zahllos

I missed that, good catch.

That said, I find the wording of dedicated counter space a bit bizarre. There are only 128 bits per block in AES - in fact I'm not aware of a widely deployed cipher which a larger block size. Whatever goes through ghash becomes the initial plaintext passed to aes under the key (this is the counter) part and then you just increment. This is just a limitation of counter mode in general: the whole IV is technically counter space and is treated as whole when evaluating the birthday bound issue.

The critical part mentioned in the post is that XChaCha "hashes the key+nonce into a fresh key". A very similar technique is used un: AES-GCM-SIV (https://datatracker.ietf.org/doc/html/rfc8452#section-9). The improved security here comes not from any "counter space" or nonce extension per se but the fact that changing the IV changes the effective key used in the block primitive (i.e. the raw aes-encrypt function) as well as the first block of plaintext fed to AES by deriving these from nonce+key.

So I guess this is asking for a somewhat different construction. Personally aside from the fact it is already widely deployed I'm not sure I'd keep GHASH.

From the NIST doc for GCM: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpubli...

The IV can be any length up to 2^64-1. The reason for picking 96-bit IVs is that other values require an extra invocation of GHASH (page 15). The document recommends 96-bit for interoperability but that's by no means a requirement.

The X part is thus in theory already allowed.

I'm reading your comment as saying that if I don't think Snowden/Assange should be pardoned and set free, I'm implicitly supporting mass surveillance.

I wanted to provide a counterbalance to that view. Snowden is a complicated case - in my view it isn't as simple as 100% hero or 100% villain - but Assange is in my view relatively clear.

Wikileaks and Manning appear to have leaked anything they can. I don't support such a scattergun approach. Also, while some of their leaks pertain to surveillance (the vault 7 ones) most of them do not.

Then there's Assange. He was facing extradition to Sweden under a European Arrest Warrant for rape alleged to have taken place there, but instead skipped bail on the pretext it was all some US conspiracy. Until extradition was approved he was free on bail. Likely had he been extradited to Sweden he would also have been free on bail, and the burden of proof would have remained on prosecutors. I'm sure he would have had a fair trial.

Instead he made it to the Ecuadorian embassy and stayed until he made himself unwelcome. At which point he was arrested by the UK for skipping bail and has since been subject to the very extradition procedure that was his pretext.

I'm British, although I no longer live there. If you are the US government and you want to extradite someone legally I can't imagine a friendlier jurisdiction than the UK.

I'm also mildly irritated that the UN torture experts keep sounding off that this is torture. Not at all. Assange chose to enter the Ecuadorian embassy and in doing so chose to break the law by not attending court. He chose to remain there for a considerable time, making labelling him a flight risk so obvious as to be automatic. When he came out of the embassy, he was convicted and jailed of that crime. He has also remained there because he's currently subject to extradition proceedings and no judge is going to grant him bail. I'm certain living in a confined space in the embassy wasn't pleasant, but that was a choice. I'm certain prison isn't pleasant either (no matter what UK tabloids say) but that is a consequence. This is a far cry from what, say, the Syrian regime does.

I support encryption and anything that frustrates mass surveillance because I believe fundamentally that private citizens have a right to a private life and that invasion of that privacy should be specific and justified, including when it comes to electronic communications. I accept that law enforcement will sometimes be faced with a situation in which they cannot decrypt communications between two almost certain criminals and this may make their job harder, and I'm happy with that trade-off. In the end, all a pervasive backdoor does is target law abiding citizens, as criminals by definition won't feel bound to put their keys in escrow or whatever. They're already developing their own handsets and the police have shown themselves capable of targeting them (encrochat).

At the same time, if Assange is extradited to the US tomorrow then good riddance. I don't see that I have to support him in any way in order to object to mass surveillance, pervasive monitoring and mandated backdoors.

> I think that there has been a degree of constructive ambiguity in the past.

Not really. Since what you're calling for specifically is the Monarch to start blocking bills: it was established in the Bill of Rights Act 1689 (which would form part of the basis of a constitution if codified) that Parliament is sovereign, and the actual Sovereign can only act on the advice of parliament apart from when exercising royal prerogative, which is done on the advice of ministers.

One example of royal prerogative is proroguing parliament, which we've discussed. Another would be giving, or not, Royal Assent to a bill. The last time Royal Assent was refused was in 1708: https://en.wikipedia.org/wiki/Scottish_Militia_Bill and that was also on the advice of ministers, as they'd changed their mind about a law that had completed its passage through parliament.

In other words, what you're asking for has not happened in over 300 years.

