Recent submissions

Comment · 12 years ago
I don't see the parallel as intended to put Napoleon down, but instead to attribute the same force of personality to Hitler. As someone who never met either man (perhaps that's obvious :), I'm not sure the connection works with me.
Comment · 12 years ago
Can you list some of the boards that are both cheaper and more capable?
Comment · 12 years ago
Why do BitFury and Petamine use a pool at all? At their scale, wouldn't they have low enough variance through solo mining? Or perhaps P2Pool?
Comment · 12 years ago
That video is just auto-complete after the first letter...
Comment · 12 years ago
I use Linux basically everywhere - Arch Linux on development machines, Ubuntu or Debian on servers. I use Windows for gaming maybe 5-10 hours a week.
Comment · 12 years ago
Can someone explain to me how the US has jurisdiction over Credit Suisse? I see how they could have gone after the individual tax fraudsters (American citizens), but how can they police foreign banks?
Comment · 12 years ago
We really ought to completely skip over Chip and PIN to something like Google Wallet or another NFC system...
Comment · 12 years ago
Yes, this is the NSA's job - foreign SIGINT. If you don't like this, you need to use encrypted communications.
Comment · 12 years ago
I take this sentiment a bit further - unless it's throwaway-cheap, the reviews and word of mouth are stellar (they're usually not for any but the biggest hits), or the concept immediately clicks for me, I will pirate the game to try it out. If I like the pirated version, I _usually_ purchase the full game (but not always). Not having reasonable demos just increases game piracy.
Comment · 12 years ago
No. If I shut down my laptop, my hard drive is encrypted and keys are no longer in RAM (modulo a cold-boot attack, but that is only really useful for <30 minutes after shutdown without preparation).
Comment · 12 years ago
The obvious solution for this would be for Android to expose "derive random numbers from image frame" as a permission. But this is unnecessary, because they can just seed /dev/random from this source at boot (or if the device is unseeded).

That said, mobile devices really aren't lacking in entropy sources. With all the radios and sensors in a modern smartphone, why do they need additional methods to generate random numbers?

For information security purposes, a cryptographically secure PRNG is typically at least as secure as the encryption algorithms that it protects.

Comment · 12 years ago
https://www.tindie.com/products/ubldit/truerng-hardware-rand...

But I'll give two cautions:

1. This device has received less auditing than linux's software crypto. And some HWRNGs are quite bad: https://news.ycombinator.com/item?id=6060636

2. You don't really need that much randomness. After your machine has been on for a while and has seeded correctly, /dev/urandom is just as secure as /dev/random. Entropy is not gasoline - it does not disappear as you use it.

Comment · 12 years ago
I use "lvh.me" - it has a wildcard DNS record to redirect any subdomain to localhost. So I'll use something like "example.com.lvh.me" to test.
Comment · 12 years ago
StartSSL's default usage mode is to generate private keys on their website. Yet another horribly insecure system.

I'd much rather that people used self-signed certs (and browsers had certificate pinning) by default, and could then step up to real CA certificates. Self-signed certs provide almost the same amount of trust that StartCom does.

Comment · 12 years ago
That bug affected OpenSSL as well. Admittedly, it was caused by the Debian maintainer, but still, OpenSSL's poor design is partially to blame.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton