When the judicial branch ruled it unconstitutional, the executive branch ignored the Constitution and do it anyway.
When the Congress choose not to change the law and make illegal immigrants legal, the executive branch chose to ignore the Constitution and write their own law.
The head of the executive, President Obama, has clearly announced that he considers "the failure of Congress" to do exactly what he wants somehow authorizes him to override Congress. In other words, according to his announcement, he actually believes the only legitimate role of Congress is to rubber-stamp whatever the executive wants - choosing not to implement his policy is a "failure" of Congress , and as such is illegitimate and requires him to override their decision. Never mind his oath to "faithfully execute the law".
>. The penalties exacted for actually being the party behind a massive DDoS (when it can be proven objectively and conclusively) are not currently nearly severe enough.
What are the penalties now, and what do you think they should be?
Rubber duck debugging refers to telling someone else about a problem or question, and thereby coming to understand it - without the listener necessarily saying anything. The speaker may as well have been talking to a rubber duck, it was the act organizing ones thoughts and speaking them aloud that resulted in clarity.
Currently I have my own office and each of my coworkers has their own. We each naturally work mostly with one or two other people through the day - the two graphic designers work together, etc. Some coworkers spend MOST of their time in their associate's office visiting^H^H^H^H collaborating. Other's less so, but it seems most of us feel the need to get out of our office and go see another human face at some point in the day.
I think I preferred the setup at my previous company, where two or three people were in a large office, with their backs to each other. Nobody was looking at you, and you didn't see anyone, until you turned to talk to them. I could focus on my work, and they on theirs, but they could also easily ask me a question, and I could notice when one of my people was having a rough day, or just just a stressful hour. We could focus on our work, but when one person was clearly getting stressed about stupid customers we could go for some frozen custard and come back 15 minutes later in a better mood.
Where I am now, my boss's office is next to mine. We office shout to one another rather than using instant messenger or getting out of our chair. It'd be easier if she was eight feet away at the other end of a large office. On the other hand, maybe I wouldn't want my boss in my office all the time - at my last company I WAS the boss.:)
It's not being used as a key. Key stretching would be pointless. You stretch to get a longer key if your goal is to derive a strong key - a Key Derivation Function. Password hashes aren't used as xryptographic keys. They're stored, period. They say "when all you have is a hammer..."
KDFs are for key derivation. That's why they're called key derivation functions. How is that hard to understand.
That sucks. It sounds like nobody on his side read the law he was charged under, probably, because with zero property damage it would be a class C misdemeanor (ticket) in most states. You didn't mention which state, but it sounds like the prosecutor, the defendant, and perhaps failed to read the law.
Federal charges for manufacturing explosives involved in interstate commerce are serious, but I don't think that type of device would qualify as an explosive under federal law, since there is no explosive composition; it's just a slow build-up of hydrogen gas.
Of course you're not, because you'd be trying to prove that it's impossible to do the things that we do all the time. I just showed that you're OBVIOUSLY wrong, so it would be pretty silly to try to write a formal proof otherwise.
When you discover that an idea you once had was mistaken, you can either a) get butt-hurt or b) learn something.
How much time? If he spent a day in jail and that nipped it in the bud, so he didn't make acetone peroxide without a license, I'm okay with that. If he spent a month, probably meaning nobody bailed him out, that sucks.
Yep, any time a new technology becomes widespread that can replace your current approach at lower cost, someone is going to take your mass market customers. You can move to the new technology, or let competitors take them.
TFA says it works only for carry-on, and one-way tickets since you'd need to board a return flight at the destination you booked.
That really limits the utility for me; rarely do I fly somewhere and not want to get back home. If I was making a permanent move, I'd probably have luggage.
PS, the other thing I did (successfully) was pre-compute symmetry of A and B, so I knew that any value of A in this list would give the same result in B. So I didn't have to compute the value of B, after I knew A I only had to select which bucket it was in to get the value of B.
If you have to solve A before B, you can work all possible A in parallel, then all possible B in parallel. More cores is better.