I'm unsure how the monarchy could be a check and a balance when the "constitutional settlement" is generally considered to include the monarch staying out of politics publicly - the monarch acts on the advice of ministers, which is to say the monarch is essentially a rubber stamp with several enormous palaces they can be stored in.

There are checks and balances. When Boris Johnson unlawfully prorogued parliament, judicial review leading to a supreme court judgement eventually overturned the order, concluding his advice to the Queen was outside the powers of the Prime Minister. This is a fairly drastic outcome but Brexit was an interesting constitutional fuzzing campaign and we had a situation where the speaker of the house stretched the definition of impartiality quite a bit too.

Other checks and balances include His Majesty's Loyal Opposition and assorted members of Parliament who may disagree with whatever bill is under consideration (the opposition are currently a bit useless, you may be forgiven for thinking they don't exist) and the House of Lords, who scrutinize bills passed from the commons (and do object to things quite frequently in spite of the irritation this causes to the PM of the day).

It isn't perfect, but as the system is currently set up I'm not sure the monarchy can be regarded to have "failed" to check or balance the party in parliament. As to whether the constitution should be written down - I think it would probably be useful, but it is unlikely - and checks and balances still work as shown in the prorogation case. As for first-past-the-post and the UK's electoral system in general - again, yeah, a problem. I'm British and it doesn't matter who I vote for since whoever the conservative candidate is will be returned for my constituency, guaranteed. However, that's also not something the monarchy can change.

Yes, the token itself most likely won't allow the key to be extracted. There isn't really a reason to allow it: safer to generate the key at manufacturing time.

In general cmvp compatible modules do sometimes allow keys to be exported but only if wrapped, i.e. encrypted to prevent unauthorized disclosure. However this is also explicitly forbidden in other standards, such as qualified signing in Europe (etsi-...)- keys are generated on device and never leave.

What do you do if you lose the token? Ideally you enroll two or three and just use another.

> Scalars, when applied to a specific curve, do have a “order” though,

Nitpick: the important point here is that points on the elliptic curve have order (by definition the smallest k such that kP = identity), and the group of such points has order (by definition, the number of elements it has). Here, scalar is just a way to say "not a point", or "integer value" and if you define them in the right group, sure, we could talk about their order as well, but what we actually care about is the order of the points.

From the definition of order, qP = identity, thus (q+30)P = qP + 30P = identity + 30P = 30P, hence the wrapping.

I attended a talk by a PhD student who specializes in CPU/architectural research, on the M1 as an architecture. There are some key differences in design, such as unified memory etc, but what accounts for a large part of the performance gap with x86 is the fact Apple's compilers can target their specific microarchitecture and optimize for that, because they know its performance characteristics well.

We know the performance characteristics of various x86 cores, however there are simply a lot of them, so most precompiled x86 code is generically targeted but likely has suboptimal parts on different architectures. You can, of course, -mtune= with gcc, but you'd basically need to rebuild your distribution. Or in other words, the ideal would be to compare someone running Gentoo vs macOS.

So, that was the gist of the talk and I more or less accept the conclusions. Now for my own view, I think what makes ARM processors interesting is their efficiency wrt power consumption. I would love a non-Apple ARM laptop if only because intel cores are much less efficient in terms of power they require.

> Using a web browser as your native app's rendering engine is what all the cool kids are doing these days, so in a way they were just 15 years ahead of the curve.

As others have said parts of explorer were using mshtml for the user interface. However it wasn't just Microsoft. Third party vendors used mshtml as a component to render their UI! You can find samples around still, e.g . https://www.codeproject.com/Articles/6845/Implementing-snap-...

Most memorably, Norton Antivirus 2003 (I think) was one such application. The entire UI was in fact written in HTML with lots of callbacks into c++ code.

So in many ways... Electron isn't all that new of an idea :)

There is actually a solution to this in the UK. Directors are permitted to have a service address on the public record instead of their home address, and you can find a bunch of companies willing to allow you to rent one and forward mail.

You still need to provide your home address to companies' house but it isn't available to the public at large as easily.

This is not just possible it is an extremely good idea. Mobile phone companies in the UK are very lax about opening contracts (UK has an aversion to government identity cards, so defaults to "give us a utility bill" like you can't find templates online) and using a valid name/address combination is what scammers love to do. So if you want to avoid getting "welcome to" letters from every mobile provider in the UK 3x over (and your credit rating subsequently trashed) then using a service address is a great idea.

