mahemm

In the sense `jeffbee meant, yes.

Pretty much any memory managed language? Java, Go, Rust, Python, pretty much anything other than C/C++ these days is memory safe for security purposes.

What's the benefit of your model of authentication vs. more-common ones?

I think you're overestimating the "appreciability" of art and music. I would say most people don't have the training to understand or enjoy the majority of the most important critical works in art or music from the last 100 years, if not longer.

I found this to be a really informative piece about how people at the forefront of their field (in this case, AppSec) can move themselves farther with LLMs, as well as the limits to be dealt with and handled in that process.

How does this differ from e.g. S3 pre-signed URLs?

The tl;dr on why IO is important is you can just use (effectively) one program, but stuff different secrets inside them with a guarantee that no one can pull those secrets back out.

Cryptographers have proven that it's possible to use this as a primitive from which you can rebuild the rest of common cryptographic primitives (public encryption, symmetric encryption, etc). So--if it's possible to put this together it'll be a novel construction for every cryptographic primitive that also dodges some of the problems with key distribution and negotiation.

It's interesting to see such ongoing strong jobs data in the face of unprecedentedly negative sentiment[1]. Not only do the numbers fail to look as bad as the sentiment, the numbers are actually fantastic and (AFAICT) fully uncorrelated with sentiment.

I've been thinking that this is basically a result of people being overexposed to aspirational lifestyle marketing influencers--even though they're doing better than ever, they're more aware than ever that others are doing even massively better. Since it's influencer marketing, they're seeing people do better in specific ways that appeal to them instead of just being passively aware that others are richer.

[1]: https://www.sca.isr.umich.edu/files/chicsh.pdf

I'm surprised y'all stopped at the personal finance layer. I've been thinking for awhile that LLMs would be really effective as personal financial advisers, and this kind of hookup (plus I guess another one for investment accounts?) seems like all that's needed to bootstrap reasoning.

Would you be comfortable using this same logic to invest most of your net worth in lottery tickets/betting on black in a casino? If not, I'd be curious to hear what is different in that for you.

My FAANG employer launched a service ~6 months ago that today seems millions of DAUs. This service was 100% vibe coded. This service was created 20x faster than the median launch, and had notably fewer issues than the median launch. If AI stopped improving today, it would be a technological leap equivalent to a new high-level language paradigm for us.

The property you're talking about (next bit unpredictability) is important for a CSPRNG, but it doesn't matter at all for a PRNG. A PRNG just needs to be fast and have a uniform output. LCGs, for instance, do not have next bit unpredictability and are a perfectly fine class of PRNG.

What game is played? To me it seems pretty straightforward that for both the actual caloric content is ~0.

To me this is completely unrelated to the quality of the PRNG, because security is explicitly a non-goal of the design. A general-purpose non-cryptographically secure PRNG is evaluated primarily on speed and uniformity of output. Any other qualities can certainly be interesting, but they're orthogonal to (how I would evaluate) quality.

You replied to a claim that Telegram doesn't do E2EE for groups saying 'Neither does Whatsapp/Signal'.

That's wrong; as `tptacek noted. If you meant something else, that wasn't clear.

Why not just read 64 bits off /dev/urandom and be done with it? All this additional complexity doesn't actually buy any "extra" randomness over this approach, and I'm skeptical that it improves speed either.

Yep! We're lucky to be part of an org that's growing across a few teams, so there's several jobs up for the wider Stores AppSec umbrella

Amazon | Full-time | Security Engineering/Management | Austin, TX | On-Site

I am hiring a new Application Security team in Austin to focus on making the highest-privilege applications in the non-AWS side of the company the planet's most secure.

This team will be joining a 9-month old effort to collaborate with developers of key apps on security assessment, architecture improvement, design and code review, and automation of the security process.

The pros of our team are technical excellence, a culture of sustainable work (we are working hard here, but strictly 9-5), the opportunity to have a significant influence on the security posture of the company as a whole, and the chance to hack on applications operating at a global scale, and low (1x/month) oncall expectations.

