Viewing profile — trishankkarthik

Very cool, and congrats! The corresponding ToB blog post says the following: > Longer term, we can do even better: doing “one off” verifications means that the client has no recoll…

Sorry to hear the bad news, John and Daniel. Thanks for all your great work, especially in promoting TUF. Hope you guys have found greener pastures now.

I work in this area. This is not a supply chain attack. This is a typosquatting "attack" people keep rediscovering every year or two. I know, because I wrote an as yet unpublished …

Are you able to read the title? "...novel supply chain attack..." But HN is the typical groupthink it always is.

This is NOT a supply chain attack. Solarwinds was a supply chain attack. This is a typosquatting demonstration that happens every one or two years.

How was I "attacking" others, when they were allowed to put words in my mouth? Go ahead and ban me: @paulgraham and @sama were right about the intolerance of free speech in Silicon…

I don't owe the community anything.

Thanks, yes, I try to write in a way where even I don't fall asleep, unlike our "nirvana fallacy" friend below...

Not a criticism if the worst you can say about someone is that he is "mean," not that he is wrong.

IDK how many more times I have to repeat this before it gets through your head that one warned about the pandemic blowing up before it happened, therefore only one can be taken ser…

Haven't heard of Google or Twitter before, have you?

Show me the money: did they warn about COVID-19 way BEFORE it be came a problem, or did they not? If not, why should we take them seriously? It is easy to prognosticate AFTER the f…

You cannot fundamentally predict the future, fuhgedaboutit, partly for the same reasons we cannot use Turing machines to solve the halting problem for Turing machines. What you can…

This is the most dangerously stupid thing I've ever heard. Tetlock is a known academic charlatan pushing his absolutely useless "superforecasting" nonsense which @nntaleb keeps deb…

100% Tech companies could hire and train students straight from high school instead of making them go through the academic priestly class, but nope, everyone wants expensive degree…

BS. Big-O is designed by academics for academics. This is not how you would teach high school students with an apprenticeship model.

I was just thinking about this the other day: at the same time, they keep adding weird, inscrutable nonsense at the end of every Google Search URL, so what's the point of hiding th…

This is why you should use a well-designed system such as The Update Framework (TUF) that aims to make security as usable as possible: [1] https://www.python.org/dev/peps/pep-0458/…

If you guys can't even take a "bad" joke, gods help you all. Feel free to ban me.

dang, I was clearly joking...

YAML IS NOT AN EFFING PROGRAMMING LANGUAGE, EVEN IN 2020

That's a bit like saying: well, encrypting the iPhone isn't all that jazz, because all I have to do is hit the owner with a $5 wrench. I mean, yes, but cryptography alone cannot so…

This is why we designed TUF and in-toto to detect MitM attacks anywhere in the software supply chain between developers and end-users themselves, and provide E2E compromise-resilie…