Nimi
Joined 14 years ago
Karma
926
Submissions
218
Member since
Apr 2
feel free to contact me: nimrod.aviram, at that thingy Buchheit invented
View on Hacker NewsRecent submissions
Comment · 3 years ago
Is there a writeup describing the exact timing side channel?
The advisory states that the vulnerability affects all RSA padding modes, which seems to imply non-constant-time BigNum operations. However, OpenSSL implemented RSA blinding even before the fix, which is supposed to prevent those class of problems. So this should be interesting :-)
(I did find the commit fixing it, but it's huge, and I can't follow the change: https://github.com/openssl/openssl/commit/b1892d21f8f0435deb...
Comment · 10 years ago
Another browser beside Chrome, Firefox and IE? OK, so Symantec announces that they will only use Opera. Even then, they have to deal with their customers, website operators who need a certificate trusted by the big 3 browsers, leaving. In fact, now that Let's Encrypt certificates are free, it seems like this is the Symantec CA's worst nightmare.
Comment · 10 years ago
Fascinating. I still feel I'm missing something basic here: If Microsoft, Google and Mozilla announce they're not going to accept any particular crypto primitive two years from now, and this time there won't be any exceptions, CAs and websites just have to abide, don't they?
Comment · 10 years ago
That's very interesting, do you happen to have a link for the blog post?
Comment · 10 years ago
Moving away from obsolete crap isn't the solution, it's the definition of the problem.
One could argue that the CA/Browser forum has achieved some success with moving away from SHA-1. As a spectator, I don't understand why this process is not repeated for similar obsolete primitives or standards.
Comment · 11 years ago
Consider another explanation: If you use the term "rape culture", you essentially claim that in today's society, oftentimes rape will be accepted (FWIW, I agree with this statement). However, there appears to be a consensus in today's society that genocide is always a bad thing; generally that opinion is expressed without any qualifiers (as opposed to qualifiers like "legitimate rape" etc.)
Comment · 11 years ago
As this is the second time I see companies complaining on HN about the short deadline, and there seems to be a consensus that transitioning to another payment provider realistically always takes more than 5 days, you might consider having a longer default deadline that makes it possible to transition in time. Just my 2 cents.
Comment · 11 years ago
Both the pitch here and the site seem a bit light on endorsements from companies which have previously hired your interns, although I'm guessing you have at list a few good endorsements on file? Maybe consider giving visibility to a few good "reviews" from companies. Just my 2 cents.
Comment · 11 years ago
Found myself in similar situations in the past. My tentative solution was to maintain a corpus of resources for practice (beyond the usual suspects of implementing the standard data structures etc.), and hope that when the chance comes, 1-2 hours each day for a week before an interview would suffice. And when I do practice, I don't use a code editor, either paper or plain editor with no way to execute the code, simulating the (horrible) conditions of interviews as best as I can.
Obviously, this doesn't get you the benefit of being constantly drilled, but should provide some advantage. If you do care enough to get yourself a bigger advantage, maybe try to clear a few weeks before a round of job searching (if that's how you operate), then use those weeks for a few hours of practice each day.
Comment · 11 years ago
Thanks!
I prob. missing something about [you're] "handing me your private keys to unlock that 1c output. Now if you ever released Transaction 1, I can spend both the outputs". What happens if you release transaction 1, then immediately release a transaction moving the funds away from that address? Seems like I have to be very vigilant and closely monitor the blockchain, fearing this will happen?