onlydnaq

há 7 mesesdiscuss

802.1x is quite trivial to bypass if you have an authenticated device (in this case the intercom) that you can transparently bridge[1].

[1]. https://www.defcon.org/images/defcon-19/dc-19-presentations/...

onlydnaq

há 4 anosdiscuss

Something about that headline really irks me. I think GitHub is an amazing place for people to share code, I also think it’s really nice of them to do this.

But the maintainers aren’t “their” maintainers. They are maintainers using GitHub for their projects.

Probably just me overreacting, just thought I’d mention it.

onlydnaq

há 5 anosdiscuss

Without having looked into it too deeply I feel that they are somewhat “cheating” by using a superserver to launch a new process for each connection, thus letting the OS handle the dynamic allocation needed for each connection.

Still pretty impressive project. Would be fun to take a deeper look at it at some point.

onlydnaq

há 5 anosdiscuss

A CPU can halt as a power saving measure, and still respond to interrupts.

onlydnaq

há 5 anosdiscuss

I don’t know where the files for the mouse are (or if they’ve been released), but the design files for the trackball can be found here [1].

[1] https://github.com/ploopyco/classic-trackball/tree/master/ha...

onlydnaq

há 5 anosdiscuss

I have one of the full size Ploopy trackballs, and it feels really good in the hand. It is 3D-printed, and it shows, but the texture of it feels pretty nice when using it.

I struggled a bit with accuracy at first, but now I’ve lowered the DPI to around 500 and it’s become much more usable for me since.

onlydnaq

há 6 anosdiscuss

> There’s probably a way to get those last three into my NixOS config

There is, it’s called home-manager [1] and it’s a pretty nice way to manage your config files and user packages even if you’re not on a NixOS system.

[1]. https://github.com/nix-community/home-manager

onlydnaq

há 6 anosdiscuss

It's worth to know that the watch also tracks HRV whenever you use the Breathe app, so if you want to get consistent HRV readings the easiest way is to use Breathe once a day (for example right when you wake up).

onlydnaq

há 6 anosdiscuss

That was their April fools joke though.

onlydnaq

há 6 anosdiscuss

> Could I have done all that in a single shell, then had it automatically cleaned up when I was done?

Yes, that is a pretty standard workflow for most nix users. You either set up a shell.nix for your project with all of its dependencies, or if you need a certain tool once you just write for example: ‘nix shell -p iotop’ to enter a shell where iotop is in the path.

onlydnaq

há 7 anosdiscuss

Why would anyone use rdrand directly? Seems like user space applications should use getrandom() or /dev/urandom and the kernel should use rdrand as a complementary random number source in its random number generator.

No user space program should need to use rdrand directly at all.

onlydnaq

há 7 anosdiscuss

That’s exactly what I meant as well. SQL may be the implementation, but if so with a well designed exposed schema, not with the application internals.

onlydnaq

há 7 anosdiscuss

When it comes to modern web development I’m more of an observer than a contributor, so my opinion might not carry a lot of weight. However for me all these abstractions seems to get closer and closer to querying a database using SQL directly.

A carefully designed database schema would be able to support all of these use cases in a way that (at least for me) seems a lot simpler than wrapping it in new abstractions. Inserting multiple objects in the same transaction?, already implemented. Updating several fields at the same time as well? Getting only the entities you are interested in together with their subentities?, well that’s what a relational database does.

As I said, I’m not a web developer, and I haven’t touched on use cases where a lot of different things need to happen on server operations, but all the examples in the article would be easily solvable with SQL.

onlydnaq

há 7 anosdiscuss

I believe you might be confusing it with Voat.

onlydnaq

há 8 anosdiscuss

I believe the correct way to protect against ReDOS is to use one of the many regular expression implementations that do not have exponential worst cases.

Nowadays there are good DFA or Tree based matching algorithms that are O(mn) where m is the length of the regular expression and n is the length of the input.

onlydnaq

há 8 anosdiscuss

If I want to decrypt a message to you that I have intercepted I can create my own email containing a modification of the intercepted message and send it to you, causing you to send me the plaintext contents.

onlydnaq

há 9 anosdiscuss

The only difference I’ve seen is a function that converts Keras models into TensorFlow estimators.

onlydnaq

há 9 anosdiscuss

You could take a look at tobii [1]. They make some interesting products where they combine eye tracking, speech analysis and other stuff to create user interfaces for people with specific needs.

[1] https://www.tobiidynavox.com/en-US/tobii-dynavox-pceye-plus/

onlydnaq

há 9 anosdiscuss

I would recommend you to try the intel python distribution. Comes with highly optimized numpy, scipy, matplotlib, pandas and so on. Everything compiled with icc and linked with MKL (intels BLAS library).

onlydnaq

há 9 anosdiscuss

This is a classic trick, and as you write could be used for performance benefits in the old day.

However, the semantics differ from just using a temporary variable in that if a and b are in the same memory location then the result will be zero.

This was used in an entry for the underhanded C contest [1] if I remember correctly where for an implementation of RC4 the author defined the following macro.

    #define SWAP(x, y) do { x^=y; y^=x; x^=y; }

And used it for swapping the values in the substitution table for the cipher, e.g. SWAP(S[i], S[j]). The weakness was that since sometimes the indices are the same in RC4 the substitution table would be gradually replaced with zeroes.

[1] http://www.underhanded-c.org/_page_id_16.html

Submissions

Anatomy of a Ghost CVE

Crux: Our new open-source tool for software verification

Fair is not the default

Pytorch 0.2.0

comments