tholo - Slashdot User

Comment The CA should be able to revoke (Score 1) 97

by OttoM on Sunday July 05, 2020 @11:21AM (#60263664) Attached to: Ask Slashdot: Could We Not Use DNS For a Certificate Revocation Mechanism?

You cannot rely on DNS as controlled by the Subject only. The Issuer should be able to revoke a certificate and it does not control the corresponding DNS.

Comment Re:first post + 20 (Score 1) 726

by dmiller on Thursday October 05, 2017 @11:30AM (#55315117) Attached to: 20 Years of Stuff That Matters

Imagine a beowulf cluster of ... nevermind.

Comment Re:Other poll ideas (Score 3, Funny) 599

by Graabein on Thursday August 25, 2016 @07:24PM (#52772349) Attached to: My main computer runs the following operating system:

Meh, you young whippersnappers know nothing. The only true VMS was VAX/VMS, pre version 5. If you were serious about your computing though, you'd be running TOPS10 or TOPS20 on a 36-bit KL10 or KS10 CPU.

And remember: Never trust a computer you can actually lift.

Microsoft Opens Vulnerability Bounty Program For Spartan Browser 53

Posted by timothy on Friday April 24, 2015 @11:27PM from the why-not-leave-the-code-to-survive-infancy-alone? dept.

jones_supa writes: As it did in the past when it tried to make Internet Explorer more secure, Microsoft has launched a new bug bounty program for Spartan browser, the default application of Windows 10 for surfing the information highway. A typical remote code execution flaw can bring between $1,500 and $15,000, and for the top payment you also need to provide a functioning exploit. The company says that it could pay even more than that, if you convince the jury on the entry quality and complexity. Sandbox escape vulnerabilities with Enhanced Protected Mode enabled, important or higher severity vulnerabilities in Spartan or its engine, and ASLR info disclosure vulnerabilities are also eligible. If you want to accept the challenge, Microsoft provides more information on how to participate.

Comment Re:AES-CTR (Score 1) 144

by dmiller on Thursday May 01, 2014 @12:10AM (#46886615) Attached to: OpenSSH No Longer Has To Depend On OpenSSL

AES-CTR being based on a permutation rather than a true PRF might matter if SSH used all the counter values, but SSH rekeys every 2^32 blocks at most - a tiny fraction of the 2^128 possible counters.

Submission + - OpenSSH has a new cipher, chacha20-poly1305, from D.J. Bernstein!

Submitted by ConstantineM on Wednesday December 11, 2013 @03:01AM

ConstantineM writes: Inspired by a recent Google initiative to adopt ChaCha20 and Poly1305 for TLS, OpenSSH developer Damien Miller has added a similar protocol to ssh, chacha20-poly1305@openssh.com, which is based on D. J. Bernstein algorithms that are specifically optimised to provide the highest security at the lowest computational cost, and not require any special hardware at doing so. Some further details are in his blog, and at undeadly. The source code of the protocol is remarkably simple — less than 100 lines of code!

Comment s/iu/ui/ (Score 2, Informative) 133

by OttoM on Saturday March 30, 2013 @04:36AM (#43317131) Attached to: Is Eccentric Sven Olaf Kamphius To Blame For Spamhaus DDoS?

Yeah, I know, dutch double vowels are confusing...

Comment Demographics (Score 1) 618

by Graabein on Wednesday October 24, 2012 @08:29AM (#41750701) Attached to: Best Trek Captain?

Methinks the results of this poll are saying a lot about the aging demographics of the /. readership.

I shall return to my cave and slumber now. You have been graabein'ed.

Comment Safety? (Score 1) 150

by OttoM on Thursday May 31, 2012 @12:30PM (#40168381) Attached to: After Trip to ISS, SpaceX's Dragon Capsule Returns Safely To Earth

Never knew they took safety with them.

Comment Re:Here's why (Score 1) 220

by OttoM on Wednesday May 30, 2012 @07:08AM (#40153595) Attached to: RIM May Need To Write Off $1 Billion In Inventory

Their inventory consists mostly of blackberries.

And PlayBooks!

Comment Re:TERRIBLE writeup (Score 1) 220

by OttoM on Wednesday May 30, 2012 @06:20AM (#40153417) Attached to: RIM May Need To Write Off $1 Billion In Inventory

Hey, this is slashdot, where submitter don't read the original article, editors don't read the submission and posters... well, they just post and don't read anything at all. Might as well skip linking to any article at all.

Comment Late April fool's joke? (Score 0) 339

by OttoM on Tuesday May 01, 2012 @09:14AM (#39856145) Attached to: Introducing SlashBI

Dunno if I should laugh or cry

Comment Re:Good news!? (Score 1) 132

by OttoM on Monday July 18, 2011 @08:11AM (#36798540) Attached to: Queen Elizabeth Sets a Code-Breaking Challenge

... and to promote that technology is cool, let's call in the help of the most uncool person in the world: QE II.

Comment Re:Version numbers (Score 2) 188

by dmiller on Thursday June 09, 2011 @05:35PM (#36393862) Attached to: Google Releases Chrome 12

Google has grabbed a bunch of open source libraries, sometimes respecting the license, hacked on them, and rolled them into Chrom*.

If you have any cases where you think that Chrome is failing to comply with the terms of a free software license, then please file a bug at http://code.google.com/p/chromium/issues/list - we take license compliance very seriously. (I'm a Google engineer, though not working Chrome).

Comment Re:OpenSSH is not vulnerable (Score 4, Informative) 31

by dmiller on Saturday May 28, 2011 @02:28AM (#36271318) Attached to: OpenSSL Timing Attack Can Intercept Private Keys

No, it is not vulnerable to this attack. The Brumley/Tuveri paper describes a timing leak in a specific algorithm that is only used for elliptic curve crypto over binary/GF(2m) fields. OpenSSH uses ECC over prime fields that use different algorithms that have no known timing leaks. A result against ECC using prime fields would be more difficult because the curve point components are integers and so can use well-tested modular arithmetic code.

Slashdot Top Deals