oconnore

Since I'm on a roll with truncated hashes: SHA2-512/384, and SHA2-512/256 are not vulnerable to a Merkle-Damgard length extension attack.

Thus, a construct like hash(key + message) can be used similar to SHA3 [1]

[1]: https://keccak.team/keccak_strengths.html

If you need a shorter hash just truncate a modern hash algorithm down to 160 or 128 bits. Obviously the standard lengths were chosen for a reason, but SHA2-256/160 or SHA2-256/128 are better hash functions than SHA1 or MD5, respectively. Blake2b/160 is even faster than SHA1!

(I suspect this would be a good compromise for git, since so much tooling assumes a 160 bit hash, and yet we don't want to continue using SHA1)

What are you using to store ~37 Tesla Powerwalls worth of energy? How is it EMP hardened?

There is still a manual high beam, which is what I use. Same interface as any other car.

If you buy a pre-2021 Tesla with a round steering wheel, it can mostly function as a normal car.

They are built by people who are excited about the web, so it sort of makes sense that anything off the critical path of: “make websites and web applications great” would be deemed less important. Why make local search when there is a web application called Google?

Ferraris probably aren’t know for having sufficient cup holders.

> fired 2 weeks before my first vesting period because I took 2 weeks off after my father's death

That seems quite implausible. Not that the managers there weren’t jerks, or that this didn’t contribute to the conflict, but there seems to be a lack of reflection on this story because there is almost certainly more to it than that.

> it's probably not ideal to build a 30 story condo tower in the middle of a neighborhood of single family homes

You mean because then it would be in their back yard? Or why?

It seems like the query planner could perform this optimization, but also it seems like the index could maintain cardinality data to avoid requiring a scan/offset of ids.

If the index had cardinality metadata, it could jump directly to the leaf node containing the first row in the result set.

[I work at Fivetran]

Which connector was that?

You can turn off tables you’re not interested in, but perhaps this was a bug.

[I work at Fivetran]

The comment “there was no product here” is referring to a specific (very lucrative) market segment.

The rest of the product was and still is selling just fine.

The new tanks are fiber wrapped composite, not steel.

If you're including cryptography in a system design, you are almost certainly relying on NIST standards to select algorithms.

Maybe it safeguards them from looking like they've screwed this up, but in terms of providing a concrete recommendation to system implementers, how does this safeguard anything? How does offering multiple algorithms in the PQC category help me make systems safer? What am I actually supposed to do here (how do I reflect this hedge in a system design)?

They didn't feel the need to provide multiple recommendations during the AES, or the SHA-3 process, even though Rijndael and Keccak used different constructions relative to RC6/TwoFish and SHA-2/Blake2. Why now?

If NIST feels the need to hedge their bets, why are they publishing at all? The whole point of these recommendations is so that I, a non-expert, don't have to reason about cryptographic bets.

> Additionally, SPHINCS+ will be standardized to avoid only relying on the security of lattices for signatures

> Both BIKE and HQC are based on structured codes, and either would be suitable as a general-purpose KEM that is not based on lattices

What's up with this caveat? Why would the standard require algorithms not based on lattices assuming there is confidence in the lattice based approach?

Is this a security concern, or is there some performance (ops/sec or size) related trade-off?

Perhaps, instead of trying to identify issues with git, think about how really deep team based collaboration works in other programs (say, online video games?) and then work backwards to see if there are opportunities in code collaboration tools.

Of course, just making an IDE multi-player would introduce chaos. What if the tool solved that chaos?

The title has been editorialized to emphasize workplaces that don't actively share some values, but the specific survey result from Qualtrics (midway through the article) is actually:

> 54% — said they would be willing to take a pay cut to work at a company that shares their values.

> And 56% said they wouldn’t even consider a job at a company that has values they disagree with

So, for a company that doesn't go around taking sides, there may be less willingness to take a pay cut for a good cause, but presumably the full talent market is open for them.

The enforcement authorities aren't on my case, though.

Plastic can be synthesized via syngas (a mix of hydrogen and carbon monoxide), which itself can be produced through sustainable mechanisms like biofuels or hydrogen electrolysis and CO2 capture.

That process starts from a lower energy level than starting from methane or oil, and so overall its more expensive. We would have to be willing to commit to generating a "surplus" of carbon-free power (e.g. nuclear, wind, solar) to support that sort of manufacturing, but it would be possible.

Also, a great thing about running electrochemical processes off of a periodic energy source like solar or wind is that the economics are easy to load-shift -- you care about the aggregate work output, not the consistency of work output.

I think it's trying to stay fairly close to C, with additional features selected judiciously. Systems programming was identified as an important design goal (e.g. having close control of memory layout).

See also: https://en.wikipedia.org/wiki/Go_(programming_language)#Omis...

I think of Haskell along with other languages that allow for shipping small, single-file binaries with a garbage collected, high level language. The straightforward alternatives I'm aware of include Nim, OCaml, Crystal, and Go.

Go is the most popular of this set, but to me seems like it barely qualifies as "high level". On Tiobe, the next most popular language from this set after Go is Haskell.

I like Haskell just fine, but what I really care about is "a more high level GC'd language than Go that ships binaries".

I don't share or endorse this specific concern, but it's disingenuous to dismiss extrapolations like this as a category. The exercise of power is not always apparent at face value.

Of course you should get chickens, but what on earth leads you to believe this is the right place to ask about it?

You can run https://gvisor.dev/ without any virtualization requirement. We use this to host user-submitted configurations (not arbitrary code, but arbitrary input to ~mostly trusted code).

Does this not meet your requirements?

Apple leverages iCloud backups to have visibility and LEO-compatibility into what you're doing on the device. Generally speaking, your day to day activities are carefully protected with good protocols and security design.

You can do that with first-party cookies though.

Allow some facebook supplied javascript to set a first party cookie when the user hits website.com/ad-34, and then reference that 1st party cookie the next day when the user returns. Phone home when they buy something. Facebook can now correlate (1) the ping they received to begin with, (2) the user session cookie they initiated on the first visit, and (3) the user session they observed when a purchase was made.

I'm sure things get easier with 3rd party tracking, but fundamentally you can do it without cross-site tracking.

Why does ability to attribute an ad depend on the ability to track individuals?

IIUC, you can do attribution with a very basic ad: <a href="website.com/ad-34" ping="fb.com/my-product/ad-34/ping"><img src="fb.com/my-product/ad-34/img.jpeg" /> Come buy my product, you'll love it!</a>

Then you sum up all the "/ad-34" hits, and figure out how many of those user sessions (which are now on your own site -- single domain, but perhaps leveraging a script supplied by the ad network) went and actually bought something. The ad network can correlate those sessions with the "ping" it receives to determine clicks vs. conversions.

Bitcoin clearly qualifies as "interstate commerce".

- If you share your password across sites that used a hypothetical browser-implemented PAKE, site A cannot login to your account on site-B

- If a site is attacked, there is no risk that password material was extracted from application memory — site operator can dump session tokens and safely re-auth users.

No, it would be much better to use a zero knowledge proof (typically called a PAKE — password authenticated key agreement) to demonstrate that the user knows their password without sending that password over the channel.

Sending the password over HTTPS doesn’t expose the password to passive observers, but it does unnecessarily expose the password to the server.

https://en.m.wikipedia.org/wiki/Password-authenticated_key_a...