onlydnaq

802.1x is quite trivial to bypass if you have an authenticated device (in this case the intercom) that you can transparently bridge[1].

[1]. https://www.defcon.org/images/defcon-19/dc-19-presentations/...

Something about that headline really irks me. I think GitHub is an amazing place for people to share code, I also think it’s really nice of them to do this.

But the maintainers aren’t “their” maintainers. They are maintainers using GitHub for their projects.

Probably just me overreacting, just thought I’d mention it.

Without having looked into it too deeply I feel that they are somewhat “cheating” by using a superserver to launch a new process for each connection, thus letting the OS handle the dynamic allocation needed for each connection.

Still pretty impressive project. Would be fun to take a deeper look at it at some point.

A CPU can halt as a power saving measure, and still respond to interrupts.

I don’t know where the files for the mouse are (or if they’ve been released), but the design files for the trackball can be found here [1].

[1] https://github.com/ploopyco/classic-trackball/tree/master/ha...

I have one of the full size Ploopy trackballs, and it feels really good in the hand. It is 3D-printed, and it shows, but the texture of it feels pretty nice when using it.

I struggled a bit with accuracy at first, but now I’ve lowered the DPI to around 500 and it’s become much more usable for me since.

> There’s probably a way to get those last three into my NixOS config

There is, it’s called home-manager [1] and it’s a pretty nice way to manage your config files and user packages even if you’re not on a NixOS system.

[1]. https://github.com/nix-community/home-manager

It's worth to know that the watch also tracks HRV whenever you use the Breathe app, so if you want to get consistent HRV readings the easiest way is to use Breathe once a day (for example right when you wake up).

That was their April fools joke though.

> Could I have done all that in a single shell, then had it automatically cleaned up when I was done?

Yes, that is a pretty standard workflow for most nix users. You either set up a shell.nix for your project with all of its dependencies, or if you need a certain tool once you just write for example: ‘nix shell -p iotop’ to enter a shell where iotop is in the path.

Why would anyone use rdrand directly? Seems like user space applications should use getrandom() or /dev/urandom and the kernel should use rdrand as a complementary random number source in its random number generator.

No user space program should need to use rdrand directly at all.

That’s exactly what I meant as well. SQL may be the implementation, but if so with a well designed exposed schema, not with the application internals.

When it comes to modern web development I’m more of an observer than a contributor, so my opinion might not carry a lot of weight. However for me all these abstractions seems to get closer and closer to querying a database using SQL directly.

A carefully designed database schema would be able to support all of these use cases in a way that (at least for me) seems a lot simpler than wrapping it in new abstractions. Inserting multiple objects in the same transaction?, already implemented. Updating several fields at the same time as well? Getting only the entities you are interested in together with their subentities?, well that’s what a relational database does.

As I said, I’m not a web developer, and I haven’t touched on use cases where a lot of different things need to happen on server operations, but all the examples in the article would be easily solvable with SQL.

I believe you might be confusing it with Voat.

I believe the correct way to protect against ReDOS is to use one of the many regular expression implementations that do not have exponential worst cases.

Nowadays there are good DFA or Tree based matching algorithms that are O(mn) where m is the length of the regular expression and n is the length of the input.

If I want to decrypt a message to you that I have intercepted I can create my own email containing a modification of the intercepted message and send it to you, causing you to send me the plaintext contents.

The only difference I’ve seen is a function that converts Keras models into TensorFlow estimators.

You could take a look at tobii [1]. They make some interesting products where they combine eye tracking, speech analysis and other stuff to create user interfaces for people with specific needs.

[1] https://www.tobiidynavox.com/en-US/tobii-dynavox-pceye-plus/

I would recommend you to try the intel python distribution. Comes with highly optimized numpy, scipy, matplotlib, pandas and so on. Everything compiled with icc and linked with MKL (intels BLAS library).

This is a classic trick, and as you write could be used for performance benefits in the old day.

However, the semantics differ from just using a temporary variable in that if a and b are in the same memory location then the result will be zero.

This was used in an entry for the underhanded C contest [1] if I remember correctly where for an implementation of RC4 the author defined the following macro.

    #define SWAP(x, y) do { x^=y; y^=x; x^=y; }

And used it for swapping the values in the substitution table for the cipher, e.g. SWAP(S[i], S[j]). The weakness was that since sometimes the indices are the same in RC4 the substitution table would be gradually replaced with zeroes.

[1] http://www.underhanded-c.org/_page_id_16.html

To be honest, nonce reuse with Bernsteins authenticated encryption algorithms will lead to the same problem as those the author points out with GCM (i.e. plaintext recovery). However, the biggest issue with GCM isn't that the plaintext leaks when reusing nonces, it's the fact that reusing nonces leads to an attacker being able to forge arbitrary ciphertexts.

That really depends on your use cases.

I love Postgres and have been using it for a long time. However if you need good support for, for example, self-updating efficient materialized views, then Postgres won't really do (yet).

I don't really agree with the premise that not having type classes is as big of a problem that the author thinks, but to answer your question OCaml has functors which are basically higher order modules. A functor in OCaml is a module defined over abstract types and you instantiate it with concrete types.

A lot of people in the Haskell community have yearned for this as well, and the latest version of the Haskell compiler will support something similar called Backpack.

> At the moment there are few enough that they could fetch a list of all of them and cache it (the public registry lacks a documented API for doing that right now, but we can certainly provide one)

Might I suggest having a bloom filter containing all the existing type declaration (which would be quite small) and only querying the registry if the bloom filter reports the type declaration as a positive.

Since the filter can be really small it will probably scale a lot better than a complete list of all type-declarations, and a new filter could be downloaded by the clients every now and then.

Awesome, good work. I was just going to ask you if you had any roadmap for adding Argon2i.

I don't believe that this is a critical issue. The PGP-trust model doesn't need you to trust neither the keyserver nor the connection to the keyserver. You are supposed to look at the actual key, and the actual signatures of the key to decide if you trust it.

Anyone can usually upload any key to the keyserver, so even if you use TLS that wouldn't make a difference from a security perspective.

If we are writing programs to write to arbitrary memory, wouldn't it be easier to write them in C? :)

  int main(int argc, char *argv) {
    *((char *)addr_to_write) = val_to_write;
  }

On a more serious note: this is a fun compiler bug, but I wouldn't call it a valid exploit. If you have the power to run your own binary on a system, then of course you can write to any memory the process has access to.

You can find a presentation about the cards used by SL from last years SEC-T conference here http://www.sec-t.org/2010/presentation-videos.html

The name of the presentation is Hacking the RKF ticket system, it can be found at the bottom of the page.