Valerie Aurora

Please notice Valerie, she is absolutely brilliant. http://valerieaurora.org/ This is my personal favorite: http://valerieaurora.org/tcpip.html

> I love Bryan Cantrill for being that classy bad-ass engineer with so much integrity. I have never worked with Bryan. What's the general opinion about Valerie's statements about working with him. https://blog.valerieaurora.org/2016/10/22/why-i-wont-be-attending-syst… https://blog.valerieaurora.org/2018/07/01/bryan-cantrill-has-been-accu…

This is a topic I'm very interested in. I have a few links (no books sorry), and would be keen to talk to you if you're interested (email in bio). I have had fantastic success with negotiating benefits and extra pay, just the other week I received 4 weeks paid paternity leave up front on top of an already generous salary offer. It is a skill worth having Steli Efti negotiation course (requires email registration) : https://courses.close.io/ Our very own patio11 : https://www.kalzumeus.com/2012/01/23/salary-negotiation/ Valerie Aurora : http://valerieaurora.org/howto_salary/

There's another aspect, which is that some people find his aggressively dismissive style personally abusive and distressing. I don't know enough to validate this perspective, but it's something for all of us to consider: https://blog.valerieaurora.org/2016/10/22/why-i-wont-be-attending-syst…

http://valerieaurora.org/hash.html that's BS to think sha1 was the best hash you could pick in 2012

1. Glassdoor. 2. A good recruiter will be able to tell you, if you can find one. Can recommend one in Boston, but you need local knowledge. 3. Some general advice: http://valerieaurora.org/howto_salary/ and http://www.kalzumeus.com/2012/01/23/salary-negotiation/

Valerie Aurora has a nice post showing the lifetime of cryptographic hash functions. You can see them all following the same pattern over time. You don't want to be on the bleeding edge, but also should avoid the trailing edge. http://valerieaurora.org/hash.html

Probably referring to Valerie Aurora (formerly Henson) http://valerieaurora.org/ and this post - https://adainitiative.org/2012/08/defcon-why-conference-harassment-mat… and this one - https://lwn.net/Articles/417952/

As a founder, and therefore Mr Cost Control, I hope you never, ever read http://valerieaurora.org/howto_salary/. :) Here's Val Aurora's "short version", but you should really read the whole thing; 1. Negotiate! It will almost never hurt you, and almost always help. Screw up your courage and just do it! 2. Do your research - know what you are worth. Ask for advice from knowledgeable, well-compensated people with more skill and experience than you. 3. Never ever give the first figure for salary - make the person hiring say a number first, even if they ask, repeatedly. Never ever ever! If there's a form, don't fill in the "Salary" blanks. Just don't do it. 4. Always act slightly disappointed, no matter what the job offer is. Ask for time to think about it (i.e., plan your strategy) before getting back to them.

My summary: 1. They believe there will be a shift back to on-prem, due to cost, improved security & latency. 2. They can take commodity hardware designs ( Open Compute Project ) and add their own software for manageability. 3. They are big on values, because in the past Bryan got a bit of a rep for being a bit hard to work with. ( eg https://blog.valerieaurora.org/2016/10/22/why-i-wont-be-attending-syst… ) 1. I'm seeing this in big companies - cloud can be an expensive option if you are generating your own data on-prem. While the economics might change, security and latency issues won't so easily. Also cloud is a big risk in that realistically what is your migration cost to another provider? If that's high, that's how much your cloud vendor can gouge you before you move ( I like to call that the Oracle business model ). 2. Don't know about the hardware, but those guys have a track record on systems software and Bryan was involved in building similar stuff before in the storage space ( http://www.oracle.com/us/products/servers-storage/zfs-storage-family-d… ) 3. He is definitely older, perhaps he is wiser.

