Stack Exchange
log in

jww

 Discussion on answer by Kate Gregory:…

Imported from a comment discussion on workplace.stackexchange....
jww
Sep 30, 2019 12:29
@Daniel - git revert and git blame are your friends.
 

 Discussion on question by 20122: poss…

Imported from a comment discussion on law.stackexchange.com/qu...
jww
Sep 30, 2019 00:28
Related, see For now, GNU GPL is an enforceable contract, says US federal judge. It sounds like you are trying to do what Hancom attempted to do to Artifex. Hancom took free software and discarded the license. Artifex is the author of GhostScript and dual licensed it as GPL or Commercial (with a fee).
 

 Discussion on question by Thomas: How…

Imported from a comment discussion on security.stackexchange.c...
jww
Sep 21, 2019 10:19
@FutureSecurity - My bad, OP is using 3 bytes, not 4 bytes: "Take the first 3 characters of the digest...".
jww
Sep 21, 2019 10:19
@FutureSecurity - OP requirements are 4 bytes, not 32 bytes.
jww
Sep 21, 2019 10:19
@FutureSecurity - I'm not aware of any proof that a truncated SHA-1 or SHA-2 hash retains the collision resistant properties of the full hash. See Kelsey's publications on the NIST website circa 2005. Part of Kelsey's work drove requirements for SHA-3.
jww
Sep 21, 2019 10:19
You might be able to use SipHash. It was designed as a fast and lightweight hash. The rub is, you will probably need to key it. It should not be too difficult to key the hash. I doubt SipHash is worse that the truncated SHA-256 you are using, and it will likely be faster.
 

 Discussion on question by user107417:…

Imported from a comment discussion on workplace.stackexchange....
jww
Aug 31, 2019 23:59
Forgive my ignorance... Did the company (or HR) know of these requirements before they placed her in your office? Or maybe, does the company know these measures are in place at the office?
 

 The Side Channel

Mostly randomly generated noise. – crypto.stackexchange.com
jww
Aug 26, 2019 23:55
Hi Everyone. I'm looking for a reference that says an ElGamal private key x should be generated over the interval [1,q-1]. It looks like ElGamal's paper says [1,p-1], but I am not sure I am parsing it correctly. Wikipedia says [1,q-1], but I can't find a citation. Does anyone have a reference for [1,q-1]?
jww
Jul 4, 2019 00:15
Hi Everyone. I'm looking for a citation on Crypto.SE. I need a question where someone performs c = E(E(m)) using the same key and iv such that c=m. It happens with stream ciphers and block ciphers in counter mode. I have not found the dup. Does anyone recall seeing one?
jww
Jun 7, 2019 19:49
@Maeher - I think a good example of improvements over time (not necessarily seminal in the derived work) is Bernstein's RSA signatures and Rabin–Williams signatures:the state of the art. It sums up decades of work and I think it is surprisingly approachable. I often offer it as a reference to beginners.
jww
Jun 7, 2019 05:30
Hi Everyone. I have a quick question on Edwards and Twisted Edwards curves. An Edwards curve can be parameterized with x^2+y^2 = c(1+dx^2y^2). A Twisted Edwards curve can be parameterized with ax^2+y^2 = 1+dx^2y^2. My question is, are there any crypto systems based on a c!=1 parameter?
 

 Discussion between MechMK1 and jww

Imported from a comment discussion on security.stackexchange.c...
jww
Aug 23, 2019 11:37
@MechMK1 - Yeah, I tried to avoid Rainbow Table Attack. That applies to MD5 and the hash chains due to the design of MD5's compression function. Pre-computing from a dictionary has been around a long time. It is more like a property of the attack. You can precompute the hashes, or you can use the uncooked word and perform the transform on the fly.
jww
Aug 23, 2019 11:37
@MechMK1 - It is probably best to leave the conversation here. If you are unclear on the terminology, then others may be too.
jww
Aug 23, 2019 11:37
@MechMK1 - Dictionary attack. I'm not sure a "lookup attack" is mainstream. It has always been called a dictionary attack since I can remember. I'm not citing wikipedia as the authoritative reference. I'm only using wikipedia and owasp as examples that most folks call it a dictionary attack. (Or most folks I know).
jww
Aug 23, 2019 11:37
@MechMK1 - Where do you think the precomputed tables are compiled from?
jww
Aug 23, 2019 11:37
@MechMK1 - Salt nullifies the precomputed tables. Also see OWASP Threat Model for Secure Password Storage.
jww
Aug 23, 2019 11:37
Big subject. Salt is probably the easiest way thwart dictionary attacks, but there are other vectors like known password lists. Attackers will certainly try all the weak/wounded/compromised passwords on the list.
 

