Does git actually verify hashes? What I mean is: if I use the “git” CLI to modify old commits then it will recompute the correct SHA1 and update everything. But if I just go and hack the data files directly and leave the hashes unchanged, will anything notice?
Neil Madden
- 876 Followers
- 353 Following
- 1.8K Posts
Author: API Security in Action (Manning), CVE-2022-21449. I'm on smoko so leave me alone.
“The future is already here – it's just not evenly distributed. Like butter scraped over too much bread.”
— William J.R.R. Gibson
— William J.R.R. Gibson
I got around to following the process and submitting feedback on JEP-524 (Java PEM support):
https://mail.openjdk.org/archives/list/[email protected]/thread/5XHYOLL4QMSNISXBE5DQAKD2NY3ARQNM/
Also, “key rotation” is a terrible term for changing a key given that you rotate a physical key to lock/unlock, not to change the lock. As a discipline, we commit so many crimes with our analogies...
#cryptography nerds: what would you call the analogous property to forward secrecy in a protocol that only does authentication (so no secrecy)?
For example, let’s suppose I send a stream of audit log messages signed in batches with an EdDSA key. I could rotate that key after every batch, (including the next PK in the previous signed batch). Thus a compromise of the signing key at time t allows forging future records but not altering prior records.
NIST calls this “backtracking resistance” in the context of DRBGs, which could work as a generic term. Is there any other term in wide use?
Someone should really start an Organic Software movement - made by humans, for humans.
I really should start giving official feedback to Java preview features:
https://lobste.rs/s/ywrcll/java_26_is_here_with_it_solid_foundation#c_sh2qyv
Maybe version ranges are a good idea after all?
One of the most important lessons I’ve learned in security, is that it’s always better to push security problems back to the source as much as possible. For example, a small number of experts (hopefully) make cryptography libraries, so it’s generally better if they put in checks to prevent things like invalid curve attacks rather than leaving that up to applications…
http://neilmadden.blog/2026/03/19/maybe-version-ranges-are-a-good-idea-after-all/
RE: https://mean.engineer/@indutny/116245283352156779
All this to support virtual filesystems in node.js, a feature Tcl/Tk had in 2002. No wonder people resort to LLMs given how basic most programming languages still are.
(It irks me that Tcl was largely abandoned in the name of safety and performance, and yet we replaced it with bloated JS frameworks that have neither and don't do half the things that a <1MB libtcl.so did 2 decades ago).