, I recommend picking up the book "The Birth of Loud: Leo Fender, Les Paul, and the Guitar-Pioneering Rivalry That Shaped Rock 'n' Roll" by Ian S.…
A Solo key is $20. https://solokeys.com/
https://quoteinvestigator.com/2017/03/23/same/ Not Einstein. It's a quote from a 1981 Narcotics Anonymous pamphlet.
Print it on a shirt, and you have the thing William Gibson dreamed up in "Zero History": "What’s that?" she asked. "The ugliest T-shirt in the world," he said… "So ugly that digital cameras forget they’ve seen it."
Useful reading: https://blog.netspi.com/stealing-unencrypted-ssh-agent-keys-... https://blog.ropnop.com/extracting-ssh-private-keys-from-win...
It's interesting that their ssh-agent runs as a service under an Administrator account. I'd guess this is an attempt to better protect the private key against theft during a local compromise (i.e. unlocked computer left…
regarding "development job... putting me outside the income level": I faced the same situation; after being rejected, all I had to do was file some extra paperwork ("special circumstances") saying that I'd left my job…
The time investment to prove or disprove this statement is more than I'm willing to give. I'd prefer to spend my time working with projects whose maintainers aren't hostile to my privacy.
"Each Bitwarden installation requires a unique installation id and installation key." Sorry, it doesn't count as open source if everyone needs your permission to run it.
Is it legitimate to have a CEO add their name to a patent? My impression is that the "inventor(s)" have to be the people who actually came up with the idea.
Wasn't 212b02125f3 ("x86, fpu: enable eagerfpu by default for xsaveopt") sufficient protection for everyone on a modern CPU?
Look at Stanford Shopping Center in the satellite view sometime: a bunch of rectangles surrounded by an ocean of surface parking. It's much more like a conventional mall than a downtown: It's effectively walled off from…
This is a loophole that exists, yes. 10b5-1 plans set up by the company will sometimes have a rule that no changes are allowed for 30 days, which solves the problem. Not sure how widespread this practice is.
Bresenham's algorithm is very useful when building software that uses stepper motors to follow a particular path (e.g. robotics, plotters, 3d printers, CNC machine). It's especially nice if you're trying to use a wimpy…
I agree the earlier paper shares the same misconceptions. I don't agree that the authors of the present paper are exempt from criticism for this reason.
That's not how SSDs work. You would never be exposed to uninitialized flash pages; they are unlinked from the logical address space until after the block gets erased and programmed with fresh data. Wear leveling doesn't…
Drives that lack cryptographic scrambling are not rare. Search a few vendors' sites and you'll find some that don't support "self-encrypting" capabilities.
Are you claiming that a random-bit-flipping attack such as targeted read disturb can cause corrupted data to be returned even through data scrambling, a first-level LDPC check and a final CRC check on the output? From…
I don't think we can assume that all impractical attacks will eventually become feasable. There are some things that are not just hard, but computationally infeasable. Triggering random bit errors and expecting to pass…
Good modern SSDs do this. Cheap SSDs use only a non-cryptographic scrambler.
The full paper is here: https://www.usenix.org/system/files/conference/woot17/woot17... I am unconvinced. They have not demonstrated an attack on any real-world SSD; instead they have attacked their own FPGA-based…
Leaded avgas is only used in piston-engine propeller planes. Jet fuel doesn't contain lead additives. So still not great, but a bit of googling shows that leaded avgas is less than 2% of total civilian aviation fuel in…