Viewing profile — mahemm

How does this differ from e.g. S3 pre-signed URLs?

The tl;dr on why IO is important is you can just use (effectively) one program, but stuff different secrets inside them with a guarantee that no one can pull those secrets back out…

It's interesting to see such ongoing strong jobs data in the face of unprecedentedly negative sentiment[1]. Not only do the numbers fail to look as bad as the sentiment, the number…

I'm surprised y'all stopped at the personal finance layer. I've been thinking for awhile that LLMs would be really effective as personal financial advisers, and this kind of hookup…

Would you be comfortable using this same logic to invest most of your net worth in lottery tickets/betting on black in a casino? If not, I'd be curious to hear what is different in…

My FAANG employer launched a service ~6 months ago that today seems millions of DAUs. This service was 100% vibe coded. This service was created 20x faster than the median launch, …

The property you're talking about (next bit unpredictability) is important for a CSPRNG, but it doesn't matter at all for a PRNG. A PRNG just needs to be fast and have a uniform ou…

What game is played? To me it seems pretty straightforward that for both the actual caloric content is ~0.

To me this is completely unrelated to the quality of the PRNG, because security is explicitly a non-goal of the design. A general-purpose non-cryptographically secure PRNG is evalu…

You replied to a claim that Telegram doesn't do E2EE for groups saying 'Neither does Whatsapp/Signal'. That's wrong as `tptacek noted. If you meant something else, that wasn't clea…

Why not just read 64 bits off /dev/urandom and be done with it? All this additional complexity doesn't actually buy any "extra" randomness over this approach, and I'm skeptical tha…

Yep! We're lucky to be part of an org that's growing across a few teams, so there's several jobs up for the wider Stores AppSec umbrella

Amazon | Full-time | Security Engineering/Management | Austin, TX | On-Site I am hiring a new Application Security team in Austin to focus on making the highest-privilege applicati…

Who do you think declassifies and releases information? Who do you think passed and enforces the Freedom of Information Act?

>Money breeding laziness ... killed ICOs ICOs were killed by Solidity and the Ethereum ecosystem more generally being insufficiently expressive to create anything of value other th…

This is the exact sort of thing that allows people to think that things like Telegram are acceptable equivalents to Signal instead of disastrously poor imitators. It's a shame the …

Can't do crypto without visualizations; I can't say how many times I've wanted someone to draw stuff out! Great article

The ideas that "culture is a matter of individual experience" and that "there was no dichotomy to begin with and nothing to deny" seem to affirm the postmodern idea from my POV. Th…

Ironically, Nietzsche is considered (by some) to be one of the fathers of postmodern thought. His criticism of the objectivity of science in "On Truth and Lies in a Nonmoral Sense"…

A postmodern critique of this argument might start with your identification of a single "culture" that has a pattern. Who decides what this culture is and who its adherents are? Wh…

Lots of people ITT seem to have an incorrect understanding of the term postmodernism. It basically boils down to the observation that history and human experience don't really move…

While this article does do a good job of illuminating the potential challenges, it's a bit frustrating that there's such scant discussion of solutions. IMO, this problem has been s…