Tony Arcieri

Time 2020-10-23 17:03:40

Web Name: Tony Arcieri

WebSite: http://tonyarcieri.com

ID:91870

Keywords:

Tony,Arcieri,

Description:

Tony Arcieri Tony Arcieri Hi there. These days I dabble in cryptography, but in the past made the Celluloid actor framework for Ruby and the Reia programming language Readthisfirst Rust 2020: towards a 1.0 crate ecosystem The Rust language itself went 1.0 in 2015. And yet, almost 5 years later, at least in my anecdotal assessment talking to and reading things written by current or potential users, there is still a sense that the language is still in some way unfinished and a bit rough around the edges.I sympathize with these concerns.There are various language-level issues which are partly to blame for this. The absence of a comprehensive story around asynchronous I/O and event-driven programs in general has been one of them, but that all changes… today… with the long awaited stabilization of async/await in the Rust 1.39 release along with the release of futures v0.3.0 earlier this week.There are other core features which many desire. In my Rust in 2019 blog post I wrote about const generics as the 1 in my top 3, along with async/await and Pin, which both shipped this year.Others long for even... Continue reading Jan 15, 2019 Rust in 2019: Security, Maturity, Stability I’ve been a day-to-day Rust user for nearly 5 years now. In that time I’ve perpetually felt like Rust is “the language that will be awesome tomorrow”. Rust has always felt like it had so much promise and potential, but if you actually sat down and tried to use it, the result was akin to trying to assemble a complex mechanism but you were always missing a few pieces. I managed to suffer through it in the long long ago of 2014, and each year it’s gotten better, until in 2018 I could confidently say “Now’s a great time to start learning Rust”. But how about actually writing a real-world Rust application and deploying it to production?2018 marked my second year as a full-time Rust developer, and I’m happy to say it’s the first year I shipped production Rust applications (not just one but three!), and added the startup I cofounded to the Friends of Rust (nee Production Users) page... Continue reading Jun 26, 2018 The Tether Conundrum Part 2: The Plot Thickens NOTE: For more background including a brief introduction to Tether itself, see part 1 of this series: The Tether Conundrum: A Quick Backstory. This post will largely assume you have read that first, or are at least familiar with the material it covers. Also thanks to Bitfinex'ed for surfacing much of the material covered in this post.There have been plenty of developments surrounding Tether in the months since I wrote the first post in this series in January:Tether’s previous “auditor” (who never completed an audit), Friedman LLP, removed all mentions of Tether from their web site. Shortly thereafter Tether would announce that they are dissolving their relationship with Friedman. Despite claims of “frequent professional audits” on their web site, to date Tether has never completed an audit.The US Commodity Futures Trading Commission (CFTC) sent subpoenas to Bitfinex and Tether... Continue reading Jan 19, 2018 The Tether Conundrum: A Quick Backstory NOTE: This post is fourth in a series I’ve written about Bitcoin, including The Death of Bitcoin, On the dangers of a blockchain monoculture, and A tale of two cryptocurrencies: Ethereum and Bitcoin’s ongoing challenges. I am a former HODLer, present nocoiner, and perpetual Bitcoin bear, so take that for what you will. Well, the nocoiner part is a bit of a lie: I have a JPCoin.Figure 1: If we correlate the declining murder rate with web browser usage, we can deduce that Internet Explorer was the major causal factor in homicide rates. Thank you Mozilla and Chrome Team, you are doing God’s work.Bitcoin has certainly been on a roller coaster ride over the past several months, with several people questioning “Bitcoin? Is it good? Should I buy it? The price keeps going up like magic and never crashes, at least for long anyway. Buy the dip, and HODL!”. Where Bitcoin bulls say it’s on... Continue reading Mar 28, 2017 It’s time for a memory safety intervention Memory safety won’t fix shell escaping bugs. Memory safety won’t fix logic bugs. Memory safety will not prevent an attacker who has obtained your HMAC key from forging a malicious credential that, when deserialized, can call arbitrary Ruby methods (yes, this was a real vulnerability in older versions of Rails). Memory safety will not prevent a federated identity system which uses XML-based credentials from accidentally running attacker controlled commands due to external entity processing (yes, this was a real vulnerability in certain implementations of SAML). A language which provides a memory safe model but binds to unsafe code is still vulnerable when calling into unsafe code.Nobody disputes these things. Now that we have that out of the way…Programming in C means you are using an unsafe memory model 100% of the time. It is the programming equivalent of trying to walk a... Continue reading Jan 14, 2017 Key rotation, user experience, and crypto reporting WhatsApp was the subject of a recent Guardian article making claims of a “backdoor” stemming from a “bug” in the way WhatsApp handles key rotations for users. The problem? WhatsApp will automatically transmit messages after the recipient’s key has changed without first asking the sender to confirm the new key is genuine.Far from being a “bug” or “backdoor” (a claim so wrong I am sure hoping the original author of the story Samuel Gibbs will issue a retraction), handling key rotation seamlessly is a difficult problem with a long-storied history, along with many attempts to surface such information to the user in order to ask them to make a security decision, such as in the SSH screenshot above.Clearly an in-person exchange of key fingerprints is the most secure option for establishing a secure channel, but is inconvenient, often impractical, and doesn’t provide a good means for... Continue reading

TAGS:Tony Arcieri 

<<< Thank you for your visit >>>

Tony Arcieri | Hi there. These days I dabble in cryptography, but in the past made the Celluloid actor framework for Ruby and the Reia programming language

Hot Websites