Viewing profile — purplehat_

i'm trying to understand how outer shell works here. on the website you give the following as your motivation: > Apps like Jupyter and Tensorboard are not typically visible to stan…

On Being the Right Size turned 100 this year. It's not entirely the same topic as this essay, but this reminded me of it and it's a pretty famous short essay that's worth reading i…

Cool find and a very interesting analysis! There's a lot more to morphology than just the shape of the shell, and indeed the shape can sometimes be misleading, in that very differe…

The first bit seems possibly solvable with private set intersection. You can publish a salted hash of everybody you trust, and I can compute hashes of everyone I trust with your sa…

For people reading this, you may want to know the the NSA is allegedly trying to weaken hybrid ML-KEM and X25519 down to just ML-KEM. This is a good thing to pay attention to! Here…

I believe ML-KEM is the standard algorithm for post-quantum asymmetric encryption. I think it's slower mainly because there's not good hardware support, but it shouldn't be a big d…

This article, "Factoring is not a good benchmark to track Q-day", was posted this month by one of Cloudflare's lead post-quantum researchers specifically addressing the factoring i…

I'm surprised people are advocating self-hosting as a viable solution. It takes a lot of knowledge to do sync and backup yourself, most of it implicit knowledge that people here do…

what's the advantage of a static site generator over pandoc + makefile?

Hi Matt, there's lots of speech-to-text programs out there with varying levels of quality. 100% local is admirable but it's always a tradeoff and users have to decide for themselve…

Have you (or anyone reading this) been able to "beat" fingerprint.com without Tor or turning JavaScript off outright? I've tried it various times over the last couple years, using …

Fair point, but that solution doesn't address the market for theft, so there's a tradeoff there.

Can you elaborate on "fairly well documented exploit tactics"? My impression is that most of these are either social engineering, for which we need to hire better designers, or com…

I really don't understand the argument here. That the product is locked down by design is a feature, not a limitation. Yes, this has the side effect of making them more money and a…

I'm not sure anyone is being this explicitly malicious. Parents' groups, child safety organizations, and researchers have been at this for years, and while I agree with you that th…

there is a `theme set` command

I'm surprised zero-knowledge proofs have not been mentioned. This is a technique where (for example) the government signs your digital license, then you can present a proof that yo…

The quote seems to imply that if the watch receives the payload from any source, even without a compromised AP, it'll pop the shell. The easiest source of this is local network att…

Yes, to self-host it you will need a Google maps API key. In the related links at the bottom, https://gdir.telae.net/links.html , the Git repo https://github.com/pafoster/gdir.tela…

Omega-3 good, Omega-6 bad has been known for many years. For example, Scott Alexander wrote in 2014 on his blog Slate Star Codex about how Omega-3 lowers crime rates and Omega-6 in…

To be fair, the octet as the byte has been dominant for decades. POSIX even has the definition “A byte is composed of a contiguous sequence of 8 bits.” I would wager many software …

I hear sentiment like this occasionally and I genuinely wonder if this is conspiracy theory stuff or if this sort of thing actually happened in the past. I'm aware of the programs …

For anyone else who got a little too excited at the title, ECC here is error correction codes, not elliptic curve crypto. Very cool writeup, thanks for digging into all those data …

Why do you say that? Bubblewrap is a it's a very minimal setuid binary. It's 4000 lines of C but essentially all it does is parse your flags ask the kernel to do the sandboxing (dr…