Tim McLean

Cryptography, functional programming. Immutability enthusiast. @[email protected]

[Tim McLean @McLean0]

A beginner's guide to constant-time cryptography https://t.co/qMNUbQaFum

[Engineering at Meta @Meta_Engineers]

It's time to leave the 🕗 leap second behind. The leap second was first introduced in 1972, but it has outlived its usefulness.

Find out why engineers at Meta are supporting a larger community push to stop introducing any new leap seconds. https://t.co/HD9ICZAV0V

[Tim McLean @McLean0]

@MMurdock86 @keeferrourke @INTERAC Cloudflare is reporting zero traffic from the Rogers ASN:

https://t.co/7ad5JVX6cD

Compare with Bell and Telus:

https://t.co/M9ApPA75tG

https://t.co/CrPFjWJPPy

[Tim McLean @McLean0]

@MMurdock86 @keeferrourke @INTERAC Where are you getting this information? I haven't seen any reports of problems with other providers yet. Bell and Telus are both claiming on twitter that their networks are unaffected.

[Riccardo Paccagnella @ricpacca]

We found that, under certain circumstances, dynamic frequency scaling depends on the data being processed, enabling *frequency side channels*. The cause is that periodic frequency adjustments depend on the current CPU power consumption, which is data dependent.

[Riccardo Paccagnella @ricpacca]

We found a way to mount *remote timing* attacks on *constant-time* cryptographic code running on modern x86 processors. How is that possible? With #hertzbleed! Here is how it works (with @YingchenWang96).

https://t.co/SRUgBRQpu2

[Tim McLean @McLean0]

@eshear @patio11 Part of the answer here though is definitely "software has not yet fully eaten the mortgage industry". It will be easier to deviate from the standards once more of the underwriting and back office processes are automated.

[Tim McLean @McLean0]

@eshear @patio11 If your mortgage fits in one of the square boxes, then all of this is easy and standardized. Your mortgage will be easy to package up and sell (either to bank or MBS). If it doesn't, then everything gets more complicated, and many mortgage banks just don't want to bother.

[Tim McLean @McLean0]

@MrBeast *extremely fintwit voice*

the only real answer is to sell that 50% chance of $100k into an asset pool for $49k, to be packaged into a coin-flip-backed security and sold to investors

[Underfox @Underfox3]

Researchers have developed a new simulator to predict the throughput of basic blocks of all Intel Core μarchs released in the last decade, demonstrating to be more accurate than the predictions of state-of-the-art tools by more than an order of magnitude.

https://t.co/83UDBQSchX

[eevee 💨 @eevee]

github copilot has, by their own admission, been trained on mountains of gpl code, so i'm unclear on how it's not a form of laundering open source code into commercial works. the handwave of "it usually doesn't reproduce exact chunks" is not very satisfying

[Tim McLean @McLean0]

the metadata service already makes server-side request forgery way more valuable than it should be

[Tim McLean @McLean0]

ugh, we really should have a better solution than metadata servers for passing parameters to VMs https://t.co/TSW9JHRD2g

[Tim McLean @McLean0]

our continuing mission
https://t.co/KQhfzl0Nxz

[Tim McLean @McLean0]

@spudowiar @real_or_random @hdevalence my not-so-secret plan with rust-timing-shield is to keep talking about it in front of compiler people and hopefully eventually nerdsnipe one of them into adding proper LLVM support 😁

[Tim McLean @McLean0]

I just published rust-timing-shield v0.2.0. The crate still depends on the nightly version of @rustlang but now only uses the asm and min_specialization features, both of which seem to be on track for stabilization soon 🙌(I hope)
https://t.co/YO4M7x82nA

[Tim McLean @McLean0]

The optimization barrier now uses the new Rust asm macro syntax. I wrote some docs on how the optimization barrier is used inside rust-timing-shield to hide code from LLVM:
https://t.co/6ntKl41U4o

[Tim McLean @McLean0]

@dzhuvi if I remember correctly I actually checked that B64 code with an early version of rust-timing-shield just to be sure before translating it to Java :)

[Keegan Ryan @inf_0_]

Did https://t.co/moEj9l86Vf actually break RSA? Probably not, and here’s why. 1/n