Also, just because you have to solve step A before you can solve step B doesn't mean you can't START working on B, such as solving B for likely values of A, storing them in a lookup table, then selecting the precomputed answer from A. In fact I won a prize doing exactly that with my software playing a game against humans.
>. It's not hard.
Harder than it first appears, we just demonstrated.
Moore never said anything about clock speed. He said the number of transistors. A CPU with more transistors can compute a complex problem faster. There is a science to trying to come up with problems that aren't solvable faster with more transistors (even at the same clock), but those problems are rare in the real world. Today's 3Ghz processor is faster than a 3 GHz processor from five years ago.
Recently, the big improvements have come from organizing the increased transistors into increased cores. Today's 8-core CPU can analyze eight moves at once. The older dual-core system could only analyze two moves at once. Therefore, the 8-core system is four times as fast, on a parallel problem like this.*
* Actually even better than four times, because a fractional core is needed to manage the overall process. The dual core chip could analyze 1.5 moves simultaneously, the 8-core can analyze seven simultaneously.
Not everyone is automatically a customer for life. Likely, their average retention will be around 18 months. Buying more books (the old model) may be analogous to remaining a customer longer.
Either way, getting more money from the happy customer. It's just measured in time vs count of books.
> Write a bad book, but find a way to get people to download your book, and you make money, even if most readers stop at page 10.
That WAS a problem in the successful businesses I worked with using this model. Not necessarily an unsolvable problem, but a problem. A trivial partial solution is to require reader ratings of at least X to get a share, or a rating of at least Y to get a higher share.
In another industry I was closely involved in, this approach significantly increased total revenue. Instead of saying "buy my book for $20", the author can say "get my book and 70,000 others for just $20". Which do you think generates more sales?
In the very successful implementations, the amount paid out was based not just on which content was most viewed, but which generated sales via something like an affiliate code. There may be smaller content which many people will click if it's free, but nobody bought a subscription in order to see that content. Others, such as TAOCP, may have fewer viewers, but those viewers bought the subscription specifically to read TAOCP. TAOCP would be rewarded for bringing buyers.
> Why is a KDF like PBKDF2, bcrypt or scrypt, a poorer option for password storage than rolling your own?
Rolling your own is stupid. I never said using a good KDF was worse than rolling your own algorithm of unknown quality and unknown behavior.
In fact, I said bcrypt specifically is acceptable, that I wouldn't take points off your grade for using bcrypt. A better choice is a properly vetted hash that's designed as a hash, such as SHA256. Using a KDF as a hash is like using a butter knife as a screwdriver - it gets the job done, and professionals normally use the tool designed for the job rather than substituting.
As parent said, almost all professional lighting, for stage and displays, uses the DMX protocol. Mobile and club DJs also. You can get a decent programmable DMX control board, like DJs use, for $100-$200 from a site like Cheaplights.com*. You can instead choose a USB-DMX converter for about $39. You don't need the expensive type of USB-DMX converter.
Be open to the possibility of running a wire or two to your DMX-controlled relay packs. In general, wireless is required for things that move around, such as your laptop, phone, etc. For anything that isn't mobile, wires are more reliable and simpler to troubleshoot. You CAN get wireless DMX; I just purchased a WiFly capable DMX board from American DJ for a church. I ignored the wireless capability and connected a cable.
* you can also find really expensive DMX lighting boards used for stadium-sized concerts. In comparison, the $125 one sucks, but the hottest nightclub in town, with the cool lasers and strobe lights, uses a $100-$250 controller.
Look up "computational complexity" sometime. A computationally complex algorithm is one that gets much slower as the input gets longer. For small inputs, low-complexity algorithm can be, and probably will be much slower than a high a complexity algorithm.
For password hashing, you want the very lowest possible complexity - constant time. Low complexity, constant time, doesn't mean fast; it means that the time and space required is the same for any legal input. If it's slow for all inputs, that's low complexity, and exactly what you want for hashing passwords.
It's clear that you know enough about the topic that you can either a) guide newbies and ask intelligent questions of experts or b) embarrass yourself by overestimating your actual understanding.
