opheliate

Well, we still haven't got a standardised set of quantum-resistant cryptographic recommendations from NIST (expected to arrive 2022-2024), but since the article was released, the NSA have replaced Suite B with the CNSA [0]. CNSA is similar to Suite B, in that it is also not quantum-resistant, and also recommends AES, ECDH, ECDSA, and SHA-2. However, it also recommends RSA & classic Diffie-Hellman over multiplicative groups of integers, while Suite B exclusively recommended elliptic curve-based public-key crypto.

Things are definitely in a bit of a weird state, the current messaging from the NSA [1] is pretty mixed:

> For those partners and vendors that have not yet made the transition to Suite B elliptic curve algorithms, we recommend not making a significant expenditure to do so at this point but instead to prepare for the upcoming quantum resistant algorithm transition.

> For those vendors and partners that have already transitioned to Suite B, we recognize that this took a great deal of effort on your part, and we thank you for your efforts. We look forward to your continued support as we work together to improve information security for National Security customers against the threat of a quantum computer being developed. Unfortunately, the growth of elliptic curve use has bumped up against the fact of continued progress in the research on quantum computing, which has made it clear that elliptic curve cryptography is not the long term solution many once hoped it would be. Thus, we have been obligated to update our strategy.

> It is important to note that we aren't asking vendors to stop implementing the Suite B algorithms and we aren't asking our national security customers to stop using these algorithms. Rather, we want to give more flexibility to vendors and our customers in the present as we prepare for a quantum safe future. Where elliptic curve protocols are to be used, we prefer Suite B standards be used to the fullest extent possible as they have a long history of security evaluation and time tested implementation that newer proposals do not yet have.

I think from any other crypto vendor, it would be a lot easier to take this at face value, but the NSA's incentives are so mixed, it's difficult to know what to think.

0: https://en.wikipedia.org/wiki/Commercial_National_Security_A...

1: https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa...

At this point, seeing the TrustArc dialogue evokes a visceral urge to exit whatever page I'm on ASAP. I can't believe they're able to get away with this kind of behaviour.

Could you elaborate on this a bit? I’m not sure what you mean.

For colour printing, I found an Epson EcoTank on Gumtree that a local business was giving away for free, having found the process of replacing ink too tedious. For those who don't know, the EcoTank line don't use cartridges in the traditional sense, you just pour ink directly into tanks on the printer. It's a bit of a hassle to fill compared to just putting cartridges in, but for just printing stuff off for around the house, it's worked out so much cheaper for me so far. Plus there's no worry about proprietary cartridges being discontinued in the future. If you can find one for free/cheap, I'd say go for it :)

My thoughts, correct me if I'm wrong here: If I'm on a very low income, likely 100% (or more) of my monthly earnings will go to buying food, paying rent/utilities, etc, so under a consumption tax, a higher proportion of my income will be taxed than under income tax (people in the lowest tax bracket generally won't pay income tax at all). Of course, you could exclude these necessities from tax, but then I find it difficult to see if tax revenue would be high enough from just taxing non-essential items.

IMO, any tax system where the poorest people pay a higher proportion of their income than those richer than them is flawed.

During my first year of university I took notes in a Markdown/MathJax static-site-generator monstrosity I wrote during my A-levels. This was in real-time during my lectures, and I didn't feel I'd be able to keep up doing it in LaTeX - it's great for expressing mathematical ideas quickly, but not great when you just want to get formatted text down fast.

I'm now fast enough that I'm able to just take notes in LaTeX directly, but for that first little while, Markdown was a very useful backup.

The other benefit was that Markdown is so easily extensible. I wrote a very small little DSL for expressing graphs, and then had the generator render anything in certain code blocks as a Cytoscape graph which I could interact with in the output pages. Wouldn't even want to try adding that to LaTeX.

My (much) older brother has severe dyslexia. He's bright, and now owns his own business, but in his school, they'd already reached the capacity for SEN provision, and he was refused a diagnosis. He could have massively improved his literacy if help was just available, but at that time, it simply wasn't. Branding anyone who doesn't immediately take to school an "idiot" is incredibly myopic.

I don't understand how, with the cost associated with re-opening and operating the plant, the cost of purchasing the rigs, the cost of paying to offset their carbon emissions, the cost of the gas, etc., this can be profitable? Or is it a bet that Bitcoin is going to rise? That seems incredibly risky, even in the crypto space.

There have always been issues with Cloudflare's DNS and archive.is, IIRC it's because Cloudflare don't pass on some information that the operators of archive.is think they should. Unfortunate, but both parties perceive it as something the other should fix.

https://community.cloudflare.com/t/archive-is-error-1001/182...

https://news.ycombinator.com/item?id=19828317

https://twitter.com/archiveis/status/1017902875949793285

A bit off topic, but I'm constantly impressed by the flexibility of LLVM to be adapted to many different language compilation tasks, and immensely grateful for its existence. One of my favourite examples of its use is SAW [0], which symbolically executes LLVM bytecode to allow automated verification of C programs. Excited to see the barrier to optimised compilation come down for new languages!

