brohee

That's a very optimistic assumption, the target is 50Hz but if it is below or over for a long period of time (e.g. high load in winter making it hard to sustain the nominal frequency) there are no provision to make it run faster or slower unless the time drifted by more than 30s (that's possibly only valid for Europe).

More at https://wwwhome.ewi.utwente.nl/~ptdeboer/misc/mains.html

Cryptography Research patented quite a few DPA/SPA countermeasures, if there is a non obvious patent on Curve448 it will likely be one of those making it hard to make a non infringing, fast yet not vulnerable HW implementation... Given their business in licencing those countermeasure (https://www.rambus.com/security/dpa-countermeasures/licensed...), one can see their eagerness to get some curves in widely used standards as suspicious in that light.

I'm not really concerned but I also understand why one wouldn't implement anything Rambus related given their history of patent trolling...

No, Curve448 is as good as can be per the public knowledge, see https://safecurves.cr.yp.to/. What one could expect given Rambus history is undisclosed patents, possibly the most efficient hardware implementation. They have been known to get their tech standardized (not disclosing IP claims) and come back at adopters with patent violation suits.

Rambus was pretty well known for using a submarine patent against RAM manufacturers back in late nineties https://www.edn.com/submarine-patents-could-torpedo-rambus/ followed by fifteen years of acting like a patent troll...

They may have good tech but have an history of being super shady.

Or you find it somewhat credible but still use them because fending off the NSA is not something you want to spend energy on, and you are confident in the fact that NSA think no one else can find the backdoor.

Writing this article without mentioning AirBnB is quite the exercise in avoiding talking about root causes.

My understanding is that one patent is still covering it for a few months : https://patents.google.com/patent/US7949129B2/

Kinda agree but Mathlib and its documentation makes for a big corpus to learn by example from. Not ideal but it helps.

https://github.com/leanprover-community/mathlib

There is something, sadly likely illegal in most of the world, that would help: a blacklist of clout chasing fake security researchers, widely shared by people in position of offering an interesting job, or any job really.

Permitting to fill CVEs without the cooperation of editors is sadly needed, so it's the easiest solution.

They are destroying a public good and deserve no less.

Oh... So that's how you end up with class names ending in FactoryFactory... Factorisation at any cost without making sure it makes sense and will keep making sense...

Let's Encrypt isn't exactly hiding that it's only practical in the context of automation

From their FAQ (https://letsencrypt.org/docs/faq/):

What is the lifetime for Let’s Encrypt certificates? For how long are they valid?

Our certificates are valid for 90 days. You can read about why here.

There is no way to adjust this, there are no exceptions. We recommend automatically renewing your certificates every 60 days.

You seem to operate under the assumption that certificate revocation does anything on the web. In practice it is only useful in the presence of mandatory OCSP stapling. And mandatory it is not.

Confidentiality isn't the only thing TLS safeguards. Integrity is a big one too.

Some ISPs were injecting ads in all sites, sometime breaking them in the process. TLS put an end to it.

Stapling works, but is a lot more useful if it is mandatory (which it is not). OCSP as intended in the early 2000s where the client query the CA is a non starter, the hosting cost would be such that not only free certificates would end but the paying one would be much more expensive.

I think most people will find short lived certificates more convenient than mandatory OCSP stapling.

Obtaining the initial certificate is somewhat vulnerable to MitM if the attacker can divert the verification request to a server under its control. Some countries (including Iran IIRC) went as far as using BGP announces to do that (which makes it very obvious).

Let's Encrypt uses Multi-Perspective Validation (https://letsencrypt.org/2020/02/19/multi-perspective-validat...) in order to protect from most interception of the DV request.

CRL are a failure, OCSP can't scale, so to get some assurance that if the private key was compromised somewhat recently, it's either mandating OCSP stapling or shorter lived certs...

Why do you hate the short lifetimes?

BitLocker is mostly worthless if you don't also password UEFI, disable booting off any other disk than the main one, and enable SecureBoot.

Yeah I was unclear, it's supposed to address the physical attacks part. If no key leaves the CPU unwrapped, it's down to software exploits and decapping the CPU...

At least TME-MK and its AMD equivalent are supposed to address in memory key stealing/memory bus snooping (even if it's still unclear to me how the key are generated/stored). There is still decapping and probing the CPU itself but given the size of features is that even remotely doable?

Well you will boot the laptop but still have to get past the login screen. Intercepting the key permits to read/write whatever you want on the disk, and thus backdoor the OS (as he does).

TLDR if you actually want to act upon that :

Takeaways

The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem.

If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary.

IMHO something is still missing. Bonin's father was a pilot (in Air France AFAIK) and I can't help but think the likelihood he was the best candidate was low, but that legacy played a part.

I also wonder if he had much passion for flying or was just following his father footsteps. I wish they would value passion more, easily demonstrated with military/glider (I must miss some..) experience.

https://en.wikipedia.org/wiki/Nixtamalization is done using limewater and actually vital to sustain life on a maize diet. But it should come with a warning.

Well he definitely misrepresented the conference taking place during Kippur.

Too bad the dude is the epitome of an unreliable narrator. Last year's discussion got some interesting links...

Most notable: https://old.reddit.com/r/suse/comments/umfyku/the_time_suse_...

It's alive in some smart TVs too. Pretty sure at least Panasonic runs a fork.

No need to go full polygamy. After WW II (or the Great Patriotic War), USSR didn't exactly became polygamous but put policies to support single motherhood, that works too.

Quoting https://www.reddit.com/r/AskHistorians/comments/dv3u8t/what_...

"The shortage of men also meant a very important shift, in which the Soviets worked to try and both destigmatize single-motherhood by increasing state benefits they could receive and featuring mothers of ambiguous marital status in propaganda, while also tacitly encourage even married men to sleep around by preventing the single mothers from suing the father for child support, and making it harder for their irate wives to divorce them. The result being that many men would have numerous affairs, and even unmarried men would often bounce from relationship to relationship."

The interbellum period in France and Germany also saw an increase in sexual freedom leading to more single mothers, without going to polygamy.

I was once in a new rental Skoda (using Here maps), that tried to make me cross a river on a bridge that was never built (I looked it up afterward, the project was abandoned). Google Maps saved the day...

There is a promising HIV vaccine in trial (eOD-GT8 60-mer), but it will take an extremely long time to assess, but given how efficient tri-therapies and PREP are, this is certainly not a revolution.

How do you plan to have any assurance that none of your dependencies is doing it? You could well consume a string you didn't build and be affected.