Kim Dotcom is of course exactly who I would trust with my secrets, he wouldn't let anything out that the producer of the content doesn't want released. Certainly all of his associates doing the actual work on the system are of the highest moral fiber.
Okay, maybe not, but at least his chat servers won't be the target of any surveillance by anyone else, so I can feel secure that only mega can read and publicize my messages.
> Two three-digit pins are not more secure than one six digit pin. > Essentially, they ARE one six digit pin.
That was #2 of my three statements. You seem to have missed the other two.
a) Two three-digit PINS are the same as one six digit PIN.
b) One six-digit PIN is better than one 3-digit PIN.
c) Therefore, two 3-digit PINs is better than one 3-digit PIN.
If you have any confusion or disagreement let me know whether it's with a, b, or c.
Your constraint that security breeches can occur only by the principal being kidnapped and forced under torture to give up their password is also quite mistaken. That's what happens in movies. In real life, the attacker guesses the password. It's easier to guess to guess ONE 8-character password than than to guess TWO 8-character passwords. It's easier to fake out a fingerprint scanner than it is to fake out a fingerprint scanner AND a retina scan.
Note also that IF you are kidnapped by people willing to torture you, you can be forced to give up your password, your smart card, and your thumb.
> really? You want a well-optimized function to turn a password into a very big unpredictable number in a way that's computationally complex
You want the hash algorithm to be SLOW, not "well optimized"
You don't care about turning it into an unpredictable number.
You don't want it to be computationally complex. In fact you sometimes enforce O(1) time, you don't want a longer or different password to take longer to hash, because that facilitates timing attacks.
"Rolling your own slow, crappy"? Like I mentioned before, yes it should be slow, but no, SHA256 isn't my own. I'm known for applied security, not the heavy math of the primitive algorithms.
Trees are nice. I'd like to have more trees. Last I checked, planting a few trees won't affect CO2 levels. Plankton does almost all of the co2 conversion. If you can plant an entire rainforest, that would be helpful.
Slashdot Mirror
>. What went wrong
When the judicial branch ruled it unconstitutional, the executive branch ignored the Constitution and do it anyway.
When the Congress choose not to change the law and make illegal immigrants legal, the executive branch chose to ignore the Constitution and write their own law.
The head of the executive, President Obama, has clearly announced that he considers "the failure of Congress" to do exactly what he wants somehow authorizes him to override Congress. In other words, according to his announcement, he actually believes the only legitimate role of Congress is to rubber-stamp whatever the executive wants - choosing not to implement his policy is a "failure" of Congress , and as such is illegitimate and requires him to override their decision. Never mind his oath to "faithfully execute the law".
>. The penalties exacted for actually being the party behind a massive DDoS (when it can be proven objectively and conclusively) are not currently nearly severe enough.
What are the penalties now, and what do you think they should be?
http://en.m.wikipedia.org/wiki...
Rubber duck debugging refers to telling someone else about a problem or question, and thereby coming to understand it - without the listener necessarily saying anything. The speaker may as well have been talking to a rubber duck, it was the act organizing ones thoughts and speaking them aloud that resulted in clarity.
Currently I have my own office and each of my coworkers has their own. We each naturally work mostly with one or two other people through the day - the two graphic designers work together, etc. Some coworkers spend MOST of their time in their associate's office visiting^H^H^H^H collaborating. Other's less so, but it seems most of us feel the need to get out of our office and go see another human face at some point in the day.
I think I preferred the setup at my previous company, where two or three people were in a large office, with their backs to each other. Nobody was looking at you, and you didn't see anyone, until you turned to talk to them. I could focus on my work, and they on theirs, but they could also easily ask me a question, and I could notice when one of my people was having a rough day, or just just a stressful hour. We could focus on our work, but when one person was clearly getting stressed about stupid customers we could go for some frozen custard and come back 15 minutes later in a better mood.
Where I am now, my boss's office is next to mine. We office shout to one another rather than using instant messenger or getting out of our chair. It'd be easier if she was eight feet away at the other end of a large office. On the other hand, maybe I wouldn't want my boss in my office all the time - at my last company I WAS the boss. :)
> a minimum, apply salting and key stretching to.
