Hacker Newsnew | past | comments | ask | show | jobs | submit | trusz's commentslogin

I always end back with monodraw. Other apps have too many features and style possibilities that you forget about the content. With monodraw I never get distracted.

However, it still has enough functionality that you can achieve a lot of things. One of my favorites are the anchors. I have even created a small demo/tutorial: https://tamasruss.com/articles/monodraw-anchors


Slightly ironic how you complain that other apps make you forget about content but fiddling with responsive separators and anchor points in monodraw is totally OK :) neat trick though


Haha, true. However, I think this one is less subjective. I just had to create it once then it works. With design, I always have the urge to change it after a week :D


That UML box of a class is really valueable. Great tutorial!


In Hungary we've learn about robot "jobs" in school. I am no expert but in serfdoms the peasants, who owned fields, had to work on the field of the lords for free. [1] I could only found the hungarian wiki page: https://hu.wikipedia.org/wiki/Igás_robot We have used the exact word "robot" in hungarian.

[1]: https://en.wikipedia.org/wiki/Serfdom


Not going to pretend that I know what the most of the stuff mean, or if it is even safe enough, but I've followed the MDN articles and put together this TypeScript snippet [1]. Maybe somebody could comment on it?

Also sorry for the long link. Is there any accepted way to post a shorted URL?

Edit: added a corrected version [2]

[1]: https://www.typescriptlang.org/play?#code/DYUwLgBAbiDGYHsBOE...

[2]: https://www.typescriptlang.org/play?#code/FAiGGcE8DsGMAIBmBX...


If you call "encrypt" more than once in that code, you'll leak the authentication key. Every invocation of GCM encryption needs a unique nonce. Cryptography nerds will chastise you for using a random nonce (there theoretically isn't enough room in the GCM nonce space to safely encrypt large numbers of message with random nonces), but the alternative (using a counter) is even more hazardous. This problem motivates a lot of people to use other AEADs like XChapoly, which has an extended nonce space that safely admits random nonces. Isn't cryptography fun?


It's still considered safe to call AES-GCM with a single key and a randomly generated nonce 2^32 times [1], most practical systems don't come anywhere near this limit. And there's AES-GCM-SIV that solves nonce reuse (mostly), though it's not available in the Web Cryptography API at the moment.

1: https://csrc.nist.gov/csrc/media/Projects/crypto-publication...


I don't personally care, and probably wouldn't even sev:info a random GCM nonce in an assessment, but I would also choose extended-nonce Chapoly in preference to GCM in part because of this issue.


From what I shallowly researched; GCM's nonce seems limited to 12 bytes by convention only. That nonce reuse is so fatal seems absurd to me.

Would "salting" the key safely tackle the problem?

Put explicitly;

  send <- nonce || salt || ciphertext
  recv -> decrypt(ciphertext, nonce, pbkdf(pass) || salt)
[edit: apply salt outside of the kdf]


As I remember it, the balance of the bytes in the AES block are used for the counter. At any rate, the convention is essentially universal.


Sounds above my (current) head.

Here I thought GCM was some modern foolproof/footgunless design.


It is sort of infamously footgunny.


Oh yes! Thank you for the feedback. I've added a new version where the `iv` and the `salt` is random. Maybe a followup question: Because you need both the `iv` and `salt` to decrypt the message is it ok in an E2E scenario to send all three: `iv`, `salt` and the encrypted message?


I didn't look to see what "salt" means in your design, but the idiom for using GCM in message encryption is to send ciphertexts that take the form `nonce || ciphertext`, and to decrypt by reading the nonce off the front of the message.


The Arc browser [1] could be nice alternative as it handles profiles pretty smooth.

[1]: https://arc.net/


This smells like pure marketing, incl the company's website. I'd rather use an open-source browser like Firefox.


This site basically says nothing except "sign up".


I have heard so much about this browser from dev & tech podcasts and websites[1]. Those who use it really love it, I wish their website had a video demo at least.

This landing page has some screenshots at least https://students.arc.net/

[1]https://www.theverge.com/23462235/arc-web-browser-review


Oh, that was not intentional. I've fixed it.


I have a small tutorial on how to create kind of responsive elements in Monodraw: https://trusz.github.io/posts/monodraw-tips-anchors/


Hi all!

We have a problem in our developer team, that the number of docker services are getting more and more and we could not remember all or new developers did not what and how to start.

So I've created a console app with console ui that we use know every day. I though maybe others have the same or similar problems.

The project is open source and constructive criticism is welcomed :)


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: