vengefulduck

Watts is already a unit of energy over time. (J/s)

And it will spend 1 million tokens finding the most memory efficient program:

int main(){}

I think the problem with this argument is the assumption that nature is inherently good. Nature is cruel and uncaring. Moving beyond it is a good thing imo. We’re just lucky that as a species by the roll of the dice we were given the power by nature to usurp it.

Have you used VLC on MacOS tho? Full screen video looks very slick and is tough to differentiate from native quicktime other than having support for more codecs and features.

The non full screen UI is a little more crusty but still looks better than the windows version imo.

Browsers enforce that certificates are signed by two independent CT logs. The public keys of which is shipped by the browser. So a MITM would need to compromise a trusted CA and two CT logs to be able to pull off an attack undetected. Maybe not impossible but much more difficult than just a single CA compromise.

Assuming that living with your parents is a safe option which for many, especially LGBT people it isn’t.

Of course, this is the only explanation. No one can just make stuff up on the internet. That’s impossible.

Browsers are just mini OSs at this point. It’s probably best just to accept it. Honestly in some respects (security, isolation, resource management) they do a better job than the operating system they run on top of.

Even as a user I don’t there’s a good reason to love cert pinning. If you’re going up against adversaries that can compromise web pki they also probably have some other exploits up their sleeve to pwn you.

Cert pinning pretty much serves to protect companies from people reversing their protocols and little else imo.

Write access to .bashrc is plenty to very sneakily get sudo access tho.

  alias sudo='./.my-evil-sudo-binary'

And wait till the next time the user authenticates, they wont see anything amiss and you just silently delete the alias after you’ve got the sudo password.

Also even without root dumping .ssh and the browser’s cookie jar is probably plenty to achieve lateral movement and you don’t need root for that.

Installable web apps would give you a workaround for that wouldn’t it?

Hahahahaha. Yeah, sure cryptocurrency never comes crashing down. It certainly would never lose 60% of its value in 6 months. That would never happen. What a perfect store of value. /s

The math used in AES (Rijndael) utilize operations in GF(2^8) tho, so you're doing operations using Galois fields whether your utilizing GCM or CBC. I don't really see how adding the GCM mode utilizing GF(2^128) on top is significantly more difficult or error prone than implementing the AES block cipher itself. You should still be familiar with operations over Galois fields regardless if you've for some reason (foolishly imo) decided you want to implement AES cryptographic primitives on your own.

Regardless there's no good reason not to use a vetted open source implementation instead, preferably with an even higher level of abstraction so your not having to worry about ciphers or modes of operation at all[1].

[1] https://doc.libsodium.org/secret-key_cryptography/secretbox

The fact that any Xorg client can become a key logger without any user input or authentication is a pretty big security hole imo.

By design Xorg has no isolation between clients so they can all read each others input, control others windows, and inject keystrokes into other applications. That’s unacceptable in the modern age and makes any attempt at sandboxing or separation of privileges for GUI applications completely pointless.

That's fair. I'm pretty new to the industry so I might be a little naive. It hasn't bitten me at the places I've worked so far though. (A big tech firm and a University)

Even when applying to companies that are LGBTQ friendly? I sometimes self identify on applications if the company has a good reputation with that kind of thing because I’d expect It would give me some diversity points. But maybe that’s not the best idea.

I submitted this in light of the recent iCloud end to end encryption announcement which seems to indicate they're using Convergent Encryption here:

https://support.apple.com/en-ca/guide/security/sec973254c5f/...

Looking into the details it seems like they're using Convergent Encryption [1][2] in order to enable deduplication in iCloud drive and photos. Which would imply it is possible for an attacker to determine if your account is storing a file for which they know the plaintext. It's still a lot better than the status quo but that's a pretty big asterisk in my mind.

[1]https://support.apple.com/en-ca/guide/security/sec973254c5f/...

[2] https://smarx.com/posts/2020/09/convergent-encryption-and-wh...

Your kidding right? Anything IO bound like an server isn’t going to be remotely affected by the speed of underlying language. There’s almost no compute required for a mastodon server just take HTTP requests and store and retrieve data from a database. The CPU is going to be active for a fraction of a millisecond before it becomes blocked on either the database or network.

I’m not so sure that’s true reading through the privacy notice when enabling SMS filtering it reads “You can install and use third-party SMS filters. If you do, the filter provider can access all of the text and content included in incoming SMS and MMS messages that you receive from unknown senders.”

That doesn’t sound like the same thing as the content blocker api it sounds like it provides plaintext access to sms messages. And it’s enough of a risk that I decided not to install it.

I don’t think you need to be from the west coast to understand people saying SIKE. It’s a pretty common phrase across the US. I’m from Colorado and I heard that a fair amount growing up. Agree on the appropriate name though it was my first thought reading that it had been broken.

They can usually still see Domain names. DNS traffic is normally sent in the clear and in the event it’s not the SNI field in TLS (https) is unencrypted. So your ISP can know which domains you visit but not the individual sites on those domains you visit. (i.e they would know you visited google.com but not that you requested the page: google.com/q=your+question) Which depending on the site might not be all that sensitive but I’m sure you can think of a few examples of sites you wouldn’t want anyone to knowing you went to even if they couldn’t see which page.

To me being FIPS compliment would be a good definition of something being “Military Grade” because that would be the actual standards the US military would use. However, that still doesn’t mean it has the best security because really good algorithms like Ed25519 aren’t FIPS compliant dispute being much better than their FIPS counterparts IMO.

No Flops are floating point operations. GPUs are better at them because they run floating point operations in parallel on thousands of optimized cores. While python will run a floating point operation serially on (likely) a single general purpose CPU core. None of this really pertains to websites where the main bottle neck is IO so python is as good as anything else.

See paper. All the “misinformation” ever spread before the internet was written on paper. Is paper evil?

I highly doubt it. Dual EC DRBG basically works by encrypting your seed value with a NSA provided public key. It’s kinda amazing how blatant the back door is.

Ever heard of bitcoin?

You can do that too.

https://support.google.com/youtube/answer/7491256?hl=en

DNS servers can be used in an DOS amplification attack by sending requests with spoofed ip addresses. So if you don’t take measures to prevent this it’s likely your server will be used in DOS attacks.

https://us-cert.cisa.gov/ncas/alerts/TA13-088A