zimmerfrei

9 ms·

1.
by zimmerfrei 4mo ago
> AMD ROCm is only supported in the rocm branch. Has anybody tried it? There is a lot of emphasis on MacBook Pro in this thread, but I would like to use it with an AMD Halo Strix with 128GB of unified RAM.
2.
by zimmerfrei 8mo ago
> Nvidia released the first Shield Android TV in 2015 > it took about 18 months to [create] an entirely new security stack [...] Android updates aren’t actually that much work compared to DRM security, and some of its partners weren’t
3.
by zimmerfrei 8mo ago
I don't think that a 100% anonymous attestation protocol is what most people need and want. It would be sufficient to be able to freely choose who you trust as proxy for your attestations *and* the ability to modify that choice at any
4.
by zimmerfrei 9mo ago
If you use AEAD, you clearly expect your recipients to use a recent client. Same as if you want to use PQC or any other recent feature. If your audience is wider, dont use AEAD but make sure to sign the data too. With respect to the 90&#x27
5.
by zimmerfrei 9mo ago
It is not a coincidence that most of the various proposed alternatives to PGP (signal, wormhole, age, minisign, etc) are led by a single golden implementation and neither support nor promote community-driven specifications (e.g., at the IET
6.
by zimmerfrei 9mo ago
When you encrypt something, you are the one deciding which level of interoperability you want and you can select the crypto primitives matching capabilities you know you recipient reasonably have. I don't see anything special with thi
7.
by zimmerfrei 9mo ago
As mentioned a few days ago, this post mainly covers a gpg problem not a PGP problem. I recommend people to spend some time and try out sequoia (sq) [0][1], which is a sane, clean room re-implementation of OpenPGP in Rust. For crypto, it us
8.
by zimmerfrei 9mo ago
This is the right answer. The problem mostly concerns the oldest parts of PGP (the protocol), which gpg (the implementation) doesn't want or cannot get rid of.
9.
Lex Fridman Podcast: Pieter Levels(youtube.com)
2 points by zimmerfrei 2y ago|0 comments
10.
by zimmerfrei 2y ago
Yes, there are methods to combine multiple, different key exchange algorithms so that you need to break all, like in: https://datatracker.ietf.org/doc/rfc9370/ https://datatracker.ietf.org/doc&#x2F
11.
by zimmerfrei 2y ago
I like it, because it is indeed nice to have a NIST-backed construction. But at the same time, it is disappointing that you get locked out of several niceties of NIST KDFs, such as label and context. I get that they are sacrificed to minimi
12.
by zimmerfrei 3y ago
Let's assume that you have a simple XOR between two registers. If the CPU can pre-label a register as having no bits set (and they can or speculate on it), during scheduling, it could theoretically simply drop the XOR, transfer or rena
13.
by zimmerfrei 3y ago
Your argument boils down to "all hardware implementations so far in history never optimized word boolean operations so future implementations will keep doing so". I think that is just an assumption and I would not take that risk f
14.
by zimmerfrei 3y ago
You assume that boolean operations are constant time, and whether that holds depends on the uarchitecture and how sophisticated the optimization layers are (e.g. nothing prevents the compiler or even the CPU from short-circuiting the OR as
15.
A multi-core Python HTTP server (much) faster than Go (spoiler: Cython) (2018)(nexedi.com)
2 points by zimmerfrei 3y ago|0 comments
16.
by zimmerfrei 3y ago
That's still described as a kernel for the TEE (like OPTEE is), it doesn't look like a replacement for Linux, which runs in the REE.
17.
by zimmerfrei 3y ago
But then, the vast majority of the affected libraries in that page don't use GMP at all, but their own custom implementation (including openssl). In reality, RSA signing with blinding will make any implementation (including those based
18.
NetHSM – The Trustworthy, Open Hardware Security Module That Just Works(nitrokey.com)
2 points by zimmerfrei 3y ago|0 comments
19.
by zimmerfrei 3y ago
Certainly Google (and Oracle and AWS): https://www.marvell.com/company/newsroom/marvell-enables-ent...
20.
by zimmerfrei 3y ago
More interestingly, Cavium (now Marvell) also designed and manufactured the HSMs which are used by the top cloud providers (such as AWS, GCP, possibly Azure too), to hold the most critical private keys: https://www.prnewswire.com
21.
Public Discussion of CommScope CA Inclusion Request(groups.google.com)
1 points by zimmerfrei 3y ago|0 comments
22.
by zimmerfrei 3y ago
>> The discrete TPM's threat model was never designed to cover you from attackers using oscilloscope to probe your laptop's SPI bus during the boot process for unencrypted data. This is not really true. All TPMs (or at least
23.
by zimmerfrei 3y ago
>> Pixel phones (and all other phones running Tiramisu+) can attest to the full DICE chain's integrity to any app that requests it. This can be done through the KeyStore API. I do not see this - the KeyStore API available to apps
24.
by zimmerfrei 3y ago
> I also noticed how the TCG manages to promote DICE without noticing it makes their baby TPM 2.0 obsolete. Alas, TCG seems to have recognized the mistake, so they have recently proposed for the DICE to rely on a separate entity (the DP
25.
by zimmerfrei 3y ago
That is not really a big improvement, as it just covers the threat of compromise for the CDN and any of proxies, but not of the PiPI infra itself. That is covered by PEP 480, which is already 9 years old: https://peps.python.org&
26.
CSA Matter – Distributed Compliance Ledger and the IoT (2022) [pdf](csa-iot.org)
2 points by zimmerfrei 3y ago|0 comments
27.
by zimmerfrei 3y ago
>> The thread already indicated that this was fixed and waiting for the next release Making a release is work too, so the response looks OK to me.
28.
by zimmerfrei 3y ago
And why exactly should pypi implement it? Pypi should just be the organized repository of packages, with only some limited assurance over their authenticity. That is, pypi should just let authors upload signatures and metadata. Something el
29.
by zimmerfrei 3y ago
> The point is that they don't remain the same. Assuming that they do is an operational error. How many projects are signing each release with a different PGP key each time? And what are the odds that such projects will actually cor
30.
by zimmerfrei 3y ago
>> but I don't think you actually want this: lots of large packages have multiple release managers (and contributors who come and go); you don't want to manually resolve each new human identity that appears for a package dis

More ›