Viewing profile — trekkin

GWT generates very performant code, even in high-CPU scenarios like hashing/encryption (and please don't spam the Matasano article about dangers of encryption in JS - it is not rel…

I implement high-performance software systems in C++ as my day job. The software has to compile and run on Linux, Solaris, and AIX. The same code is 2x slower on AIX (Power) and 3x…

check AES.io

Most consumers want convenience first, security second. Evernote just targets the mass market.

That's why client-side encryption is useful - even with the company (Dropbox) not leaking/selling their users' data on purpose, it is easy to inadvertently leak it. Proper client-s…

Non-technical co-founders should take care of the business side of the start-up equation - marketing/sales/PR/community building/fundraising/etc.

The problem with GWT is that it appears to be a low-priority product at Google - it took them more than a year to release v 2.5 vs 3-4 months for 2.4 and earlier. And we all know w…

Sorry, by "proprietary" I meant "custom". I admire people who have skills and dedication to built OSS, this was just a wrong word to use. I completely agree that for specific uses …

You can put as many "events" in the body of an HTTP POST request as you wish. What really matters in distributed messaging systems, from the performance point of view, is the numbe…

Well, I'm sure there are specific use cases where Riemann would be preferable to a generic web server. But for most developers in most situations, it is a no brainer to choose an H…

>> Throughput here is measured in messages, each containing 100 events, so master is processing 200,000–215,000 events/sec. So in reality it is ~ 2k messages/sec. This is a rather …

I have the same impression. Many start-ups are built by well-meaning people who have no formal CS or even engineering background and thus are somewhat out of touch with what it mea…

I'm not saying timing attacks against interpreted code are impossible. I'm just saying they are easier to execute against native code, and thus have nothing to do with JS crypto be…

Exactly - interpreted code is harder to do timing attacks against because interpreters add a lot of timing "noise", while native code is much more consistent re: time taken to exec…

Mega is not the first one. AES.io (my company) and several others have been available for some time. Mega is the first one to bring client-side JS crypto into public discussion.

> timing attacks don't necessarily need access to the actual machine to work. his point is valid because a timing attack may arise from the differences in time it takes to receive …

As there can be backdoors and bugs in OSes and hardware, any crypto code done on generic-purpose computers with standard OSes (Windows, OSX, Linux, BSD) is not safe. That does not …

For example, AES.io

Investors are probably more guilty here - entrepreneurs, most of the time, are trying to "create value", in PG/HN speak. Investors who swindle entrepreneurs are just making money o…

Try AES.io, or SilentCircle, or HushMail. There are encrypted communication services available, the problem is that most Internet users don't think they need encryption, or do not …