 Discussion on question by Conny: Disc…

Imported from a comment discussion on workplace.stackexchange....
jww
Aug 8, 2019 12:18
"John just opens a remote desktop session, demonstrates that he's already designed the system in spare time... We also can't find John's demo work" - That is probably company IP. John may find himself in a lot of legal trouble such that no one will employ him. He'll be working for startups in return for equity instead of a comfortable paycheck...
 

 Discussion on question by Jonny Cash:…

Imported from a comment discussion on workplace.stackexchange....
jww
Jul 24, 2019 20:57
Do you have a written agreement? What country are you in? There may be specific legal remedies available to you.
 

 Root Access

For all you Super Users out there. You have backups, right?
4
jww
Jul 20, 2019 03:35
Thanks @Aibobot. Yeah, I am a Fedora guy myself. I don't run openSUSE, but I need to coordinate with one of their maintainer on github.com/weidai11/cryptopp/issues/865 .
jww
Jul 20, 2019 03:21
Hi Everyone. I need to contact an openSUSE package maintainer. openSUSE has a package search page, but it does not provide package details, like Maintainer. Confer, software.opensuse.org/package/libcryptopp . How does one determine a package maintainer for an openSUSE package?
 

 The Water Cooler

General chit-chat for workplace.stackexchange.com. Feel free t...
2
jww
Jul 16, 2019 23:49
Hi Everyone. I'm starting a contracting role and I need to find a benefits package. Ideally, the package will provide health+dental+disability+term life+legal insurances. And it will be a benefits package with a group rate, like $1500/month for all services.

Google search is returning hits, but they don't seem like quality hits. For example, I found https://icba.activatebenefits.com/, but I can't find detailed information like what a plan costs per month. I can't even find their mailing address. I also cannot locate them in the Non-profit BBB.
 

 Discussion on question by DavGin: How…

Imported from a comment discussion on workplace.stackexchange....
jww
Jun 19, 2019 15:29
Did someone really need to ask a question with an answer "drink whatever you like"?
 

 Discussion on answer by Tom Carpenter…

Imported from a comment discussion on electronics.stackexchang...
jww
Jun 14, 2019 13:16
@8bittree - off-topic, my instructor's name was Henry Katz. He was a character who loved to talk about interesting things. He would do things like put trivia on tests to see who was paying attention during lecture. He told us a story of how the US Air Force tried to kill his PhD theses, and it showed up on one of the exams. His work solved manned vehicle reentry during the space race. This was his program when he was at the NSA: Operation Ivy Bells. If you met him you would have thought he was some sort of country boy in the big city.
jww
Jun 14, 2019 13:16
@8bittree - Yes, whatever the Pentium and Pentium MMX were called. His notes called them Pentium 5's (I just checked my old notebooks). I seem to recall he got them from an Intel engineer for the class. I guess around the time the marketing department named the chip.
jww
Jun 14, 2019 13:16
@8bittree - Yeah, those were the P5's, like Pentium MMX. They were the 5th generation after i486.
jww
Jun 14, 2019 13:16
Cache coherency between chips and cores was (is?) a big problem. When I took my EE classes in college one of my instructors knew the Pentium 5 very well. He really enjoyed talking about Snoop. It was a component that watched the address bus for reads and writes and managed the caches.
 

