CarpaDorada

If you lose your YubiKey, or any other hardware key, for all intents and purposes all your data on it is compromised.

What I'm reading from <https://ninjalab.io/eucleak/> is this:

>This vulnerability – that went unnoticed for 14 years and about 80 highest-level Common Criteria certification evaluations – is due to a non constant-time modular inversion.

The vulnerability is therefore that the secrets can be extracted without taking the YubiKey apart, by measuring timings, thus tricking you into thinking that your YubiKey is intact (but you were already compromised the moment you could not account for the location of the YubiKey). On the other hand, a well motivated adversary can take apart your YubiKey, extract the secrets through other means (every hardware key is vulnerable to this) and finally put together a new YubiKey, identical on the outside to your old YubiKey, with the same secrets.

The two scenarios are almost the same, unless you're biotagging your YubiKey (which only buys you knowledge that you've been compromised). If Yubico is selling these keys, it's because it would be too expensive for them to clearly label the firmware version on each YubiKey sold, for various reasons. I think this is a great opportunity for a competitor to arise, who hopefully allows flashing of the firmware, at a minimum. The Nitrokey seems like a good option <https://www.nitrokey.com/>.

This looks like a great presentation for children of a complex topic. I wish there was more of this but for different, more important, topics, like PGP for example.

The graphics are nice, are they AI? Isn't there a copyright issue using such graphics?

Digital currencies are a terrible concept and I was always against it, it's basically the opposite of decentralization due to the exchanges & the complexity of the subject rendering most users at the mercy of a few in the know. On top of that, in practice, digital currencies are used for the worst things humanity has to offer! But one can hope that young people will learn useful concepts from pursuing the subject.

edit: I'm also wondering, why don't they offer a true javascript shell instead of a fake one? When asked to run the `echo $sig | xxd -r -p` command. The benefit would be that the user can experiment some more with the command line.

Just take the money and never follow up on it.

For my own opinions, if you'd like to hear more, you can just ask me. I will only provide the citation as a one-off...

<https://www.britannica.com/topic/agriculture/Economics-polit...>:

>Agriculture has always been influenced by the actions of governments around the world. Never has this been more evident than during the first half of the 20th century, when two major wars profoundly disrupted food production. In response to the tumultuous economic climate, European countries implemented tariffs and other measures to protect local agriculture. ---Rasmussen, Wayne D. , Mellanby, Kenneth , Nair, Kusum , Gray, Alic William , Ordish, George , Crawford, Gary W. and Fussell, George Edwin. "origins of agriculture". Encyclopedia Britannica, 28 Oct. 2024, https://www.britannica.com/topic/agriculture. Accessed 30 October 2024.

This puts it in the context of WW2.

Here's one example where you find the opposite of "protections" at play: in the US you need prescriptions for antibiotics, in EU 7% is without. <https://ec.europa.eu/newsroom/sante/newsletter-archives/4487> (their PDF link is broken; one that works is <https://health.ec.europa.eu/system/files/2020-06/amr_arna_re...> "Antimicrobial resistance and causes of non-prudent use of antibiotics in human medicine in the EU" (2017)) Here's their Figure 2.6 e.g. <https://imgur.com/a/wLfoV7h>.

As a European I find your assessment appalling. The oft repeated lie that Europe has protected its citizens against anything is bizarre, European governments only protect their big governments. The ban of US pesticides is to stifle American infiltration of EU agriculture, and basically every other law can be viewed under this lens.

It is as if people live in a lie, they do not understand what has taken place in the past 200 years, the devastating destruction of the environment with pollution worldwide. As for protecting its citizens, what can really be said about this other than: ignorance is bliss.

Don't use cryptographic software from people refusing to identify themselves.

What occurs to me now is that with a proper SELinux configuration you do not even need per-user /tmp, you can use the old /tmp for all. It is still motivating to look into PAM, but perhaps also motivating to learn more about SELinux that I've also put off.

Very nice, thank you. I will look into this. This may be my break into PAM that I've ignored thus far.

I'm wondering if there's programs that will break with such a change. One example would be if multiple users in a group need access to the same file under /tmp.

Is it possible to configure every user to see /tmp as $USER/.tmp via some Linux isolation method (namespaces)?

This is a short bill.

It disallows the TSA from using facial recognition and requires that the TSA disposes of all facial recognition biometric information, including images and videos, obtained through facial recognition, no later than 90 days of the enactment of the act. Congressional acts prior to the enactment of the act are invalidated with regards to TSAs authorization of facial recognition use, and the TSA can use facial recognition only if authorized in future congressional acts. In section 4, it modifies law to exclude facial recognition for pilot licenses, those deemed threats to air security, and prevents the TSA from using the $20mm DARPA defense research grant for researching facial recognition means of defense. Additionally in section 5 it prevents the TSA from using facial recognition in implemented pilot programs, it prevents the TSA from cooperating with airport operators on the use of facial recognition, and prevents the TSA from issuing guidance to identify airport employees & law enforcement via facial recognition.