The cons of our team are moderate process debt (arising from our newness and some unexpected demand)and higher-than-normal ambiguity in tasks (we hold too many task definitions/bars in our head and haven't written them down yet).

Please apply to these roles through the links below:

* Security Engineering Manager: https://www.amazon.jobs/en/jobs/2769965/security-engineering...

* Senior Security Engineer: https://www.amazon.jobs/en/jobs/2778970/senior-security-engi...

* Security Engineer: https://www.amazon.jobs/en/jobs/2777245/security-engineer-ii...

I'll check this post periodically and respond to any questions (concerning non-confidential info about this job) if people are interested.

Who do you think declassifies and releases information? Who do you think passed and enforces the Freedom of Information Act?

>Money breeding laziness ... killed ICOs

ICOs were killed by Solidity and the Ethereum ecosystem more generally being insufficiently expressive to create anything of value other than pyramid schemes (insofar as those have value).

This is the exact sort of thing that allows people to think that things like Telegram are acceptable equivalents to Signal instead of disastrously poor imitators. It's a shame the discourse around secure messengers has become so polluted.

Can't do crypto without visualizations; I can't say how many times I've wanted someone to draw stuff out! Great article

The ideas that "culture is a matter of individual experience" and that "there was no dichotomy to begin with and nothing to deny" seem to affirm the postmodern idea from my POV. That's basically what they argue.

By contrast, many Modernist philosophers believed that human history moved inexorably towards more-just society or that human knowledge moved towards perfect understanding of all phenomena.

Edit: not sure I understand what you mean when you say "The pattern is much broader that postmodernism claims it to be. "; the project of postmodernism is in part to show that there is no pattern.

Ironically, Nietzsche is considered (by some) to be one of the fathers of postmodern thought. His criticism of the objectivity of science in "On Truth and Lies in a Nonmoral Sense", his deconstruction of the Western concept of self in "The Anti-Christ", and to some extents his criticism of 19th-century historiography in “On the Uses and Disadvantage of History for Life” and other books are touchstones which presage a lot of postmodern discussion of these topics.

Check out https://muse.jhu.edu/article/27340 for the argument against though!

A postmodern critique of this argument might start with your identification of a single "culture" that has a pattern. Who decides what this culture is and who its adherents are? What if there are exemplars of the culture that do not fit this pattern; are they inherently excluded from the culture by the fact that they do not fit the pattern? If so, it may be the case that we are fitting a pattern we would like to see onto a culture that is in fact varied and diverse, and which does not in fact have a particular direction.

Lots of people ITT seem to have an incorrect understanding of the term postmodernism. It basically boils down to the observation that history and human experience don't really move towards a single goal, but instead consists of lots of independent narratives going nowhere in particular.

These observations invalidate Modernist ideas that held that human historical development lead toward specific outcomes or followed observable patterns. For instance, postmodernist thought argues Marx was wrong in thinking that history followed a dialectical pattern, and instead holds that history follows no pattern.

While this article does do a good job of illuminating the potential challenges, it's a bit frustrating that there's such scant discussion of solutions.

IMO, this problem has been solved pretty comprehensively by the TUF framework[1], which has a number of solid implementations[2][3]. Many of these implementations even have reliable third-party reviews, so should be pretty trustworthy.

[1]: https://theupdateframework.github.io/ [2]: https://github.com/flynn/go-tuf [3]: https://github.com/theupdateframework/notary

I use the high level concept pretty regularly in my day-to-day as a security consultant specializing in cryptography, and this project is a fantastic way to democratize the use of differential fuzzing. The only negative thought I have about this is that I didn't think of it first!

The widespread usage of Telegram in a situation as sensitive as the Hong Kong protests is a failure on behalf of the security industry in educating the public.

Even WhatsApp is miles better, but in reality it should be a no-brainer for the relevant people to use Signal or perhaps Threema/Wire. What a shame that charlatans have successfully marketed themselves to the top of this segment with a distinctly inferior product.