 Discussion on answer by reed: Is it a…

Imported from a comment discussion on security.stackexchange.c...
jww
Jun 14, 2019 07:57
Wait a minute... You are not using research results or security engineering principals??? You are saying, my company does it, it worked for me so it is OK??? Man, what a waste of my time... If you wanted announce you are proficient at it, you should have done so instead of dragging me into this.
jww
Jun 14, 2019 07:57
@JMac - Maybe this will make more sense... My undergrad and graduate work was in Computer Science. I'm guessing you are about the same. We are CompSci guys. Could the company send us to 2 hours of training and then expect us to do the work of the MBAs and CPAs in the front office? I certainly should not be modifying the ledger or trying to balance to books.
jww
Jun 14, 2019 07:57
@JMac - Train users to do what? Anyone who places their hopes on the user doing the right thing has already lost. Some users don't have the skills to make a security related decision, and some users will ignore the training even after you teach them. Users will choose the dancing bunnies around 40% of the time even after you train them not to open emails or follow links. We know this is a fact from Security UX studies.
jww
Jun 14, 2019 07:57
@JMac - "No quarantine will be perfect" - Agreed. The quarantine was not perfect. It mis-classified at a rate of at least [roughly] 10 a day. "There are also obviously costs..." - So what? Security is a cost center. It is the cost of doing business. Computing is a privilege, not a right. If you want to collect the data, then you have to protect the data.
jww
Jun 14, 2019 07:57
@JMac - My bad, I answered in the context of the question; and not the comments. I need to use another block to answer. You don't block all email. Rather, you quarantine suspicious emails and then notify the user. That means you need a security appliance at your email gateways. Users don't make the choice of "what is suspicious". Most users don't claim the quarantined email so no time is lost.
jww
Jun 14, 2019 07:57
@JMac - For those who do request a release, the NOC or SOC personnel extracts the suspicious email at a mini-DMZ area on the network using a computer like ARM64 or PowerPC (back then it was PowerPC or SPARC). The email and attachments are inspected and scanned. This takes the "dumb user" out of the decision process. Some PDFs and Word docs are re-saved/re-written to remove active content like macros. The email is released if we can't find a reason to reject the email. On a typical 8-hour shift at Treasury, we would get less than 10 requests to release emails from a base of about 18,000 users.
jww
Jun 14, 2019 07:57
@schroeder - "There are many, many effective ways to teach users how to detect phishing" - Citation, please. The Security UX studies I have read say it is not effective. Most users I know cannot discern the difference between a legitimate email and a fake one, including my mother, my father, my sister-in-law and my brother. In fact, my mother is very social. Every device she owns has been compromised - desktops, tablet and phone. I built here a machine using ARM-based AMD Opteron running Zorin to stop x86 malware and root kits. My biggest problem now is the damn browser malware.
jww
Jun 14, 2019 07:57
@Jmac - Well, for this question, I don't think social media exposure matters. When I worked in US Financial employee lists we considered medium value data. The firms did not want other firms poaching [top] employees. (High value data was executive compensation, pending litigation, mergers and acquisitions, etc). Everyone knew everyone else (give or take) so it was not hard to know where the financial wizards were working.
jww
Jun 14, 2019 07:57
@Jmac - For the miscreants, their vector is handed to them. They are going to target the folks in HR, sales and marketing. The miscreant will submit fake resumes to open positions. They will gather email addresses when HR contacts them for an interview. Similar will play out for marketing and sales. They will pretend to be a corporate customer interested in <insert tech here>. So the miscreants will accumulate a list of potential targets; and won't need to comb Facebook, Instagram, LinkedIn, etc.
jww
Jun 14, 2019 07:57
Well, the information you are citing is wrong. The best thing to do is remove the user from the situation. From Engineering Security, p.28: "The best approach to the human-factors problem ... is to redesign ... the application so they [users] are no longer needed. Since users will invariably click ‘OK’ (or whatever’s needed to make the dialog disappear so that they can get on with their job) the best way to protect users is to actually do the right thing, rather than abrogating responsibility to them." Anyone who tells you any different does not have subject matter expertise.
jww
Jun 14, 2019 07:57
This is why Gutmann's book is so good... the research and citations. It does not get any more explicit than this from p. 203: "In another study that evaluated the effectiveness of trying to educate users about phishing, researchers discovered that the education attempts made no difference in users’ ability to detect phishing email ... [681]". You have to take users out of the loop.
jww
Jun 14, 2019 07:57
Also see Peter Gutmann's Engineering Security or Ross Anderson's Security Engineering. The more robust systems anticipate internal threats and bad user decisions, and take users out of the loop. Taking users out of the loop was one of the NSA's remediations after Snowden's release of classified information. NSA reduced the number of sysadmins who had access to the data in the first place.
jww
Jun 14, 2019 07:57
"The best security practice is to train the employees..." - Citation, please. That hasn't worked in 30 years. Why do you think it is going to start working nowadays? Have IQ's suddenly risen? When I was a contractor at US Treasury, we took the user out of the loop. Suspicious emails (for a very aggressive definition of "suspicious") were sent to quarantine and not provided to the user. They could not follow a link because the message with the link was not delivered to them. If a user wanted the email message, then we had a procedure to release the message if it was benign.
 

