# rdist Embedded security, cryptography, software protection This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Returning to Writing About Cryptography, Embedded Systems, and Security DevFeed: [Returning to Writing About Cryptography, Embedded Systems, and Security]() Original publisher: [Read original article]() Author: Nate Lawson Published: 2022-11-17T20:59:04Z Content type: opinion Language: en Sources: [rdist]() Topics: [Cryptography](), [Security](), [Embedded Systems]() Tags: [cryptography](), [embedded](), [security](), [systems]() ### AI overview The author announces a return to writing about cryptography, embedded systems, and security. The article also highlights a podcast discussion covering past projects and changes in these fields over 25 years. ### Source excerpt I've recently had some time to catch up on reading and research. I've decided to start writing again here about cryptography, embedded systems, and security. Recently, I enjoyed being on the "Security, Cryptography, Whatever" podcast. I got a chance to cover some past projects and how the fields of cryptography and security have changed over ... Continue reading Rebooting ## Evaluating Technology Regressions and Historical Alternatives DevFeed: [Evaluating Technology Regressions and Historical Alternatives]() Original publisher: [Read original article]() Author: Nate Lawson Published: 2014-12-01T12:00:32Z Content type: opinion Language: en Sources: [rdist]() Topics: [Software](), [systems](), [data](), [mac os](), [Unix](), [cpu]() Tags: [analysis](), [architecture](), [history](), [security](), [software](), [system-design](), [systems](), [technology]() ### AI overview The article argues for evaluating technology by examining both its benefits and its regressions rather than treating progress as simply good or bad. It uses the microwave oven and software design as examples, and advocates teaching critical analysis of historical choices in software and system design. ### Source excerpt Here we go again -- another article arguing whether the past was better or not (this one says "better"). These articles are tiresome, rehashing the debate whether technology is enabling or isolating and dehumanizing. But I'm interested in a different line of technology criticism: which parts of technology are a regression and what to do about ... Continue reading Was the past better than now? ## Thought experiment on protocols and noise DevFeed: [Thought experiment on protocols and noise]() Original publisher: [Read original article]() Author: Nate Lawson Published: 2014-11-04T18:42:52Z Content type: opinion Language: en Sources: [rdist]() Topics: [Security](), [Protocol (disambiguation)](), [sha-256](), [hash]() Tags: [crypto](), [hash](), [hmac](), [network](), [protocol](), [protocols](), [security](), [sha-256]() ### AI overview A security thought experiment examines how to respond when an HMAC does not verify, including whether comparing MAC differences could distinguish network noise from tampering. It questions the security risks of exposing error details or accepting messages with altered MAC bits. ### Source excerpt I hesitate to call this an interview question because I don't think on-the-spot puzzle solving equates to a good engineering hire. On the other hand, I try to explore some simple thought experiments with candidates that have a security background. One of these involves a protocol that has messages authenticated by an HMAC. There's a message ... Continue reading Thought experiment on protocols and noise ## Timing-safe memcmp and API parity DevFeed: [Timing-safe memcmp and API parity]() Original publisher: [Read original article]() Author: Nate Lawson Published: 2014-06-24T12:03:33Z Content type: opinion Language: en Sources: [rdist]() Topics: [API](), [C](), [Optimization](), [vulnerability](), [ordering]() Tags: [api](), [assembly](), [branch-prediction](), [c](), [cache](), [compiler](), [cpu](), [developers](), [optimization](), [ordering](), [performance](), [security](), [timing]() ### AI overview The article discusses OpenBSD's timing-safe bcmp and memcmp APIs. It supports simpler constant-time equality comparison but questions timing-safe ordered comparison because compiler and CPU behavior may undermine its guarantees and because ordering secret data can indicate larger architectural problems. ### Source excerpt OpenBSD released a new API with a timing-safe bcmp and memcmp. I strongly agree with their strategy of encouraging developers to adopt "safe" APIs, even at a slight performance loss. The strlcpy/strlcat family of functions they pioneered have been immensely helpful against overflows. Data-independent timing routines are extremely hard to get right, and the farther you are from ... Continue reading Timing-safe memcmp and API parity ## In Defense of JavaScript Crypto DevFeed: [In Defense of JavaScript Crypto]() Original publisher: [Read original article]() Author: Nate Lawson Published: 2014-06-23T12:05:28Z Content type: opinion Language: en Sources: [rdist]() Topics: [JavaScript](), [Security](), [Web](), [Encryption](), [SSL]() Tags: [browser](), [credit-card](), [encryption](), [google](), [javascript](), [race-condition](), [security](), [ssl]() ### AI overview This opinion argues that JavaScript cryptography in web pages remains difficult to implement safely. It discusses JavaScript's language-related problems for cryptographic code, limitations in proposed workarounds, and risks in using browser-side encryption to avoid PCI audit scope or reduce backend encryption. ### Source excerpt Thai Duong wrote a great post outlining why he likes JavaScript crypto, although it's not as strong a defense as you might guess from the title. While he makes some fair points of some limited applications of JavaScript, his post is actually a great argument against those pushing web page JS crypto. First, he starts off with ... Continue reading In Defense of JavaScript Crypto