Nimi

Is there a writeup describing the exact timing side channel? The advisory states that the vulnerability affects all RSA padding modes, which seems to imply non-constant-time BigNum operations. However, OpenSSL implemented RSA blinding even before the fix, which is supposed to prevent those class of problems. So this should be interesting :-)

(I did find the commit fixing it, but it's huge, and I can't follow the change: https://github.com/openssl/openssl/commit/b1892d21f8f0435deb...

Another browser beside Chrome, Firefox and IE? OK, so Symantec announces that they will only use Opera. Even then, they have to deal with their customers, website operators who need a certificate trusted by the big 3 browsers, leaving. In fact, now that Let's Encrypt certificates are free, it seems like this is the Symantec CA's worst nightmare.

Fascinating. I still feel I'm missing something basic here: If Microsoft, Google and Mozilla announce they're not going to accept any particular crypto primitive two years from now, and this time there won't be any exceptions, CAs and websites just have to abide, don't they?

That's very interesting, do you happen to have a link for the blog post?

Moving away from obsolete crap isn't the solution, it's the definition of the problem.

One could argue that the CA/Browser forum has achieved some success with moving away from SHA-1. As a spectator, I don't understand why this process is not repeated for similar obsolete primitives or standards.

Consider another explanation: If you use the term "rape culture", you essentially claim that in today's society, oftentimes rape will be accepted (FWIW, I agree with this statement). However, there appears to be a consensus in today's society that genocide is always a bad thing; generally that opinion is expressed without any qualifiers (as opposed to qualifiers like "legitimate rape" etc.)

As this is the second time I see companies complaining on HN about the short deadline, and there seems to be a consensus that transitioning to another payment provider realistically always takes more than 5 days, you might consider having a longer default deadline that makes it possible to transition in time. Just my 2 cents.

Both the pitch here and the site seem a bit light on endorsements from companies which have previously hired your interns, although I'm guessing you have at list a few good endorsements on file? Maybe consider giving visibility to a few good "reviews" from companies. Just my 2 cents.

Found myself in similar situations in the past. My tentative solution was to maintain a corpus of resources for practice (beyond the usual suspects of implementing the standard data structures etc.), and hope that when the chance comes, 1-2 hours each day for a week before an interview would suffice. And when I do practice, I don't use a code editor, either paper or plain editor with no way to execute the code, simulating the (horrible) conditions of interviews as best as I can.

Obviously, this doesn't get you the benefit of being constantly drilled, but should provide some advantage. If you do care enough to get yourself a bigger advantage, maybe try to clear a few weeks before a round of job searching (if that's how you operate), then use those weeks for a few hours of practice each day.

Thanks!

I prob. missing something about [you're] "handing me your private keys to unlock that 1c output. Now if you ever released Transaction 1, I can spend both the outputs". What happens if you release transaction 1, then immediately release a transaction moving the funds away from that address? Seems like I have to be very vigilant and closely monitor the blockchain, fearing this will happen?

Interesting - can you please elaborate on those different cognitive skills?

(also, both your plight and the efforts you put towards getting out of it sound very serious - best of luck to you)

A few random thoughts/questions:

- This sounds similar to the incast problem which occurs in datacenters, but this happens on consumer Internet - cool.

- After reading both this post and the TCP/NC paper, it seems to me like TCP/NC is unfair to vanilla TCP. If all TCP/NC does is send the same number of packets, but the packets are "more sophisticated" encodings of the original data, link utilization would be the same. So apparently, TCP/NC is more aggressive than vanilla TCP, and that's fine, but I think it should be acknowledged (haha). When they say stuff like "TCP doesn’t see the packet loss, and as a result there’s no need for the TCP senders to reduce their sending rates", it's a bit unclear what they mean - you can just as well modify the TCP stack to ignore the packet loss and not reduce the sending rate, without network coding.

- Why not use TCP termination? You could install a performance-enhancing proxy at the Sat gate, and make sure the link is always 100% utilized.

- "Let’s increase the queue memory" - I thought this should theoretically work. See for example http://yuba.stanford.edu/~nickm/papers/sigcomm2004.pdf. If folks familiar with the apnic effort are reading, I would love to know if they tried such measures and what happened.

- Could CoDel improve the situation here?

Their phrasing appears to state they use TCP/NC, a network coding-based variant of TCP introduced in an academic paper by (some of) the same people behind this initiative:

http://arxiv.org/pdf/0809.5022.pdf

I'm surprised to see Certificate Transparency presented as a band-aid. My understanding is that assuming it will be deployed successfully, forged certificates will require very significant resources to use successfully for an attack, typically limiting such attacks to nation states.

But I would love to know where I'm wrong about this.

I was surprised by how similar Sivers' advice is to the Budha's teachings.