It's not being used as a key. Key stretching would be pointless. You stretch to get a longer key if your goal is to derive a strong key - a Key Derivation Function. Password hashes aren't used as xryptographic keys. They're stored, period. They say "when all you have is a hammer ..."
KDFs are for key derivation. That's why they're called key derivation functions. How is that hard to understand.
That sucks. It sounds like nobody on his side read the law he was charged under, probably, because with zero property damage it would be a class C misdemeanor (ticket) in most states. You didn't mention which state, but it sounds like the prosecutor, the defendant, and perhaps failed to read the law.
Federal charges for manufacturing explosives involved in interstate commerce are serious, but I don't think that type of device would qualify as an explosive under federal law, since there is no explosive composition; it's just a slow build-up of hydrogen gas.
>. I'm not going to write a full proof
Of course you're not, because you'd be trying to prove that it's impossible to do the things that we do all the time. I just showed that you're OBVIOUSLY wrong, so it would be pretty silly to try to write a formal proof otherwise.
When you discover that an idea you once had was mistaken, you can either a) get butt-hurt or b) learn something.
GP knows what he's talking about - he was already stoned when he wrote that.
How much time? If he spent a day in jail and that nipped it in the bud, so he didn't make acetone peroxide without a license, I'm okay with that. If he spent a month, probably meaning nobody bailed him out, that sucks.
If you go camping and take a pack of Black Cats with you, you may have just illegally transported explosives. Details matter.
Yep, any time a new technology becomes widespread that can replace your current approach at lower cost, someone is going to take your mass market customers. You can move to the new technology, or let competitors take them.
TFA says it works only for carry-on, and one-way tickets since you'd need to board a return flight at the destination you booked.
That really limits the utility for me; rarely do I fly somewhere and not want to get back home. If I was making a permanent move, I'd probably have luggage.
PS, the other thing I did (successfully) was pre-compute symmetry of A and B, so I knew that any value of A in this list would give the same result in B. So I didn't have to compute the value of B, after I knew A I only had to select which bucket it was in to get the value of B.
If you have to solve A before B, you can work all possible A in parallel, then all possible B in parallel. More cores is better.
Also, just because you have to solve step A before you can solve step B doesn't mean you can't START working on B, such as solving B for likely values of A, storing them in a lookup table, then selecting the precomputed answer from A. In fact I won a prize doing exactly that with my software playing a game against humans.
>. It's not hard.
Harder than it first appears, we just demonstrated.
Moore never said anything about clock speed. He said the number of transistors. A CPU with more transistors can compute a complex problem faster. There is a science to trying to come up with problems that aren't solvable faster with more transistors (even at the same clock), but those problems are rare in the real world. Today's 3Ghz processor is faster than a 3 GHz processor from five years ago.
Recently, the big improvements have come from organizing the increased transistors into increased cores. Today's 8-core CPU can analyze eight moves at once. The older dual-core system could only analyze two moves at once. Therefore, the 8-core system is four times as fast, on a parallel problem like this.*
* Actually even better than four times, because a fractional core is needed to manage the overall process. The dual core chip could analyze 1.5 moves simultaneously, the 8-core can analyze seven simultaneously.
Not everyone is automatically a customer for life. Likely, their average retention will be around 18 months. Buying more books (the old model) may be analogous to remaining a customer longer.
Either way, getting more money from the happy customer. It's just measured in time vs count of books.
> Write a bad book, but find a way to get people to download your book, and you make money, even if most readers stop at page 10.
That WAS a problem in the successful businesses I worked with using this model. Not necessarily an unsolvable problem, but a problem. A trivial partial solution is to require reader ratings of at least X to get a share, or a rating of at least Y to get a higher share.
In another industry I was closely involved in, this approach significantly increased total revenue. Instead of saying "buy my book for $20", the author can say "get my book and 70,000 others for just $20". Which do you think generates more sales?
In the very successful implementations, the amount paid out was based not just on which content was most viewed, but which generated sales via something like an affiliate code. There may be smaller content which many people will click if it's free, but nobody bought a subscription in order to see that content. Others, such as TAOCP, may have fewer viewers, but those viewers bought the subscription specifically to read TAOCP. TAOCP would be rewarded for bringing buyers.
