asciilifeform: mp_en_viaje: plox to gpg ssh key you want to use (or otherwise i'ma gen random pw and gpg to mp_en_viaje , and he can put in at leisure )

asciilifeform: diana_coman: atm plan is to properly handle all evacuations ( data, afaik, evacuated, BingoBoingo uploaded gpg'd backups, yours is afaik done but BingoBoingo forgot to send me login to fetch it before went to sleep ) ; after this, publication of cost for evacuations of irons ; after this , auctions of jettisoned irons, liquidation ; then to pay mp_en_viaje , he is owed ; then BingoBoingo returns output re cost of action vs latech ; t

asciilifeform: mod6: lemme know if you want that box of yours housed here, i'ma gpg the postage addr.

asciilifeform: aite, let's ask BingoBoingo to dd if=/dev/thatstick | gzip > diana_coman.img.gz and then gpg to asciilifeform . i'ma modify it strictly as required to sit down on new ip and naught else.

asciilifeform: diana_coman: if you'd like an exact image copy of your old rk, we can work with BingoBoingo , could gpg . otherwise will be 'virginal' as described in my 'gentoo for rk' cookbook.

asciilifeform: vtron imho also oughta go in. and gpg 1.4.10 .

asciilifeform: mp_en_viaje: if you told me he's the man who got o. j. simpson to walk from electric chair, i'd also believe. but gpg -- he had 0 idea about.

asciilifeform: http://logs.ericbenevides.com/log/trilema/2019-10-09#1943177 << the 'master attourney' who mp billed as 'will use gpg' but never heard of any such thing ? him ? yes i'ma pay what mp billed for this 'service' .

asciilifeform: aha ha. then trinque plox to gpg re where it wants to live.

asciilifeform: BingoBoingo: seems like the FGs will be going here, plox to obtain a suitable crate, i'ma gpg addr later today

asciilifeform: with the modest ram, not a rk competitor, but potentially useful for other applications ( has 3 serial ports, so can eat FG ) ; runs 'pogo'-style linux, so can stuff even classic gpg in ; can have nic plug attached, so potentially even host small net proggies ; pulls coupla milliwatt, so could work in radio relays or similar.

asciilifeform: i'm even surprised that gpg ate this

asciilifeform: (i.e. whatever one might plug 'battery gpg' into, could trivially extract privkey via timing side channel)

asciilifeform: diana_coman: whole story of how asciilifeform ended up with peh , if you recall, at one pt asciilifeform wanted to bake a battery-powered 'gpg replacement'. then went and saw what gpg actually consisted of, and found that not only koch liquishit, but broken on ~algo~ level

asciilifeform: as in, it gets auth turd from deedbot and you manually fed it to gpg ??

asciilifeform: (same thing we're doing to gpg's rfc2440 etc)

asciilifeform: ( 'build in' would require explicitly calling the keyboard, also, a la gpg, rather than 'pw from stdin', tape is already coming from stdin )

asciilifeform: e.g alternative of asciilifeform's 'here is my hash of mp's gpg-1.4.10' thing is fundamentally sinful , cuz not in fact vtronically contiguous w/ original

asciilifeform: http://btcbase.org/log/2019-06-22#1919166 << trinque sweated out a draft cuntoo, which sadly i have not had chance to test in anger. i have a physical box that is destined for it , when get chance, and also will be porting it to the sim-mips, ditto. but i promised to mircea_popescu not to undertake any elaborate works until ffa suitable for 'discard gpg' and extension to other (gossipd, trbi, what else is waiting on it) paths ☝︎

asciilifeform: ftr anyone who thinks 'i'ma use other people's tapes blindly' is gearing up for world of pain. peh is less an object like gpg and moar like surface-to-air rocket, reqs some basic grasp of what yer doing

asciilifeform: mp_en_viaje: re gpg, seems like he reimplemented the mechanism in orig v

asciilifeform: cat yer_otp.txt | gpg --decrypt ?

asciilifeform: http://btcbase.org/log/2019-04-07#1907304 << i formerly thought that this was obvious from the docs , but you ~can~ operate on vpatches without a vtron ( they're edible by trad. unix 'patch' util, and you can verify the sigs with anyffin roughly gpg-like , also by hand ) ☝︎☝︎☟︎

asciilifeform: http://btcbase.org/log/2019-03-30#1906193 << interestingly, at 139.2 kloc , still 1 of the heaviest proggies in civilized use; vs, e.g., trb ( http://btcbase.org/log/2018-11-29#1876053 ) ; but lighter than koch gpg ( if minus autoconf, http://btcbase.org/log/2017-07-08#1680705 ) or linux kern. ☝︎☝︎☝︎

asciilifeform: hanbot: if you're concerned re mitm, ask BingoBoingo to log in via console and gpg you the current hostkey to

asciilifeform: mircea_popescu: all of this being said, currently on target for end of apr. for usable gpg replacement.

asciilifeform: ( ftr linus is pretty lulzy example of 'uses gpg' -- erry single time signed MB-weighing ball of ??? that in no conceivable way he could have read or fit in head )

asciilifeform: may take some time to develop, the addition of GPG signing to commits would be a welcome feature.' << afaik to this very day no such thing in opensoresdom (outside of linus's releases)

asciilifeform: 'To that end, the compromise may actually be a good thing in the long run. Kuhn said that they have contacted the CVS maintainers and have offered to pay for development of features that would allow GPG signing of commits through CVS -- making it much more difficult for changes to be inserted unnoticed into code held in a CVS repository. He said that they have also contacted the GNU Arch maintainer about adding GPG signing. Though it

asciilifeform: hanbot: it is also possible to bootstrap any vtron using naked gpg, ancient gnupatch, and bare teeth ( manually check sig and patch -p0 < foo.patch, for ea. )

asciilifeform: btw does mircea_popescu have a apache tarball to sign ('as found') and share for cuntoo etc, a la gpg-1.4 ?