I don't think that comparison is quite right: ten years ago we already had two of Xiaoyun Wang's attacks which significantly reduced the work factor to break SHA-1. They were already cited at the time as reasons to move away from the algorithm (and I doubt we'd be able to do the 2⁸⁰ work needed to get a collision without cryptanalytic research! — notably the successful Stevens attack today reported performing a total of 2⁶³ hash operations while claiming to be "one of the largest computations ever completed"). There's also important concern about SHA-512 (which has led to SHA-3 and other options), but I'm not sure it can be put in the same category; at least all of the best attacks today are significantly reduced-round. https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_validation By contrast, Wang's original attack (which we had more than 10 years ago) achieved a 2¹¹ speedup for collisions against full SHA-1 and her second attack later the same year achieved 2¹⁷ speedup. Evidently the speedup for the final version of Stevens's attack (which worked) was also around 2¹⁷. By contrast, a Moore's law improvement over 10 years would only be expected to make computers around 2⁶ times faster! (At the risk of mixed or mangled metaphors, we might say that mathematical insight during the time period you mention has been about 2¹¹ times more useful for attacking SHA-1 than computer power increases.) Edit: someone else linked to Valerie Aurora's chart, which I'd forgotten about,…

Val Aurora (and Matthew Garrett) are also involved in some kind of Shun Project against Ted T'so, as best as I can tell it's because of the savage crime on his part of saying that it's possible that some forms of sexual assault and rape are worse than others (e.g. being touched while drunk vs. being violently gang-raped in a bus). One of Ted's actual examples was that of two extremely drunk individuals, where he asked that if a drunk female does not have the mental ability to knowingly consent, does the drunk male have the mental ability to knowingly rape the female? And how do we know who raped who? [1]. He goes further into territory I don't personally agree with (talking about shifting some responsibility onto a party that has been drinking) but even there that's at least consistent with the treatment of other situations involving consumption of alcohol. While it's probably insensitive to talk about like that, I'm even more scared of those who try to turn policy and ethics debates like that into "my way or the highway" topics by turning every opposing viewpoint into thoughtcrime. Certainly sexual assault of any type should not be tolerated, but should a conference organizer report all types of sexual assault that occur at a conference only as a flat "rape", or is it OK to split into further categories? And how can you sanely debate policy at all when you will simply be silenced if your opinion does not conform? More…

Sure you can take part in them, but if you go to an invitation-only private party at 2 AM held at a separate hotel that less than 1% of the conference can actually get into and is thrown for the sole purpose of getting people drunk and doing inappropriate things, you shouldn't be surprised if there is some random inappropriate behavior, that's kind of the point. And just to be clear, this is not gender specific harassment, as a male I would have preferred not to have experienced any of the following: * Random drunk guy at a party suggesting that everyone sitting around a table playing black-jack instead play strip-poker, and being ignored until he tried to lean against a lamp and fell over with it. * Naked people jumping into a pool, splashing me, and attempting to start a minor orgy. * Walking into a room at a party where 2 guys and a girl were laying on a bed giggling at male/female pornography. * Being groped by random men and women who half the time weren't actually trying to molest me, they were just too drunk to stand up straight. * Having random women suggest that I should ask to see their breasts. * etc. But in the end, it doesn't really bother me, and I'm glad that those people had a chance to cut loose and get crazy. I've been to Las Vegas 20 to 30 times, and I've experienced far more inappropriate behavior outside of DEFCON than I have at the convention. I was at a dozen or so different parties over 5 nights, and excepting a few of the small room parties,…

This person meant to insult me. There is really no positive spin you can make on that comment. I didn't bring up feminism, nor did I make anything like a claim that men and women are biologically identical. He made up some things, and then he painted me as a member of some bizarre cult. If he revisits this thread, it will likely be to insult me again. Perhaps he will not. That would be nice. And you may not have meant your comment here to be dismissive and condescending, but you are basically telling me that this is all in my head, and I should be quiet. I counter that I am far from the only woman with this opinion, and you have not paid close attention (because why would you? you aren't a woman, this doesn't generally affect you). In any case, this is not the place to debate that topic. I spoke up, and I got insulted for it, but it's all good. If you are truly interested in learning more, please refer to the following links, and feel free to contact me by email if you have questions. Otherwise, enjoy your day. Recent issue at a Rails conference: http://www.ultrasaurus.com/sarahblog/2009/04/gender-and-sex-at-gogaruc… A PDF of slides about women in FOSS you may find interesting: http://valerieaurora.org/review/flosspols.pdf

We will be able to crack today’s encryption algorithms in the future because we’ll find flaws in them. In other words, one day brute force won’t be necessary! Have a look at this post, which illustrates this reality being true for hash functions (where similar principles as symmetric and asymmetric encryption apply). https://valerieaurora.org/hash.html Notice Valerie specifically calls out, “Long semi-mathematical posts comparing the complexity of the attack to the number of protons in the universe”.

