Hacker News Reader

dfrankeon A Go implementation of Poly1305 that makes sense

That won't work. When we say "constant-time code" what we really mean is "code whose running time is independent of its input". It won't really be constant due to factors like the OS scheduler and the initial state of the CPU's instruction cache.

What you really want is https://github.com/agl/ctgrind or something similar.

dfrankeon Daylight Saving Time Year-Round, Abolish Standard Time in US

As one of the people who would be getting phone calls about all the software that breaks when EST gets redefined to be four hours behind UTC rather than five, I'd really not want to go to there. Either of "EDT is now year-round" or "The east coast of the US is now on AST" would lead to a lot fewer problems, as changes of that nature have to be dealt with pretty regularly.

dfrankeon How not to design a wire protocol

Just to clarify the phrase "one of the NTP people": I'm the lead designer of NTS, which adds modern cryptographic security to NTP. I did not design NTP; Dave Mills did that, in large part before I was born.

If I got the chance to redesign NTP from scratch, there are a lot things I'd change, but use of fixed binary fields is not one of them.

dfrankeon How not to design a wire protocol

I'm the lead author of the protocol that ESR is critiquing. I've just posted a rebuttal here: http://esr.ibiblio.org/?p=8254#comment-2202914

dfrankeon DMCA notice against oh-my-fish

Although this takedown notice evidences some... confusion... about how open source is supposed to work, it looks to me like the target actually did infringe the filer's copyright by stripping his name off the copyright headers, which is the one thing that the MIT license doesn't allow.

dfrankeon Falsehoods programmers believe about addresses

Furthermore, just because you don't have an address doesn't mean you can't receive mail! At least as recently as a few decades ago, there were rural communities in the US where nobody had a street address; the postal service knew where everybody lived and would deliver mail given just a name and town. I'm not sure whether this arrangement still exists in the US, but I'm pretty sure it still does in Ireland and probably elsewhere.

dfrankeon Marking HTTP as Non-Secure

That thread misses the most important way: the length of the request and the length of the response. On most small sites, the combination of the two will be enough to uniquely identify what page you're visiting.

dfrankeon Shell Shock Exploitation Vectors

Someone else already pointed this out in my comments section. I'm working on an update.

dfrankeon Shell Shock Exploitation Vectors

Probably not, unless there's something really weird in your Apache config.

dfrankeon Shell Shock Exploitation Vectors

The qmail bounty explicitly disclaims "bugs outside of qmail", which this one clearly is. So, no.

dfrankeon Willem Pinckaers on Akamai's flawed OpenSSL allocator patch

Speaking as a security researcher at Akamai, I can say that tptacek is 100% correct here. We're absolutely better off for having received Willem's report, and I'm pretty sure we're all mature enough to tolerate the jabs that accompanied it.

I didn't have any part in writing this allocator, but I was asked to do a code review prior to publication. I told Rich Salz that it would take me at least two days to do a thorough one, and we both made the decision that it was better that we just get this code out there for public review and discussion than that we wait until we thought it was perfect.

So, with the caveat that we're still evaluating most of Willem's technical claims (and I'm probably going to be in the office all night doing so), the only sentence in Willem's report that I really take exception to is this one:

  In either case they should not be sending out non-functional,
  bug ridden patches to the OpenSSL community, while claiming
  they protected Akamai against the Heartbleed attack.

This statement is self-refuting. If we hadn't published this patch, we wouldn't be having this discussion, and some of the bugs that Willem and others are finding would have gone unnoticed. I almost certainly would have caught the issue with the CRT intermediates if Willem hadn't done so first, but I doubt I'd have caught everything that has or will be identified through public scrutiny.

dfrankeon Murder Suspect John McAfee: I'm Innocent

"Luger", originally, meant the Luger P08 pistol. You'd probably recognize it as the sidearm you see the Nazis carrying in WWII movies. It was the first pistol to take the cartridge which today most people just call "9mm".

Today, "9mm Luger", "9mm Parabellum", and "9x19mm" are all synonyms for this same cartridge. Usually when "9mm" is said without qualification, this is what it means. However, there are other much rarer 9mm cartridges such as the 9x18mm Makarov, and also "9mm short" and "9x17mm" are rarely-used synonyms for the (common) cartridge usually called .380ACP.

dfrankeon Murder Suspect John McAfee: I'm Innocent

Looking at a cartridge from a few feet away, anyone who's a gun geek and has decent eyesight can probably tell you that a 9mm cartridge is either that, a .40 S&W, or something very obscure. Also though, almost all handgun cartridges have their caliber stamped on the rim. I just checked to see from how far away I can read the markings on my Federal .40 (I don't own any 9mm, but it should be basically comparable). In good light and at just the correct angle, I can read it from about arm's length. Otherwise I have to hold it close.

dfrankeon Printers are spontaneously printing odd "SQL" strings

Heh... a similar "project" when I was in high school got me sent to the principal's office once :-)

dfrankeon Microsoft sticks to its guns, keeps Do Not Track on by default in IE10

Embrace and extinguish.

dfrankeon Entrepreneur Challenges Peter Thiel To Million Dollar Chess Game

A.J. was my classmate and chess-teammate in elementary school. I still remember his kicking my ass in a game of blindfold chess while I was sitting next to him on the plane to the scholastic nationals, while concurrently my dad was getting his ass kicked by our coach in the next row up. I had no idea until I came across this article what he's been up to since then :-)

dfrankeon Falsehoods Programmers believe about Time

You didn't mention any assumptions that get screwed up by the presence of leap seconds.