Cynic criticism:

1) The invalidation of former Congress acts with regards to TSA authorization of facial recognition use seems too polemic; would this pass as is?

2) Airport operators can still use facial recognition.

3) It does not define biometrics; nor what disposing means, and this may render this part ineffective, especially if derivatives of these data are not considered biometrics.

Overall what I'm reading this bill as, is that the government does not want the TSA to directly participate in this type of surveillance, but I think it leaves open the possibility of contractors to do so. It is still a good bill in my opinion.

I extrapolate to all of academia, but not to all academics (persons working in academia). My methodology is based on my intuition and my experiences. Already in this YC article the comments appear to be akin to the first meeting between battered housewives. You don't have to believe me or others, I'm just issuing a warning to anyone thinking of getting into academia: be alarmed and alert, and always careful. It's nothing like the movies portray academia to be, instead it's a thieves den, or a poker table, etc, you get the point.

I believe that tech and finance also have a drug problem. Those that sell expensive drugs like cocaine go after rich clients. You work in Hollywood, but have you been attending wild private parties? I've worked in academia and I was in the thick of it, I've experienced first hand the fraud I'm talking about, and it was a large part of my experience, not some side note. Perhaps it's an uncomfortable truth that academia is in the state it is in, but again, it is of utmost importance to warn younger people to its perils. (Act as if you're at a poker table at all times.) In any case, how do you know that it isn't your biases that prevent you from considering what I describe? What is so surprising with the claim that people who are very incentivized to steal and commit fraud do so if they are not punished for it?

edit: and it's not things I've heard, instead it is direct experiences, i.e. people stole my work, and things like that. As a graduate student to watch professors come to you with problem X, take what you've said (an actual solution) and publish a paper without attribute, that sort of thing; to report it and have nothing be done about it, et cetera, and on it goes, it's just instance after instance of such behavior, or the million ways in which they are careful to trick you into working on their problems without receiving attribute. One such trick for example, that again happened to me, is that after a conference talk I got into an e-mail discussion where I explained my approach; I was told that "they already have these results" (the trick here was to divulge less in the talk than what was currently known in order to be able to avoid "significant progress by another person" in the case another person does share new progress that they have already established, and hence not having to share attribution.) It turned out that our discussion was enough for them to go from n=3,4 to a general formula involving primes, because I pointed out a certain property they had not noticed. This is just a single example of the sorts of tricks, aside from total fraud, that happen, and one of the milder incidents I had happen to me.

From personal experience, it is all I've seen. Could anyone be in a position to extrapolate to all of academia without speaking from personal experience? I'm not speaking of all academics (hence 'most'). It's a statement similar to "Hollywood has a drug problem" or something of that sort.

My advice to anyone going into Hollywood would be to stay away from drugs; my advice to anyone going into academia is to treat every interaction as if you've just sat at a poker table in Las Vegas.

If you are familiar with academia you'll realize the academic dishonesty policy is essentially the playbook by which academics behave. The author is surprised that Eliezer Masliah purportedly had instances of fraud spanning 25 years. I bet the author would be even more surprised to find out that most academics are like that for the entire duration of their career. My favorite instance is Shing-Tung Yau, who is still a Harvard professor, who attempted to steal Grigori Perelman's proof of Poincare's conjecture (a millenium prize problem <https://www.claymath.org/millennium-problems/> that comes with a $1MM prize and $10k/mo for the rest of one's life; Perelman rejected all of it.)

I mean, get this: an extremely gifted Mathematician living on a measly salary in Russia had had his millenium prize almost stolen by a Harvard professor. What more evidence do you need?

It would be nice if the releases were cryptographically signed. I've never used Tcl/Tk before but I just downloaded the 9.0 release and I'll give it a go.

Section 3 in the whitepaper <https://sel4.systems/About/seL4-whitepaper.pdf> describes how it is done: (1) they restrict themselves to a possible-to-reason subset of C (that they have a parser in Isabelle for), and implement a kernel and prove the implementation is formally correct, and (2) to avoid compiler/kernel bugs of host & trojan horses, they verify the compiled/linked output as well.

