nickodell

Are non-sequiturs always malicious? For example, suppose you have a news site, and it has a story about Ukraine, followed by a story about school shootings. Even if two links next to one another are unrelated, that doesn't prove that they're not genuine.

Alex Oh worked for a law firm which represents Exxon. That law firm was accused of obstructing a deposition to avoid providing answers to the other side. [1]

ORDERS defense counsel to show cause by May 14, 2021 why sanctions should not be imposed under Rule 11 (b)(3) for alleging that plaintiffs' counsel was agitated, disrespectful, and unhinged during the deposition despite a lack of record evidence supporting those allegations. See Mem. Op. 29-31. ORDERS defendants to serve a copy of this order on Ms. Oh.

Was Alex Oh specifically responsible for this conduct? The order doesn't say.

What does this have to do with Clinton? Nothing, except in a six-degrees-of-kevin-bacon sense.

[1] https://www.courtlistener.com/recap/gov.uscourts.dcd.14559/g...

Stingrays are more useful as an investigative tool than an evidentiary tool. DNA is the other way around.

Believe it or not, I was already aware of all of those things, having followed a number of criminal defense blogs.

If you read the article and appellate decision which is linked, it says what I just said:

On Wednesday, the appellate court sided with the defense [PDF] and sent the case back to a lower court directing the judge to compel Cybergenetics to make the TrueAllele code available to the defense team.

taking the life of an innocent

The prosecutor isn't unilaterally deciding whether the DNA evidence is valid. There will be a public hearing where both the prosecution and defense show evidence about the validity of the DNA evidence, and a court will rule based on that evidence.

My prediction: this firm will probably try to get removed from the case, rather than open source their shitty code.

That isn't necessarily their choice. The prosecutors will make the decision about whether to withdraw the DNA evidence. They probably won't, given that they would need to give the defendant a new trial, which could lead to an accused murderer getting off. A bad look for any prosecutor.

More to the point, if the firm withdraws from any case where their credibility is questioned, what does that say to law enforcement agencies who are thinking about using their software?

Why couldn't you attach to the screen, press Ctrl-C, then press up arrow to get the original command?

That's a thoughtful answer; thank you.

First, the client makes an unauthenticated request to the server to retrieve the password salts associated with the username. If no user is found, an error is returned to the client. If a user is found, the server sends the client the user's password salt and password token salt, which the client uses to rebuild the password token. The password token is then passed to the server for authentication. To prevent brute force password guesses, clients get 25 incorrect attempts in a row before the server locks the user out of their account for 24 hours (Note we are aware this introduces a DoS vulnerability. Our first priority is to protect user data. We plan to implement a more sophisticated lockout mechanism in the future).

Hang on, so the process of retrieving the salt gives the remote client information about whether the user exists? Doesn't this mean that an attacker could take a list of possible usernames, and confirm which of them are using your service?

Seems like you could return a salt even when the user doesn't exist, and that would prevent this information disclosure.

I was looking for a more technical response.

e.g. How are new blocks created? Proof of work, predefined functionaries, something else?

You say you have SPV proofs which allow a full node to prove a particular domain is owned by a particular party. How does that work?

How does your service differ from NameCoin?

The article also suggests that COVID was maybe an inside job, and that it's unpatriotic to follow health restrictions. (Not in exactly those words, but it warns about "acquiescing" to government restrictions.)

Apple says they're going to move to an HTTPS based system, so the relevant comparison is between HTTPS and DNS, not HTTP and DNS.

Then the question is, "how much do I trust my ISP/DNS provider?"

Those DNS lookups tell your ISP 1) that you use a mac and 2) that you have an application from a specific developer installed.

I think I trust my ISP less than I trust Apple, here. Am I wrong to do so?

So what happens if a removed function is called? Or can you guarantee that won't happen?

Note that minority shareholders have some rights, though this varies by state of incorporation:

(PDF warning)

https://www.ibanet.org/Document/Default.aspx?DocumentUid=F20...

It's 90 days, and they renew it when there are 30 days left.