Even historically there isn't a particularly well defined set of requirements for a subsystem. The closest to win32 was the subsystem for Unix applications, that loaded psdll.dll and used PE format executables even in the "Unix" environnement. WSL1 used elf files and required a custom execution process: bash.exe called com which called into the kernel to set up a special lightweight process supporting Linux syscall translation/implementation. Wsl2/wsa are Hyper-V based.

Charles de Gaulle. Apparently there was a proposal to share nuclear weapons between France, Germany and Italy, but according to the Charles de Gaulle government "atomic weapons should never be shared with others" (https://www.openstarts.units.it/bitstream/10077/15330/1/Nucl...).

De Gaulle wanted sovereign control of any French nuclear deterrent and did not trust that, if it came to it, the US would put itself on the line for Europe: https://www.nato.int/cps/en/natohq/opinions_139272.htm - presumably, for similar reasons he did not want any dependence on allies, even ones closer in location and likely part of the same conflict.

The US did actually help the French nuclear programme once it started going, under the reasoning that multiple nuclear-armed NATO members is better than one.

> Rust is a great tool for writing safer programs, but it won't defend you from many if not most DoS attacks if you're not careful

Just want to stop by and point out "behavior not considered unsafe": https://doc.rust-lang.org/reference/behavior-not-considered-...

I have a simple phrase I use to explain this. Rust tries to give you memory safety. It does not imply nor check for correctness.

I'm not, but I do crypto (as in PKI, smartcards) stuff, so let me try to explain some of the thinking behind hardware keys.

The idea of a second factor is that "something you have" is hard for an attacker to also have, however, proof of having something usually means "proof that you know some secret" and that secret itself can often be copied.

The lazy "proof you have" something is SMS auth, i.e. proof you control a phone number. However this isn't great, since in some jurisdictions ringing your mobile provider is enough to get control over that number.

TOTP then says: let's assume you have some secret seed and I also know it. If I take a hash of it (HOTP) and include some time information I have a code valid for a small window that is hard to steal. The benefit is that everywhere this secret exists you can have an authenticator. The downside is that this is rarely a separate device to your computer. You also are going to enter your code into a website... and that might not be the right website, allowing capture of the code via phishing.

The standard for legal, qualified digital signatures in the EU is to have non-extractable keys generated on hardware devices and never backed up. Why? Well, if you lose the hardware token (or it is damaged) you don't lose access to encrypted data, just the ability to sign documents. At this point you have an annoying dance to do to be issued a new token, but allowing backup of the signing key means signatures may be repudiated (because someone else could have stolen the backup).

The same goal applies to U2F / FIDO certified security keys. U2F generates a unique key-pair per authentication target and that private key never leaves the authenticator. This gives you two things: 1) a binding between your target service and your device. Phishing becomes a lot more difficult unless you can present the right challenge-response to the authenticator, and 2) an authenticator you physically need to have present, but don't need a pin or awkward copy-paste of a code to use. You aren't using this key for encryption, but for authentication, so, the backup strategy is: have multiple keys. If you lose one, you can delete that entry from respective accounts.

Password managers exist because some websites are password-only and even if not, you can't always trust they employed argon2id as a password hash. It also saves you having to remember multiple passwords. Your password database is something you will need to keep backed up.

Personally I keep printed recovery codes of really important accounts, spare registered security keys, and a disk with my password database on in a safe place.

Gstaad is 'exclusive'. It probably isn't so well known, but it has very expensive resorts and hotels, like https://www.thealpinagstaad.ch/ and its own private bank https://www.saanenbank.ch/ and the centre of the village has a lot of luxury shopping. It is definitely up there in terms of destinations for UHNW people. However I don't think it attracts quite such a percentage of "can afford to go but not ultra high net worth" people, which is much more true of Zermatt, Verbier, St Moritz etc.

Academic research for security purposes is almost exclusively done with llvm. Why? It is a compiler framework that is (relatively) easy to work with compared to GCC.

So there is already a monoculture in some circles.

However there's plenty of custom gcc toolchains for embedded systems. It isn't going anywhere for a while yet.

I know someone in Switzerland who bought a car in cash, 12x 1k chf notes.

If you're paying for a big-ish shop, e.g. over 100chf, the major supermarkets won't blink if you proffer a 1k note because that's how the older generation get their pension. I've personally paid for about 20chf worth of stuff with a 200 note.

Perhaps they could ask for support from the international monetary fund, an organization established in the wake of the great depression in order to try to preserve financial stability worldwide?

Interesting article. Since the article focuses on Switzerland and I live there I have another angle to present that I find very interesting.

