Viewing profile — vngzs

It lets organizations (Tailscale) control the timing and narrative around the disclosure more directly. Organizations sometimes avoid the bureaucracy of going through CVE Numbering…

How do you manage to coax public production models into developing exploits or otherwise attacking systems? My experience has been extremely mixed, and I can't imagine it boding we…

I can register my Yubikeys on account.google.com (and around the web, e.g., fastmail.com) as passkeys. If you visit the account security page[0] and enable "skip password when poss…

Curious what the threat model for the cryptographic verification is. It looks like verify_signature_software[1] doesn't actually verify ed25519 signatures, but rather computes a tr…

Does this mean rewriting Magit to use libgit2 FFI bindings[0] rather than subprocess calls would lead to significant speedups? [0]: https://github.com/emacsorphanage/libegit2

It's a Linux phone that runs Android apps, so they ostensibly don't have the problem of building the ecosystem.

It's "fury phone": > Furious Support from the FuriOS team

There's a binary analysis time travel debugger similar to this, Qira [0][1]. [0]: https://www.usenix.org/conference/enigma2016/conference-prog... [1]: https://qira.me/

We're not, and they're still in the process of discussion. It seems a bit early to fork and witch-hunt [0]: > So clarification here: you asked me about that, but I haven’t been abl…

It's not a complete mitigation, but you can pause your video history which may decrease the amount of information Google retains over time from this sort of analytics. I haven't du…

There's actually a Slate article covering this topic[0]. First, consent was given for certain homes. However, the article also notes that under "exigent circumstances" warrantless …

I think you'll find "distributed decision-making" is no panacea. I joined a company recovering from a distributed governance model, and the big challenge was that nobody had enough…

Links are just for reference, but the gist is: serve the webapp from the Go binary instead. The end-user already has to trust the Go binary, and if they need to they can look at th…

You're very right! Luckily, we can resolve the vulnerability in this instance, although it's a challenging problem to resolve in general webapps. The technical explanation for our …

AES-GCM has more issues than merely the nonce reuse in the context of random nonces. For instance, the short tag issue[0] leaks authentication (not encryption) keys after a probabi…

I assume there's TLS in the server connection already, but the encryption here is to make the communication unavailable to the server for decryption, so "bare" TLS does not solve t…

You will still need to get the nonce and key generation right, but I'd recommend using Golang's nacl/secretbox [0] for a project such as this. It's designed to be relatively misuse…

Good job releasing your project! It's a cool idea and surprisingly minimalist. That said, I've found a number of cryptographic flaws in the application source. This should not be u…