0: https://saw.galois.com/

When saying "Safari's behind Chrome in features" is not a valid criticism, the fact that the author is opposed to JavaScript is a massive caveat, since the feature disparity will likely come down to differences in the APIs available in JS.

I'm personally extremely worried about the fact that Chromium's eating the world, but if you're dictating what is and is not a valid criticism of the browser space, and you're starting from the premise that browsers shouldn't have JS, it's not surprising that some people aren't interested in what you have to say.

Are you doing okay? Seems like an unnecessarily acidic response to this post, which definitely seems like it's intended for C beginners.

> a woman with issues arising from mental or personality disorders

Oh come on. You certainly can’t divine that from the article, and wanting to “fit in” is a perfectly reasonable, if very sad, explanation for her actions.

I think the difference would be that DMCA could be the only mechanism for content takedown, which would hopefully deter spurious claims, as compared to content ID, which doesn't appear to incur any liability for false claims on the part of the claimant.

I think there’s a subset of YouTube who would much prefer the website without content from media conglomerates. Not sure if it could be profitable on its own though.

One of my favourite parodies of this "brain teaser" format invokes Fermat's last theorem: [0]

0: https://i.imgur.com/5QGR1Lt.jpeg

So it's actually a speculative instrument then?

I'm sure everyone who bought bitcoin at >$50,000 would have something to say about whether its utility as a "store of value" has been proven in the marketplace.

I’m not sure what point you’re making here? IMO, while JS is certainly more bloated than ever as a result, the current popularity of frameworks like React, Vue, etc. makes it much less likely that a beginner will introduce XSS than 10 years ago.

IMO it's really unfortunate that Monocypher doesn't implement a high-level CSPRNG API. I appreciate that it goes against the design goal of being entirely dependency-free, but getting random number generation wrong is such an easy foot-gun in my view, and it's already my least favourite part of libsodium (its most obvious "competitor") that the AEAD constructs don't generate a random nonce for you.

Edit: Also, not sure why the author chose to use Argon2i over Argon2id as the PBKDF for Monocypher, my perception was that the id variant should be used unless you have a reason not to. Would be interested to hear other opinions on this.

> We further compare our findings with non-cryptographic systems, observing that these systems are, indeed, more complex than similar counterparts, and that this excess complexity appears to produce significantly more vulnerabilities in cryptographic libraries than in non-cryptographic software.

This, to me at least, seems like a strange conclusion for this paper to reach. While there are evidently more vulnerabilities reported in NVD/CVE for cryptographic libraries, does this necessarily correlate with a larger number of vulnerabilities being present? Or could it be that cryptographic code is much more heavily scrutinised, and so it’s more likely that vulns will be found? I think the former is probably more reasonable, but I’m not sure you can come to either conclusion based on CVE data alone. Or am I missing something?

Absolutely, this is what we eventually did, and I’m immensely grateful for the current ubiquity of low-cost hardware :) it’s just discouraging to me that Apple takes such a hard line on this

When I was younger, my family couldn’t afford a laptop, but I have the distinct memory of wanting to learn to code on the iPads at my school, and being unable to find any app which would let me just write and execute programs. Looking around the App Store now, there do seem to be a couple of apps which would allow this, but it’s still really disappointing to see this kind of removal. The majority of kids these days will likely use a phone lots more than they use a laptop. For those who want to learn to code, why doesn’t Apple make it easier?

If by "caught up", you mean talked about clang-tidy in a separate post, which is definitely not a GCC compiler flag, then sure.

The goalpost, since you're insistent on being explicit about it, was whether a C/C++ compiler "with reasonable flags" will catch the implicit wrap. GCC is a very popular compiler, and to be honest, I'm still not sure how to get it to warn on the above code, if doing so is possible.

Edit: Just read the rest of the thread, it's -Wconversion, which I suppose makes sense. Ignore me, point taken.

And yet RedHat's recommended compiler flags for GCC [0], for example, do not appear to catch the wrapping assignment in the above example code.

0: https://developers.redhat.com/blog/2018/03/21/compiler-and-l...

Very cool! I've been using TMSU for this purpose for a while, but I'll have to check out supertag :)

Really interesting project, thank you for sharing! Looking at the documentation [0], it would appear that negative feedback for an item can only be given by giving feedback that the user has read the item, and not then providing positive feedback. Is that the case? Or is there a way to provide explicitly negative feedback that I'm not seeing?

0: https://docs.gorse.io/ch01-02-recommend.html

Perhaps I wasn’t clear, I’m specifically talking about detecting PCIe cards that modify RAM, as the parent comment mentioned. I appreciate the need for anti-cheat software, but surely the number of people who will not only cheat, but also do that kind of modification is vanishingly small?

I find it really difficult to see the value proposition for anti-cheat companies in spending time developing that functionality. Is it really worth spending dev hours on catching what I imagine is a tiny population of people, who you already know are prepared to use hardware modifications to circumvent anticheat? Or is it just a good marketing point?

What was wrong with SteamOS being based on Debian? I’ve not used SteamOS myself, but I wasn’t aware there were problems in that regard.