Valerie Aurora

I don't think that comparison is quite right: ten years ago we already had two of Xiaoyun Wang's attacks which significantly reduced the work factor to break SHA-1. They were already cited at the time as reasons to move away from the algorithm (and I doubt we'd be able to do the 2⁸⁰ work needed to get a collision without cryptanalytic research! — notably the successful Stevens attack today reported performing a total of 2⁶³ hash operations while claiming to be "one of the largest computations ever completed").

There's also important concern about SHA-512 (which has led to SHA-3 and other options), but I'm not sure it can be put in the same category; at least all of the best attacks today are significantly reduced-round.

https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_validation

By contrast, Wang's original attack (which we had more than 10 years ago) achieved a 2¹¹ speedup for collisions against full SHA-1 and her second attack later the same year achieved 2¹⁷ speedup.

Evidently the speedup for the final version of Stevens's attack (which worked) was also around 2¹⁷. By contrast, a Moore's law improvement over 10 years would only be expected to make computers around 2⁶ times faster! (At the risk of mixed or mangled metaphors, we might say that mathematical insight during the time period you mention has been about 2¹¹ times more useful for attacking SHA-1 than computer power increases.)

Edit: someone else linked to Valerie Aurora's chart, which I'd forgotten about,…

Sure you can take part in them, but if you go to an invitation-only private party at 2 AM held at a separate hotel that less than 1% of the conference can actually get into and is thrown for the sole purpose of getting people drunk and doing inappropriate things, you shouldn't be surprised if there is some random inappropriate behavior, that's kind of the point.

And just to be clear, this is not gender specific harassment, as a male I would have preferred not to have experienced any of the following:

* Random drunk guy at a party suggesting that everyone sitting around a table playing black-jack instead play strip-poker, and being ignored until he tried to lean against a lamp and fell over with it.

* Naked people jumping into a pool, splashing me, and attempting to start a minor orgy.

* Walking into a room at a party where 2 guys and a girl were laying on a bed giggling at male/female pornography.

* Being groped by random men and women who half the time weren't actually trying to molest me, they were just too drunk to stand up straight.

* Having random women suggest that I should ask to see their breasts.

* etc.

But in the end, it doesn't really bother me, and I'm glad that those people had a chance to cut loose and get crazy. I've been to Las Vegas 20 to 30 times, and I've experienced far more inappropriate behavior outside of DEFCON than I have at the convention.

I was at a dozen or so different parties over 5 nights, and excepting a few of the small room parties,…

Val Aurora (and Matthew Garrett) are also involved in some kind of Shun Project against Ted T'so, as best as I can tell it's because of the savage crime on his part of saying that it's possible that some forms of sexual assault and rape are worse than others (e.g. being touched while drunk vs. being violently gang-raped in a bus). One of Ted's actual examples was that of two extremely drunk individuals, where he asked that if a drunk female does not have the mental ability to knowingly consent, does the drunk male have the mental ability to knowingly rape the female? And how do we know who raped who? [1]. He goes further into territory I don't personally agree with (talking about shifting some responsibility onto a party that has been drinking) but even there that's at least consistent with the treatment of other situations involving consumption of alcohol.

While it's probably insensitive to talk about like that, I'm even more scared of those who try to turn policy and ethics debates like that into "my way or the highway" topics by turning every opposing viewpoint into thoughtcrime.

Certainly sexual assault of any type should not be tolerated, but should a conference organizer report all types of sexual assault that occur at a conference only as a flat "rape", or is it OK to split into further categories? And how can you sanely debate policy at all when you will simply be silenced if your opinion does not conform?

More…

This person meant to insult me. There is really no positive spin you can make on that comment. I didn't bring up feminism, nor did I make anything like a claim that men and women are biologically identical. He made up some things, and then he painted me as a member of some bizarre cult. If he revisits this thread, it will likely be to insult me again. Perhaps he will not. That would be nice.

And you may not have meant your comment here to be dismissive and condescending, but you are basically telling me that this is all in my head, and I should be quiet. I counter that I am far from the only woman with this opinion, and you have not paid close attention (because why would you? you aren't a woman, this doesn't generally affect you).

In any case, this is not the place to debate that topic. I spoke up, and I got insulted for it, but it's all good. If you are truly interested in learning more, please refer to the following links, and feel free to contact me by email if you have questions. Otherwise, enjoy your day.

Recent issue at a Rails conference:
http://www.ultrasaurus.com/sarahblog/2009/04/gender-and-sex-at-gogaruco/

A PDF of slides about women in FOSS you may find interesting: http://valerieaurora.org/review/flosspols.pdf

My summary:

1. They believe there will be a shift back to on-prem, due to cost, improved security & latency.

2. They can take commodity hardware designs ( Open Compute Project ) and add their own software for manageability.

3. They are big on values, because in the past Bryan got a bit of a rep for being a bit hard to work with.
( eg https://blog.valerieaurora.org/2016/10/22/why-i-wont-be-attending-systems-we-love/ )

1. I'm seeing this in big companies - cloud can be an expensive option if you are generating your own data on-prem. While the economics might change, security and latency issues won't so easily. Also cloud is a big risk in that realistically what is your migration cost to another provider? If that's high, that's how much your cloud vendor can gouge you before you move ( I like to call that the Oracle business model ).

2. Don't know about the hardware, but those guys have a track record on systems software and Bryan was involved in building similar stuff before in the storage space ( http://www.oracle.com/us/products/servers-storage/zfs-storage-family-ds-173093.pdf )

3. He is definitely older, perhaps he is wiser.

As a founder, and therefore Mr Cost Control, I hope you never, ever read http://valerieaurora.org/howto_salary/. :)

Here's Val Aurora's "short version", but you should really read the whole thing;

1. Negotiate! It will almost never hurt you, and almost always help. Screw up your courage and just do it!

2. Do your research - know what you are worth. Ask for advice from knowledgeable, well-compensated people with more skill and experience than you.

3. Never ever give the first figure for salary - make the person hiring say a number first, even if they ask, repeatedly. Never ever ever! If there's a form, don't fill in the "Salary" blanks. Just don't do it.

4. Always act slightly disappointed, no matter what the job offer is. Ask for time to think about it (i.e., plan your strategy) before getting back to them.