In our local region one problem is that the 'city' is heavily concreted. There's a distinct lack of green in many areas. In the summer and in particular this year, but other heatwaves as well, this becomes punishing in the city: concrete absorbs the heat during the day and radiates it at night, making the city even hotter.

See the sibling comment about whether the CO2 numbers make sense, but I also think with warming environs locally we're going to have to get a lot smarter about how we build to manage heat as well. There was a fascinating article on HN a while ago about the London Underground and the troubles they're having cooling it... The Swiss build a lot with concrete in their cities and there's going to be a corresponding difficulty of keeping them cool.

Plus if you're using enough IPv4 addresses it is going to be the same problem anyway. I can barely keep track of what I've assigned everything to in just a /24 so I have local DNS and I don't need to.

...and it must also be said that the selection of client software that supports it is somewhat limited. For this discussion, Thunderbird does not. I'd also add that some fairly major providers, e.g. anything based on MS Exchange, and Google's Android client, do their own thing (e.g. ActiveSync).

For myself I'm aware of a bunch of bugs in Thunderbird affecting my experience and I'd rather these were fixed first.

Never worked for Google, but.

This shouldn't be surprising. Perhaps comparing it to Oracle might not be quite right, I leave that to people who know, but Google is pretty obviously not the startup/disrupter of 2000-2004 any more. It is now 20+ years old and huge, and that means it is going to be somewhat like any very large organization: internal politics/empire defending, standardised compensation and management, mission, vision and values, etc. Your experience likely varies greatly depending on where in the org you land and who with - some people will come out writing blog posts and some people will find their happy place and never leave.

The interesting part around Google is that they had a kind of mythical status amongst techies that's lasted quite a lot longer than the early days. But they're just another big company now.

Be nice of them to fix outstanding bugs, like the nondeterministic turing machine that is doing anything with certificates in Thunderbird e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=1481969

The javascript disaster that is the compose window refuses to find certificates that NSS finds, because... something to do with intermediate certificates.

Signing messages is a feature thunderbird has had forever, yet is unstable and nobody is dealing with the obvious open issue in their bug tracker, open since v60 and ignored.

Honestly what I want from an email client is this, plus cardbook (the default address book can't talk carddav, what century are we in), plus calendars. That's it. That's what I want a mail client to do.

I'm using alacritty all the time, and I'm thinking of switching to starship from powerline because powerline has noticeable startup time (I think it is python-based). Unfortunately neovim+plugins does too, probably as a result of plugins more than neovim.

I tried this and it is much nippier than my current neovim+plugins setup. I'll have to plug in a bunch more language servers to fully compare.

In a way I'm almost hoping they don't add a plugin system. There's something to be said for this all-rust future my terminal suddenly seems to have found itself in: it is quick!

It's even worse when you consider the DoD at least have multiple functioning internal PKIs and issue smartcards in the form of the CAC and others to all its users.

I'm sorry, we don't want your fancy crypto, please accept this insecure SMS.

Depends a bit what you do. I work with firmware that uses all kinds of architectures. Paying an extra $2k per architecture I want the decompiler for is simply too much.

Yes, the license cost is likely marginal if you only disassemble Windows malware on Windows.

IDA Pro doesn't come with a decompiler either. For that you need to spend extra and pay for the hex-rays license on top of the price for the disassembler.

The total price kicks licensing costs well outside that of hobbyist use cases.

Yes, especially 'logically impossible' when you dig into the details. From the blogpost:

> and the kernel modifications to seL4 that can reclaim the memory used by the rootserver.

MMMMMMMMMMMkkkkkk. So you then have to ask: were these changes also formally verified? There's a metric ton of kernel changes here: https://github.com/AmbiML/sparrow-kernel/commits/sparrow but I don't see a fork of https://github.com/seL4/l4v anywhere inside AmbiML.

I mean, it does also claim to be "almost entirely written in Rust", which is true if you ignore almost the entire OS part of the OS (the kernel and the minimal seL4 runtime).

Feels like the moment to mention 'Strange Code' - https://nostarch.com/strange-code by Ronald T. Kneusel (no relation or affiliation, I just like the book).

You're never going to build your next major project in one of them (unless you happen to be a COBOL developer or happen to maintain OpenFirmware boot code written in Forth) but seeing different ways of doing things is both interesting and instructive.

Yeah agree, receive is probably what I should have said :) I did try to see if there were any discussions of UWB before posting, but only found some PDFs from the FAA from 2015 or so in my casual search. I guess industry insiders might know more. It could well be that the low power was deemed not risky enough (you would have thought all airlines would have banned them if risky) and other posts suggest that in fact Lufthansa have not banned airtags at all... so who knows.