zygentoma

Code does not need to be reviewed to be secure. [^]

It needs to be designed to be secure.

[^] of course I'm hyperbolic here, it does still need to be reviewed – I just mean, review doesn't matter as much as choosing a secure design, where certain bugs just can not or will not happen.

I think this would be the better link for this

> And so if you don't trust the server that is hosted on or the security of the transport mechanism like TLS/SSL, such that the content may be manipulated by adversaries, you think that git hashes are good enough?

How does this matter? When I have a machine that I trust and a git hash that I trust, I don't need to rely on the transport mechanism. As long as the content cannot be forged to match the hash, the transport is completely irrelevant.

Git was maybe never intended to be used as an integrity check, but SHA hashes definitely were and are.

And if git provides a cryptographic hash over the content, I don't see why it shouldn't be used to verify the integrity of the checked-out content.

And what do these cryptographic signing algorithms do? They sign a cryptographic hash of the data … Which the SHA-family of hashes are.

Sorry, no.

When I check out code from a git repository in a pipeline using a git hash, I expect the code to be exactly what has been reviewed by me under that hash.

Everything else would just be a crazy invitation to make supply chain attacks uncircumventable.

I believe it's a reference to the hitchhikers guide to the galaxy – where the plans to remove the protagonists building to build a bypass road was hidden in this way.

This also seems to happen for 16 and 32 bit numbers, so you should be able to see zeros easily.

They also write:

> Running the same programs on an Intel processor, and the 0's are there with no problem.

Radiation pressure! There is so much heat (= photons) radiating outwards, that it counteracts the gravitational pull.

It's not really like you're 5, but the third sentence of the introduction makes it really understandable:

> The problem’s definition is simple: There are k servers located at points of a metric space. At each time step, a request arrives at a point of the metric space. An online algorithm must serve the request immediately by moving a server to the requested location, without knowledge of future requests. The goal is to minimize the total distance traveled by servers.

So metric space is anything where you can measure a distance, so you know the distances between all servers and the distance from the request to all servers. Could be direct distance, could be travel time …

Easiest to just imagine just some (eg. n=5) servers on a plane. A request pops up somewhere on the plane. Which server do you move there, such that the total distance moved by servers is as low as possible in the end after a sequence of requests.

Well, any natural number is unimaginably small, compared to ω …

Shouldn't a fixed additional amount also care for inflation based price increases indefinitely?

(Maybe not if the inflation greater or equal the interest rate … though I did not do my math here.)

"Innocent until proven guilty" concerns whether someone did a crime, not whether something is a crime.

An action can clearly be a crime, but it might be unclear if you did that action.

Would be nice if you could get an exact clone of a yubikey, so you always have a spare in case you lose one.

Though I think there is also the option that sites can store some sort of identifier on the key, then this would not work:/