Stack Exchange
log in

zakinster

 Discussion on question by MR.-c: Disa…

Imported from a comment discussion on security.stackexchange.c...
zakinster
Jul 6, 2021 17:33
@schroeder The claim is preposterous, without an explanation on how it 's supposed to work it's hard to refute with arguments as it just doesn't make sense. The one suggesting a new groundbreaking solution should provide a working principle before we can discuss its strengths and weaknesses. The question cannot be answered as currently stated.
 

 Discussion on question by MrTony: Wha…

Imported from a comment discussion on workplace.stackexchange....
zakinster
Jun 12, 2020 16:19
How short a timeframe are we talking about ? 15min ? 30min ? 1 hour ? 2 hour ?
 

 Discussion on answer by vol7ron: Was …

Imported from a comment discussion on law.stackexchange.com/qu...
zakinster
Feb 11, 2020 02:22
Well since 18 USC 2071 governs Records and Reports in the context of the Crime and Criminal Procedure code, it seems really far-fetched to apply it to a public speech in the House of Representatives.
zakinster
Feb 11, 2020 02:22
Not an expert but @NateEldredge said in this comment that "18 USC 2071 can't apply to proceedings in the House of Representatives because it's a law enforced by the judicial branch which doesn't have jurisdiction over speeches and debates in the House of Representatives. See Section 5 and Section 6 of the Constitution of the United States."
 

 Discussion on answer by HelloWorld: E…

Imported from a comment discussion on workplace.stackexchange....
zakinster
Jan 28, 2020 12:22
None of these bullet points is common practice, especially in big software firms. Do you have any source for them ? The first two points would be against labor rights in many jurisdictions. The 2nd, 3rd and 4th are not common practice in software development and definitely not applicable to any sizable project. The 6th and 7th are practice used in intelligence agency, not software industry. The last one is anecdotal and doesn't really answer the question (it doesn't prevent code leaking).
 

 Discussion on answer by harrymc: Does…

Imported from a comment discussion on superuser.com/questions/...
zakinster
Oct 29, 2019 13:25
@harrymc You argument regarding EULA is very interesting but it's only relevant when there's no purchase contract signed between the software provider and the customer. When a company buy software, it doesn't buy it on the shelf, it usually call a sales rep and sign a contract with negociated price, license terms and support conditions.

Secondly, even without a contract (small business or private individual), what makes you think the EULA can't integrate restriction of use not implemented in software (as long as they are advertise before purchase) ? Do you have a source for that ?
zakinster
Oct 29, 2019 07:25
Let us continue this discussion in chat.
zakinster
Oct 29, 2019 07:25
@harrymc Ok, your point is clear and I'm not a Microsoft licensing expert. But could you clarify in your answer the limitation of your assertion (wether it's Microsoft specific and/or may not be true for all software providers, etc.). Because there has been precedent where software provider sued their clients for license infringement (recent example: SAP vs AB InBev settled for $600m ).
zakinster
Oct 29, 2019 07:25
@harrymc No this is the standard license terms for "personal use" (vs commercial/production use). This is not beta software, those are fully-fledged Windows VM designed for testing web application retro-compatibility with older versions of Internet Explorer. And again, this is just an example, you'll find plenty of other example where your sentence "any software you have legally installed can be used as you see fit" is blatantly false.
zakinster
Oct 29, 2019 07:25
@harrymc But is it really ? Take the free Microsoft Edge VM as an example. You can install it and technically do everything with it but the license limitation are clear : "You may use the software for testing purposes only. You may not use the software for commercial purposes. You may not use the software in a live operating environment.". And this is just an example, there are a lot of Microsoft Single-user/Developper oriented license that have legal limitation not technically implemented in hardware/software.
zakinster
Oct 29, 2019 07:25
@harrymc You seem to suggest that each and every license limitation is implemented in software/hardware but that's definitely not always the case, especially in the corporate world. It's the client responsibility to ensure that its use of the software is in conformity with the contract (i.e. license agreement) he signed.
 