> Why is a KDF like PBKDF2, bcrypt or scrypt, a poorer option for password storage than rolling your own?
Rolling your own is stupid. I never said using a good KDF was worse than rolling your own algorithm of unknown quality and unknown behavior.
In fact, I said bcrypt specifically is acceptable, that I wouldn't take points off your grade for using bcrypt. A better choice is a properly vetted hash that's designed as a hash, such as SHA256. Using a KDF as a hash is like using a butter knife as a screwdriver - it gets the job done, and professionals normally use the tool designed for the job rather than substituting.
As parent said, almost all professional lighting, for stage and displays, uses the DMX protocol. Mobile and club DJs also. You can get a decent programmable DMX control board, like DJs use, for $100-$200 from a site like Cheaplights.com*. You can instead choose a USB-DMX converter for about $39. You don't need the expensive type of USB-DMX converter.
Be open to the possibility of running a wire or two to your DMX-controlled relay packs. In general, wireless is required for things that move around, such as your laptop, phone, etc. For anything that isn't mobile, wires are more reliable and simpler to troubleshoot. You CAN get wireless DMX; I just purchased a WiFly capable DMX board from American DJ for a church. I ignored the wireless capability and connected a cable.
* you can also find really expensive DMX lighting boards used for stadium-sized concerts. In comparison, the $125 one sucks, but the hottest nightclub in town, with the cool lasers and strobe lights, uses a $100-$250 controller.
Look up "computational complexity" sometime. A computationally complex algorithm is one that gets much slower as the input gets longer. For small inputs, low-complexity algorithm can be, and probably will be much slower than a high a complexity algorithm.
For password hashing, you want the very lowest possible complexity - constant time. Low complexity, constant time, doesn't mean fast; it means that the time and space required is the same for any legal input. If it's slow for all inputs, that's low complexity, and exactly what you want for hashing passwords.
It's clear that you know enough about the topic that you can either a) guide newbies and ask intelligent questions of experts or b) embarrass yourself by overestimating your actual understanding.
Kim Dotcom is of course exactly who I would trust with my secrets, he wouldn't let anything out that the producer of the content doesn't want released. Certainly all of his associates doing the actual work on the system are of the highest moral fiber.
Okay, maybe not, but at least his chat servers won't be the target of any surveillance by anyone else, so I can feel secure that only mega can read and publicize my messages.
> Two three-digit pins are not more secure than one six digit pin.
> Essentially, they ARE one six digit pin.
That was #2 of my three statements. You seem to have missed the other two.
a) Two three-digit PINS are the same as one six digit PIN.
b) One six-digit PIN is better than one 3-digit PIN.
c) Therefore, two 3-digit PINs is better than one 3-digit PIN.
If you have any confusion or disagreement let me know whether it's with a, b, or c.
Your constraint that security breeches can occur only by the principal being kidnapped and forced under torture to give up their password is also quite mistaken. That's what happens in movies. In real life, the attacker guesses the password. It's easier to guess to guess ONE 8-character password than than to guess TWO 8-character passwords. It's easier to fake out a fingerprint scanner than it is to fake out a fingerprint scanner AND a retina scan.
Note also that IF you are kidnapped by people willing to torture you, you can be forced to give up your password, your smart card, and your thumb.
> really? You want a well-optimized function to turn a password into a very big unpredictable number in a way that's computationally complex
You want the hash algorithm to be SLOW, not "well optimized"
You don't care about turning it into an unpredictable number.
You don't want it to be computationally complex. In fact you sometimes enforce O(1) time, you don't want a longer or different password to take longer to hash, because that facilitates timing attacks.
"Rolling your own slow, crappy"? Like I mentioned before, yes it should be slow, but no, SHA256 isn't my own. I'm known for applied security, not the heavy math of the primitive algorithms.
Trees are nice. I'd like to have more trees. Last I checked, planting a few trees won't affect CO2 levels. Plankton does almost all of the co2 conversion. If you can plant an entire rainforest, that would be helpful.