u/bitwiseshiftleft

It depends on the state, but IIUC most US neighborhood streets have speed limits around 25-30 mph (which is still pretty high!). But bigger roads that collect traffic from the neighborhoods, and so pass through them, sometimes have higher speed limits.

In this case, if I’m mapping correctly, most of Norpoint Way is a residential artery with a speed limit of 30 mph, but the speed cameras are on a non-residential part of it where the speed limit is 40, and Marine Way also isn’t residential.

The outcome also depends on whether you completed Love and Fear first, I think. And also on whom you accuse, in addition to the evidence used.

If your ECDSA public key is an elliptic curve point P=xG where the scalar x is a 256-bit number with the MSB (bit 255) set, then Q := P - 2^255 G would correspond to the same private key but with the top bit clear. So the proposal only hurts security, by giving the attacker something one bit shorter to attack even if the private key was generated well.

Curve25519 sets a fixed top bit (bit 254) for a different reason: because of a hope that this makes the scalar multiplication easier to compute in ways that don’t leak through side-channels (this isn’t actually needed vs timing attacks for the reference way to do the calculation in software, but it can help slightly vs hardware attacks), and/or harder to compute in ways that do leak (developers can’t save ~0.4% of the runtime by scanning for the MSB, which would leak its position).

Also, fixing that bit doesn’t cost any security for Curve25519, because only the x-coordinate of the public key is revealed which collapses two points (P and -P) to one x-coordinate. Almost always, one of these points has bit 254 set on the corresponding private key and the other doesn’t.

Don’t make all those machines by hand! Build a section of the factory to make the machines for you (a “mall”). An assembler making mining drills, an assembler making yellow inserters, another one making red inserters etc. Put them into chests limited to eg one slot so you don’t come back to 2000 assembly machines (having used up all those resources in the meantime). Leave space for the mall to grow as the factory grows.

It means just the portion of the 17ms budget which is used for unit calculations, as indicated by the debug menu.

Always the critical question with formal: what did you verify and how? Say you have some code (in this case in Rust) that will be compiled and run on various machines and OS’s, interacting with users and remote devices and whatever.

Then you have some Lean code (or Roq or HOL or whatever) that proves a statement. How does that statement relate to your Rust code? It probably includes some model of what your Rust code is supposed to do. How was that model produced? How accurate is it? What does the Lean code claim about the model of your code? What assumptions did the Lean proofs use?

Could also be unrelated to cryptanalysis. I’m not at a computer so I haven’t checked but an obvious guess is they filtered for positive trace, to avoid the P160 situation where private keys and ECDSA scalars in sigs are 161 bits long. (Wouldn’t be a problem for p256 in any case, but it likely would for the other ones.)

Edit: per Filippo’s writeup, it’s looks like they did reject curves where the order would be longer than the field, but one of the selected curves does have negative trace. So it’s not exactly that, there’s another criterion (or bug, or race, or arbitrary choice, or …)

To be clear, a typical plane flight would emit much less than 400t CO2, though an A380 at maximum range would emit more (total, not per passenger, and they can carry 500+ people), plus a little extra warming on top for the contrails.

It’s just that there are a lot more plane flights than rocket launches.

Yeah, intelligence community deception is another topic.

> It's hard to believe, that there's no other quantum algorithm out there, which can improve (perhaps per cryptographic algorithm instance) bruteforce. And IMHO it will be even harder to proof that there are no possibilities at all.

Oh, there will surely be new quantum algorithms that break things. They just won’t be Grover’s algorithm. Well, I mean Lov Grover is still alive as far as I know, so he could invent some amazing new algorithm, but they won’t be that Grover’s Algorithm.

We can’t yet prove whether P=NP, or NP in BQP or whatever. We can’t prove that time travel is impossible either. So we don’t know whether better generic white-box attack algorithms can exist (white-box meaning per algorithm instance), or attacks that break out of our current understanding of quantum physics or quantum computation. But we do have bounds on quantum black-box algorithms like Grover, from relatively mild assumptions.

Quantum cryptanalysis should surely receive more research. It’s just really hard, especially as we lack large quantum computers to test on. Chances of a quantum attack on lattices or whatever aren’t negligible … in fact you can see there is Daniel Simon’s proposed quantum attack on LWE being discussed on the qcryptanalyis discord. The community is skeptical that this particular attack works, so don’t panic, but there could always be a better quantum (or classical!) attack on whatever system. (Some folks even have a theorem that’s supposed to show that Simon’s proposed attack doesn’t work. That theorem is even formalized in Lean, but of course it could still be proving the wrong thing, or there could be a bug in Lean.)

