Mathematics

Associated with Math.SE; for both general discussion & math qu...
jrh
Feb 13, 2023 18:02
Right, if p were false that'd be a trivial proof. So we're assuming X is a subset of Y, and then assuming b is in (X intersect Z), the only thing left to prove is that b is in (Y intersect Z). I guess that makes sense, when you let the trivial cases of subset and implication fall away. Thanks.
jrh
Feb 13, 2023 17:52
That is fair, the empty set is a subset of any set. Another thing I don't completely understand about the author's method, it seems like the procedure assumes q in p -> q; though if p were false, wouldn't that give false positive proof results?
jrh
Feb 13, 2023 17:45
The example is trying to prove "for all sets X, Y, and Z, if X is a subset of Y, then (X intersect Z) is a subset of (Y intersect Z)"
jrh
Feb 13, 2023 17:44
I've been working through "A Guide to Proof Writing", on page 497 of the proof in Example 3, the author assumes that b is in the intersect of X and Z but I am not sure how that's a safe assumption, couldn't Z be the empty set? That would make the proposition true but it would be a false assumption.
 
jrh
Mar 21, 2022 21:34
@doneal24 Gen12, maybe not, but $150 laptop (amd64 not arm/chromebook) + 16 GB of RAM ($70), 1 TB SSD (SATA) ($80) = $300 which is a lot less than $1k and does everything I need, personally. For high performance stuff I use my desktop. I've found high performance laptops to be flaky and poor cost to performance.
jrh
Mar 21, 2022 21:34
@doneal24 you save about $800 buying used, for comparable hardware. I rarely find laptops that go for less than $800-$1000 new with the specs I can get used for $200-250
jrh
Mar 21, 2022 21:34
@doneal24 or just buy a used laptop (e.g., a later model Dell Latitude) that has official Linux support. If you're willing to wait for a deal you can get a laptop that runs Linux perfectly for under $200. In case that sounds like an ad, I don't have any affiliation with any resellers/etc, I just did this about 4x myself for family and friends.
 
jrh
Feb 13, 2022 21:12
Sometimes people seem to think "freedom of speech" means "No material harm whatsoever may come to you as a consequence of something you said, unless it was fraudulent, shouting fire in a theater, illegal, etc.", I'm not sure where that comes from, maybe before the internet was widely used things were less "public"?
jrh
Feb 13, 2022 21:02
@LorenzoDonati--Codidact.com "Keep in mind that freedom of speech is taken very seriously in western democratic countries." -- yes, and no. You definitely can say whatever you want, but you might get fired for it. Since the prof was "on the job" the tolerance for "freedom of speech" will vanish if it becomes inconvenient or embarrassing, and their "freedom" exists just because 1) nobody complained, 2) higher ups aren't paying attention / don't watch the lectures, 3) their tenure (if applicable).
 
jrh
Feb 8, 2022 18:13
You can say the employee violated that trust, and maybe they did, but the answer isn't "micromanage them". My recommendation: The employer should give 100% to try and build that trust back (on both sides), or move on. Anything else is winning the (Leetcode) battle (this time) and losing the (trust) war. Encourage careful thought and trust because their brain may be your only line of defense against huge problems (e.g., security issues).
jrh
Feb 8, 2022 18:09
It's a bit creepy and underhanded for a boss to track an employee's personal accounts (I'm assuming they do not have a company subscription to Leetcode or something). There's a ton of trust involved with professionals, especially devs. Probably won't end well to confront the employee with "we searched for your name and stalked your personal accounts and found you were not spending every second thinking about only approved topics"
jrh
Feb 8, 2022 18:06
If the employer doesn't interview with leetcode, then I can understand where they are coming from more; try and address the performance problems. The employee might not even "want" to do leetcode, but feels like they have to; maybe they know things are not doing well and are trying to get ahead for their next interview. I'm not saying it's right for the employee to do this on company time, but just wanted to point out this employee might already be on their way out.
jrh
Feb 8, 2022 18:04
Vaguely related, if this employer uses leetcode to screen employees, and expects perfect "parrot back" perfect answers on everything, well, it sounds to me that the employer thinks this is a skill the employee should be able to pull out on demand. If it's valuable (literally valuable enough to memorize and parrot back under time pressure), then an employee should get paid to practice it. If it's not valuable, don't interview with it.
 

