fryguy

I mean, that's what STIR/SHAKEN do.

My problem with notebooks is that I feel like the natural mental model for them is a spreadsheet mental model, not a REPL mental model. Under that assumption, changing a calculation in the middle means that all of the cells that depend on that calculation would be updated, but instead you need to go and manually re-run the cells after it that depend on that calculation (or re-run the entire notebook) to see the effect on later things. Keeping track of the internal state of the REPL environment is tricky, and my notebooks have usually just ended up being convenient REPL blocks rather than a useful notebook since that's the workflow it emphasizes.

It seems to me to be the exact opposite of this. If all of the data going from server to client comes through JSON to javascript, which usually means a JSON serializer and should correctly escape the data since you're not generating the JSON by hand, then there is no chance for traditional XSS attacks since the only remaining vector would be doing manual DOM building by concatenating strings, which you generally don't do in React. Now CSRF attacks I would believe you, but not XSS with React.

I would say this is more like a local git repository than what you said. When you add passwords to a vault, then it gets saved to your local copy and then synced to the server. When changes are made elsewhere, it downloads the changes and syncs your local repository.

Now "travel mode" simply removes the local git repository. The data still exists in the cloud, but you have to actively go out and log in to their service to retrieve it. Are you "hiding something" because you deleted a local copy of something from your device? There isn't something on your device that is somehow hidden. It's not there.

I prefer the Goodreads rating system which compresses 1 and 2:

1 - Did not like it

2 - It was ok

3 - Liked it

4 - Really liked it

5 - It was amazing

The reason being is that most books won't end up being 1 or 2, and there really isn't much difference between them. But it sucks giving 2 stars to something that wasn't bad. Perhaps emoji arranged in a non-star-like pattern would be the best.

Can you explain how a collision helps? I mean, there's trivial collisions with the truncation that would be used instead. That doesn't mean that bcrypt(f(x)) is any weaker because there may be some other x' that f(x) = f(x').

I use realtimebitcoin.info

How many dots/stars should one display for a password? That's a question that can't be answered by your two valid question. Are you suggesting that dots/stars shouldn't be displayed for passwords, since you can't ask how many "characters" it is?

Think about it this way. Netflix wanted to separate their DVD and streaming into separate companies, so there would be different websites for each. Consumers complained about that so much that they changed their mind and stayed with one. If Google/YouTube started with a single product and broken it out like it is now, people I think would rightly complain.

I think the most egregious thing is music, rather than YouTube Red or this service itself. There's Google Play where you can buy music, Google Play Music where you can subscribe like Spotify, and YouTube Red also includes unlimited music on top of the shows on Red but is somehow different than Google Play Music. I guess what I would suggest if I had any say in things is just killing the Google Play Music and Google Play Movie/TV brands, and moving the content to YouTube and maybe integrating YouTube into the Google Play app on phones. YouTube already has movies, so it would just be a matter of making the music and live streaming part of it more visible on the home page. I don't see any links to them on my front page.

Well if you use the Bitcoin network as a metric, there's roughly 3 billion GH/s (which is really two chained SHA1 in hardware), and realtimebitcoin.info claims this is ~2000 MW. If you compare that to the 9 billion GH that the shattered article claims are needed, then that indicates it would take a network equivalent in size to the Bitcoin network ~3 seconds and ~1'600 kWh. There's no indication how "lucky" a 9 billion GH collision is, so perhaps it would be longer or shorter based on the statistics.

Looking at it from the other direction, they claim 110 GPU-years. A GeForce GTX 1080 is claimed to be 180 W. That's 175'000 kWh. If you assume that dedicated hardware ASICs are 100x more power efficient than the card I claimed, that has at least a similar order of magnitude. To do it in an hour would take a million graphics cards, and ~200 MW.

That's not entirely true. You could fork a popular git repo, and then make some kind of patch for a bug in some seldomly changed file. Then force a collision in the new file with the benign change as well as your poisoned version. Then they could convince you to pull in the changes. Then they could reset their repository to the one with the poisoned version and anyone who pulls from them first would get the poisoned version of the file instead of the right one. It seems extremely unlikely that a practical attack would come out of this though.

Basically, the reason that things corrode is that there are dissimilar metals, one with more electrons than the other creating a voltage between them. So your part is a battery and the ocean is the "wire". The electrons move from your part (corroding them), to other parts with less electrons. If instead you have a sacrificial piece of zinc, the zinc has more electrons than your part so the electrons will come from the sacrificial piece of zinc instead of your part. Think of it like a lightning rod, but for corrosion instead of lightning. It's more complicated than this, but that's the general idea.

Is it though? There's only 230k words in that list, and most words aren't that long. Building a trie and then trying all the permutations of all of the words seems like it would finish in a reasonable amount of time. Even then O(n^2) approach of comparing pairwise would probably get you to a reasonable time. Especially since this is a one-time thing and doesn't get run over and over.

And your argument is kind of silly when in the very same article when he uses brute force to see how many segments. Shouldn't he have found the most optimal algorithm for that instead of brute forcing it?

For a, you can put a sacrificial anode on the frame. Given that the rate of corrosion should be known, the size of it can be calculated to however long the pod is expected to be in service.