Viewing profile — cyphar

You're talking about limited liability companies, which is a legal structure relevant for civil claims. Someone committing crimes "on behalf" of a company is not protected by the c…

You can make it complete, it just won't be consistent. In fact there is a simple way to do it -- add contradictory axioms and then you can use the principle of explosion to prove a…

Not really, Go already disallows import loops so even if Go did have exportable traits the compilation flow would be the same. But traits wouldn't really make sense for Go -- my po…

Don't Godel's incompleteness theorems mean that completeness is a property you don't want in a prover (as it means the prover must then be inconsistent and this unsuable) and consi…

That is the classic answer for how to do that in pre-generics Go. It doesn't solve the problem I mentioned.

In Rust this is solved by defining a local trait and methods implemented for a trait are only available if the trait is imported. This is in contrast to Go where methods are not na…

I've maintained one of the major container runtimes (which is written in Go) for over a decade as well, I think I have a less rosy view of Go than you but I still think it's a nice…

On the other hand, design decisions made under one set of constraints can become problematic when you add new features that don't play as well with earlier design decisions. For a …

For more context, sample reference materials from the NIST reference catalogue are not meant to be exceptionally high purity examples of the sample -- SRMs are usually commercially…

[dead]

It's hard to do a 1-to-1 comparison but if the telemetry also used a masked form of the machine-id with an application ID unique for the telemetry service then you wouldn't be able…

On most distributions I've seen, SELinux is configured to automatically label /proc files with labels based on fairly granular roles, so that setup already exists. If you want to c…

It should be noted that the "correct" usage of /etc/machine-id is that you use it in a way that doesn't allow cross-correlation between different applications by using a HMAC of th…

Most games are not perfect information games. How would you implement poker?

Facebook uses more advanced fingerprinting techniques than just cookies, even a few data points like IP address, User-Agent, and screen-size probably uniquely identify you and let …

Breaking any kind of DRM (or writing, distributing, or using software that does so) violates section 1201 of the DMCA[1]. The maximum penalty for a violation is $500k and up to 5 y…

I don't think the (fairly factual) description of these systems as stochastic parrots means that they will never do useful work, just that they are not intelligent in the way we be…

They actually do use "os/user".Lookup() as a fallback if fetching via getent(1) fails, so they might be using NSS modules to dynamically define users and then not linking their bin…

Indeed, but they did have code to use "os/user".Lookup() in a fallback path so I wonder if the issue is that they have some NSS module for user definitions (which wouldn't work wit…

In my experience it is really very quick and easy to get a CVE if you contact MITRE directly, and on paper you do not need to disclose too much. The GitHub CNA is (ironically) very…

As an open source maintainer of a fairly large project, we get reports from Ada Logics and similar firms every once in a while and those are absolutely not the same as a proper sec…

djb proposed Internet Mail 2000 back in the early 2000s as an attempt to solve this kind of problem without micropayments[1]. As others have said, a lot of the useful emails I get …

It really should not be surprising that we can get very high recovery percentages from batteries -- we do not mine elemental lithium, so the processes we use for extraction are alr…

I am aware of the history behind Zones and Jails, but my point is still the same -- the (lack of) protection you get against kernel exploits should be the same because the only thi…