barsonme

The part hat dupe trick!

But keep in mind this:

> Upon examination, however, the discrepancy between the U.S. and other countries appears largely due to country-to-country differences in the way infant mortality statistics are compiled. Infant mortality is defined differently in different countries, and the U.S. definition is notably broader than that of most other countries.

https://worldpopulationreview.com/country-rankings/infant-mo...

But that’s not a problem with TLS any more than you giving out your AES keys is a problem with AES.

What you’ve said so far has been generally confused and incorrect. I would suggest doing more research about HTTPS.

Not sure how this is a problem with HTTPS, then. It’s like complaining that AES encryption is broken because you have away your keys to a bunch of people.

All they see is ciphertext unless they’re terminating TLS and forwarding your traffic on to the target website.

How so?

I’m not sure what you mean. Do you know how to break TLS?

That is entirely untrue. HTTPS is just HTTP encrypted with TLS. The only parties that can decrypt the traffic are the people with the session keys: you and the website you’re visiting.

What are you talking about?

They’re not magic. They can’t peek into the TLS connection between your browser and google.com.

With some schemes, like ECDSA, you can't use a larger nonce since the nonce is a field element.

In general, you shouldn't need to worry about it unless you're using a broken CSPRNG or a bad cryptography library. And some libraries will try and work around bad RNGs: https://cs.opensource.google/go/go/+/refs/tags/go1.19.1:src/...

The fmt package should not put the compiler into conservative mode. If it does, file a bug report.

You should mention which browser and OS you're using. Otherwise, your comment isn't very useful.

Thanks. This explains the Common Criteria entropy assessment.

And some standards (like Common Criteria) actually require you to bring your own FIPS-validated CSPRNG, which effectively makes a userspace CSPRNG unavoidable.

I wasn't aware that FIPS required your _entropy source_ to be validated in order for your library to be validated, though. BoringSSL, for example, just reads from RDRAND, getrandom(2), or /dev/urandom. Maybe the OS/CPUs it's certified for all have FIPS-validated entropy sources?

Is your benchmark running concurrently? Or single-threaded?

> none of that exists for guns.

This is entirely untrue.

In my state, for example, you must be at least 18 to purchase firearms generally and 21 to purchase handguns or semiautomatic rifles. Every sale has a mandatory criminal and medical background check. The transfer applications (state and ATF Form 4473) require listing your name, date of birth, address, declaration of citizenship, Social Security number, driver license number, etc. Firearms must be stored in "secure gun storage." They are not permitted on various types of school property or property being used by a school, public demonstrations, state capitol grounds, and so on. You can only discharge firearms in certain places. You must have a license to conceal one on your person. You cannot possess short-barreled shotguns or machine guns. You need special licensing for short-barreled rifles and suppressors. I'm excluding a bunch of stuff—mostly federal laws—but you get the point. Violating any of those laws is a gross misdemeanor or felony. Keep in mind I live in a state with relatively permissive firearms laws! The laws in plenty of other states are much more severe.

Purchasing, owning, and operating a vehicle is much more easier than purchasing, owning, or operating firearms.

my job :)

But the keychain is, of course.

Sure, they’re not E2EE, but stuff like iMessages are E2EE (assuming iCloud backups are turned off so the keys aren’t included in the backup).

Rewriting something like OpenSSL isn't exactly trivial for many of the same reasons rewriting a large, widely used software library (especially one written in C) isn't trivial. Except in this case you need cryptography experts that are familiar in Rust (or whatever language) to review the code.

As a developer you should use prefer libraries written in safer languages (Rust, Go, etc.). But that's not always possible given business/environment/etc constraints.

It's got two hoses, one for intake and the other for exhaust. But yeah, the apartment had terrible drafts. And also would turn into an oven. Perks of a concrete apartment, I guess? :)

It was. We blocked off all the windows in our apartment (outside and inside) with old bed sheets and towels. We camped out in our living room with our A/C unit, keeping the "cool" air localized by blocking off the rest of the apartment with bed sheets and towels.

Even with the A/C unit (rated for about 465 sq ft) full tilt 24/7, our living room never dipped below 85 F. The rest of our apartment was well over 95.

Our poor cat was absolutely lethargic. We wiped her down with a wet washcloth every few hours, which she clearly appreciated. I think the A/C unit was a bit loud for her, though, because the dumb thing kept trying to sneak back to her favorite spots which were outside of the living room (and therefore over 100 F).

To be clear: I’m not advocating anything, just stating that Congress could choose to delegate that authority as a result of the ruling.

By “a safe level of arsenic” I meant “a safe level of arsenic in drinking water.” I’ve edited my comment to make this more clear.

Or Congress could pass legislation granting ATF authority to determine what constitutes a machine gun under the National Firearms Act.

> do you really want a US senator voting on what level of chemicals are allowed to be present in drinking water?

That’s not the level of granularity here. Using your hypothetical example about clean drinking water, Congress would need to delegate authority to EPA to regulate clean drinking water instead of EPA inferring or assuming it has that authority because of some other unrelated statute. Congress itself would not decide what a safe level of arsenic in drinking water is, EPA experts would.

They’ve declined to do a lot over the last decade :)

No matter how many times I hear them I just can't get over how incredible and haunting loons sound (eg https://earth.fm/recordings/midnight-loons/)

The only other animal sound that can come close is an Elk's bugle.