Viewing profile — tob_scott_a

If you can't write it down, why would you expect it to be universal and enforceable? Different cultures exist and have different opinions on what "decency' means, after all. A secu…

To test a Claude Skill for analyzing cryptographic implementations of cryptographic side-channels ([1] see constant-time-analysis), I had Claude vibe-code an Ed448 implementation. …

Recommended for this list: 1. https://archiv.infsec.ethz.ch/education/fs08/secsem/bleichen... - This is necessary to scare newbies away from implementing textbook RSA 2. https://ww…

> I think that attitude vastly underestimates the complexity of a typical TLS implementation If you ever get the impression that I'm underestimating the complexity of a typical TLS…

woodruffw already wrote an excellent comment for this question: https://news.ycombinator.com/item?id=39131723 Rust isn't just memory-safety. The type system also coaxes developers …

By itself? No. The other details covered in the blog post, however, would absolutely do something to fix denial of service attacks. To wit: x509-limbo

I think getting it into cURL would be more impactful, since that's already tapped into by many OSS projects.

> Carcinize existing C and C++ X.509 users. This could be game-changing for a lot of open source software. I spent years avoiding X.509 (and ASN.1, for that matter) in my designs b…

Yeah, it's also deeper than that. Aptitude with a technology certainly correlates with intelligence, but it doesn't necessarily imply above-average intelligence. Some people attain…