jakecraige

Yeah this is not universal. I bought mine

Yeah, I think it's more of a British English thing. It can also mean things like "in a fight". Like: "those two guys had a big row outside the pub the other night"

Another vote for SynthRiders here. I have the same complaint about Beat Saber as OP. Can be done with wrist flicks and be lazy

Synth Riders forces you to have to move your body and do large sweeping motions, it feels like dancing, AND it has online multiplayer with voice chat which regularly has groups hanging out and playing for fun

That last part makes it so much more enjoyable for me

The main app powering coinbase.com, the “monorail”, is a Rails app backed by MongoDB. It’s typically what’s being referred to when breaking out microservices.

Historically most other services were Rails/Sinatra with Postgres. These days there’s a lot more Golang being used for new services.

There’s also some services that are serverless, using Lambda and DynamoDB but these are a minority.

We (Coinbase) already sign cold storage transactions in a distributed manner so this isn’t an issue :)

Brian calls this out and describes how Coinbase plans to do this in the “This will require a huge shift in how we do things. How will we get there?“ section.

To address all of these, we will form a cross-functional team to oversee this transition. This group will identify the changes we must make to become a remote-first company (e.g., around people management, recruiting/talent, culture and connection, and documentation and async work…), host open design sessions with all of you to surface ideas, considerations, dependencies, and concerns, and partner with internal experts to redesign how all of this works for a remote-first Coinbase.

It’s not assuming MITM or that the attacker can upload the signature to the site.

The attack is that the attacker can reuse the already uploaded signature in a way that allows them to get certificates issued under their account instead of the initial owner.

This blog is a little confusing about that since it does read like they are supposed to upload their own sig with the graphic used.

This post and linked IETF report is a little more clear: https://www.agwa.name/blog/2015/12

Matthew Green has a related post about this speaking to “multiple encryption” where people do the same thing with ciphers. [1]

A very generic take would be that depending on the system, it may be able to be done securely, but with all crypto there be dragons.

For example, let’s say you have two hashes H1 and H2 and want to use the double hash to prove existence of a file in history. Publish the hash to a blockchain or something.

So the file is hashed H1(H2(file)). In what ways could you break this if one of the hash functions is broken?

The first way is if you want to dispute the validity of what file was hashed. If we assume they later publish the file and you have a second-preimage attack on the hash.

You can create a different file where H2(file) = H2(newFile), and because H1 is deterministic, this second file verifies. It’s now no longer clear which is the true file. While a single hash function also fails under this attack, you increase your exposure to possible attacks by introducing a second one.

If you have control over the verification procedure you can imagine a similar attack with only a break in H2 by not even using H1 to generate the output.

[1] https://blog.cryptographyengineering.com/2012/02/02/multiple...

I haven't implemented but like what it's going for. Modern crypto is all about making it easy to do the right thing without thinking about it and PASETO does that well with its versioning scheme and relying on established crypto from libsodium.

Nonce reuse is easily preventable with deterministic nonces or sufficient randomness. PS3 used a fixed nonce which is a whole different problem.

I agree that JWT has all sorts of flexibility that make it hard to use well but NIST curves work just fine.

If you think they are backdoored then sure, Ed25519 is a better option but real world constraints may require you to use a NIST curve for now.

They have a bug bounty program that gives you permission to do certain kinds of things and it not be illegal since you’re planning to report anything you find (and get paid for it)

Y'all are talking about two different things.

Secret key recovery via nonce reuse(linked SO post) is a different than simply trying a range of integers which is mostly what these researchers did.

Thanks for the link! I went down a small rabbit hole from this which ended up with a script that allows for similar style workflows even within the GitHub PR world:

https://twitter.com/jakecraige/status/1056835104440545280 https://gist.github.com/jakecraige/51f9583f1f55cc0ecccfaa11e...

First step in trying it out requires inputting my full name and email address :/

Yes, I’m saying that rather than needing an hour to get 6 blocks if the hash rate doubled, you’d only need 30 mins _until_ the adjustment occurs. Then it would be an hour again.

Yeah it’s sort of time based assuming consistent blocks, but it would still based on confs. If the hash rate doubled then one would only require 30 minutes until the difficulty adjustment kicked in.

The main purpose of my post is that to actually pull off a successful attack you probably need more than an hour, so the numbers are making it look like it’s cheaper than it would be in practice (ignoring other factors other commenters have shared about acquiring ASICS, data centers, and such).

