1. 4

    My understanding is that the POSIX shell spec isn’t nearly detailed enough to define a complete shell, so the promise of “if it runs on mrsh, it’s portable” seems dubious.

    1. 10

      IMO to be strictly POSIX compliant, you’d have to randomly choose between ambiguous interpretations so that you can’t rely on a specific behavior.

      1. 2

        This would be wonderfully chaotic! I can imagine the docs now:

        Feature foo does either thing x or, if you’re unlucky, another slightly different thing y.

        1. 4

          It is not like this hasn’t ever been done before.

          1. 1

            Wow that’s simultaneously hilarious and disturbing. I suppose it gets the point across…

      2. 6

        My understanding (I could very well be wrong!) is that POSIX sh is the “minimum bar” of a shell – it’s quite usable by itself (as long as you don’t need fancy features like, gosh, arrays), and every modern shell strives to be compatible with it. In my experience, anything that’s POSIX-sh-compliant will run properly on dash, bash, mksh, etc.

        1. 4

          I think that’s more of the result of these shells being tested against each other.

          1. 4

            In practice I find that the biggest problem is compatibility of shell utilities, rather than the shell itself. The POSIX shell utilities are really bare-bones (and some are outright missing, like stat) and it can be rather tricky to do things sticking to just the POSIX flags. It’s really easy for various extensions to sneak in even when you intend to write a fully compatible script (and arguably, often that’s okay too, depending on what you’re doing and who the intended audience is).

            I appreciate that POSIX is intended as a “minimum bar” kind of specification, but sometimes I wish it would be just a little less conservative.

          2. 2

            Strong https://xkcd.com/1312/ vibes

          1. 5

            The notice at the top of the paper is unique and awesome, and I love seeing NDSS taking action here:

            Statement from the NDSS 2021 Program Committee: NDSS is devoted to ethical principles and encourages the research community to ensure its work protects the privacy, security, and safety of users and others involved. While the NDSS 2021 PC appreciated the technical contributions of this paper, it was the subject of a debate in our community regarding the responsible disclosure of vulnerabilities for the Firefox web browser. The PC examined and discussed the ethics concerns raised and the authors’ response. Although no harm came to users, the authors’ oversight could have made a non-vulnerable browser vulnerable to the attack proposed in the paper. The PC does not believe the authors acted in bad faith. Nevertheless, we decided to add this note as well as the authors’ response (in an Appendix) to the paper because the NDSS PC takes both the ethics of responsible disclosure and fairness towards the authors seriously. It is the PC’s view that researchers must not engage in disclosure practices that subject users to an appreciable risk of substantial harm. NDSS will work with other conferences to further improve the transparency of vulnerability disclosure to reduce such errors in the future.

            1. 8

              That is unique and awesome. However… I find both the authors’ response and the conclusion that they did not act in bad faith quite hard to swallow.

              I remember being shocked by the bugzilla issue before I even knew any detail about the paper.

              In their response, they state:

              We informed all vulnerable browsers through reports in June2020, detailing our technique and the underlying issue – as we wrote in the paper “we have disclosed our findings to all affected browsers”. This disclosure took place even before we submitted our paper to NDSS in July 2020.

              and they later add that

              we simply (and unwisely) didn’t take Firefox into account during the disclosure process because it wasn’t susceptible to the attack.

              One of the authors joined Ars Technica to say in the comments:

              Our mistake at this point was not circling back with Mozilla and explaining that if they did fix this bug, the other vulnerability could show up - all of our attention was on refining our understanding of the weaknesses we discovered in other browsers.

              That all sounds reasonable in isolation, but if you read the actual issue in bugzilla you can see one of the papers’ authors asking, in late May, whether Mozilla planned to fix this.

              That feels a lot different than “we just opened an issue we found early in our exploration of the space, then forgot to follow up.” They were following up at very nearly the same time as they were disclosing vulnerabilities to other browsers. Given what they had to have known by late May, it’s hard to read this as anything besides trying to get Firefox to expose its users to the same issue they were seeing on other browsers.

