stipes

8 ms·

1.
by stipes 14y ago
Agreed. As a point of comparison, it looks like you can get 650 million/s on a cg1.4xlarge instance [1] (Amazon's GPU computing instance with 2x Tesla Fermi M2050 GPUs), and it looks like they cost $2.10/hour per instance. So some quick mat
2.
by stipes 14y ago
Your numbers show that SRP-SHA1 is about 50000 times better than salted SHA1. Not great, better than nothing (at least for those of us without dictionary-targetable passwords).
3.
by stipes 14y ago
Down-thread [1], someone claims to have found SRP to be about 172 times slower than SHA1 on CPU due to the modular exponentiation and other overhead. Some numbers run by zaroth (down-thread) [2] show that we could see 100k 1024-bit modular
4.
by stipes 15y ago
My guess? The team was solid. Since they found something else (i.e., something better), they probably are.
5.
by stipes 15y ago
The design of BitCoin only includes very weak anonymity. A medium-to-large scale network analysis could most likely break any anonymity people thought they had.
6.
by stipes 15y ago
Yes, in general write to /dev/random with the write permissions is how entropy gathering daemons and the like work. It gets added the input and mixed in. However, that doesn't fix the issue of how a snapshot restore works on most hypervisor
7.
by stipes 15y ago
Part of the problem is the conflict of transparency and security here. Fixing the wholesale reuse of RNG state would most likely require modifying the guest so that it is aware of being restarted from a snapshot so it can react appropriatel
8.
by stipes 15y ago
I did some research work last semester on crypto inside VMs. One of our initial readings was Yilek's work on attacking VM crypto through VM snapshots http://cseweb.ucsd.edu/~syilek/ndss2010.html
9.
by stipes 15y ago
Whoops. The protocol you described is actually secure against that, since your login passes the preimage to the server for hashing and then comparison.
10.
by stipes 15y ago
This increases the password space (assuming a cryptographically strong hash), but if the datastore is compromised, an attacker can just bypass the client hashing (by changing JavaScript, etc) and just pass in the hash itself.
11.
by stipes 16y ago
I believe Koza has several patents for things he has discovered using Genetic Programming / Algorithm techniques.
12.
by stipes 16y ago
Well, as true decentralized bootstrapping is still an open problem (as far as I know), I'll give them a bit of a pass on that. It's an interesting idea, but I'd agree that there are possible ramifications of repeated pseudonymous communicat
13.
by stipes 16y ago
Bodybuilders would tend to go for the 100% method, not the 80/20. Although reading through some responses to the book on bodybuilding forums is an entertaining way to spend an hour.
14.
by stipes 16y ago
I would personally say that even if nearly everything in the book fails for me, it was a good enough read to be worth $15 (roughly what I would pay for a novel, let's say).
15.
by stipes 16y ago
He isn't CEO anymore...
16.
by stipes 16y ago
I'm more familiar with the term "Computer Engineer" applied to hardware design folks, and "Software Engineer" with human programming. Am I nuts? Aside from the nitpick, the point is a good one. Thanks for the essay.
17.
by stipes 16y ago
AGPL is the license that closes the service provider loophole. Normal GPL only applies if you are delivering binaries---providing a service is considered "in-house" use.
18.
by stipes 16y ago
Thus the reason the AGPL was created, although hardly anyone uses it (to my knowledge).
19.
by stipes 16y ago
I much prefer this treatment: http://rjlipton.wordpress.com/2010/06/26/stating-pnp-without... However, it is more of a "p vs. np for non CS theory people".
20.
by stipes 16y ago
The article is rather sparse on technical details. The homepage for LOCKSS is http://www.lockss.org/lockss/Home . It appears to use some sort of Byzantine fault tolerance in its auditing system (to detect the fault and repair) spread acros
21.
by stipes 16y ago
There's a good wiki on Starting Strength at http://startingstrength.wikia.com/
22.
by stipes 16y ago
I was surprised by the lack of mention for PlanetLab and Emulab.
23.
by stipes 16y ago
TLS/SSL can cache the session in order to actually improve performance and scalability. Otherwise you'd have to redo the exchange each time you made a request. My guess is that the level of caching you'd want TLS/SSL to do is dependent on
24.
by stipes 16y ago
I read this back as a private preprint. Definitely well designed (a good fit for USENIX, where it will be published). They had to overcome some significant technical hurdles in order to get it to be properly backwards compatible (issues wit
25.
by stipes 16y ago
My initial reaction to the title was that winning a professional level soccer game by more than five points does cause a loss of sorts: the physiological taxation that such effort causes could easily decrease the chances of winning games
26.
by stipes 16y ago
> ''The practicable and certain way of finding Longitudes'' - satellite navigation. We figured that out (for varying definitions of "practicable and certain") as early as the invention of the watch.
27.
by stipes 16y ago
Of note is that most of what are called "distributed social networks" are actually federated social networks.
28.
by stipes 16y ago
The government would still know (if they were logging traffic) that you accessed the page. In this case, as it is publicly accessible, the encryption is fairly meaningless.
29.
by stipes 16y ago
After some brief digging, it appears there has been some published research on location diversity in path selection in Tor since I last worked on that problem. https://docs.google.com/viewer?url=http://www.cs.rpi.edu/~ed... has some good
30.
by stipes 16y ago
Yes, Tor is for anonymity, not privacy. But that just means you still need to be operating over a secure channel---be that SSL or sending the documents encrypted, etc. The fact that they operated compromised nodes does NOT diminish from Tor

More ›