16,798 reputation
12785
bio website
location Brooklyn, NY
age 32
visits member for 2 years, 11 months
seen 8 mins ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Apr
14
comment Heartbleed: Why does the client supply the length of the message at all?
@PeterDettman - At that point the standard said just dump the payload and padding -- didn't specify how the payload / padding was differentiated (presumably a header not deigned to mention at that point). Juho first said let's specify the header, (2) and was concerned why these fields are allowed to be so large (concerned about both types) and that if you allow 2^14 - 5= 16379 that requires a uint16 (two byte field).
Apr
14
answered Cryptosytem Question
Apr
14
comment Heartbleed: Why does the client supply the length of the message at all?
@PeterDettman - I added another long section with nuggets seen in the TLS IETF mailing list. It's interesting that many several people noted this potentially opens up side channel attacks. Adding randomized padding seems to be poorly justified based on an analysis of DAE and vague hope to prevent flaws of bad ciphers (meanwhile let's open this side channel).
Apr
14
revised Heartbleed: Why does the client supply the length of the message at all?
added 2550 characters in body
Apr
13
revised Heartbleed: Why does the client supply the length of the message at all?
added 1034 characters in body
Apr
13
answered Heartbleed: Why does the client supply the length of the message at all?
Apr
13
awarded  Popular Question
Apr
13
revised Who proposed adding heartbeat to SSL? And who proposed it's form?
added 328 characters in body
Apr
13
comment Heartbleed: hackers have already used the vulnerability?
@Clockwork-Muse - Fixed.
Apr
13
revised Heartbleed: hackers have already used the vulnerability?
added 106 characters in body
Apr
13
revised Who proposed adding heartbeat to SSL? And who proposed it's form?
added 1098 characters in body
Apr
13
answered Who proposed adding heartbeat to SSL? And who proposed it's form?
Apr
13
awarded  Great Answer
Apr
13
revised Heartbleed: hackers have already used the vulnerability?
added 59 characters in body
Apr
13
answered Heartbleed: hackers have already used the vulnerability?
Apr
12
accepted Does xkcd.com/1353 overstate heartbleed's capability?
Apr
11
awarded  Announcer
Apr
11
comment Ethicality of websites that test other sites for Heartbleed
It is easy to test for heartbleed vulnerability without the risk of getting any valuable data; e.g., you have payload length of 20, but only send 16 bytes (minimum size). Does it fail as it should or does it return 4 extra bytes? Those four bytes of exposed memory will not in anyway be useful to attack the system. However, it does indicate the system is likely vulnerable.
Apr
11
comment How to explain Heartbleed without technical terms?
@MichaelBorgwardt - I tried giving a thorough answer without resorting to just technical jargon or giving silly analogies. I believe some found it helpful. It's not obviously not an "Explain it like I'm a five" or explain it in under a minute, but take the time to explain and related concepts like you are an intelligent adult, even if you aren't a computer/security expert.
Apr
11
comment Does xkcd.com/1353 overstate heartbleed's capability?
@AviD - I think Mr Munroe takes heartbleed very seriously as today's comic also discusses heartbleed in depth (and gives a great summary of it). So I don't see it dripping in sarcasm (besides the obvious comic parts referring to imaginations/paper/clay tablets being safe and the Blade Runner quote).