              That’s much worse than failing to follow up.

            1. 9

              Lmao the first example is so cursed

              git log --graph --abbrev-commit --decorate --all --format=format:"%C(bold blue)%h%C(reset) \ - %C(bold cyan)%aD%C(dim white) - \ %an%C(reset) %C(bold green)(%ar)%C(reset)%C(bold yellow)%d%C(reset)%n %C(white)%s%C(reset)"

              1. 5

                Urgh the curse of the tutti frutti.

                I think I’ve developed a physical aversion to cyan.

                1. 1

                  Attack of the Angry Fruit Salad!

                2. 2

                  That is what we have Git aliases for ;)

                  1. -1

                    That is what we have Git aliases for ;)

                  1. 2

                    If you plan to flag as off-topic (as five already have), I urge you consider why you feel that way. This is the water in which we swim, the air that we breathe. Off-topic from “culture,” “practices,” and “ai” doesn’t really make sense.

                    1. 12

                      From the about page:

                      “Lobsters is focused pretty narrowly on computing; tags like art don’t imply every piece of art is on-topic. Some rules of thumb for great stories to submit: Will this improve the reader’s next program? Will it deepen their understanding of their last program? Will it be more interesting in five or ten years?”

                      “Some things that are off-topic here but popular on larger, similar sites: […], management, [,,,], anthropology, […], and defining the single morally correct economic and political system for the entire world when we can’t even settle tabs vs. spaces.”

                      I think that the intent of the about page is to try and focus on the technical side of computing rather than the air we breathe that enables it. If you think that the article counts under the ai, culture, or practices tag, then it’s no stretch to consider even more so that it’s about management, anthropology, and the political systems at play in tech and academics.

                      It’s not to say that the article is wrong or important, just that lobsters is a specialised forum and that there are other, better places to discuss it.

                      1. 1

                        Well said and fair enough. I am glad though that this particular forum will have exposure to this article and I do believe it can concretely impact the development and study of software.

                      2. 5

                        I originally flagged it as off-topic because none of it was “about” AI. You could write the exact same essay about physics or sociology or economics, and propose the same problems and the same solutions.

                        On second reading, there’s a paragraph on AI ethics, which is on-topic, but I don’t think it’s enough to carry the other ten pages.

                        1. 1

                          Reasonable. I’m still behind posting it, but not everyone has to agree, especially if they give it a thorough chance as you did.

                      1. 4

                        Short but powerful read on combating racism in AI, applicable to CS in general. Academic bent, but also very applicable to industry and interpersonal interaction.

                        1. 11

                          This is like asking highway engineers to maintain a horse-and-buggy lane on the freeway. Extra work, inefficient, and potentially dangerous.

                          If you want some decrepit machine to hit the internet over HTTP, put it behind your own sslstrip proxy or something.

                          1. 1

                            Great, now do ICE

                            1. 3

                              Great way to get Universal XSS against a whole browser instead of just a site

                              1. 1

                                For the 1000th time, RNGs aren’t crypto. Not even when they’re “hey look RC4 is broken but it works as a non-secure RNG.” Unless it’s a CSPRNG, it’s not crypto. Stop tagging them as crypto.

                                1. 2

                                  This is fantastic, but what’s with the comics? They didn’t relate to the content at all, as far as I could tell.

                                  1. 3

                                    It’s a New Yorker house style.

                                  1. 2

                                    Now you can automatically derive Chosen Ciphertext Attacks (such as padding oracles) from arbitrary functions https://eprint.iacr.org/2019/958

                                    1. 2

                                      decently fast non-cryptographic hash function

                                      Please stop posting these in crypto (not just you @zimpenfish)

                                      1. 2

                                        Argh, sorry. Noted for next time.

                                        1. 2

                                          No worries, thank you!

                                      1. 0

                                        I think Lea said it very well. Not really interested in hearing you whining about being mistreated after the credible accusations of sexual assault and harassment. Flag as off-topic because this isn’t technical, and it’s not “culture” either, it’s just you @nadim

                                        1. 0

                                          Hi Max,

                                          I received an email a few minutes ago notifying me that you had tagged me in this comment.

