• 0 Posts
  • 20 Comments
Joined 11 months ago
cake
Cake day: August 14th, 2023

help-circle
  • Yeah, timestamps should always be stored in UTC, but actual planning of anything needs to be conscious of local time zones, including daylight savings. Coming up with a description of when a place is open in local time might be simple when described in local time but clunkier in UTC when accounting for daylight savings, local holidays, etc.






  • I’d say the real world doesn’t reward being actually gifted.

    More accurately, the real world punishes being below average at any one of like a dozen skillets. You can’t min/max your stats because being 99th percentile at something won’t make up for being 30th percentile at something else. Better to be 75th percentile at both.

    The real world requires cross-disciplinary coordination, which means thriving requires both soft skills and multiple hard skills.




  • It basically varies from chip to chip, and program to program.

    Speculative execution is when a program hits some kind of branch (like an if-then statement) and the CPU just goes ahead and calculates as if it’s true, and progresses down that line until it learns “oh wait it was false, just scrub all that work I did so far down this branch.” So it really depends on what that specific chip was doing in that moment, for that specific program.

    It’s a very real performance boost for normal operations, but for cryptographic operations you want every function to perform in exactly the same amount of time, so that something outside that program can’t see how long it took and infer secret information.

    These timing/side channel attacks generally work like this: imagine you have a program that tests if variable X is a prime number, by testing if every number smaller than X can divide evenly, from 2 on to X. Well, the bigger X is, the longer that particular function will take. So if the function takes a really long time, you’ve got a pretty good idea of what X is. So if you have a separate program that isn’t allowed to read the value of X, but can watch another program operate on X, you might be able to learn bits of information about X.

    Patches for these vulnerabilities changes the software to make those programs/function in fixed time, but then you lose all the efficiency gains of being able to finish faster, when you slow the program down to the weakest link, so to speak.


  • This particular class of vulnerabilities, where modern processors try to predict what operations might come next and perform them before they’re actually needed, has been found in basically all modern CPUs/GPUs. Spectre/Meldown, Downfall, Retbleed, etc., are all a class of hardware vulnerabilities that can leak crypographic secrets. Patching them generally slows down performance considerably, because the actual hardware vulnerability can’t be fixed directly.

    It’s not even the first one for the Apple M-series chips. PACMAN was a vulnerability in M1 chips.

    Researchers will almost certainly continue to find these, in all major vendors’ CPUs.






  • Things might be different by now, but when I was researching this I decided on the Yale x Nest.

    It’s more secure than a keyed lock in the following ways:

    • Can’t be picked (no physical keyhole).
    • Codes can be revoked or time-gated (for example, you can set the dog walker’s code to work only at the time of day they’re expected to come by).
    • Guest codes can be set to provide real-time notifications when used.
    • The lock keeps a detailed log of every time it’s used.
    • The lock can be set to automatically lock the door after a certain amount of time.

    It’s less secure than a physical traditional lock in the following ways:

    • Compromise of a keycode isn’t as obvious as losing a key, so you might not change a compromised keycode the same way you might change a lost key.
    • People can theoretically see a code being punched in, or intercept compromised communications to use it.
    • Compromised app or login could be used to assign new codes or remotely unlock

    It’s basically the same level of security in the following ways:

    • The deadbolt can still be defeated with the same physical weaknesses that a typical deadbolt has: blunt force, cutting with a saw, etc.
    • The windows and doors are probably just generally weak around your house, to where a determined burglar can get in no matter what lock you use.
    • Works like normal without power or network connection (just can’t be remotely unlocked or reprogrammed to add/revoke codes if not online)

    Overall, I’d say it’s more secure against real-world risk, where the weakest link tends to be the people you share your keys with.


  • Oh come on you don’t actually believe we should structure the entire system around such a minority use case

    Minority use case? I’m talking about how downvotes are useful for communities to enforce their own norms, or ensure that erroneous information is excluded. Someone who insists on a proof that the angles of a triangle add up to more than 180º is probably going to get downvoted, especially if he’s being an asshole about it. Same with someone who insists that the common cold is caused by exposure to cold air, or that the earth is flat.

    Or there are broad consensus beliefs about what is or isn’t off topic for a discussion, what types of insults break the forum rules on civility, etc. When a community largely agrees that someone is being an asshole for using racial slurs, downvotes quickly sort that out. In other words, toxicity can get filtered out through the downvote/hide mechanism, as well.

    Even for beliefs that are simply matters of opinion/taste/preference, the community can decide what’s actually up for debate and what’s not, within that space. A forum dedicated to fans of Real Madrid doesn’t have to tolerate trolls coming in and saying “Real Madrid sucks” or “lol soccer is a stupid sport you Europeans are so stupid” or “sports are dumb.” Same with a vegan forum downvoting someone’s brisket recipe (or a BBQ forum downvoting a “meat is murder” manifesto). These “echo chambers” are just how people organize with people who share their interests, and it’s weird not to be able to see that there’s value in those communities.

    So yeah, I think that you have a problem with people’s desire to organize into groups of similar interests, not with the actual mechanism by which those groups enforce those norms. It wouldn’t be any better with a mod-enforced echo chamber, either.