See also: "Lifetimes of cryptographic hash functions" - https://valerieaurora.org/hash.html MD5 appears to be firmly in the "fun party trick" stage.

> good randomness, few collisions on typical input data, and universal implementation The relevant standards body NIST has issued SHA-3 in 2015. Spread the word that programmers should not reach for outdated hash algos. <https://valerieaurora.org/hash.html>

Here’s a good post by a kernel hacker that suggests how a tool like this can aid in debugging subtle corruption: https://blog.valerieaurora.org/2008/02/17/howto-debug-silent-data-corr…

People are never just ONE type of awful. It's almost always a package deal. See also https://blog.valerieaurora.org/2017/07/18/the-al-capone-theory-of-sexu…

AES is one of the few that has a pretty good shot at it, yeah. SHA-2 has had its margin eroded significantly over the last 10 years. I'd feel nervous about using it in security-critical applications now, never mind 20 years down the line. ECB is insecure regardless of which cipher you use. There's no excuse for using it in production applications. http://valerieaurora.org/hash.html

My first thought on hearing this news was the famous essay "The Al Capone Theory of Sexual Harassment." https://blog.valerieaurora.org/2017/07/18/the-al-capone-theory-of-sexu… Basically it states that for a long time, sexual harassers were given a blind eye with excuses like "he's good for our bottom line." But it turns out this isn't true. It turns out people who act unethically in one way often act unethically in other ways, that (among other things) hurt the bottom line.

If this interests you, you should give her phd thesis a read. Easily one of the craziest kernels out there; a 1980s optimizing JIT kernel that goes to crazy lengths even when viewed against today. http://valerieaurora.org/synthesis/SynthesisOS/index.html

Another post on the lifetime of hash functions: http://valerieaurora.org/hash.html

Apparently this guy is a dick. https://blog.valerieaurora.org/2018/07/01/bryan-cantrill-has-been-accu… Also, why does he deserve a Wikipedia page? https://en.wikipedia.org/wiki/Bryan_Cantrill

The problem is that we don’t know whether our encryption is vulnerable to advanced attacks. Cryptographic hash functions actually have a useful lifespan based on the math and the cost of computing. The more time we spend analyzing the math, the more likely we are to find unexpected weaknesses. http://valerieaurora.org/hash.html

Well, there is Synthesis OS [1] where the kernel can rewrite itself on the fly to provide synthesized system calls (think of a specialized `read()` call that can return a file line-by-line for just a simple example). But even that is (was?) almost 30 years ago. [1] http://valerieaurora.org/synthesis/SynthesisOS/

Also: http://valerieaurora.org/synthesis/SynthesisOS/index.html

The comment to whitch Linus respond reports that there are 40 constants in many places in the git code. The bit size of a SHA1 hash is 160 bits which holds in 20 bytes. In hexadecimal, the length is 40chars. So the problem reported in the initial comment was the text length, not the bit length. Of course there is probably 20 hardcoded in many places too. So in this case the bit length is an issue too. You are right. Switching to base64 encoding would not solve the hardcoded bit length if any. Using file hashes as file identifier doesn't look like a good idea as suggested here https://valerieaurora.org/hash.html because hash lifetime are short. The system should support changing the hash every year. The work required to compute hashes increases too.

On a quick scroll of the comments, I haven't seen this posted so far: http://valerieaurora.org/hash.html We're at the "First collision found" stage, where the programmer reaction is "Gather around a co-worker's computer, comparing the colliding inputs and running the hash function on them", and the non-expert reaction is "Explain why a simple collision attack is still useless, it's really the second pre-image attack that counts".

Massalin's Synthesis was a research OS designed for low-latency media processing. It's been decades since I read the thesis, so don't trust me to summarize it, but I think it was something like: set up layers in kernel space, but collapse them with runtime code generation (fusing loops), keep switching overhead low instead of buffering a lot, and schedule with a phase-locked loop in software. http://valerieaurora.org/synthesis/SynthesisOS/ch1.html