News for hackers. Stuff that matters.

wolfwyrd

Re:When random is not actually random enough on Wednesday October 07, 2026 @08:56AM (#49992114)
There is a series of blog posts[0] by Eric Lippert called "Fixing Random"[1] that starts at random and covers distributions, weights, noise and so much more. It's a fantastic deep dive into the subject.

[0] https://ericlippert.com/2019/01/31/fixing-random-part-1/

[1] https://ericlippert.com/tag/fixing_random/

Re:Jujutsu Worktrees Are Convenient on Monday December 08, 2025 @06:19AM (#46191009)
Phil Haack has a neat script called tree-me[0] that takes a lot of the pain out of this in vanilla Git

[0] https://haacked.com/archive/2025/11/21/tree-me/

Re:Jujutsu (jj), a Git compatible VCS on Sunday October 20, 2024 @11:27AM (#41895922)
Whatever I want because —amend is a thing?
It's fiber interconnect between sites that is not actively visible to other people who are routing data around the world. Think of it as being pre-layed but not yet turned on/made available.

See: https://en.wikipedia.org/wiki/Dark_fibre

Re:Slack AI Training with Customer Data on Friday May 17, 2024 @07:57AM (#40388915)
The way it's written means this just isn't the case. They _MAY_ use it for what you have mentioned above. They explicitly say "...here are a few examples of improvements..." and "How Slack may use Customer Data" (emph mine). They also... may not? And use it for completely different things that can expose who knows what via prompt hacking.
Shouldn’t[0] be able to. It’s all still fallible software written by humans.

[0] https://www.theregister.com/AMP/2022/06/02/conti_rasomware_i...

Re:ᚣ the Rune Programming Language on Sunday November 27, 2022 @04:02AM (#33761551)
This is a timing attack or timing oracle. Lets assume a mac represented in an array of 32 bytes. If we had a pseudocode method like:

    byte [32] (actualMac, expectedMac)
    for int x = 0..31
        if (actualMac[x] != expectedMac[x])
            return false;
        fi
    end
    return true;
We return false as soon as we hit an invalid byte in our calculated mac. If the time taken to execute one iteration of the loop is Y and the attacker is able to time this method accurately they will be able to tell what the value of actualMac is by feeding known inputs. They will know because the return time will be 2Y when they have bailed after the first byte. 3Y after the second, 4Y after the third etc.

This is why we should check the arrays in constant time - compare every byte in both arrays before returning. We do not return early so we can’t leak information

Re:Westinghouse sees a tech disrupter in its eVinci microreactor on Thursday November 24, 2022 @06:10AM (#33729997)
If they're modular then they'll be intended to run more than one. You get the land, grid tie-in, permits and staff and then... stack 4 of these instead of 1. You use the same benefits from economies of scale to have as many of these as can be safely crammed into your building and go from there.
Re:Ask HN: What game do you wish existed? on Wednesday May 25, 2022 @01:50PM (#31508010)
Star Citizen
I wrote a BDD style testing library. It builds on top of NUnit to make unit testing classes with dependencies super simple.

https://github.com/LeapingGorillaLTD/Testing

I was fed up of having to substitute every dependency manually whenever I wanted to write a test, finding it hard to apply clean software design principals to test suites.

It's laid out further in the thread [1]. The key quote comes from Thorsten:

> All that afaics doesn't matter. If a new kernel breaks things for people > (that especially includes people that do not update their userland) > then it's a kernel regression, even if the root of the problem is in > usersland. Linus (CCed) said that often enough

[1] http://lkml.iu.edu/hypermail/linux/kernel/1710.3/02487.html

Re:Simple Techniques for Lowering the Cost of Zero-Energy Homes on Friday September 01, 2017 @10:49AM (#15148762)
This came from the Zero Energy Project[1] which also has floor plans.

[1] http://zeroenergyproject.org/2017/07/24/simple-techniques-lo...

It's ok - it's made with <3
They'll still get hit hardest. Weak pound means more expensive imports. UK imports ~40% of it's food [1]. That food will now cost more to import raising prices at the supermarkets. Poorer people spend a larger %'age of their income on essentials like food.

The weak pound means importing oil (priced in USD) will be more expensive. This will affect Petrol prices (we're already seeing a 2-3p rise at the pumps). Poorer people spend a larger %'age of their income on essentials like fuel.

There are a number of knock-on effects from the weak pound. Yes it's good for exports but overall it's going to be a rough couple of years for the already disadvantaged.

Speaking to your point on competition as well - if the UK wishes to join the EU free market they will most likely need to accept freedom of movement. No treaty has ever been agreed with any country without this caveat (that covers the Swiss, Norway etc). It's possible that the UK may be an exception but it's unlikely.

[1] http://www.foodsecurity.ac.uk/issue/uk.html

Re:How to Safely Store Your Users' Passwords in 2016 on Wednesday February 17, 2016 @11:56AM (#11119207)
hmac.compare_digest is constant time whereas == will return as soon as a mismatch is found. The difference in return time can be measured. The key phrase is a Timing Attack[0].

[0]https://en.wikipedia.org/wiki/Timing_attack

Re:Around the World in 33 Keyboards on Wednesday January 27, 2016 @09:44AM (#10980203)
ALT+3. Dead easy right~
Re:The password hash Argon2, winner of PHC on Friday January 08, 2016 @08:50AM (#10864766)
Here's a discussion on that[0]. Depending on how you do it you either weaken it to the strength of the weakest algorithm or alternatively gain nothing but may introduce a weakness. It's basically a bad idea.

https://security.stackexchange.com/questions/93730/why-not-m... [0]

Older »