001spartan

I think it's primarily written to a different audience than yourself, then. I mean that in the best of ways. As an infosec sort, it came across pretty clearly what they intended. I think it's just a culture difference between information security, and the rest of IT.

As someone interested in getting into penetration testing, this is a fascinating look into how techniques that have been around forever can be used to get into anything. Disregarding the scale and target, this isn't anything groundbreaking. It's just the fact that a company like Gamma was vulnerable to simple things like this that is surprising.

Blizzard's new title is called Heroes of the Storm. It's free to play as well, but works in a similar manner to League of Legends, where there is a rotation of free heroes to play every week. If you want other heroes, you earn them through playing the game, or microtransactions. It seems to be aimed more at a casual crowd, though.

You can earn levels through playing the game, and earning drops in-game as well. It's not necessarily from buying levels alone.

Just because an algorithm isn't suitable for use as a cryptographic hash function doesn't mean it's easy to crack. There's a world of difference.

That is very true. However, the number of people who are both good software engineers and good cryptographers is very low. Personally, I can't say that I've seen experts being hostile towards those willing to learn the concepts and best practices for cryptography, though. The hostility is usually reserved for those who try to roll their own crypto with ill considered design, no matter how nice their code is (Telegram, etc). But it's possible that I could be entirely out of touch with that.

I'll grant you that. Crypto is just one aspect of the security field that doesn't seem very intuitive to me, but it's probably just me.

Disclaimer: I'm an infosec student/enthusiast, so I may have a different perspective. Also, it's late; it's entirely possible that this is sleep deprivation talking.

I think it's more a case of the subject being so important that it's not really something that you can take shortcuts with. When it's something so critical to daily life as the internet is becoming, it's imperative that all code made for security purposes is carefully considered, and architected to avoid the tiniest bugs. Hobbyists or amateurs (myself included) are not necessarily qualified to judge what might constitute a critical bug, and that is one of the reasons the barrier to entry in the field is so much higher.

The fact remains that crypto _is_ very hard. I don't see why telling people that equates to "chasing people away" from cryptography. It would be even more dangerous to not mention that fact when people try to roll their own encryption systems. It's just not something that can be safely done by a hobbyist/amateur, at least not for critical applications.

When you're talking about something used to secure as much sensitive data for as many people as TLS/SSL, timing and side channel attacks are very important. Any little flaw can lead to information exposure such that people are put into danger.

I was under the impression that they did in fact contact package maintainers in addition to companies like CloudFlare.

For dedicated roleplaying, I really like Roll20. It's specifically designed for that, and I've used it for several different groups, both from the DM side and the player side.

This is a very striking article, and I feel it gave me some important things to consider when it comes to medical decisions like this. While I'm still (very) young, and hopefully won't have to deal with this sort of thing for many years, I hope that when I am in the position of choosing to prolong an uncomfortable life, or dying with a little more dignity, I will be brave enough to choose the cheaper and potentially less painful option for all involved.