81–90 of 203 posts
What's up with having two different new experimental languages from Google on the front page https://news.ycombinator.com/item?id=33756800 - did Google just happen to release them at the same time? I think when Carbon came out people's reaction was stronger than deserved (like saying that Google don't believe in Rust, or that Go has been a failure because it hasn't replaced C++ etc.) while in reality all of this is v…
Can someone explain how this works: "Assume the attacker can tell how long it takes for mac == computedMac to run. If the first byte of an attacker-chosen mac is wrong for the attacker-chosen message, the loop terminates after just one comparison. With 256 attempts, the attacker can find the first byte of the expected MAC for the attacker-controlled message. Repeating this process, the attacker can forge an entire MA…
This is a timing attack or timing oracle. Lets assume a mac represented in an array of 32 bytes. If we had a pseudocode method like: byte [32] (actualMac, expectedMac) for int x = 0..31 if (actualMac[x] != expectedMac[x]) return false; fi end return true; We return false as soon as we hit an invalid byte in our calculated mac. If the time taken to execute one iteration of the loop is Y and the attacker is able to tim…
why is it called constant time if it isn't constant with respect to array length? Just seems confusing because the algorithm is linear without a short circuit
Wouldn’t it make way more sense to write this in C and expose a typed API via language-specific packages. The functionality is cool, but nothing stops you from forgetting to use secret(string) instead of string.
Seems kind of odd that you’re arguing “just do it in C” and “nothing stops you from forgetting” in the same post.
Earlier quoted context omitted.
This is a timing attack or timing oracle. Lets assume a mac represented in an array of 32 bytes. If we had a pseudocode method like: byte [32] (actualMac, expectedMac) for int x = 0..31 if (actualMac[x] != expectedMac[x]) return false; fi end return true; We return false as soon as we hit an invalid byte in our calculated mac. If the time taken to execute one iteration of the loop is Y and the attacker is able to tim…
Don’t really buy it. Seems to be both “spherical cow optimistic assumptions” and “anyone who could seriously think about pulling this off has nation-state level resources and already 0wnz you and/or already has the rubber hose at hand"
Also ignoring the fact that calling constant_strcompare(string, string) instead of strcompare(string, string) when working with secrets isn't that big of an ask.
What's up with having two different new experimental languages from Google on the front page https://news.ycombinator.com/item?id=33756800 - did Google just happen to release them at the same time? I think when Carbon came out people's reaction was stronger than deserved (like saying that Google don't believe in Rust, or that Go has been a failure because it hasn't replaced C++ etc.) while in reality all of this is v…
From https://github.com/google/rune/blob/main/benchmarks/mandelbr...
for k = 0u32, k (8 * x + k) / width - 1.5;
}What's up with having two different new experimental languages from Google on the front page https://news.ycombinator.com/item?id=33756800 - did Google just happen to release them at the same time? I think when Carbon came out people's reaction was stronger than deserved (like saying that Google don't believe in Rust, or that Go has been a failure because it hasn't replaced C++ etc.) while in reality all of this is v…
It seems like somebody got too easy access to the Google Github repo. Usually only higher quality projects get approved to the central repo.
Since Google owns the copyright it almost makes sense.
Also, being in the Google organization doesn't mean that Google is involved in it. I'm maintaining a project there (`google/double-conversion`), despite not having worked for Google for years. Nobody at Google has any influence or reviews on that project.
There already exists Rune programming language and that one was earlier: https://rune-rs.github.io/ They should be more careful picking the name.
Why do they call it " Python-inspired " if it looks like C++? From https://github.com/google/rune/blob/main/benchmarks/mandelbr... for k = 0u32, k (8 * x + k) / width - 1.5; }
It's slot-based, vaguely like Python, and has reference-counting GC, like Python. That's how I understand it.
There already exists Rune programming language and that one was earlier: https://rune-rs.github.io/ They should be more careful picking the name.