 Discussion on answer by Greendrake: I…

Imported from a comment discussion on law.stackexchange.com/qu...
zakinster
Sep 30, 2019 00:43
It may be useful to point out that this answer is only valid in the US (even thought the question is tagged US but may attract other viewers). In Europe and most specifically France it's illegal for a merchant to refuse a sell without a legitimate reason (Consumer Code). Here the burden on proof is reversed, it's up to the merchant to demonstrate a legitimate reason to refuse not up to the consumer to demonstrate a potentially illegal discrimination or breach of contract.
 

 Ask Different Chat

1
zakinster
Apr 6, 2019 16:42
@bmike Sorry if I unintentionally participate in the noise, I wasn't aware of the situation and was a bit surprised of all the comment disappearance. I guess this stack needs a lot more moderation than what I'm used to or it's just bad timing. Anyway, I sincerely which you bon courage to you and all the moderation team in this duty !
 

 Discussion on question by Hajar Qh: I…

Imported from a comment discussion on security.stackexchange.c...
zakinster
Mar 27, 2019 09:40
@OrangeDog not sure about security measure by itself and maybe schroeder will answer, but a technical solution can improve both security and user experience. "Password manager" VS "Post-it notes" for instance, improves both the security aspect (secure storage and access control) and usability (auto-fill and bookmark), it's a win-win situation in that case, the only trade-off being the cost of the solution.
 

 Discussion on answer by d-b: What to …

Imported from a comment discussion on workplace.stackexchange....
zakinster
Feb 17, 2019 20:41
@ciamej How do you know if the employee is in the ~80% case where he could respond (but arguably shouldn't, he should rest) or if he's in the ~20% where he just can't respond (which include the <1% life threatening situations) ? You just know he's on sick leave and you don't know precisely why since it's usually privileged information. You should act like it's the latter and not assume the former.
 

 Discussion on question by iFlo: How t…

Imported from a comment discussion on interpersonal.stackexcha...
zakinster
Mar 15, 2018 20:25
I would be more concerned about the inexperience than the weight.
 

 Discussion on question by Jamie Bull:…

Imported from a comment discussion on security.stackexchange.c...
zakinster
Dec 15, 2017 08:14
@Solomonoff'sSecret That's true, but depending on the amount of the information revealed (n bits), the factor 2^n - if high enough, say n > 32 - may transform a "practically impossible" attack scenario to a "technically possible" one, and thus possibly lead to a "sudden catastrophic loss of security".
zakinster
Dec 15, 2017 08:14
@JamieBull the level of risk depends on the threat model, but it is kind of stupid when you can almost as easily share a hash in a slack channel : "Is the md5/sha-1 hash of you key 098f6... ?". All modern operating systems provide some native hash functions and every IT guy should know how to use them.
zakinster
Dec 15, 2017 08:14
@Solomonoff'sSecret yes, and without powerful quantum computing, brute force is currently not a threat with a key of that size, even if revealing half of it. But there may be other attack vectors, specific to the encryption algorithm weaknesses, that may be leveraged by knowing part of the key.
zakinster
Dec 15, 2017 08:14
@MSalters If the question is about asymmetric encryption private keys, you're completely right and that falls into my "you don't really need to to this" case. I was just covering the other cases, but we may be in front of a XY problem.
zakinster
Dec 15, 2017 08:14
@Solomonoff'sSecret not really. If an attacker can brute force the 248 bit unexposed part of the key in a few days as instance, it would have take the same attacker a few years (feat days times 2^8) to brute force the whole 256 bits. When bruteforcing, for each of the 256 values of the first 8 bit, you still have to check the 2^248 possible values of the 248 remaining bits.
zakinster
Dec 15, 2017 08:14
If you really need to do this (which I don't think you do), would a cryptographic hash (SHA-256 ?) provide a better level of information with a lot less security issue ? It's not much that the risk is very high, it depends on the threat, but it's completely unnecessary.
 

 Discussion on answer by Stephane: How…

Imported from a comment discussion on security.stackexchange.c...
zakinster
Dec 14, 2017 19:53
@NickT Isn't AES-256 pretty standard nowadays ? It's in NIST recommendation since 2010 and is implemented in BitLocker or FileVault full disk encryptions.
 

 Discussion on question by Developer N…

Imported from a comment discussion on gamedev.stackexchange.co...
zakinster
Apr 17, 2016 17:40
@Sam But how much process do you have running ? 100 threads for one process is a lot.