172900+ entries in 8.894s
assbot: Logged on 17-01-2015 22:34:54; davout: asciilifeform: yeah, that's what
i was reading, it mentions user ids in the subpackets spec, but
i'm unsure whether that includes an actual key fingerprint,
i tend to understand that it doesn't
davout:
i'll let you read the convo
davout: well,
i was just reading about them in the deedbot spec
davout: by this account
i'm a core contributor to bitcoin too,
i reset testnet once, fuck it
davout: ah, yea lol,
i had a look to see if this chick had any other commits on the project, seems like it's her sole 'contribution' to the whole thing
mircea_popescu: the "o look mom,
i made a github commit. it changes the spelling of comments" thing
nanotube: kakobrekla:
i have no idea why
i keep keyid as a separate column in db either. probably something grandfathered in...
Apocalyptic: just take the bitcoin network, it performs 2**64 hashes in 60 seconds at current hashrate if
I'm not mistaken
davout: and
i guess even in the case of a keyid collision that has no impact on actual signature verification
davout: asciilifeform: yeah, that's what
i was reading, it mentions user ids in the subpackets spec, but
i'm unsure whether that includes an actual key fingerprint,
i tend to understand that it doesn't
☟︎ undata: say you and
I make an agreement and you fail to execute your side
davout:
i think we should've stuck to lighting these jasmine candles :-)
undata:
I have witnessed that fact and
I sign and note the time
undata: two parties presented themselves to me and both said "
I agree to whatevers in this blob"
undata: or
I'll go sit on a park bench and call myself a notary
davout:
i mean, even in that case, what's the worst that could happen? specifically?
undata:
I'm hacking on it as well
davout: for all
i care the bot could hang out in -assets, and notarize whatever is asked from whoever has voice, sounds like the simplest straight-to-the-point approach to me
undata: or have
I missed something
punkman: so
I guess v4 sigs don't have fingerprints either
davout: kakobrekla: tbh if verifying the signature on notarized data is not considered necessary
i don't think it's a big issue if the dump is unsigned
Apocalyptic:
I confess that surprises me, had imagined the full fp would be somewhere
punkman:
I think there is, but not 100% sure
Apocalyptic: punkman, thanks for the link, but
I mean that there should be something in the clearsigned message structures that clearly identifies the key that produced it
Apocalyptic:
I wonder what the behaviour is if you have two pubkeys in your keyring with the same eight bytes key id and you're trying to verify a message
Apocalyptic: davout, re "looks like this can't be verified correctly without either relying on a keyid as an actual key unique identifier OR keeping a synchronized keyring and actually verifying the signature"
I suspect there actually is, playing with the source atm
davout: undata: "the wot is an excellent tool for making good decisions about establishing those" <<< sure, but
i'm not sure why the notarization *tool* would enforce that,
i defo don't feel strongly enough about it to argue the point either way
davout: Apocalyptic:
i've started poking at it yep
undata: kakobrekla: yes, that's what
I meant
davout: yeah,
i put fpr or keyid in url, you spit out the fpr, actually no that's dumb
kakobrekla: you still need to check
i didnt give you garbage no
kakobrekla: you mean you input keyid and
i output fp
Apocalyptic:
I can see a quite unpleasant spam attack otherwise
davout: punkman: mebbe
i'm wrong here, lemme try and find a reference
davout: kakobrekla:
i agree, it's bad if you rely on keyids to actually identify the key, but if you output the actual full fingerprints in the returned json one can make an educated choice
davout: Apocalyptic: yeah,
i think mp mentioned somewhere that verifying the sig is not necessary
undata:
I've got a friend with a decent golang bot on github
davout: Apocalyptic: "you have to validate the sig" <<< no
i don't think so
davout: if
i don't have the key in my own keyring it doesn't seem possible to extract the fingerprint from a signed message
undata: as for english as
I delve into a few other languages on duolingo
I find my native tongue ever more horrifying
davout: that would work when listing keys,
i can't seem to get it work when piping a clearsigned msg to "gpg -v -v --fingerprint"
davout: "replace keyid with fp ?" <<< sure, but how do
i get the fpr from a signed message? gpg -v -v will just return the key id
davout: kakobrekla: "nfi why nano keeps keyid field in his db" <<< if you keep the fingerprint you're automatically keeping the key id as far as
i understand since the key id is simply the second half of the fpr
davout: thing is,
i was also reading mp's deedbot spec, the part
i was wondering about was the "extract keyid from signed message, and use it in w.b-a.link URL"
davout: yea,
i was reading gpg's rfc yesterday and found out that they aren't supposed to be relied upon for unicity
ben_vulpes: as someone somewhere once said "
i don't hire developers who spell well,
i hire developers who mispell consistently."
punkman: ben_vulpes,
I think "their/they" was being used long before the queers adopted it
davout: ben_vulpes: wasn't sure about that,
I assumed a weakness in my own english since no one brought that up, but it did sound slightly weird, thanks for clearing it up!
davout: undata:
i like ruby :)
ben_vulpes: <danielpbarron>
i tried to make a raw tx once, got rejected by my own node for having too small a fee << heinous
danielpbarron:
i tried to make a raw tx once, got rejected by my own node for having too small a fee
ben_vulpes: say
i have the transaction hash (aka txid) and output index - how do
i get the pubkey those coins were sent to?
ben_vulpes: how do
i get the pubkey for a given output?
ben_vulpes: (one can sign anything at any time - that's not the problem. the problems crop up in a) knowing the sigs are valid and b) the multi-input, multi-privkey transaction generation use-case: how am
i to know which privkeys are to be used to sign which inputs, and furthermore [and somewhat recursively] how do
i know those signatures to be valid?)
danielpbarron:
i thought all you need to know is the tx id of the outputs you want to use, the private keys of the coresponding addresses, a destination, and an amount
ben_vulpes:
i don't know that a bitcoind would be able to verify a transaction without access to the full inputs
ben_vulpes:
i'm starting to see some of the rationale behind the wallet paradigm - creating transactions for signing requires being able to retrieve arbitrary transactions from the blockchain
ben_vulpes:
i don't really know how the transmission of btc is supposed to work for the thing
gabriel_laddel: they're in the same vein of games such as diablo
I&II, baulders gate, path of exile etc. Not in terms of gameplay, but overall attention to detail and cohesive structure.
mircea_popescu: "
I've lived in filth,
I've lived in sin, but
I still smell cleaner than the shit you're in"
ben_vulpes:
i awoke to sewage leaking around the bathtub plug actuator
kakobrekla: why are you asking me, do you think
i know ?
mircea_popescu: camweon's a total heel.
i have nfi whatabout england produces such contemptible sacks of shit.
i thought blair was an exception, but apparently he was just a harbringer.
mircea_popescu: decimation
i bet you the guy does not even currently ~KNOW~ that that's what's being discussed.