But Grover itself cannot get more than a small factor more efficient than it is, not without major changes that would make it “not really Grover anymore”. There are theorems that a black-box generic quantum attack (which Grover is) cannot speed things up by more than something like 4*depth. To get a bigger speedup you need an algorithm specific to the thing you’re breaking, or for the models where those theorems were proved to be badly wrong (eg some kind of P=NP type result, or QM doesn’t describe the real world’s physics).

> Still.. saying McEliece is quasi-broken, but grover-does-not-matter.. seems to me from the sidelines as one of those double-standards.Still.. saying McEliece is quasi-broken, but grover-does-not-matter.. seems to me from the sidelines as one of those double-standards.

I'm really not sure what you mean by this. Could you expand? What are the two standards? Who is saying that "Grover does not matter" and in what context?

I sometimes say things in the direction of "Grover does not matter", but it's more specifically that:

• If you're counting only bitops, Grover square-roots the difficulty, so would e.g. break AES-256 using ~2^128 AES calls, but if you constrain also how long the attack is allowed to take (to e.g. 1000 years, but as parallel as the attacker wants; more academically you'd limit the depth of the circuit) then the speedup is much less — say 2^50 or 2^60. A model with limited depth is more realistic. The smaller speedup might still be an academic break of AES, except that we already knew about Grover (it's from 1996) so it's priced in, so to speak. It's part of why you'd use AES-256 in the first place, in addition to extra security margin and resistance to multi-target attacks.
• Early quantum computers will probably have many orders of magnitude of overhead vs classical ones, which means that practically Grover probably won't provide any gains for at least a decade.

Edited to add: DJB has made a lot of hay about the GIJS estimates undercounting the realistic cost, e.g. counting only bitops and not memory. So that would be a double standard ... except that counting memory it still knocks well over 100 bits off the security estimates for the highest parameters.

> Then in that regard, grover DOES matter, once quantum computers are there ...

Grover is part of the model, even though it will not be a practical attack in the near future. The 256-bit security targets are usually set (including eg NIST) at "allows no classical or quantum attack better than brute force on 256-bit symmetric ciphers such as AES, where Grover counts as quantum brute force".

> IMHO there's a double standard at play.

DJB certainly argues that, and he's partly right in that eg Kyber's security is now also probably slightly below the NIST target, due to steady improvements in lattice cryptanalysis, but people usually don't say "Kyber is broken". (This is why most folks deploying Kyber are deploying Kyber-768 or 1024, and DJB's campaign against Kyber contributed to that.) But Kyber also didn't lose roughly 150 bits of estimated security in a couple weeks. When something similar happened to HAWK, the authors withdrew it from the standardization process.

And it really is a serious problem for Classic McEliece: almost nobody wants multi-hundred-kilobyte public keys even if the ciphertexts are only ~100 bytes. But some people deployed it, or considered deploying it, mostly because of the nearly-50-year track record of no major progress in attacking it. Now we will need new parameters, even bigger keys and ciphertexts (not by a huge factor but the keys were already big), the track record is no longer stellar, and the lead author has reacted not by trying to navigate a transition or patch up security or pin down costs and bounds for the new attacks, but by spreading FUD across mailing lists and discord. So while the scheme might still be secure with bigger parameters, the trust factor isn't there anymore, and it'll be hard to get it back.

> You really say no Classic McEliece is “broken”?

It depends on what you mean by “Classic McEliece” and “broken”. All the standardized Classic McEliece parameter sets had their estimated security drastically lowered by the new GIJS attack, the biggest ones by well over 100 bits even with a reasonable model of memory costing. That’s definitely “academically broken” but that attack is too slow to run in practice without additional improvement, possibly even for nation-states, so it’s not “practically broken”.

One could come up with new parameter sets that resist the GIJS attack, and standardize and implement them, and maybe they would hold up to further analysis? Or maybe not. But since that hasn’t happened yet, it doesn’t make sense to deploy Classic McEliece right now.

It’s less important in vanilla / SA than in some other mods like SE or maybe Py. In SE there are lots of things that can trip your power offline, and offshore pumps need electricity to run unlike in vanilla, and you might be off-world like in SA, so you really want a backup power source specifically for the main generator.

In Py the main power plant might use a lot of power itself (especially if it’s eg fusion) or might use some complex resources from your base, so it’s nice to have extra-reliable backup plants. And there are a lot of ways that your base can spiral into a shutdown so it’s nice if your power won’t also go completely offline if that happens. But you won’t be off-world (until PySex anyway!) so it’s easier to jumpstart something yourself.

In Yahtzee you get to reroll some of the dice though. Getting a Yahtzee on the first roll is uncommon.

I’ll give a different justification from OP’s answer for a similar change: the experience of Space Exploration (SE).