asciilifeform: it is difficult to dispell even the most outrageous lulhypothesis re koch-gpg. sorta what makes it 'speshul', what, 40MB of ???.

asciilifeform: ( not even to mention the fact that -- rare, for a kochism -- the problem dun even exist in stock gpg, which defaulted to 2 subkeys, 1 for sigs and 1 for encipherments )

asciilifeform: the 1 with the gpg fp

asciilifeform: mircea_popescu: correct. the item that needs padtron, is mircea_popescu's specced 'fuckng replace gpg already' ; and possibly also koch-free euloratrons.

asciilifeform: classical gpg (base64) is a 400% neh

asciilifeform: ( of much moar, in fact, than $file-length, cuz gpg is retarded )

asciilifeform: i have a half-written bot that takes a deedbot-style gpg wot decrypt and puts out a single-use emulated ftp login thing. but it is not alive, because gnarly in practice ( if single-shot, resumes dunwork; and no crypto, and prolly this is solvable but i dun have currently the time budget for massaging it )

asciilifeform: the copy on my www ( and later cleaned further by diana_coman ) is from gpg 1.4.10 ( itself from signed tar that mircea_popescu dug in in '14 )

asciilifeform: gpg itself is substantially moar crippled than koch's mpi lib

asciilifeform: mircea_popescu: this is tru re gpg per se

asciilifeform: mircea_popescu: to summarize : if phf decides to Do Right Thing and gpg to asciilifeform the goods, then i'ma eat'em and whatever public output will not reveal his informant.

asciilifeform: i proposed gpg of raw material to asciilifeform .

asciilifeform: ( gpg dun look at file names for anyffing )

asciilifeform: and that gpg1/2ism has 0 to do with the eggog ( i removed the custom gpg invocation line to 0 effect )

asciilifeform: http://btcbase.org/log/2018-11-13#1871703 << also neato, i expect this'll come in handy when we start extracting moduli / migrating off gpg ☝︎

asciilifeform: mircea_popescu: stallman has plenty to answer for, but i dunno what he has to do specifically with koch's gpg

asciilifeform: i can't think of anyffing to do but a) make flensed version of phf's that actually worx here, i have NO intention of breaking my legacy toolchain in which i still have 90000 unconverted private patches or b) bake an e.g. if gpg.__version__ = phf : ... else .... thing

asciilifeform went to strace to find what gpg binary it actually invokes, and oddly enuff no mentions of EITHER in strace output...

asciilifeform: it always baked a tmp to satisfy gpg's keyring idjicy and nuked it after

asciilifeform: ( on , afaik, all known kochian gpg )

asciilifeform: ( alternatively, does anybody know how to control the gpg binary that python-gnupg sees ? )

asciilifeform: i dun have any cuntoo boxes here yet. all of my dev machines run vintage gentoo, where the gpg that python-gnupg sees is gpg2 (cuz idjit portage pulled it in, long ago). asciilifeform's actual pgp-ing happens on diff machine, naturally, with 1.4.10 . but apparently phf's hack for subkeyism breaks the thing in this combo.

asciilifeform: mod6: recall when i went on similarly fruitless expedition into kock.gpg guts, heh

asciilifeform: mircea_popescu: happens to be exactly what i set out to; on top of that, even got a gpg extractor (currently in py, but slated for adaization) , precisely for same ☟︎

asciilifeform: esp. in re routines not used in ye olde gpg, or used with various constraints

asciilifeform: anybody who wants to be in this list, plox to gpg #.

asciilifeform: mircea_popescu: i'ma gpg you the login to the stats page later today

asciilifeform: gpg --import behaves like this.

asciilifeform: tho it could be artifact of gpg on trinque end, depending on how he keeps these ( if you use the built-in 'import' mechanism, it never throws out cruft )

asciilifeform: confirmed that gpg still thinks 'expired' after eating

asciilifeform: file names are covered by the gpg seal of given patch, tho, so it isn't as if people can get away with blindly renaming items in a patch. so if taking all of mircea_popescu's algo but the hashed-names part, you have a usable algo.

asciilifeform: mircea_popescu: if he's stuck to the old gnudiff format, which per my test appears to be the case, names aint hashed at all ( they're covered by the gpg sig of given patch, but that's it )

asciilifeform: diana_coman: i suspect idea was 'make him manually gpg --verify ... and then press by hand-gnupatch a la pre-v trb, better than signed tar'. but i'ma let phf clarify.

asciilifeform: ( will move when finally kerosene poured on gpg )

asciilifeform: mircea_popescu: birth of trb was 100% powered by 'muscle-powered v' of gpg-signed patches, recall.

asciilifeform: ( recall, we had gpg-signed patches with 0 robotics for yr+ )

asciilifeform: gpg doesn't sign names.

asciilifeform: http://php.net/manual/en/function.gnupg-init.php << to gpg

asciilifeform: loox like callout to gpg

asciilifeform: pretty sure nobody has any other gpg eater than callout to koch