 The DMZ

A serious place where infosec is discussed PS we don't do hard...
jrh
Dec 13, 2021 17:18
@A.Hersean Than any other client that isn't a browser. A statement like "password is worse than authentication_code" is pretty much making that statement, isn't it?
jrh
Dec 13, 2021 16:59
That's around when the Google searches quit bearing fruit, "why exactly is the browser considered a more secure client"
jrh
Dec 13, 2021 16:57
The other points made like "don't train people to enter their passwords into random apps" is a moot UX point because the desktop pattern is to pop up a browser window with no context (easily spoofable, see the way Visual Studio does it) and persuade users to enter their passwords into that, it's not an informed decision, previously people said that OAuth being "transparent and ignorable" was a good thing, so their own selling point to me sounds like a contradiction.
jrh
Dec 13, 2021 16:56
The way it's explained would make it sound like the browser's potential for replay is "not that bad" or "acceptable", the reasoning I can guess is that the browser is probably up to date, well maintained (maybe you are less likely to find a bug in a browser than a random app), etc., but it's also a more juicy target for exploits.
jrh
Dec 13, 2021 16:53
@A.Hersean makes sense, and my PC is technically impersonating me right now (I am logged in to the operating system). For all I know it could be keylogging every keystroke and replaying passwords too. The book I'm reading (and other sources) seem to say that "the potential for replay is bad", but that potential is always there, in my USB keyboard, its drivers, the kernel, my distro, the browser, the clientside JS from the server, the auth server, anything running as root, etc.
jrh
Dec 13, 2021 13:54
Other possible arguments I could think of, 1) because the auth server serves the JS that makes up the client, it's thought to be secure, 2) password flow bypasses the "scope", it is a license to impersonate me, with every power my user has (rather than "You can do X, Y, and Z"). Am I on the right track?
jrh
Dec 13, 2021 13:51
It's generally accepted that OAuth2 authorization_code is safer than password, because the client can save and replay the username/password. But isn't authorization_code adding another client, the browser program itself? Couldn't you also say that the browser could store my password and replay it? From a theory perspective, is there an implied trust of the browser at all times, and an implied distrust of any non-browser client?(Note: for the sake of simplification, assume no 2FA)
jrh
Dec 3, 2021 21:53
There's sensible cases, if you're just sending a phone number it shouldn't be 10^345 digits long, but when it comes to file-like things, or flexible length things, it gets harder to say what that "upper limit" ought to be. If it's a DDoS concern I can pretty confidently say even 1 MB is probably not going to sink my server, but if it's some kind of thing like "<some HTTP Server> has been known to have memory corruption with requests longer than 1024 bytes" that's something else
jrh
Dec 3, 2021 21:46
DDoS / abuse isn't solved by setting a max field length though, a bad person could send 1 trillion 10 kb messages an hour from a zombie cluster and have the same effect
jrh
Dec 3, 2021 21:02
the important part is "installs this thing on the server that does bad stuff"; kinda just an extension of ACE
jrh
Dec 3, 2021 21:01
it's an easy example to type out, it could just as easily be a keylogger / data stealer / etc
jrh
Dec 3, 2021 20:59
It gets interesting when the service is critical and downtime is dangerous, for the sake of simplifying things, let's say it's not safety critical
jrh
Dec 3, 2021 20:58
The reason why it's a distinction is, if I drop the ball on security, my users are the victims, if I get DDoSed it hurts me, but they just get an outage
jrh
Dec 3, 2021 20:57
@nobody A service issue, yes, but not "security", unless it causes some other bug
jrh
Dec 3, 2021 20:55
@nobody It's not great, for sure, but I would define a security issue as something that allows for arbitrary code execution, leaks data, installs a cryptominer, installs some other malware/backdoor, etc.
jrh
Dec 3, 2021 19:46
chat.stackexchange.com/transcript/message/59598842#59598842 @forest do you have a link for this? Mailing list / etc? I haven't heard about this.
