Reputation
Next tag badge:
97/100 score
25/20 answers
Badges
14 226 353
Newest
 Nice Answer
Impact
~4.4m people reached

Mar
16
comment How, if at all, are some programming languages inherently less safe?
Proponents of static (respectively dynamic) types always present their favourite language feature as the best way to achieve "safety" but it is not really substantiated in actual practice -- developer's discipline is much more important. But note that not all developers are equivalent; some will be more at ease with static type-checking, while others will be more efficient with dynamic type-checking. In general, the best language a developer may choose is the one he masters, and that won't be the same language for every developer.
Mar
16
revised How, if at all, are some programming languages inherently less safe?
added 471 characters in body
Mar
16
answered How, if at all, are some programming languages inherently less safe?
Mar
15
answered What is the difference between PCI-DSS compliance and certification?
Mar
14
awarded  Nice Answer
Mar
13
awarded  Good Answer
Mar
12
awarded  Nice Answer
Mar
11
answered Principal Password in Kerberos KDC database
Mar
11
answered What is the point of using an open source and secure OS if you are running it on a machine with closed source firmware?
Mar
11
awarded  Enlightened
Mar
11
awarded  Nice Answer
Mar
11
answered Increasing the Calculation Cost of Hashing
Mar
11
comment Secure Configuration of Ciphers/MACs/Kex available in SSH
@Mecki: I would contend that speed matters only up to what the underlying network can absorb. Even with CBC, a normal PC can do AES encryption faster than what can be sent over gigabit ethernet -- especially since all modern x86 systems have the AES-NI opcodes. What CTR parallelism gains is better performance for constant-time implementations (not table-based implementations) on platforms that have large integer registers but do not have dedicated AES hardware -- there we are talking about smallish ARM systems, not PC.
Mar
10
awarded  Good Answer
Mar
10
comment Is there a PRNG in Java with a period of at least 256 bits?
@TrevorBernard: Cryptographic security relies on unpredictability. It does not matter whether all shuffles are mathematically reachable, only that outsiders (attackers) cannot differentiate between a "true" random shuffle and the one you make with your PRNG.
Mar
10
awarded  Nice Answer
Mar
10
comment Is C a good choice for security-related software any longer?
@Adjit: it depends on the context, but, as a starting point, C# is not bad. Thanks to Mono, code written in C# can run on Windows, OS X and Linux. It has automatic memory management, checks array accesses, and no undefined behaviour on integer computations.
Mar
10
answered Proxy + TOR = anonymous?
Mar
10
answered Is C a good choice for security-related software any longer?
Mar
10
answered Is there a PRNG in Java with a period of at least 256 bits?