SE penalizes you for the number of tiles on your ship. This led to people making a lot of unnatural-looking ships with “speed holes“ cut into them to reduce the tile count. Cutting speed holes in ships was not considered immersive or a fun puzzle, but instead a wart on the mod. In SE you stand in the ship and move around in it, and cramming things in and speed holes both interfere with that, but either way it rewarded an optimization that wasn’t especially well-liked. So Earandel changed it to not count some fraction of empty tiles.

In SE, speed holes are also more annoying because you can cut holes in the ship (with mines, unless they patched this) but it’s fiddly and not an intended mechanic. So optimizing the exact locations of holes is even worse.

I haven’t played the new patch but if it turns out that in SE (edit: SA) the fastest ships require a huge amount of fiddling with red inserters over gaps, land mines and other forms of speed holes, then reducing platform weight or making some platform not count might improve things.

The eyeglasses thing is beryl, a mineral which contains beryllium. You still really don’t want to breath its dust, but it’s probably not as dangerous as the pure metal.

Right but I mean that the last splitter looks like it’s cutting things down from 2/3 of a red belt to 1/3. So you might be able to just skip it, and the splitter it feeds into, if you use yellow belts.

Very cool. Can you simplify it slightly by doing 2/3 of a yellow belt, or maybe by taking a different 1/3 of the output? (Eg the 1/3 that’s already split from the feedback in the 1:3 splitter?)

No, no way, not at all, not even close. A close friend of mine works on basically exactly this, so let me try to give you a sense of the problem.

Imagine the connectome as a circuit diagram, but each part in the diagram is either a transistor (of some polarity), inductor (of some value), capacitor, diode, sensor… or, because this is biology, some combination of all of the above. You’ve tried to categorize each part but it’s a rough guess and you don’t know the values. There are 139000 parts but they’re not 2-pin SMT: each part is connected to 80 others through a network whose resistance/inductance/capacitance is also not accurately known, and is critical to what the whole circuit does. IIRC in insect brains the connections can be bidirectional too. Since everything is so densely connected, you can’t pick out most modules, and the way most modules work is probably as some fine-tuned filter or resonator where the exact values of everything are critical to its function … but we don’t know that for sure, because we don’t know what the modules are or how they work, because we can’t accurately simulate almost any of them. If you just plug in whatever values and simulate, you get complete garbage: parts of the brain lock up, parts oscillate wildly, its nothing like a functioning brain.

A couple of the modules are partly worked out, eg the compass, and can be simulated semi-convincingly in some cases, but basically only when the module boundaries are clearly defined. The simulations are only semi-convincing because the exact behavior of the neurons and the exact connection types/strengths are not known, but in some cases you can kind of guess the rough behavior (eg it’s a ring attractor) and plugging in reasonable values will produce reasonable behavior because ring attractors are pretty robust.

We don’t even know how C Elegans works and it only has 302 neurons (depends on sex, but the connectome of adult hermaphrodite C Elegans is always the same). C Elegans is a little trickier because it’s harder to experiment on than a fly brain — IIUC basically they pop if you put probes in them — but still.

A friend of mine did basically this a few years before. She made a simple, low-cost Braille printer as a school project, and then made a startup to productize it.

The problem is that the market is tiny. Only 10% of American blind people even use Braille, because for most types of information there is now audio assistive tech. So your market is a few blind people who want to print labels or reminders, and a few businesses or social services that work with enough blind people who actually use Braille to want one. Then your Braille printer only prints on one type of thing (paper, plastic, embossed labels, whatever) which further reduces its market.

So you just aren’t going to sell that many printers, and once you account for your R&D, manufacturing in probably China, QA, shipping, marketing, payment processing etc it’s going to cost $1500 anyway.

So I’m not surprised that Braigo, despite sounding promising in the article, never actually shipped.

Would it though? I don’t think lattice or Bleichenbacher attacks can scale down to that small a bias. Edited to add: At a few hundred thousand tries, you might never get 0 just by luck, so it can’t leak that much info.

IIRC the original Ivy Bridge RDRAND can't generate a 0 either ... as a 64-bit number. (It used zero to signal an error.) Which is not quite as specified, but it's probably fine. On a 16-bit number ... yeah that's not great. I dunno why you'd use 16-bit RDRAND for cryptography, so hopefully doesn't hose cryptographic uses, but 1/2^16 is an easily detectable bias.

OP is saying they’re already producing fish in order to get fish oil, so some of the fish could be diverted to make turbines.

Also IIRC some decks with Goyf ran cards like Tarfire, so you could turn 1 fetch, Tarfire the bird; turn 2: 4/5 Goyf.