214 reputation
19
bio website
location
age
visits member for 2 years, 5 months
seen 16 hours ago

Kids in rectangles irritating sick urchins rattling foxes, directory.kirisurf.org lol


Jul
17
accepted Is this idea for a password manager secure? If so, why doesn't anybody use it?
Jul
17
awarded  Nice Question
Jul
17
awarded  Yearling
Jul
16
awarded  Popular Question
Jul
16
awarded  Critic
Jul
16
asked Is this idea for a password manager secure? If so, why doesn't anybody use it?
May
6
comment What makes Let's Encrypt secure?
@Brian An active MiTM attacker would also break Let's Encrypt.
Mar
2
awarded  Popular Question
Sep
24
awarded  Autobiographer
Jan
5
accepted Why would Tor not be vulnerable to this easy-sounding attack?
Jan
5
accepted Why are security-crucial software written in unsafe languages?
Oct
21
comment Why are security-crucial software written in unsafe languages?
Why is that an issue? I can't believe every single GC in the world relies on undefined behavior, and might crash the kernel.
Oct
21
comment Why are security-crucial software written in unsafe languages?
Even professional developers can make fatal mistakes in coding C. I doubt, for example, that the makers of Firefox and Chrome were "unprofessional". On the other hand, it is reasonably easy for an "amateur", who knows a lot about theoretical cryptography but NOT about the nitty-gritties of low-level programming, to write secure software in a high-level language.
Oct
21
comment Why are security-crucial software written in unsafe languages?
But things like malloc can block for a long time as well. Moreover, common "deterministic" GCs such as C++ refcounting smart pointers do cause large amounts of lag when, say, the root of an enormous tree goes out of scope, and the whole tree must be freed IMMEDIATELY.
Oct
21
comment Why are security-crucial software written in unsafe languages?
"The driver author needs to know exactly when memory will be allocated and destroyed, for example". Hmm. Why exactly? I never got why people are so fussy about timing in low-level systems. Nobody really cares if your screen lags by 50 milliseconds every 20 seconds because of garbage collection?
Oct
20
comment At what point is a cryptosystem “rolling your own”?
I am more "reimplementing TLS plus some breaking incompatibilities" than designing a system from scratch. The thing is that using TLS seems to be a pain to do correctly, considering many OS TLS libraries are seriously outdated, etc.
Oct
20
comment At what point is a cryptosystem “rolling your own”?
I would be implementing an algorithm very similar to TLS but avoiding some of its known pitfalls (which cannot be changed mostly due to compatibility), such as it's love of CBC, and MAC-then-encrypt. My usage case is also going to leave the PKI part of SSL unused.
Oct
20
asked At what point is a cryptosystem “rolling your own”?
Oct
19
awarded  Commentator
Oct
19
comment Why are security-crucial software written in unsafe languages?
In C/C++, there are lots of things that usually work but present a security hole (gets for example). In other languages they only present an crash risk due to an unhandled exception (out of range).