Their Figure 3.2 shows how this is done: each transformation into the "Graph Language" nodes is proven formally correct. They need two proofs because the binary is automatically proven correct, i.e. what they prove is that their formalized binary is equivalent to the original binary using a HOL4 disassembler, without knowing what sort of binary they have at their hands. On the C side, they preserve semantics while proving the program correct (manually, i.e. they wrote the proofs themselves), and then they prove the two are equivalent, again automatically, using SMT solvers and throwing small chunks of data at it.

As they explain, proving the two "Graph Language" representations to be equivalent semantically is, in general, undecidable like the halting problem. However, they get away with it because the C compiler is not too wild in its output.

I'm not dogwhistling, I'm sinophilic and I wish for democracy in China. I don't know what should happen to H-1B's and green card holders, I think they provide great value and they are smart programs that the U.S. has, but your statement about allegiance and your parallel to an ant colony seemed oddly uninformed, and I gave you one specific example of coercion that is currently happening.

China has many modern-day heroes that are unsung, doctors like Li Wenliang, journalists like Li Zehua, businesspeople like Fang Bin, that came forward with crucial information when Covid-19 first occurred, or various politicians like Bo Xilai who revealed cracks and inefficiencies in the CCP's management.

Nice parents and younger sister you have there, shame if something were to happen to them. And don't think we can't reach you in your host country. <https://en.wikipedia.org/wiki/Chinese_police_overseas_servic...> Your comment is staggeringly ignorant of the realities of China today and of human nature.

If we ever found the meaning of life, it'd be behind a paywall. It's a shame that papers of such importance with regards to black holes and the universe are behind a paywall. The URL indicates "-for-all" but the reality is, you have to be a researcher or historian.

PS. The link "Find out more about joining Cambridge University Library as a private researcher or other user" is 404 broken.

I hope this answers your question. Let me preface this by saying that there are (probably) no satisfying answers for these questions, and that I'm not an expert. There is a classical limit <https://en.wikipedia.org/wiki/Classical_limit> that will recover classical equations from quantum equations from the limit ℏ -> 0. Such a thing is a heuristic, which means that we just know some equations/models where it works, but have not discovered a general truth. There are also situations where you may take c -> +∞ for example, and that would be called the non-relativistic limit. Why do we take these limits? Because when we did, the answer was not complete nonsense. We don't know what to make of them, i.e. we don't have complete theories. Also, what these limits mean is not a simple matter of calculus, they are not point-wise limits.

In one such instance I've been studying for years, the WKB approximation, I've realized two things: 1) the approximations are not well understood and 2) the mathematics are quite complicated, but these points notwithstanding the equations are used in experiments. You can read the few-page introduction in "Lectures on the Geometry of Quantization" by Bates & Weinstein <https://math.berkeley.edu/~alanw/GofQ.pdf> to see some of this, in particular the subsection "Quantization and the classical limit". I'll just quote the relevant paragraph:

> Although there remain some unsettled issues connected with the question, “How can ℏ become small?” the answer is essentially the following. For any particular mechanical system, there are usually characteristic distances, masses, velocities, . . . from which a unit of action appropriate to the system can be derived, and the classical limit is applicable when ℏ divided by this unit is much less than 1.

But remember, this is just one approach to the subject. Another heuristic is this: h has dimensions energy x time, which means it converts frequency into energy, e.g. E = hf. In the Fourier transform, the character is exp(2πihx·ξ), where ξ is the frequency. The effect of h -> 0 would be to dampen high-energy waves. Irregularity comes from high frequencies (think of it like this: a sum of sines of large periods would not have many kinks.) When you "iron out" the irregularity of the quantum solution, you end up with a classical one.

Again disclaimer: not a physicist, nor an expert.

The expressibility of a language is what can be expressed in it, not what it can express to you. This additional feature allows you to express this projection without being explicit.

Well said, like IQ tests, if you train for it you're better at it, but it the meaning of the results is dubious.

Recently I failed the first round of a fintech analyst position because I didn't complete the 9 undergrad (or high-school, in certain talented schools) math problems (I have a math PhD) in the 1 hour time frame. In retrospect, I should've cheated using computer/online assistance, and my true failure was my unwillingness to cheat. Not because fintech analysts are cheaters, but because the testing process is nonsense, so recognizing that, one should cheat it (indeed, an analyst mindset!) I'd rather be jobless than to adopt that mentality though. (and in fact I am, the only job I was able to find was a minimum wage service-type job, it can't even pay for daycare, I'd rather raise my child on my own while wife works thank God.)

We have high-interest rates and global crises resulting in companies not hiring while simultaneously governments give orders to news media to tout the strong economy. Ineffective hiring practices will always exist, but people don't complain when jobs are available; you only see this type of discussion online when things have gone sideways.

This is a short blog post I wrote about my exploration of OpenLDAP, it may demystify some things for you.