Slightly off-topic: Could you please add RSS support to your "blog"? I'm sure others, besides me, would love to me notified of new entries. Thanks!

Could you please give some examples?

Can a malicious display install a rootkit on the device? If there's USB access, this seems like an avenue worth exploring...

When I was in a freshman math course, a professor started the semester with a warning: "Trying to learn math without solving exercises is like trying to teach a toddler to walk from physiology textbooks". Yet, I haven't found a good source of exercises for introductory category theory - is it the case that exercises for this subject are hard to come by? Or maybe it's a relatively advanced subject, so there are few books, and as always most books don't include exercises for some strange reason? Anyway, would love to hear where I can find exercises on the subject, if anyone knows. (BTW, I don't mean sprinkling an exercises or 3-4 here and there like in the OP, I mean like 10-15 exercises per lecture, which was the standard when I was a freshman)

Pardon the shameless plug, but I've recently used a similarly unorthodox approach for replacing the heap inside Dijkstra's algorithm, and got a speedup - I use an array indexed by the vertices' current distances, and scan it from start to finish.

A paper is currently making the rounds, would love to hear feedback:

https://www.dropbox.com/s/zy1gx1azfvvqm6i/NetSciComm%20versi...

I'm not sure what's going on here, and would love if anyone informed could chime in (looking at you there, tptacek :-)

Google search for "operation cleaver" brings up mainly mainstream news, and few infosec websites besides Cylance's own website - this could be an indication that the report is mainly marketing and hype. Discussion over at Reddit does seem to agree that there's a large marketing component to it, although there's good technical analysis alongside:

http://www.reddit.com/r/netsec/comments/2o1kdu/operation_cle...

Are there other indications this is the hard truth? It could turn out to be just one genius' creative process, where others do "idle under the apple tree". I believe Feynman's results about quantum theory did stem from idling and meddling with some non-interesting work, before the revelation dawned on him.

It's a bit hard to get a clear impression from this discussion about the amount of difficulty for transferring between employers on an h1b. Can anyone who has been through this process more than once (either as an employer or employee) shed more light on this please?

My answer: I have a cursor I can move to previous lines, copy-paste like I do in a code editor, and generally move around like I would in a code editor. My take is kind of the opposite: I don't believe we don't have these capabilities in other command lines.

This is what we have in Israel, and it works nicely IMO. We have a duopoly of "infrastructure" providers, where the wires go from homes to the local Internet eXchange Point, and from there it's a free market of ISPs. We don't pay a lot (and the bulk of what we pay is to the infrastructure providers), and user experience is mostly very good.

See here for a comparison of various build systems, including tup:

https://github.com/ndmitchell/build-shootout#readme

Well, this sounds pretty much like an admission of the uselessness of his methods. Contrast this with Wins Produced (http://www.boxscoregeeks.com/faq), a simple statistical model, and it's hard to see the point...

Another perspective, if I may: you write that you've been taking care of your family since you were in school, and have made it through a rough life to be considered a candidate for both Google and AWS? You're Awesome! What do you care about those companies and their broken interview processes?

A personal anecdote I just went through this week: a few years ago, I lost an interview with a company I really wanted to work for. Part of the reason I wanted to work there was that a lot of people I knew and respected worked there, and they seemed very happy when I visited for the interview. I was pretty down after that. This week one of the people who worked there reached out, and among other things we discussed, it appears he had a horrible time there, and there was no reason for me to feel down about not being accepted. Also, I spent this past summer as an intern at Google, and while I don't want to start the usual "is Google still a cool place to work at" fights here, I do feel comfortable writing that my own very subjective conclusion is that one can get stuck at an uninteresting role at Google, like in any other company.

Keep meditating, and keep being awesome.

I did just that 2 years ago, when I was 29. So far, I don't regret the decision.

But please bare in mind, I didn't really like my job as a software developer, and upon being cautioned about the drawbacks of academia by a tenure track professor I reached out to for advice, I simply shrugged and told him: "What's the worst thing that can happen - I'll end up being a software developer for 35 years instead of 40?" He immediately agreed that if that's the way I look at it, it probably makes sense to make the jump.

My contact info is in my profile, feel free to contact me if you want. And whatever you decide, good luck!

Does this random value need to be unpredictable?

And leaving this specific example aside for a moment, I was trying to prove a larger point: people write crypto code for a reason. Some people will write it for no reason at all, yes. A lot of other devs will be dying to save themselves the time it will take to write any type of code, especially if it has to deal with something they aren't experts in, but they just can't. Now, it seems likely you and I can hash out the details of an acceptable solution in this discussion (in fact, I think once you take the steps to make sure the random source isn't predictable, you're good, but even this is slightly crypto-related), but how would the average developer know this? How would he go from "don't write crypto code" to this? In my humble opinion, simply saying "don't write crypto code" isn't a solution, and there are good reasons why this hasn't worked so far.