@cwebber To clarify, my second paragraph applies only to symmetric encryption.
You're absolutely not under-cautioning; I don't believe in such a thing in crypto. :) I was inquiring to see if multiple encryption was supported out of caution.
Certain ciphers have been weakened (or broken entirely), absolutely, which is what makes multiple encryption attractive. I didn't mean to suggest otherwise.
Thanks for your reply. I'm hoping to have the time to look into Spritely more deeply after LP2019.
Re: encryption "shelf life": would the URI scheme support multiple encryption?
Barring weaknesses in the actual ciphers (and the various other ways to undermine encryption), it's unlikely that data encrypted with modern ciphers at sufficient keysizes will ever be able to be decrypted without the key (Bremermann's limit, with the optimal brute-force post-quantum attack against symmetric ciphers being Grover's algorithm, which is mitigated by doubling the keysize).
So one option to mitigate the compromise of a cipher due to some sort of cryptanalytic attack is to use multiple ciphers, each with different keys.
Of course, if Alice is communicating an ephemeral symmetric key to Bob using a asymmetrically encrypted channel, the robustness of the symmetric algorithms won't matter much if attacker that can monitor network traffic between Alice or Bob may be able to decrypt that key exhcnage in the future. But that exchange could take place over a more trusted connection that is not available to the public, unlike the e.g. IPFS-stored encrypted messages themselves (though it may still be available to e.g. the NSA/GHCQ/etc). So there is still value in hardening the symmetrically encrypted message as much as Alice and Bob desire based on their threat model.
I feel like most times I respond to something on HN it's because I don't give myself a cooldown period. Unfortunately, things on HN don't last long on the front page, so it incentivizes haste replies, or else people will never see the thread again. And that reduces discussion quality. I'm not pleased with the tone of my reply.
@fixato Thank you for taking the time to tell me and take those screenshots.
I did neglect trying to restyle cgit a little bit while working on my site's mobile layout, but I didn't realize it was this bad. I'll play around with it a bit. Thanks again for the bug report. :)
@cwebber I've been trying to explore hacking as a form of relaxation too by forcing myself to work on very small things (because "relaxing" on a larger project turns into sleepless nights). I'd be curious to know how you approach it and prevent yourself from getting too serious and re-stressed.
I recently set myself up a repository to try to encourage myself to do just that (https://mikegerwitz.com/projects/night/about/), though I haven't had too much time for it yet. Though it did have an unexpected consequence: one of the things I did was write a sed script to make little balls move and fall around a barely-interactive ASCII map, and my kids fell in love with it.
I'm encouraged by this. Let's see more of this nationwide.
> Lawmakers nationwide would be wise to follow Illinois’ lead and ensure that people throughout the country have a way to defend against surreptitious or misleading uses of their biometrics and other private and sensitive data.
@asic It has been at least in recent years (I haven't checked all past years), but I mention it anyway because, if I'm trying to get new people to attend, I don't expect that they'd know that.
To subscribe to a Google Groups mailing list without having to run non-free JS or have a Google account, send an email to:
<group-name>+subscribe@googlegroups.com
That seems to have worked, but we'll see if I actually start getting messages.
After @cwebber's talk about Guile and Racket in which he mentioned a mailing list, I figured I'll start lurking on racket-{users,dev}. I was disappointed to learn both of them use Google Groups. I still don't know how to browse group archives without JS; if anyone knows, lmk. Otherwise I won't ever be able to send anyone links to such conversations (I can send message-id, but users would need to have copies in their own mailbox to avoid having to run non-free JS).
@cwebber I enjoyed the candidness of your talk. I've been watching curiously for some time as you explore Racket, so it's nice to see a summary of your perspective now that you've worked with Racket for some time.
Guile's shortcomings aren't secret (and may not matter to many people---we know how that goes with smaller hacker communities). But they aren't often laid bare, and you've provoked some interesting conversation that I think we'll only benefit from. And you've balanced that with the very positive work that's being done with Guile.
So good talk, and I'd be interested to pick your brain on certain things in the future.