                                          I don’t think we’ve ever met, but I see that you’re one of Matt Green’s PhD students and are thus active in the field, and I wanted to respond to your comment which appears to imply that I deserve the treatment described in my post because I have, according to you, likely committed serious crimes which people have accused me of on Twitter.

                                          I have two things to say:

                                          1. I understand that you think that my blog post is “whining”. I would disagree. I think that, as an aspiring academic, you should recognize that using someone’s work and soliciting for their feedback over a period of an entire week, in over a hundred messages and in two conference calls, while promising them citations that fail to materialize, isn’t exactly something I would describe as whining; it’s actually calling out plagiarism. And pointing out plagiarists does seem to be in the community interest, especially when they (or their students) resort to ad-hominem attacks in response to the calls for proper citation. Your own thesis advisor, Matt Green, is a co-author with Lea Kissner on the Zoom paper, and so I would also wonder whether there is a conflict of interest materializing when one of his students appears to further insinuate that I have committed crimes when I point out the act of plagiarism and supplement it with evidence. If what you’re saying here is that some people deserve to be plagiarized because of Twitter rumors about them, well, that’s not something I can really come to grips with.

                                          2. If you are interested in what I have to say regarding the tweets that you’re referring to, I wrote a detailed response here that you can read if you wish. In that response, I address the tweets in detail.

                                          I don’t mind you flagging the post or not wanting to read it, but I would appreciate it if you could please consider the points I make above and try to understand why they could make your comment appear unkind at best. Thank you for reading, and all the best to you.

                                        1. 0

                                          The DevOps tag is to computer systems as the Culture tag is to lobste.rs

                                          1. 1

                                            This isn’t crypto, this is a fun toy Bruce Schneier decided to work on.

                                            1. 1

                                              You’re correct in that it doesn’t do encryption and decryption. It’s a random number generator for cryptographic tools, such as the master password encrypting your password manager, or for seeding a SoloKey.

                                              Also, Bruce was only an advisor on the project.

                                            1. 8

                                              UPDATE: paper is possibly being withdrawn due to an error, sounds like in Theorem 1 on page 7.

                                              1. 4

                                                Withdrawl is now on arXiv: “Paper is withdrawn because a counterexample was found to Theorem 1”.

                                                1. 1

                                                  PDF is not on arXiv since it’s been withdrawn. Anyone still have it? Or (inclusive or) details on the counterexample?

                                                  1. 4

                                                    You can access previous versions on arXiv. Try https://arxiv.org/abs/2008.00601v1.

                                              1. 1

                                                Probably mostly useful for CTFs. Fun tool, thanks!

                                                1. 1

                                                  This breaks the security of common blind signature schemes, which is surprising and impactful. The security assumption involved (ROS) seems to have been cooked up for the scheme in question, which isn’t totally invalid but (clearly) has risks.

                                                  1. 12

                                                    Post quantum cryptography I know even less than Jon Snow. Can’t help you, sorry.

                                                    PQC is also not magic. We achieve this by making algorithms which rely on primitives that aren’t broken by known quantum algorithms. For example, Pete Shor’s algorithm factors numbers and can be applied to elliptic curve point multiplications as well, so RSA and ECC are out.

                                                    However, the best we have for e.g. hashes would be Grover’s algorithm, which (very roughly) makes search problems more efficient, and so might reduce work from exponential to the square root of that exponential. So as long as we have large hashes (256 bits -> 2^256 -> sqrt = 128 bits of security) our constructions can be secure. Lamport signatures, for example, are based on hash functions.

                                                    1. 6

                                                      PQC is also not magic.

                                                      I trust it’s not. It’s just that I only know “Lattices have promises, but the literature doesn’t look stable”, and “Hash based algorithms work well, but they’re slow, and key/signatures are big”. And even then I’m not sure. I figured a humorous quip would be better than ignoring the subject altogether (which at worst could be misleading).