News for hackers. Stuff that matters.

Nimi

Nimi on Hacker News

Re:OpenSSL Security Advisory [7th February 2023] on Tuesday February 07, 2023 @04:20PM (#34699845)
Is there a writeup describing the exact timing side channel? (I found the commit fixing it, but it's huge, and I can't follow the change: https://github.com/openssl/openssl/commit/b1892d21f8f0435deb...
Re:The DROWN Attack on Wednesday March 02, 2016 @06:37AM (#11209328)
Another browser beside Chrome, Firefox and IE? OK, so Symantec announces that they will only use Opera. Even then, they have to deal with their customers, website operators who need a certificate trusted by the big 3 browsers, leaving. In fact, now that Let's Encrypt certificates are free, it seems like this is the Symantec CA's worst nightmare.
Re:The DROWN Attack on Tuesday March 01, 2016 @08:29PM (#11207550)
Fascinating. I still feel I'm missing something basic here: If Microsoft, Google and Mozilla announce they're not going to accept any particular crypto primitive two years from now, and this time there won't be any exceptions, CAs and websites just have to abide, don't they?
Re:The DROWN Attack on Tuesday March 01, 2016 @06:55PM (#11207153)
That's very interesting, do you happen to have a link for the blog post?
Re:The DROWN Attack on Tuesday March 01, 2016 @02:36PM (#11205431)
Moving away from obsolete crap isn't the solution, it's the definition of the problem.

One could argue that the CA/Browser forum has achieved some success with moving away from SHA-1. As a spectator, I don't understand why this process is not repeated for similar obsolete primitives or standards.

Re:The Supreme Court's Crucial Mistake About Sex Crime Statistics on Thursday July 30, 2015 @09:54AM (#9974949)
Consider another explanation: If you use the term "rape culture", you essentially claim that in today's society, oftentimes rape will be accepted (FWIW, I agree with this statement). However, there appears to be a consensus in today's society that genocide is always a bad thing; generally that opinion is expressed without any qualifiers (as opposed to qualifiers like "legitimate rape" etc.)
Re:Getting Fucked by Stripe on Wednesday June 03, 2015 @05:13AM (#9651383)
As this is the second time I see companies complaining on HN about the short deadline, and there seems to be a consensus that transitioning to another payment provider realistically always takes more than 5 days, you might consider having a longer default deadline that makes it possible to transition in time. Just my 2 cents.
Re:Help kids from low income communities access careers in tech by hir... on Monday April 27, 2015 @05:31PM (#9449231)
Both the pitch here and the site seem a bit light on endorsements from companies which have previously hired your interns, although I'm guessing you have at list a few good endorsements on file? Maybe consider giving visibility to a few good "reviews" from companies. Just my 2 cents.
Re:Ask HN: How to keep yourself prepared for potential interviews? on Sunday April 26, 2015 @03:40PM (#9442998)
Found myself in similar situations in the past. My tentative solution was to maintain a corpus of resources for practice (beyond the usual suspects of implementing the standard data structures etc.), and hope that when the chance comes, 1-2 hours each day for a week before an interview would suffice. And when I do practice, I don't use a code editor, either paper or plain editor with no way to execute the code, simulating the (horrible) conditions of interviews as best as I can.

Obviously, this doesn't get you the benefit of being constantly drilled, but should provide some advantage. If you do care enough to get yourself a bigger advantage, maybe try to clear a few weeks before a round of job searching (if that's how you operate), then use those weeks for a few hours of practice each day.

Re:Bitcoin Lightning Networks Part I: Revocable Transactions on Thursday April 09, 2015 @01:11PM (#9349141)
Thanks!

I prob. missing something about [you're] "handing me your private keys to unlock that 1c output. Now if you ever released Transaction 1, I can spend both the outputs". What happens if you release transaction 1, then immediately release a transaction moving the funds away from that address? Seems like I have to be very vigilant and closely monitor the blockchain, fearing this will happen?

Re:Ask HN: Why do I have to struggle with everything? on Monday April 06, 2015 @01:15PM (#9329255)
Interesting - can you please elaborate on those different cognitive skills?

(also, both your plight and the efforts you put towards getting out of it sound very serious - best of luck to you)

Re:Is your satellite link oscillating? Improving goodput using network... on Monday March 16, 2015 @12:40PM (#9212486)
A few random thoughts/questions:

- This sounds similar to the incast problem which occurs in datacenters, but this happens on consumer Internet - cool.

- After reading both this post and the TCP/NC paper, it seems to me like TCP/NC is unfair to vanilla TCP. If all TCP/NC does is send the same number of packets, but the packets are "more sophisticated" encodings of the original data, link utilization would be the same. So apparently, TCP/NC is more aggressive than vanilla TCP, and that's fine, but I think it should be acknowledged (haha). When they say stuff like "TCP doesn’t see the packet loss, and as a result there’s no need for the TCP senders to reduce their sending rates", it's a bit unclear what they mean - you can just as well modify the TCP stack to ignore the packet loss and not reduce the sending rate, without network coding.

- Why not use TCP termination? You could install a performance-enhancing proxy at the Sat gate, and make sure the link is always 100% utilized.

- "Let’s increase the queue memory" - I thought this should theoretically work. See for example http://yuba.stanford.edu/~nickm/papers/sigcomm2004.pdf. If folks familiar with the apnic effort are reading, I would love to know if they tried such measures and what happened.

- Could CoDel improve the situation here?

Re:Is your satellite link oscillating? Improving goodput using network... on Monday March 16, 2015 @12:32PM (#9212421)
Their phrasing appears to state they use TCP/NC, a network coding-based variant of TCP introduced in an academic paper by (some of) the same people behind this initiative:

http://arxiv.org/pdf/0809.5022.pdf

Re:TLS in HTTP/2 on Friday March 06, 2015 @12:27PM (#9158225)
I'm surprised to see Certificate Transparency presented as a band-aid. My understanding is that assuming it will be deployed successfully, forged certificates will require very significant resources to use successfully for an attack, typically limiting such attacks to nation states.

But I would love to know where I'm wrong about this.

Re:Getting out of a bad place on Monday February 02, 2015 @04:41PM (#8987199)
I was surprised by how similar Sivers' advice is to the Budha's teachings.
Re:Why not DANE in browsers on Monday January 19, 2015 @09:25AM (#8912011)
Slightly off-topic: Could you please add RSS support to your "blog"? I'm sure others, besides me, would love to me notified of new entries. Thanks!
Re:A Career in Science Will Cost You Your Firstborn on Sunday January 11, 2015 @04:42PM (#8871448)
Could you please give some examples?

Older »