Hacker News Reader

gnarulaon OwnCloud vulnerability with max severity score comes under "mass" exploitation

In a similar boat here! I moved my home stuff behind Tailscale the moment I realised ufw rules don't apply to ports exposed by docker containers.

gnarulaon Rust Cryptography Should Be Written in Rust

I reckon https://github.com/RustCrypto is an effort in this space.

gnarulaon Practically-Exploitable Cryptographic Vulnerabilities in Matrix

Cryptography parlance for a man-in-the middle adversary.

https://en.wikipedia.org/wiki/Alice_and_Bob might be of interest :)

gnarulaon Why are glasses so expensive? The industry prefers to keep that blurry (2019)

There's plenty of margin in the industry - as an anecdote, I've paid around £40 for a pair in the UK through an online retailer (Glasses Direct), around ~₹1500-2000 in India through an online retailer (Lenskart) and ~₹800 by visiting a local store in a Tier 2 city in India

gnarulaon Ssss: Shamir's Secret Sharing Scheme (2006)

Refer: https://github.com/dedis/kyber/blob/master/share/vss/rabin/v... and https://github.com/dedis/kyber/blob/master/share/vss/pederse...

gnarulaon Learn TLA+

There's a video series by Leslie Lamport himself: https://lamport.azurewebsites.net/video/videos.html

There's also Dr. TLA+ series by Microsoft Research at https://www.youtube.com/watch?v=ao58xine3jM&list=PLD7HFcN7LX...

gnarulaon Where are all the crypto use cases?

I reckon that's now how SSI solutions use a blockchain (or at least the ones I know of). AFAIK, a blockchain is only used to resolve a DID (an identifier mapping a random ID to a bunch of public keys you control, along with a URL to communicate with your device). Your personal information, as in your name, phone number, email stay in your device and are only exchanged with the party you want to authenticate against.

I'm curious to know if there's something I misunderstood in this space

gnarulaon Where are all the crypto use cases?

Could you elaborate a bit on that please? How would that pan out?

gnarulaon You can do a lot with an empty file

From POSIX [1][2]:

> If the execl() function fails due to an error equivalent to the [ENOEXEC] error defined in the System Interfaces volume of POSIX.1-2017, the shell shall execute a command equivalent to having a shell invoked with the pathname resulting from the search as its first operand, with any remaining arguments passed to the new shell, except that the value of "$0" in the new shell may be set to the command name. If the executable file is not a text file, the shell may bypass this command execution. In this case, it shall write an error message, and shall return an exit status of 126.

[1] https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V... [2] https://unix.stackexchange.com/a/373229

gnarulaon You can do a lot with an empty file

In case anyone's curious, in absence of a shebang (#!), Linux [1] returns an ENOEXEC to the execve syscall, after which the invoking program (the shell) handles the failure. Usually shells default to running the file as a shell script with itself as argv0.

[1] https://github.com/torvalds/linux/blob/3e732ebf7316ac83e8562...

gnarulaon Verifiable Voting: A Primer

> You /still/ have no way to ensure that the checkbox corresponded with the name, and that you cast the vote you think you did

Well the voter can verify if the voting machine is acting honestly by querying the salt used for encryption (refer to "How do you know your ballot was properly constructed?"). From an adversarial voting machine's perspective the chances of the voter validating the ballot is 0.5 and given the sensitivity of the elections, I'd imagine even one incident of foul play spreading like wildfire to raise alarms