jrh
Dec 3, 2021 19:34
Right, but that's not really a "security" issue. I'd say 1 MB would be a limit I'd probably never hit for what I'm doing, 1K if I want to be stingy. High server costs aren't really a 'security issue' either as the site presents it.
jrh
Dec 3, 2021 18:31
Does it think I'm running a C API behind it and used statically allocated arrays or something? Seems kinda silly...
jrh
Dec 3, 2021 18:29
There's a recommendation on openapi scanner sites: set a min and max expected length of responses. Is this supposed to prevent me from sending requests 1 TB in length or something? Is there any reason why I shouldn't just set it to something like 1000 (or even 1000000) characters if it's not static string length? Computers are pretty good at shuffling text around.
jrh
Aug 31, 2021 20:48
In any case, annoying... that's a lot of e-waste of functional processing horsepower (from the CPU vulnerability I mean).
jrh
Aug 31, 2021 20:46
I think after the initial patch I said "I guess they'll fix that in hardware eventually" and forgot to check back later; IMO youtube videos should really circle back on this instead of saying "We really have no idea why Microsoft dropped support (it's probably because they stink)"
jrh
Aug 31, 2021 20:44
I did have to re-read all this to remind myself, though, I honestly forgot if it was a band-aid or a real "fix", looking like the former
jrh
Aug 31, 2021 20:42
and there's a fair cynical point in that, for all we know spectre 3.0 is hanging out in 8th gen CPUs
jrh
Aug 31, 2021 20:40
Well, found this, "However, the protections are put in place on a case by case basis, and there is no guarantee that all possible attack vectors for Spectre variant 1 are covered." that's not terribly reassuring
jrh
Aug 31, 2021 20:33
I'd still like to see something from an unbiased source. Not Intel or AMD who have a clear motivation to sell chips, not Microsoft that loses money by supporting old hardware and might just want to reinvent the wheel. e.g., a Linux Kernel maintainer saying "it's hopeless, we can't prevent side-channel attacks" or some evidence that this has still been exploited on Linux (CVE, etc).
jrh
Aug 31, 2021 20:29
On the whole "are 6th gen CPUs vulnerable for some other reason than just TPM", I now vaguely remember that some vulnerabilities would only be fixed by a new generation of CPUs, e.g,. as reported here howtogeek.com/415018/…
jrh
Aug 31, 2021 15:00
I don't really follow cryptocurrency, but isn't it possible to sell it for real money?
jrh
Aug 31, 2021 12:52
I'm even more hesitant about embedded TPM, sounds like Management Engine all over again; can't be upgraded/validated
jrh
Aug 31, 2021 12:50
I quite like my laptops too, if I threw them out I'd have to replace them with something that has no replaceable disks, RAM, etc; they run great with Linux too, which makes them quite rare
jrh
Aug 31, 2021 12:49
honestly I could probably leave this PC in my will, it's wonderful
jrh
Aug 31, 2021 12:48
The 6th gen part I can't verify 100% (very hard to prove a negative) but I haven't heard of anything that hasn't been patched in the kernel for spectre/meltdown
jrh
Aug 31, 2021 12:47
from the sound of it there's no particular reason for me to upgrade my 6th gen hardware, or buy a TPM
jrh
Aug 31, 2021 12:44
But I can see why a business might benefit from it
jrh
Aug 31, 2021 12:44
It kinda sounds like TPM is something that's pretty unlikely to affect personal use PCs, somebody would have to break into my house to do something to the BIOS/Bootloader/Kernel
jrh
Aug 31, 2021 12:39
Or is this something that is trying to work around that?
jrh
Aug 31, 2021 12:39
Wasn't secure boot cracked years ago?
 
jrh
Dec 12, 2021 06:41
In high school I took the highest / most advanced classes I possibly could (and even skipped a grade in math). I took the equivalent of 1 semester of calculus, but I think I was only very lightly introduced to matrices (it may have literally just been "this is a matrix" with no real math explained). Matrix Algebra was part of my Bachelor's program. With that said I did know people who took two semesters of calculus instead of one, but that was not accessible to me at all, where I went. If I did not skip a grade (a hard thing to do), my math education would have ended with precalc, not calc.