bracewel
Re:Go has added Valgrind support
on Tuesday September 23, 2025 @11:36AM (#45348555)
This is mainly actually for testing constant-time code, rather than doing proper memory tracking (see https://www.imperialviolet.org/2010/04/01/ctgrind.html for a slightly out-of-date description of this technique).
Re:Go has added Valgrind support
on Tuesday September 23, 2025 @11:30AM (#45348445)
Author of the linked CL here: we added this mostly so that we could abuse the memory initialization tracking to test the constant-time-ness of crypto code (similar to what BoringSSL does, proposed by agl around fifteen years ago: https://www.imperialviolet.org/2010/04/01/ctgrind.html), which is an annoyingly hard property to test.
We're hoping that there are also a bunch of other interesting side-effects of enabling the usage of Valgrind for Go, in particular seeing how we can use it to track how the runtime handles memory (hopefully correctly!)
edit: also strong disclaimer that this support is still somewhat experimental. I am not 100% confident we are properly instrumenting everything, and it's likely there are still some errant warnings that don't fully make sense.
Re:What it means to see a 'bad' certificate in TLS Certificate Transpa...
on Monday October 17, 2022 @01:40AM (#33230094)
There is a fifth, incredibly common, (arguably) non-malicious possibility.
You don't control the entirety of your web stack, and your hosting provider, or DNS provider, or someone else, has decided to be 'helpful' (either blindly, or due to some misconfiguration somewhere along the line) and issue a certificate on your behalf, as they are able to intercept CA validation traffic at the DNS, TLS, or HTTP layer.
Re:No Radical Changes in GNU Project
on Wednesday October 09, 2019 @03:18PM (#21206859)
ah yes, I remember personally lying to congress and pushing false narratives in the media. oh wait, no, that wasn't me was it...
Googlers Against Transphobia and Hate
Re:Let's Encrypt Root Trusted by All Major Root Programs
on Tuesday August 07, 2018 @05:16PM (#17710896)
Note that CABF bylaws require a simple majority of browsers to vote positively for a ballot for it to pass, regardless of how CAs vote.
Tg registrar was compromised for at least 9 days
Using BGP to Acquire Bogus TLS Certificates [pdf]
Final Removal of Trust in WoSign and StartCom Certificates
Symantec explores selling web certificates business
Apple's annual profits fall for first time in 15 years as iPhone sales decline
The RFC 5114 saga
Russia claims it can collect encryption keys
Re:What It Costs to Run Let's Encrypt
on Tuesday September 20, 2016 @05:19PM (#12543529)
> CA/SSL specification does not change weekly...
The draft ACME specification does though.
Incidents involving the CA WoSign
Re:Let's Encrypt now fully supports IPv6
on Tuesday July 26, 2016 @03:47PM (#12168282)
DNSSEC is enforced at the resolvers.
Re:Let's Encrypt now fully supports IPv6
on Tuesday July 26, 2016 @02:33PM (#12167784)
Yup.
Re:Reflections: The ecosystem is moving
on Wednesday May 11, 2016 @02:51AM (#11673106)
Google did not write the HTTP/2 spec.
While Roberto Peon is one of the authors (and a core developer of the preceding SPDY protocol) saying that HTTP/2 is some Google invention is a bit of a punch in the face to the IETF and the two other authors who do not work at Google.
Early Impacts of Certificate Transparency
Re:Learning from Tay’s introduction
on Friday March 25, 2016 @06:23PM (#11363163)
It allowed users to bypass Twitter blocks by tweeting at the bot while tagging users that block them, which seems pretty bad and was abused very quickly. Also it's a violation of the Twitter TOS.
Re:Uber Engineering Bug Bounty: The Treasure Map
on Tuesday March 22, 2016 @03:59PM (#11339529)
> paltry $15k
The tech/security community is crazy.
StartSSL domain validation vulnerability
Re:Going Fast Slowly
on Wednesday March 02, 2016 @10:23PM (#11214833)
> The two CVEs against Varnish were both utterly bogus "trophy-hunter" CVEs in my opinion. (But don't take my word for it, judge for yourself.)
ok
> CVE-2013-4484: Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.
:|
Distributed Security Alerting
Re:Political Correctness Killer for Social Media
on Friday February 12, 2016 @07:05PM (#11091611)
Dope watermarks.
Re:Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 c...
on Tuesday December 22, 2015 @02:18PM (#10779670)
Guh, until CF/FB can provide some data that shows users with no upgrade path are genuinely going to be effected by this, and not connections MITM'd by some crappy AV or other random middlebox the LV proposal seems like a pretty silly idea...
https://www.cabforum.org/pipermail/public/2015-December/0064...
Re:Android NDK: GCC is now deprecated, everyone should be switching to...
on Monday December 21, 2015 @04:23PM (#10773615)
waits for RMS to get mad