Viewing profile — codahale

Shamir’s is one of my favorite little crypto schemes. I’ve implemented it over GF(256) in a bunch of different languages just for fun: Haskell: https://github.com/codahale/hs-shami…

XML parsing is notably an even larger minefield: https://www.owasp.org/index.php/XML_Security_Cheat_Sheet

Those safeguards were added by Travis CI folks as one of their remediation action items: https://github.com/DatabaseCleaner/database_cleaner/pull/521

"You know the law: two men enter, one man leaves."

While it’s definitely the case that there are more concise domain-specific examples, as you’ve pointed out, the article’s point stands: in Clojure, a Strategy is simply passing a f…

Obviously, those are monoliths in dire need of decomposition.

3.1.x is a development branch and not intended for production use. When they release 3.2, MongoDB will support it.

MongoDB doesn't track this information, unfortunately.

And that 'nice' used to mean 'foolish'? http://www.etymonline.com/index.php?term=nice And that 'fizzle' used to mean 'fart quietly'? http://www.etymonline.com/index.php?term=fizzle…

Taubes breezily dismisses the Hall paper, which is, methodologically speaking, pretty conclusive. If you're curious about the paper and its implications for Taubes's obesity-insuli…

800-273-8255 National Suicide Prevention Lifeline 24 hours a day, 7 days a week or www.suicidepreventionlifeline.org

If you want your reads to ever work, then they need to be synchronized. Reading from an unfenced address during concurrent writes is undefined behavior for any CPU architecture you…

It’s worth noting that not only do you need to synchronize access to the singleton, you need to synchronize access to the singleton’s state as well. And even if you manage that at …

Two things: First, you're describing RSA signatures. "Encrypt X with your private key" means "X^D mod N" which is how RSA signatures work. In the context of RSA-based cryptosystems…

I really really really don't recommend outsourcing your security architecture to interested passers-by if that's going to be a core feature of your project.

Apparently so. It uses DTLS, but I'm not sure where the certificates for that would come from or how their authenticity is verified. If it's all self-signed, then your best solutio…

* No confidentiality. All communications are sent plaintext. They plan to "add support in the future when solid approaches emerge". * Non-repudiable. Everything you send is signed …

Postgres: https://aphyr.com/posts/282-call-me-maybe-postgres

That said, the ergonomics of the mutex design and the ownership system would probably eliminate most of the race conditions I've seen. Lock ordering can be effectively established …

Use bcry—ah, fuck it.

I didn't do this in my spare time. I did this in rough a week and a half of full-time work.

That was not the path taken by Amazon as they made their nearly 40 different APIs. Engineers from there could certainly speak to the circumstances behind their choices. As for aws-…

The irony here is that your jaded insight is a retread of Fukuyama's 1992 framing of liberal democracy as a Hegelian end-state in _The End Of History_.

(Apologies for the self-promotion, but it's at least on-topic.) I just opened up this repo yesterday: https://github.com/stripe/aws-go . It's really raw, but it uses the JSON API d…