 Discussion on question by henning: Ar…

Imported from a comment discussion on academia.stackexchange.c...
jww
Jun 13, 2019 15:04
@user71659 - Manley's illiteracy is a statement of fact. He faked his way through college as reported by news outlets like the LA Times and interviews with periodicals like People Magazine. When he testified before Congress on illiteracy he could not read his own prepared statement. I don't claim he cheated. I could not care less how he got through college. Nor do I care how the college treated their start athletes. If I have any opinion, it is we (society) cheated him and every other black or latino child that followed him. It disgusts me that we allow children to fall between the cracks.
jww
Jun 13, 2019 15:04
@user71659 - I don't believe I drew any conclusions. I stated Dexter Manley graduated from University and was illiterate (and provided a citation). Off the record - I'm from the Baltimore/DC metro area. Manley used to appear on talks shows I listened to back in the 1980s, like The Grease Man and Howard Stern. Manley was illiterate because of socio-economics; not a medical disorder. It was well known in this area of the country. I don't know if he is still illiterate.
jww
Jun 13, 2019 15:04
Dexter Manley of the Washington Redskins football team graduated college but could not read. He was illiterate, and still graduated from Oklahoma State University.
 

 Discussion on question by ilie: Must …

Imported from a comment discussion on workplace.stackexchange....
jww
Jun 12, 2019 05:42
"Is there any strategies or ways to solve this type of problem?" - Don't have social media accounts. I don't participate in the social media experiments, so I don't have the accounts. I have never had this problem. I don't have the other problems associated with social media either, like loss of privacy and shipping personal data off to partners. (Maybe should be an answer but the system dissuaded me from adding another answer).
 

 Discussion on answer by Solar Mike: A…

Imported from a comment discussion on workplace.stackexchange....
jww
May 31, 2019 11:12
"... consider an exam or test as part of the interview process" - that may alienate senior folks. I often decline the invitation if I have to partake in an online exam, especially if it is proctored by a third party. I graduated college 25 years ago so I don't get excited over exams. I also don't want third parties possessing/selling/losing information about me. I'm happy to point them to my GitHub to inspect my work. I'm also happy to take a phone screen. I need to interview the company while it is interviewing me.
 

 The Whiteboard

General Discussion for softwareengineering.stackexchange.com P...
jww
May 12, 2019 14:27
@anon - Yeah, you are right about “userland”. I was thinking system service versus the user launching the program from a terminal. On Unix they are basically the same thing (with some hand waiving). On Windows a service is kind of distinguished, a kind of lies between kernel and userland (depending on the service).
jww
May 12, 2019 14:24
@anon - At the moment the logs don't have anything useful in them. They have program startup, shutdown and errors. At the moment, there are no errors after about 20 days of uptime.

The logs are sparse by design. I don't believe in logging like some folks do. I believe at release time, you gotta put on your big boy pants and bring your A game. Time for debugging is over. Plus, logs leak a lot of information, and some audits (like NIST SP-800-53) frown upon debug logging in production.
jww
May 12, 2019 14:19
Thanks @amon. Well, yes and no (re:special porting). I think systemd accommodates old Unix daemons with PID files. Newer services should do things like implement the sd_notify API.
jww
May 11, 2019 21:39
Hi Everyone. I have a program written in C. I currently run it manually in userland. I want to convert it to a systemd service. The conversion is mostly done. The C program checks if it is being run as a systemd service, and uses the sd_notify API if symbols are present using dlopen and dlsym. I think I only need to create the *.service file and start it on boot.

As a service I will lose detailed monitoring of the program. The program generates output at various levels, like Debug, Info and Error. I am aware of 'systemd status', but it leaves a lot to be desired, especially with a lot of o…
 

 The Factory Floor

Main chat room for worldbuilding.stackexchange.com
3
jww
Apr 16, 2019 00:58
It would really bother me to learn that economic models say slavery must exist to push through some barriers. It is kind of a touchy subject and I don't want to ask on the main site.