This doesn't seem to work that well. If you type invalid syntax, like '.[' then the window suddenly resizes to accomodate the error message, but not all of the text boxes resize.

jiq is probably a better tool.

It's therefore trivial to have both protocols coexist, even on the same UDP port, without any negotiation whatsoever. You simply need to discard packets that don't decrypt, which is what WireGuard already does.

If both ends will automatically fall back to v1, how do you prevent protocol downgrade attacks? An adversary dropping v2 packets looks exactly like the other end not supporting v2 packets.

It's dangerous to include a downgrade-capable negotiation in your VPN protocol.

I agree. It's a hard problem to solve. But it's going to have to be solved eventually.

In contrast, a hypothetical WireGuard protocol v2 can offer just two suites, the old one and the new one, with simple advice: use the new one if you can, and allow the old one for old nodes until they’re upgraded. There’s nothing unusual about this, except you don’t need to be a cryptography expert to configure it.

I don't think this is going to be as simple as the author thinks. Look at Git's migration away from SHA1. There was no designed mechanism for switching hash functions, and lots of code assumed 20-byte hashes. Three years after the first SHA1 collision was discovered, Git has not switched to a new hash function. I don't mean to be alarmist - no one has created a practical attack on Git objects, but the time to switch cryptographic primitives is when they start showing weakness, not after they are definitely broken.

IPSec has a standard method for supporting multiple cipher suites, and negotiating a common suite. It might be very complicated, but we have no way of comparing it to WireGuard, because WireGuard doesn't implement the same feature.

Under C11, the compiler is still allowed to assume termination of a loop if the controlling expression is non-constant and a few other conditions are met.

https://stackoverflow.com/a/16436479/530160

That unprivileged user will not have the SSH host key, which will create a warning for any user who connects, just as though someone had conducted a man-in-the-middle attack.

Of course, there are plenty of privileged ports to choose from.

https://www.google.com/search?q=random+number+between+1+and+...

Here's the vulnerability:

    <html>
    <script>
        var total = "";
        for (var i = 0; i < 100000; i++) {
            total = total + i.toString();
            history.pushState(0, 0, total);
        }
    </script>
    </html>

That's a very good point, and thank you for correcting me.

Is it really possible to remove the side channels? Even if you formally prove that it does not access memory outside of authorized regions, that doesn't prevent it from speculatively accessing unauthorized memory.

We've seen Spectre exploits through sandboxed Javascript. Unless you separated the eBPF VM address space from the kernel address space, I suspect you would have the exact same problems that browsers have had. But if you did put them in separate address spaces, then why bother with eBPF? You could run a normal userspace program.

In the case of the Uber crash in Tempe, the car did kick the decision over to a human operator. However, it did so 1.3 seconds before impact. This wasn't enough time for the human to assess the situation and decide what to do.

What about anti-semites? What about subtle racism (Is that even something we want to moderate?)

It's not clear to me that xHamster actually tries to remove that from their site. I wonder if this is just a case where the media reports about racist content on YouTube or Facebook, but not on porn websites, so comparatively it looks like porn sites are doing a great job moderating.

> The Church executed no one.

From the Wikipedia article you mention:

A number of procedures and protections restricted the torture of the accused, although much torture could be inflicted, and capital punishment was executed by secular authorities due to the clerical prohibition on shedding blood.

"We didn't execute anyone! We just decided who would be executed!"

So if you've been paying attention to Purism's website and do some digging, you'll realize that they've never actually [filed a Social Purpose Report]

I filed a complaint with the State Attorney of Washington over the issue

So yeah Purism is going to skate by on yet another clear and obvious lie. They are pretty much going out of their way to take advantage of people at this point. On a side note, its really sad and pathetic how little the state of Washington is willing to do to try and compel Purism to live up to their legally mandated expectations as an SPC.

Um, what were you expecting? The State Attorney is going to view this as "someone forgot to file a form." That isn't exactly priority #1.

Or, less cynically, reduction of the number of fires.