Viewing profile — timmclean

For supply chain security, you might be interested in cargo-vet[0], a tool for coordinating and requiring manual reviews of open source dependencies. Both Mozilla and Google[1] hav…

Is there a reason why they couldn't split the load across multiple HSM? For something so sensitive I would've expected a design where one or more root/master keys (held in HSM) are…

Saving you a click: despite what the repo title might suggest, while the code is open source, the model weights cannot be used commercially without permission. > The code in this r…

FWIW, spot prices for c5a.24xlarge in us-east-2b and us-east-2c seem to have been under $0.92/hr for most of the last 3 months. So, assuming some flexibility on the choice of regio…

Thank you for your comments on this thread and others today. They have been very helpful in understanding what is actually going on.

I believe you're thinking about `add`. According to Agner Fog's instruction tables, the load and ALU uops are fused for `add`s, but not in the case of `inc` http://www.agner.org/op…

That all makes sense, but it doesn't seem to apply to the example code in the article, right? `inc` doesn't decode to a single fused uop on Ivy Bridge. AFAIK, the example code in b…

The important thing to take away from this article is that MD6 really shouldn't be used in any production software, unfortunately. MD6 didn't even make it past the first round of t…

I've been meaning to learn jq, so I decided to give it a try. FRUITS=$(cat input.json | jq '.models | map(select(.title == "fruits")) | .[0]') FRUIT_NAME_KEY=$(echo "$FRUITS" | jq …

The author should use a library that provides a simple "encryptWithPublicKey" method, so that any choices about RSA key size, AES mode of operation, etc are all taken care of. NaCl…

Heads up to anyone considering using this: the author wrote their own crypto code[1]. I would recommend against using this until that is fixed... I've already spotted a few vulnera…

Modern password hashes are designed to use a large amount of RAM in addition to CPU time in order to make password cracking using ASICs and GPUs more difficult. The paper on Argon2…

Mainly because it adds complexity, and complexity in crypto can hide subtle bugs. Example: http://blog.ircmaxell.com/2015/03/security-issue-combining-b...

To expand on this, here are a few mistakes that I caught while scrolling quickly: > For production applications some AES variant or RC4 would be a better choice. RC4 is not at all …

I prototyped almost exactly this a couple years ago: https://www.timmclean.net/json-editor/ I haven't had time to come back to it, so I'm very glad to see that other people are wor…