You can’t 51% attack Bitcoin for $611K, but your site says you can. While the site can’t be perfect, it would be helpful to make it more realistic. If a news site picks this up and doesn’t understand the nuances they’ll accidentally spread FUD and mislead a lot of people.

It would be helpful to expand on how many blocks can be reversed given only one hour of hash rate.

Many wallets, exchanges, etc require a minimum number of confirmations before allowing you to spend the coins to handle reorgs that happen naturally.

For example, in Bitcoin this is often around 6. With 1hr of hash rate you might be able to get 7 blocks but likely you’ll actually need more time to get enough blocks or successfully attack. Accounting for this would increase the cost substantially.

Either way, pretty neat site!

It's not so much that miners would ignore empty transactions, it's that the spammer would need to pay the miner fee to get each transaction in the block which would end up being very expensive and unsustainable long term.

For the second idea, this wouldn't really work either. When each node receives a transaction it will validate it first before broadcasting it to other nodes, so it would be stopped from propagating through the network pretty quickly and no one would attempt to include it in a block and run do PoW work it which is the most time consuming part.

I suppose in theory if you had a large enough network and could target a ton of nodes individually you might be able to do some form of damage but that's likely a pretty impossible amount of power and similarly to the previous example you could maybe bloat it a bit but it would be very expensive to sustain an attack like this.

Tools like React Native and Electron are pretty popular these days to build cross-platform apps and such. Since you know web stuff and I'm assuming JS, those might be a good option to explore so you could maintain them without having to learn the entire toolchain of building for various platforms

Cool product. I've used calendars in the past to maintain this kind of thing but a product has many more features than a calendar so I'm into it.

A mobile app would definitely be nice for this kind of product at some point. Push notifications for reminders / an easy entry system, integration with contacts, calendar, etc.

Either way. Thanks for this cool product, and OSS-ing it.

US style dates, you probably want 03/18/1965

I'm a fan of FB login. In practice it's pretty trivial to maintain once it's set up, I don't recall ever having to do any updates to an FB login system once set up.

It's nice that I don't have to create yet-another-password for a new app as well. I use a password manager so it's not a big deal for me, but for other users it could be so they may just use a shared password and having FB login would be a way to have them not do that.

I say it's shitty because they don't follow best practices and just focus on pushing out workflow apps as quickly as possible. No docs, old tooling, etc. Really a mess.

I doubt schooling would fix this. It tends to be more about theory and algorithms than building "real world"(depending on what you're doing) apps.

Also, those are problems you can fix by reading a few books on best practices, learning from your team, keeping up to date on tools and just doing it (docs). If anything, the school would likely be behind on things like tooling and many best practices related to the modern frameworks.

It's not all bad, you'll learn things that from time to time come in handy, but getting a CS degree won't turn someone into a good programmer. That's a skill you'll develop over time from doing it and learning from others.

This repo is pretty cool and links to lots of free courses that show the kind of things you'd learn at Uni: https://github.com/open-source-society/computer-science

Great read. Reminds me of a book I read recently, Difficult Conversations, where my key takeaway was to do everything I can to understand the other person, and make sure they understand me. Then we can work together towards a resolution.

The authors uses the term "Learning conversation" which I really liked. To highlight that you're there to first and foremost, understand them, before judging or criticizing or whatever else.

This will definitely not work with MeteorJS. It's a React tool built around their framework. I don't think there's anything like this for Meteor yet.

Unless you mean does it work if you use React within a Meteor app. If so, it may.

The problem is that "Silent Errors" is not spot on. At least not his example of them. If you have this example in angular, you'll get the same result.

$scope.myObj = {x: 2}; <div ng-bind="myObj.notHere"></div>

(forgive me if my syntax is off a bit, haven't written angular in awhile)

The example he gave is an object not having a properly on it that he's trying to access. Any javascript templating language will have this issue

The framework battle is really between Backbone, Angular, and Ember. No one else I can think of off hand has the marketshare that those 3 do..

And each has their own strengths and unique opinions. My preference is Ember, but it's just that, a preference.

I made an Ember.JS version of this since we have a few different posts comparing all the frameworks today. Still need to split it up into steps but it's there as an example of the implementation right now

Lines of Javascript: 92

Lines of Javascript(without ember-data model definition): 63

https://github.com/jakecraige/ember-phonecat