SpikeGronim

6 ms·

1.
by SpikeGronim 10y ago
ChaCha20 is implemented in hardware on many mobile platforms. It's often a preferred TLS cipher on Android. AES is common in hardware as well.
2.
by SpikeGronim 10y ago
This is the subject of an excellent book on Archer Blood: https://www.amazon.com/Blood-Telegram-Gary-J-Bass/dp/0307744...
3.
by SpikeGronim 11y ago
You can pressurize the gas and put a barometer in the tube in order to detect any breach of the tube. This was used during the cold war and the NSA tapped the communications cable anyway by filling the space around the tube with gas as well
4.
by SpikeGronim 11y ago
I love Brazil and Apollo. As an ex-Amazonian I miss them on a weekly basis.
5.
by SpikeGronim 12y ago
I don't think your attack violates the security model of this protocol. One of the proofs in the paper is that if you have a network of good and bad nodes the bad nodes can use tricks like you posted to discover whether a good or bad n
6.
by SpikeGronim 12y ago
You generally use Unicorn etc. behind something like nginx. The last time I did that I used nginx to handle thousands of concurrent connections that were forwarded to nCPUs Unicorn instances. Nginx is very good at handling lots of connectio
7.
by SpikeGronim 12y ago
Several things make it easier to maintain: - super fast compile times for fast developer iterations - you can create an interface (set of methods) that your module owns, and apply it to objects created by other modules without recompiling.
8.
by SpikeGronim 12y ago
They say no evidence of illegality, but there is evidence of poor judgement. Without commenting on the specifics of this incident that's a valid reason to fire a CEO/co-founder/exec. I have no particular knowledge of what hap
9.
by SpikeGronim 12y ago
I am an ex-AWS employee. I can verify that AWS was founded as a new line of business using new servers purchased for AWS. The idea that AWS was started using Amazon's spare capacity is widely repeated but false. Amazon is definitely le
10.
by SpikeGronim 13y ago
Yeah, the reason AMZN doesn't pay UK tax is NOT because they are not profitable. It is because they legally avoid taxes by basing all their EU operations out of Luxemburg. Tax codes need reform world-wide to avoid this kind of bad beha
11.
by SpikeGronim 13y ago
Prime is considered a marketing expense. Amazon absorbs hundreds of millions or even a billion dollars in shipping charges through prime. It's a huge reason they have a thin profit margin.
12.
by SpikeGronim 13y ago
"W/ the NSA program, you're just a row in a database, if you're not a terrorist* or associate with terrorists nobody gives rat's ass about what you're doing unless one can relate you to another suspicious chara
13.
by SpikeGronim 13y ago
I can confirm that Etsy.com is primarily PHP. We have no externally facing Rails projects. We have some internal tools on Rails. -- spike@etsy.com
14.
by SpikeGronim 13y ago
Legally, due to the EU Data Protection Directive. It's a legal obligation.
15.
by SpikeGronim 13y ago
Etsy.com! We're hiring, and we're turning a great many creative people into small business owners. https://www.etsy.com/careers
16.
by SpikeGronim 13y ago
Redis doesn't use libuv, and in fact rejected a patch from MS to add libuv support. The reason is dependency management, not performance. Redis takes very very few dependencies - basically just a C compiler and POSIX. This makes it eas
17.
by SpikeGronim 13y ago
Absolutely. Step 0 of this article should have been "profile your GC and establish that it is a problem."
18.
by SpikeGronim 13y ago
I've read all of those books. They cover the NSA chronologically, so there isn't much overlap. I would recommend all of them. (edited: typo)
19.
by SpikeGronim 13y ago
AFAIK there is no curent, practical "encrypted VM" that can protect itself from the hypervisor. Homomorphic encryption can theoretically do that, but is very slow and unproven right now.
20.
by SpikeGronim 13y ago
TCP cannot tell what the application wants. If the client application never closes the connection then TCP will keep that connection alive indefinitely (assuming you configured it with keep alives). Each connection consumes some resources o
21.
by SpikeGronim 13y ago
How do you know if this caller is from the NSA for real? I could get up to all sorts if mischief. Either I can make the NSA look bad, or I can social engineer my way into ISPs by pretending to be the NSA. Good on this ISP though!
22.
by SpikeGronim 13y ago
IANAL, but saying "pay me because I have a 0day exploit against your business" is often construed as extortion. You can end up in jail for that. Consult your lawyer before negotiating like this.
23.
by SpikeGronim 13y ago
Average size is irrelevant. A handful of 1G objects dwarf hundreds of 1 byte objects when computing the average. The overal distribution is interesting. There are actually three: GET sizes, PUT sizes, and stored sizes. They are not identica
24.
by SpikeGronim 14y ago
I saw the exact same thing with Cisco in the NY public school system. They gave my high school something like $50,000 of equipment in a rack to support two machines that submitted grades. We stripped it for parts and put it to better use, i
25.
by SpikeGronim 14y ago
This is optimized for bulk analysis. RDS is more optimized for low latency queries. This is because Redshift is column oriented: http://en.wikipedia.org/wiki/Column-oriented_DBMS .
26.
by SpikeGronim 14y ago
If you follow the advice in this paper[1] you will be measuring media errors in your drives. That means re-reading all data every N days, even archived data. Without periodically re-reading and validating (checksumming) the data you can't t
27.
by SpikeGronim 14y ago
I'll share how wavii does this. We use amazon elb and chef. The first chef recipe that runs on our frontend is "touch /tmp/website_should_drain". The website then returns 404 from the /status health check URL. We wait 30s, update the site,
28.
by SpikeGronim 14y ago
My favorite part is that they shut off their code signing infrastructure "within minutes". Good job Adobe! They are also saying that the root cause was essentially "somebody didn't follow procedures for setting up secure build servers, and
29.
by SpikeGronim 14y ago
Yes, that was my intent. I was asking for the other side to make a clear response and specifically to mention the Apache license in their response. They made a vague, long winded, PR-speak response which did not address any of the issues. I
30.
by SpikeGronim 14y ago
Thanks for responding here Jeff. The license on https://github.com/appcelerator/titanium_mobile is Apache 2.0. How can you possibly ask for money from a developer who used Apache 2.0 code? It seems like a black and white issue and that yo

More ›