I just explained what it actually is. I said "you know how you go to a website HTTPS and it's secure? Well Apple chose a couple of trusted parties that your phone inherently trusts, and those people approve a few thousand intermediate companies who do the day-to-day certificate work for end websites. One of those intermediates, rather than choosing a 200-digit random number, chose 4, no not four-digits, the number 4". And then we could laugh at some of the memes.
i think this oversells the likelihood of it. the probability of any random 116 digit number having its first 115 digits be the number zero is much lower than that of it containing a much higher number of non-zero digits.
As long as programmers trust 3rd-party-provided content-length input, it will be insecure. At this point, I'm not sure why we even use content-length anymore since you're going to need to size your buffers based on the actual content.
Learning about the concept of “negative zero” in school stuck with me. It was one of those lessons where the professor had us bang our heads against one’s complement to understand the shortcomings and introduced two’s complement like Moses coming down with the stone tablets.
I don't know, when I run a password cracker, I always start with a brute force pass of very short passwords. Doing so adds a negligible amount of time to the crack, and its surprising how many short passwords you'll find in systems that permit them.
I was a little surprised when a well-known password cracker managed to pop a bunch of passwords set by a sysadmin at a place I used to work at, who had left under something of a cloud.
I wouldn't have got them if I hadn't set it to start at three characters, on a hunch.
Cameron, if you're out there, I hope you're making less of an arse of it and not still using "CAM" as a password for everything.
First time I pointed John the Ripper to a password file it immediately started beeping like crazy. Turns out default password was no password, and 70% of the accounts were unused. Those happy quaint 90s...
As I understood it, any private key up to N can be cracked in √Ν steps. I don't know what threshold they used, but they probably ran the scan for small private keys.
It's called the baby-step giant-step algorithm, and it's referred in the report thread to Mozilla:
"They can be recovered near instantly via the baby-step giant-step discrete log algorithm or more simplistically by just generating the 'first' 256 P384 keys."
Oh, I thought you meant "private key up to N bits", not "private key up to the exact value N". In that case, sure, but for non-eMudhra-issued keys BSGS's more relevant complexity figure is O(2^keybits). Unless you've a quantum computer on you, in which case I'm told it's easy-peasy :)
These new proposals, which have been suspiciously hidden under NDA’s, misdirection, etc. are ENORMOUS. And the local permitting in my area has data centers categorized as “light industrial”, and thus passed a 1-year moratorium to revisit the code. I am fully aware of smaller data centers along the highway I drive every day with no issue, and as such I do not consider myself crazy.
But are the NDAs new, or were you manipulated into caring about them this time and not the 1000's of other times it's happened (across various industries)
In the great POSIX, Windows vs. Apple filesystems debate, and iPad "what is a file", the great AI Overlords propose: "what if the filesystem was soup?". Manufacturer instructions, public data, and user's instructions and data, all sort of swimming together.
Could also phrase it "What if the filesystem was SOUP?"
Apple’s Developer Documentation is historically pretty terrible. So I’d be curious to see if they stepped it up for the agent instructions for the new API’s.
Apple's current docs suck, and they have, for a long time (SwiftUI was so bad, that someone came up with this[0], and it was a lifesaver).
But I'm old enough to remember Inside Macintosh[1], and that was a thing of beauty.
Apple used to take technical documentation very seriously. Many of their technical writers had better tech chops, than the engineers making the stuff they wrote about.
I really wish they still did, instead of focusing so much on trying to make it simple and obvious like in SwiftUI. Objective-C was a pinnacle of computing, and ever since Swift they've been devolving into the pursuit of oversimplifying and abstracting away the details such that they don't even feel necessary to teach anymore, even though as a new developer, I WANT TO KNOW THEM.
Unfortunately, during that time is when they screwed around with the gold confiscations. So the best option would have been to illegally hoard gold until they struck the statute down?
I'm shocked that more people don't know about this. It seems insane that the "land of the free" (yeah I know, not really, but that's the pitch anyway) would have such an obviously command-economy policy through the heart of the cold war.
My pessimistic take is it’s being optimized for the “numbers” users benchmark with. The 5G repeater towers that display on your phone as full-bars but the tower itself is constrained, to juicing the speedtests. Apple even changed how the RSSI translates to the bars. There are engineers doing great work, and the marketing teams muddle the waters (like ATT’s “5Ge”).
reply