Yeah, I think it's more of a British English thing. It can also mean things like "in a fight". Like: "those two guys had a big row outside the pub the other night"
Another vote for SynthRiders here. I have the same complaint about Beat Saber as OP. Can be done with wrist flicks and be lazy
Synth Riders forces you to have to move your body and do large sweeping motions, it feels like dancing, AND it has online multiplayer with voice chat which regularly has groups hanging out and playing for fun
That last part makes it so much more enjoyable for me
The main app powering coinbase.com, the “monorail”, is a Rails app backed by MongoDB. It’s typically what’s being referred to when breaking out microservices.
Historically most other services were Rails/Sinatra with Postgres. These days there’s a lot more Golang being used for new services.
There’s also some services that are serverless, using Lambda and DynamoDB but these are a minority.
Brian calls this out and describes how Coinbase plans to do this in the “This will require a huge shift in how we do things. How will we get there?“ section.
> To address all of these, we will form a cross-functional team to oversee this transition. This group will identify the changes we must make to become a remote-first company (e.g., around people management, recruiting/talent, culture and connection, and documentation and async work…), host open design sessions with all of you to surface ideas, considerations, dependencies, and concerns, and partner with internal experts to redesign how all of this works for a remote-first Coinbase.
It’s not assuming MITM or that the attacker can upload the signature to the site.
The attack is that the attacker can reuse the already uploaded signature in a way that allows them to get certificates issued under their account instead of the initial owner.
This blog is a little confusing about that since it does read like they are supposed to upload their own sig with the graphic used.
Matthew Green has a related post about this speaking to “multiple encryption” where people do the same thing with ciphers. [1]
A very generic take would be that depending on the system, it may be able to be done securely, but with all crypto there be dragons.
For example, let’s say you have two hashes H1 and H2 and want to use the double hash to prove existence of a file in history. Publish the hash to a blockchain or something.
So the file is hashed H1(H2(file)). In what ways could you break this if one of the hash functions is broken?
The first way is if you want to dispute the validity of what file was hashed. If we assume they later publish the file and you have a second-preimage attack on the hash.
You can create a different file where H2(file) = H2(newFile), and because H1 is deterministic, this second file verifies. It’s now no longer clear which is the true file. While a single hash function also fails under this attack, you increase your exposure to possible attacks by introducing a second one.
If you have control over the verification procedure you can imagine a similar attack with only a break in H2 by not even using H1 to generate the output.
I haven't implemented but like what it's going for. Modern crypto is all about making it easy to do the right thing without thinking about it and PASETO does that well with its versioning scheme and relying on established crypto from libsodium.
They have a bug bounty program that gives you permission to do certain kinds of things and it not be illegal since you’re planning to report anything you find (and get paid for it)
Thanks for the link! I went down a small rabbit hole from this which ended up with a script that allows for similar style workflows even within the GitHub PR world:
Yes, I’m saying that rather than needing an hour to get 6 blocks if the hash rate doubled, you’d only need 30 mins _until_ the adjustment occurs. Then it would be an hour again.
Yeah it’s sort of time based assuming consistent blocks, but it would still based on confs. If the hash rate doubled then one would only require 30 minutes until the difficulty adjustment kicked in.
The main purpose of my post is that to actually pull off a successful attack you probably need more than an hour, so the numbers are making it look like it’s cheaper than it would be in practice (ignoring other factors other commenters have shared about acquiring ASICS, data centers, and such).
You can’t 51% attack Bitcoin for $611K, but your site says you can. While the site can’t be perfect, it would be helpful to make it more realistic. If a news site picks this up and doesn’t understand the nuances they’ll accidentally spread FUD and mislead a lot of people.
It would be helpful to expand on how many blocks can be reversed given only one hour of hash rate.
Many wallets, exchanges, etc require a minimum number of confirmations before allowing you to spend the coins to handle reorgs that happen naturally.
For example, in Bitcoin this is often around 6. With 1hr of hash rate you might be able to get 7 blocks but likely you’ll actually need more time to get enough blocks or successfully attack. Accounting for this would increase the cost substantially.
It's not so much that miners would ignore empty transactions, it's that the spammer would need to pay the miner fee to get each transaction in the block which would end up being very expensive and unsustainable long term.
For the second idea, this wouldn't really work either. When each node receives a transaction it will validate it first before broadcasting it to other nodes, so it would be stopped from propagating through the network pretty quickly and no one would attempt to include it in a block and run do PoW work it which is the most time consuming part.
I suppose in theory if you had a large enough network and could target a ton of nodes individually you might be able to do some form of damage but that's likely a pretty impossible amount of power and similarly to the previous example you could maybe bloat it a bit but it would be very expensive to sustain an attack like this.
Tools like React Native and Electron are pretty popular these days to build cross-platform apps and such. Since you know web stuff and I'm assuming JS, those might be a good option to explore so you could maintain them without having to learn the entire toolchain of building for various platforms
Cool product. I've used calendars in the past to maintain this kind of thing but a product has many more features than a calendar so I'm into it.
A mobile app would definitely be nice for this kind of product at some point. Push notifications for reminders / an easy entry system, integration with contacts, calendar, etc.
Either way. Thanks for this cool product, and OSS-ing it.