lvh
Joined 16 years ago
Karma
6,765
Submissions
1,801
Member since
Oct 1
Recent submissions
Comment · 1 day ago
You get a very different CVSS score depending on the formula you use. Ubuntu's response page lets you select between the two.
(I think CVSS is a very poor metric in cases like these; I'm just explaining what I think Ubuntu's process/position is, not making excuses for them. My read is the 9.8 is probably too high but nevertheless more accurate in this case.)
Comment · 11 months ago
"The operating system makes it easy to mess with" doesn't seem like a particularly useful property for application file formats.
Comment · 1 year ago
That doesn't really explain why, you're just saying that the thin you claimed was desirable is desirable.
(I don't disagree! I'm just saying: you haven't advanced your argument or answered GP's question.)
Comment · 1 year ago
This is a fantastic example of applying deception strategies in practice as part of a detection & response plan. The most common use case is as a canary, but it absolutely works as evidence of compromise, too.
I won't comment on the specifics of the case (the complaint comes across as very convincing), but I will remind people that it's common for investigations to ostensibly show an employee doing bad things, when in reality it's e.g. that employee's credentials/devices that are compromised.
Comment · 2 years ago
Some of our customers, like Tailscale, are a helluva lot more picky than that.
Comment · 2 years ago
Re: hashing: Yes, but I'll leave that one to Paul who is a lot smarter than I am :)
Re: QA: can you say a bit more about the type of coverage you're worried about? Is your concern that we'd be missing APIs, or that the storage format itself breaks, resulting in fact elision? payne (the underlying project) has a borderline obnoxious amount of tests, but that doesn't mean we didn't miss anything :)
Comment · 2 years ago
FYI: we're planning a followup post for people who are less interested in the Datomic mechanics and more interested in the usefulness to investigations and other security functions. Informally, I think of it this way: your SIEM has the deltas, but often you want the contextual states in between the deltas (and a lot of investigation is about trying to reason about that state). We built this tool originally to support that, and it turned out that approach was also super useful for things like compliance, CSPM...
We already wrote a high level blog post here: https://www.latacora.com/blog/2023/11/01/our-approach-to-bui... -- but the one I'm hoping to write is more of a case study.
Comment · 2 years ago
(I'm one of the founders of Latacora and reviewed the post.) If any of you are at Heart of Clojure, I'll be there both wearing my Latacora hat and my Clojurists Together hat :)
Comment · 2 years ago
I don't know if I count as a "feline friend", but: SIDH kept the DH shape. Being able to upgrade the protocols we had relatively closely is appealing. "Structure is useful but seems precarious" wasn't exactly secret knowledge.
Comment · 2 years ago
We did an updated version of the Cryptographic Right Answers for PQC. Given how quick the field is moving, I'm sure we're going to have to edit it a bunch :)
https://www.latacora.com/blog/2024/07/29/crypto-right-answer...
Comment · 2 years ago
These standards are developed out in the open.
Are you suggesting a true backdoor, or just "the NSA knows something about lattice algorithms the rest of us don't"?
Comment · 2 years ago
The additional information you need is that that's what Thomas Wouters does (and has done for as long as I've known them, which is many, many years).
President of the Clojurists Together Foundation. We help the Clojure ecosystem, primarily by funding important open source projects (like CIDER, Ring, Reagent, Calva, Fireplace...), but also critical infrastructure like Clojars. https://www.clojuriststogether.org/
Feel free to contact me at [email protected] or professionally at [email protected]. Twitter: @lvh.
I wrote an introductory course on cryptography called Crypto 101. It's available for free and pairs well with cryptopals:
[ my public key: https://keybase.io/lvh; my proof: https://keybase.io/lvh/sigs/3Vhvhy8z2GAvOxd_cISVYLuz61aGzZ8f6AKzD2uAWVA ]