152 reputation
5
bio website
location
age
visits member for 1 year, 10 months
seen yesterday

Kids in rectangles irritating sick urchins rattling foxes, directory.kirisurf.org lol


Oct
21
comment Why are security-crucial software written in unsafe languages?
Why is that an issue? I can't believe every single GC in the world relies on undefined behavior, and might crash the kernel.
Oct
21
comment Why are security-crucial software written in unsafe languages?
Even professional developers can make fatal mistakes in coding C. I doubt, for example, that the makers of Firefox and Chrome were "unprofessional". On the other hand, it is reasonably easy for an "amateur", who knows a lot about theoretical cryptography but NOT about the nitty-gritties of low-level programming, to write secure software in a high-level language.
Oct
21
comment Why are security-crucial software written in unsafe languages?
But things like malloc can block for a long time as well. Moreover, common "deterministic" GCs such as C++ refcounting smart pointers do cause large amounts of lag when, say, the root of an enormous tree goes out of scope, and the whole tree must be freed IMMEDIATELY.
Oct
21
comment Why are security-crucial software written in unsafe languages?
"The driver author needs to know exactly when memory will be allocated and destroyed, for example". Hmm. Why exactly? I never got why people are so fussy about timing in low-level systems. Nobody really cares if your screen lags by 50 milliseconds every 20 seconds because of garbage collection?
Oct
20
comment At what point is a cryptosystem “rolling your own”?
I am more "reimplementing TLS plus some breaking incompatibilities" than designing a system from scratch. The thing is that using TLS seems to be a pain to do correctly, considering many OS TLS libraries are seriously outdated, etc.
Oct
20
comment At what point is a cryptosystem “rolling your own”?
I would be implementing an algorithm very similar to TLS but avoiding some of its known pitfalls (which cannot be changed mostly due to compatibility), such as it's love of CBC, and MAC-then-encrypt. My usage case is also going to leave the PKI part of SSL unused.
Oct
19
comment Why are security-crucial software written in unsafe languages?
In C/C++, there are lots of things that usually work but present a security hole (gets for example). In other languages they only present an crash risk due to an unhandled exception (out of range).
Oct
19
comment Isn't all security “through obscurity”?
The interesting thing is that supposedly the Enigma's mechanical PRNG was known to contain a significant bias (namely, it never produced a zero, so cipher-bytes never enciphered to itself), but the Nazis did not fix it, instead just messing up the wires (implementation) once in a while, hoping to thwart reverse-engineering. Of course that didn't work.
Sep
16
comment Popular Security “Cargo Cults”
@drjimbob Or software with open source but completely developed in-house without using a mess of contributors (c.f. Red Hat Enterprise Linux).
Aug
5
comment Get info encrypted across a MITM proxy
Yes, but the problem is that it stops people, and ignoring it means that you will get eavesdropped. Is there some protocol that just won't fail no matter what and would, say, actively countermeasure and stop a MiTM from working when it happens?
May
8
comment Why shouldn't we roll our own?
It would be really nice to know what that "introductory cryptography text" is :)
Feb
20
comment NSA Suite A Cryptography: Security through obscurity?
Also, the NSA probably has the capability to hire many cryptographers for review work, and also has the power to forbid them to publish the details. Most other people do not; thus, obscure algorithms are likely to be very weak.
Feb
12
comment Make the public key unrecoverable given the private key
I didn't think you understood my question. The private key isn't even supposed to be secret (it's publicly in the program directory).
Feb
12
comment Can I scan with nmap from cloud services?
No, AWS gives you a full paravirtualized server, for free for one year even. It's behind a NAT though...