142 reputation
4
bio website
location
age
visits member for 1 year, 2 months
seen Apr 14 at 21:33

Kids in rectangles irritating sick urchins rattling foxes, directory.kirisurf.org lol


Jan
5
accepted Why would Tor not be vulnerable to this easy-sounding attack?
Jan
5
accepted Why are security-crucial software written in unsafe languages?
Oct
21
comment Why are security-crucial software written in unsafe languages?
Why is that an issue? I can't believe every single GC in the world relies on undefined behavior, and might crash the kernel.
Oct
21
comment Why are security-crucial software written in unsafe languages?
Even professional developers can make fatal mistakes in coding C. I doubt, for example, that the makers of Firefox and Chrome were "unprofessional". On the other hand, it is reasonably easy for an "amateur", who knows a lot about theoretical cryptography but NOT about the nitty-gritties of low-level programming, to write secure software in a high-level language.
Oct
21
comment Why are security-crucial software written in unsafe languages?
But things like malloc can block for a long time as well. Moreover, common "deterministic" GCs such as C++ refcounting smart pointers do cause large amounts of lag when, say, the root of an enormous tree goes out of scope, and the whole tree must be freed IMMEDIATELY.
Oct
21
comment Why are security-crucial software written in unsafe languages?
"The driver author needs to know exactly when memory will be allocated and destroyed, for example". Hmm. Why exactly? I never got why people are so fussy about timing in low-level systems. Nobody really cares if your screen lags by 50 milliseconds every 20 seconds because of garbage collection?
Oct
20
comment At what point is a cryptosystem “rolling your own”?
I am more "reimplementing TLS plus some breaking incompatibilities" than designing a system from scratch. The thing is that using TLS seems to be a pain to do correctly, considering many OS TLS libraries are seriously outdated, etc.
Oct
20
comment At what point is a cryptosystem “rolling your own”?
I would be implementing an algorithm very similar to TLS but avoiding some of its known pitfalls (which cannot be changed mostly due to compatibility), such as it's love of CBC, and MAC-then-encrypt. My usage case is also going to leave the PKI part of SSL unused.
Oct
20
asked At what point is a cryptosystem “rolling your own”?
Oct
19
awarded  Commentator
Oct
19
comment Why are security-crucial software written in unsafe languages?
In C/C++, there are lots of things that usually work but present a security hole (gets for example). In other languages they only present an crash risk due to an unhandled exception (out of range).
Oct
19
comment Isn't all security “through obscurity”?
The interesting thing is that supposedly the Enigma's mechanical PRNG was known to contain a significant bias (namely, it never produced a zero, so cipher-bytes never enciphered to itself), but the Nazis did not fix it, instead just messing up the wires (implementation) once in a while, hoping to thwart reverse-engineering. Of course that didn't work.
Oct
19
asked Why are security-crucial software written in unsafe languages?
Oct
11
awarded  Student
Oct
11
asked Why would Tor not be vulnerable to this easy-sounding attack?
Sep
16
comment Popular Security “Cargo Cults”
@drjimbob Or software with open source but completely developed in-house without using a mess of contributors (c.f. Red Hat Enterprise Linux).
Aug
5
accepted Get info encrypted across a MITM proxy
Aug
5
comment Get info encrypted across a MITM proxy
Yes, but the problem is that it stops people, and ignoring it means that you will get eavesdropped. Is there some protocol that just won't fail no matter what and would, say, actively countermeasure and stop a MiTM from working when it happens?
Aug
5
asked Get info encrypted across a MITM proxy
May
8
comment Why shouldn't we roll our own?
It would be really nice to know what that "introductory cryptography text" is :)