N. There are 60 seconds in every minute. N+1. UNIX timestamps always advance monotonically.

dfrankeon Schemaverse: MMO entirely in Postgres

This looks like the perfect game for goofing off at work without anyone knowing. Especially if you're a DBA.

dfrankeon University of Florida shutting down research in Computer Science department

What of Computer Science? Is that staying under CLAS/CISE?

dfrankeon University of Florida shutting down research in Computer Science department

It's not obvious that they're actually "shutting down" any research, though. They seem just to be moving it under the aegis of other departments.

dfrankeon University of Florida shutting down research in Computer Science department

I graduated from UF in 2007 and have in no way since kept up with departmental politics, but as of then, CISE was a bit of a Frankenstein creature. As an undergraduate, if you were looking for a computing-related degree, you had five possible majors to choose from:

* Computer Science (College of Liberal Arts and Sciences; CISE Department)

* Computer Engineering with Software Emphasis (College of Engineering; CISE Department)

* Computer Engineering with Hardware Emphasis (College of Engineering; ECE Department)

* Electrical Engineering (College of Engineering; ECE Department)

* Computer Information Sciences (College of Business; CISE Department).

So basically, the CISE department was answerable to three different colleges, and some of those colleges offered very-closely-related degrees that weren't in the CISE department.

As for myself, I started out in Computer Engineering with Software Emphasis. I later switched to Computer Science. The reason for this change was that I wanted to double in Mathematics, which belongs to the College of Liberal Arts and Sciences. Having a double major is a lot easier when both majors are in the same college, because you then don't have to worry about satisfying conflicting and redundant gen. ed. requirements.

So, as a CISE alumnus, I have a vested interest in maintaining the reputation of that department, and this reorganization sounds likely to damage it. However, the status quo (as of 2007) is a mess, and this change might overall be for the better.

dfrankeon RSA public exponent size

http://archiv.infsec.ethz.ch/education/fs08/secsem/Bleichenb...

dfrankeon Who Expected That? Extreme close-ups create a Klein Bottle.

Oh dear, I just realized I dropped a sentence while I was composing this comment and now it's too late to edit. The beginning of it should read, "Yes you can. Cut out a long rectangular strip of paper. Run a sharpie..."

dfrankeon Who Expected That? Extreme close-ups create a Klein Bottle.

You can't uniquely identify each point on its surface using only two dimensions

Yes you can. Run a sharpie along the bottom edge of the paper so that it bleeds onto both sides of the paper. Now tape the ends of the strip together with a half twist to make a Möbius strip. Place a point anywhere on the strip. Draw a line through that point such that the line meets both edges of the strip at a right angle. Measure the distance along that line between your point and the darkened edge; call this x. Now, hold the Möbius strip in your left hand so that you're pinching it by the tape. With your right hand, run your finger along the strip, starting from the tape and moving to the right. Measure how far you have to move your finger in order to reach the line you drew; this could require up to two loops around the strip. Call this distance y. The tuple (x,y) uniquely identifies your point.

dfrankeon Google to Sell Heads-Up Display Glasses by Year’s End

Relevant: http://dilbert.com/strips/comic/1994-10-12/

dfrankeon Thinnest silicon-chip wires refuse to go quantum

from what I read that's still an exponential problem for Quantum computers

Shor's algorithm is cubic, not exponential, in the log (i.e. the number of bits) of the number being factored.

dfrankeon Thinnest silicon-chip wires refuse to go quantum

DJB has done quite a bit of research on what crypto could look like if large quantum computers ever become a reality. http://pqcrypto.org/

dfrankeon This Site’s Domain is Stolen

I think the accepted definition of a domain squatter is someone who registers domains with the intent of flipping them for a profit. This is more broad than "specifically and reasonably belongs to someone else" since you could merely be speculating that someone, at some point in the near future, might want to open a shop called "XYZ pizza", but still doesn't include pud.

dfrankeon Mass-scale Cold Fusion either becomes reality or proved a scam today

I think what he means is "systematic_error = 1/log(log(equipment_cost))"

dfrankeon The Slashdot Effect from the Other Side

Did you create an HN account and submit this so that you could measure the HN effect? :-)