patrickmn's comments

patrickmn | 4 years ago | on: Nim 2.0 thoughts

You can literally do whatever you want with any library you use in your own codebase and have a consistent convention in your own code regardless of what your dependencies' authors preferences are. In other words, if the library authors used camelCase but you want to use snake_case in your code, you just do it.

It's very strange at first, and I had the same reaction as you, but it's actually quite nice. (I say that as somebody who strongly dislikes snake_case :) )

patrickmn | 4 years ago | on: Golden Handcuffs

never even heard of that kind of bonus. it sounds like it's designed to work exactly this way.

patrickmn | 7 years ago | on: Compromised supply chain within a supply chain poses new risks

> I have not heard many companies really conceptualize their “supply chain” exposure from the myriad of scripts/dependencies injected via tag managers and other software.

I made a thing called "TrackerMap" that allowed people, mostly Fortune 500 web/risk/compliance people, to do just that: https://www.crownpeak.com/products/monitoring-solutions/tag-...

(It has since been acquired, and I have no affiliation.)

patrickmn | 8 years ago | on: Horcrux: A Password Manager for Paranoids

It's not the same issue. With your approach, a compromise of the seed is catastrophic and reveals everything. With a regular password manager, you also need access to the vault encrypted using that master password. That's not a given -- most password managers either store their vaults locally or offer 2FA when synced.

(Nevermind that you can't change individual passwords or the master password at will with a deterministic scheme.)

patrickmn | 8 years ago | on: Horcrux: A Password Manager for Paranoids

All such deterministic algorithms are seeded by something. This is their basic flaw. Guess the seed and you get all the passwords.

With a password manager that randomly generates unique passwords, you don't have that problem, but you do have to synchronize the data.

patrickmn | 8 years ago | on: Is SHA-3 slow?

Highly recommend using Argon2id/Argon2d/scrypt/bcrypt/PBKDF2 (in that order of preference) for password authentication/"storage." While SHA-3 might be slower than other fast hash functions, it's not at all designed for the same purpose. Functions suitable for password authentication are not merely CPU-intensive, but also memory-intensive.

Shameless plug: https://patrickmn.com/security/storing-passwords-securely/#n...

page 1