alcari

If you can run the app on a jailbroken/rooted device, it's fairly easy to beat certificate pinning in a few different ways. Two that come to mind are:

* find the certificate file in the app and replace it with your own.

* hook the function that verifies the certificate and make it return true.

OpenZFS was forked from the original Sun/Solaris ZFS code base, which Sun made available regularly. It's still CDDL.

No, and it effectively never will be.

See: http://open-zfs.org/wiki/FAQ#Do_you_plan_to_release_OpenZFS_...

A statute of limitations prevents you from charging someone with a crime once some period of time elapses. It says nothing about how long you have to prove your case in court. That's more likely to run afoul of the right to a speedy trial.

They're acting as cache, to hide the latency to your RAM. They're implementing increasingly niche instructions that speed up ever smaller sets of programs. They're mostly sitting idle, because power usage hasn't fallen at nearly the rate of increasing density, so switching them all at the same time is a great way to start a fire.

A significant part of the exponential gains in the '90s and early 2000s was that clock speed kept increasing. That's been stagnant for years because of heat problems.

That's a classic canary trap. [0]

[0] https://en.wikipedia.org/wiki/Canary_trap

Additionally, old versions will expire, so there's a limit to how far back you can keep someone, even if you continuously intercept the update attempts.

Maybe it changed at some point (8?), or my memory's fuzzy. I haven't looked at it in several years.

Either way, trusting a root CA generally looks far less threatening than the self-signed certificate warnings.

It's scary how easy it is to add new roots on all major platforms. You just click on the CA link and get a response with the appropriate MIME type back, then:

* Windows gives you a helpful little wizard wherein you click "next" a few times.

* Firefox gives you a dialog with 3 checkboxes; check them and click okay.

* iOS sends you to settings, and asks you if you want to trust the given CA.

* OS X hands it to Keychain Access, where you have to select 'trust' from a dropdown and maybe enter a keychain password; it's a bit less intuitive.

* Chrome uses the OS trust store, so it hands it off to the OS while claiming it's a dangerous filetype.

Don't fall back. If you don't have a reasonable enough environment to get a PRNG, you should halt and complain very loudly.

As for actually generating random numbers, here's a good explanation from 'tptacek: http://sockpuppet.org/blog/2014/02/25/safely-generate-random...

People use DSA for the same reasons they use RC4, 3DES, and MD5: that's what the other party's 10 year old legacy platform that will never be updated supports.

They probably just said that because it's ZFS, and didn't look at the upstream. IIRC, Nexenta pulls from Illumos like all the other ZFS-based storage vendors.

`rm` is definitely one of them, it's just suppressed by the `-f` flag. (examples from Ubuntu)

    $ touch foo
    $ chmod -w foo
    $ rm foo
    rm: remove write-protected regular empty file ‘foo’?

There's also the immutable attribute many modern filesystems support, which prevents the file from being modified unless the attribute is removed.

    $ sudo chattr +i foo
    $ rm foo
    rm: remove write-protected regular empty file ‘foo’? y
    rm: cannot remove ‘foo’: Operation not permitted

That's an Economist thing. They feel that "what is written is more important than who writes it"[0].

[0]: http://www.economist.com/blogs/economist-explains/2013/09/ec...

Sure, but that doesn't help in the context of zfs send, which serializes at the filesystem level for transport. The stream is still going to be in plain text. In fact, Oracle's ZFS still sends the stream decrypted and decompressed, even if those properties are enabled.

Nobody outside of Oracle supports encrypted ZFS, and that's probably not going to change any time soon (I'd love to be wrong, though).

I seem to recall this being on HN a few months ago: https://github.com/shazow/ssh-chat

That method's mentioned in the article. See the section 'The Obvious Problem'.

Black Forest Games is still around, and making Giana Sisters games.

The ZFS crypto implementation (which isn't really available outside Oracle's Solaris) uses AES-GCM, which solves the authentication problem.

This brings back some memories, but not the ones everyone else seems to have: I'd spent several hours (at least) looking at MSDN docs, various DLLs on my system, and the contents of the Windows SDK trying to figure out how to get an old fashioned beep.

I finally ended up on Larry's blog and, as it seemed like he'd know how it all worked, asked him.

I was quite pleasantly surprised by his response, as I wasn't really expecting an answer, never mind such an in-depth blog post the next day.

Give those shares votes, and let shareholder interests define value for you.

The problem isn't necessarily with the intentions of the people running the site. It could be an attacker altering the site to steal the information.

One-time pads are still secure because the decryption process will produce every plaintext the same length as the ciphertext, and you'll have no way of knowing which one was correct.

This reminds me of [1], where scratch-off games were founded to be using PRNG output improperly, allowing winning tickets to be identified without playing them.

[1]: http://www.wired.com/2011/01/ff_lottery/

> The first tidbit is “PERRIN” this is referencing Perrin numbers. I 100% confident that we are the only people to ever hit that wiki page, ever.

Almost: I was on that wiki page while waiting in line around 3 am Thursday morning (speakers got badges, etc. early, and a friend of a friend was a speaker). We just didn't have the time to stick with it.

1o57 designs the DEFCON badges every year.

Not necessarily, because things like robots.txt will still prevent it from ending up in search engine results.

The basic rules they recently published for D&D 5 read a lot like the 3.x rules, to the point that I was referring back to the 3.5 Player's Handbook to see the differences in some areas.

The quote is wrong: ZFS checksums both the user data and metadata in a Merkle tree, optionally using cryptographic hashes (i.e. SHA256).