whyever

7 ms·

1.
by whyever 10d ago
They are currently bootstrapping battery cell production in Germany, see PowerCo.
2.
by whyever 4mo ago
There was Quelle, Europe's largest mail-order and retail company. They were excited about mailing their catalogue on CD-ROM, but slept on the Internet. In 2009, they went bankrupt.
3.
by whyever 5mo ago
LLMs are vulnerable to prompt injection attacks, so I'm not sure they are in advantage.
4.
by whyever 10mo ago
Note that N=1 for the memory safety vulnerabilities they had with Rust, so the error of the estimated average number of vulnerabilities per LOC is quite large.
5.
by whyever 11mo ago
It's missing which point?
6.
by whyever 11mo ago
I agree, but https://www.pcg-random.org/ still advertizes PCG as "challenging" to predict, and critizises other RNGs as predictable and insecure.
7.
by whyever 1y ago
Yes, but this relation does but apply to statistical mechanics and statistical physics, they mean the same: https://en.wikipedia.org/wiki/Statistical_mechanics What is included in "statistical physics" that i
8.
by whyever 1y ago
They are synonyms.
9.
by whyever 1y ago
Signal asks you to repeat the key immediately before even enabling backups. It cannot fail much later unless you modify the digit after the check.
10.
by whyever 1y ago
That's a good question! Especially after Frank McSherry's COST paper [1], it's hard to imagine where the sweet spot for Spark is. I guess for Databricks it makes sense to push Spark, since they are the ones who created it. In
11.
by whyever 1y ago
It's a quantitative problem. How big is the error introduced by the simplification?
12.
by whyever 1y ago
I know some people who do trunk-based development with pair programming: You write the code together, and once you are satisfied, you merge it to the main branch, from where it is deployed to production if the tests pass. It works well for
13.
by whyever 1y ago
It would require a lot more memory, because you have to remember every generated UUID. And how would you do the partial match? You are not going to observe any collisions.
14.
by whyever 1y ago
Doesn't the clustering make collisions strictly more likely?
15.
by whyever 1y ago
You can also look at the expected number of collisions instead, which is approximately the number of random numbers squared, divided by the size of the space of random numbers. Then you can choose how many collisions to accept on average. (
16.
by whyever 1y ago
> With that access you can also "do" things, like sending messages or delete stuff. If you break E2E encryption, you can likely also impersonate and "do" things.
17.
by whyever 1y ago
I know some conservative newspapers (Frankfurter Allgemeine Zeitung) kept using the old orthography for a while, but even they started using the new one in 2007, ten years after the reforms.
18.
by whyever 1y ago
Yes, in this case it would be easier to brute-force the key instead of the password, so the additional characters don't really help.
19.
by whyever 1y ago
Such long passwords are silly, they will be effectively truncated by the key length of the underlying cryptography.
20.
by whyever 1y ago
That's not how errors add up, it's nonlinear. You have to take the sum of squares. So in your case, it wouldn't be 10 * 0.01 = 0.1, but sqrt(10 * 0.01^2) = 0.032, which is less than one third of a tenth.
21.
by whyever 1y ago
I think the argument was about automated killing, not automated weapons. There are already drones from Germany capable of automatic target acquisition, but they still require a human in the loop to pull the trigger. Not because they technic
22.
by whyever 1y ago
All the attacks you described also apply to downloading and executing a file. I don't think `curl | sh` is worse in this regard.
23.
by whyever 1y ago
Ok, so how would such a secret end up in a commit? E.g., I don't see why I would have my home address anywhere close to a code repository. Maybe if I used the wrong "secret" email address when authoring the commit? If it&#x27
24.
by whyever 1y ago
If you rotated the secret, why do anything else? I don't think there is any potential further damage (except maybe reputational).
25.
by whyever 1y ago
> I mean, webp was made by Google and we know how many of their heavily promoted creations are dead already... I don't understand this argument. WebP is an algorithm, not a service. You cannot kill it once it's published.
26.
by whyever 1y ago
Docker is not really a security boundary (unless you use something like gVisor), so it's a bit of a red herring here. The idea is to make your app immutable and store all state in the DB. Then, with every deployment, you throw away the
27.
by whyever 1y ago
If it is a disagree button, then why is it disabled for new users?
28.
by whyever 1y ago
Access logs do help with this. They have been successfully used by the police to identify rogue officers abusing their access to police databases.
29.
by whyever 1y ago
They main defense against internal attacks is bookkeeping. Banks have been dealing with this for thousands of years. I recommend the corresponding chapter in Security Engineering by Ross Anderson: https://www.cl.cam.ac.uk/ar
30.
by whyever 1y ago
> by choosing to write safe Rust you're sacrificing many perfectly good patterns that the compiler can't understand in exchange for safety Historically, programmers drastically overestimate their ability to write perfectly safe

More ›