timmclean

9 ms·

1.
by timmclean 3y ago
For supply chain security, you might be interested in cargo-vet[0], a tool for coordinating and requiring manual reviews of open source dependencies. Both Mozilla and Google[1] have started publishing their audits.toml files, which are mach
2.
by timmclean 3y ago
Is there a reason why they couldn't split the load across multiple HSM? For something so sensitive I would've expected a design where one or more root/master keys (held in HSM) are periodically used to sign certificates for t
3.
by timmclean 3y ago
Saving you a click: despite what the repo title might suggest, while the code is open source, the model weights cannot be used commercially without permission. > The code in this repository is open-source under the Apache-2.0 license. Th
4.
by timmclean 4y ago
FWIW, spot prices for c5a.24xlarge in us-east-2b and us-east-2c seem to have been under $0.92/hr for most of the last 3 months. So, assuming some flexibility on the choice of region, that would adjust your estimate to $0.92 / $1.6
5.
ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough(wiz.io)
116 points by timmclean 5y ago|34 comments
6.
ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough(wiz.io)
10 points by timmclean 5y ago|2 comments
7.
by timmclean 6y ago
Thank you for your comments on this thread and others today. They have been very helpful in understanding what is actually going on.
8.
by timmclean 9y ago
I believe you're thinking about `add`. According to Agner Fog's instruction tables, the load and ALU uops are fused for `add`s, but not in the case of `inc` http://www.agner.org/optimize/instruction_tables.pdf
9.
by timmclean 9y ago
That all makes sense, but it doesn't seem to apply to the example code in the article, right? `inc` doesn't decode to a single fused uop on Ivy Bridge. AFAIK, the example code in both cases decodes to the same number of uops in th
10.
by timmclean 10y ago
The important thing to take away from this article is that MD6 really shouldn't be used in any production software, unfortunately. MD6 didn't even make it past the first round of the SHA-3 competition, so it hasn't received m
11.
by timmclean 10y ago
I've been meaning to learn jq, so I decided to give it a try. FRUITS=$(cat input.json | jq '.models | map(select(.title == "fruits")) | .[0]') FRUIT_NAME_KEY=$(echo "$FRUITS" | jq '.fields |
12.
Why losing a home means losing everything(washingtonpost.com)
3 points by timmclean 11y ago|0 comments
13.
by timmclean 11y ago
The author should use a library that provides a simple "encryptWithPublicKey" method, so that any choices about RSA key size, AES mode of operation, etc are all taken care of. NaCl[1] would probably be best, since it's writt
14.
by timmclean 11y ago
Heads up to anyone considering using this: the author wrote their own crypto code[1]. I would recommend against using this until that is fixed... I've already spotted a few vulnerabilities. [1] https://github.com/Feder
15.
Million Dollar Curve(cryptoexperts.github.io)
4 points by timmclean 11y ago|0 comments
16.
The design flaw in PBKDF2(chosenplaintext.ca)
3 points by timmclean 11y ago|0 comments
17.
Researchers make quantum computing breakthrough, paving way for world-first chip(smh.com.au)
2 points by timmclean 11y ago|0 comments
18.
by timmclean 11y ago
Modern password hashes are designed to use a large amount of RAM in addition to CPU time in order to make password cracking using ASICs and GPUs more difficult. The paper on Argon2[1], the winner of the recent password hashing competition,
19.
by timmclean 11y ago
Mainly because it adds complexity, and complexity in crypto can hide subtle bugs. Example: http://blog.ircmaxell.com/2015/03/security-issue-combining-b...
20.
Escaping callback hell(chosenplaintext.ca)
3 points by timmclean 11y ago|1 comments
21.
by timmclean 11y ago
To expand on this, here are a few mistakes that I caught while scrolling quickly: > For production applications some AES variant or RC4 would be a better choice. RC4 is not at all a good choice for new applications[1]. > SHA1 SHA-1 is
22.
by timmclean 11y ago
I prototyped almost exactly this a couple years ago: https://www.timmclean.net/json-editor/ I haven't had time to come back to it, so I'm very glad to see that other people are working on the idea!
23.
Uninterruptible Programming(faq.sealedabstract.com)
1 points by timmclean 11y ago|0 comments
24.
by timmclean 11y ago
Code for a Cause : Web Developer for Healthcare Non-Profit (work from home in Toronto, ON) We Canadians are proud of our universal health care, but our healthcare system faces difficult challenges. Our hospitals' staff use “enterprise
25.
by timmclean 12y ago
Of course; I was speaking informally. "allowing collisions" == "allowing it to be feasible to find a collision"
26.
by timmclean 12y ago
Collision resistance is critical for most applications of the OP's scheme. The OP is proposing using hashes as identifiers for immutable content. Imagine the following: - I publish a JavaScript library under this scheme using a hash
27.
by timmclean 12y ago
N-bit hashes have at best (N/2)-bit collision resistance (see birthday attack[1]). An 80-bit security level does not have a large enough margin of safety nowadays. RIPEMD has a 256-bit variant, but it hasn't received enough scrut
28.
by timmclean 12y ago
A member of the SHA2 (or SHA3) family would be more appropriate. RIPEMD-160 is slower and less resistant to collisions. I agree however that the use of SHA1 is problematic!
29.
by timmclean 12y ago
Agreed. Unfortunately, some implementations missed that: https://github.com/namshi/jose/commit/127b4415e66d89b1fcfb5a... https://github.com/davedoesdev/python-jwt/commit/5ddb71
30.
What I don't like about JSON Web Tokens(timmclean.net)
8 points by timmclean 12y ago|4 comments

More ›