190900+ entries in 1.386s

assbot: You rated user assbot on 12-Apr-2014, with
a rating of 1, and supplied these additional notes: Nice ass & face bot..
kakobrekla: whats next,
a nuclear sub delivered 2 days before your order while paying you 500$?
mircea_popescu: can't hurt. leave all these for
a 2nd version down the road.
assbot: You rated user kakobrekla on 03-Mar-2013, with
a rating of 5, and supplied these additional notes: too much stuff to list. inquire within..
assbot: You rated user mircea_popescu on 16-Dec-2012, with
a rating of 5, and supplied these additional notes: good fella.
artifexd: I will pause coding to read "Malicious Crypto" and finish the course. I'll report back when I'm done and made
a decision re: golang's crypto libraries.
mircea_popescu: nono it was
a course, you were supposed to email your results
mircea_popescu: asciilifeform you got
a link to that hacking course thing that was crypto oriented ?
mircea_popescu: even if you use rsa-only keys, you can rsa-encrypt
a message so that it's easier to break but still decryptable by destination.
mircea_popescu: artifexd not to be taken lightly this.
a lot can be compromised in gossipd crypto.
artifexd: How could the crypto routines be compromised in
a way that would matter? Weak key generation? gossipd doesn't generate keys. Weak rng during encryption? I pick the rng (and can offer an option for you to supply your own). Encrypting
a message with an "extra" key so peet can read it? That should be easy to see in the code.
mircea_popescu: seems
a reasonable approach tbh, but generally people should free to use whatever they wish to use.
mircea_popescu: if i pick
a barber i don't go by the straight razor brand.
mircea_popescu: well ok, sure, but still. i dun see the problem, so b-
a guy wants to play with go. his choice, his signature, why is this an issue.
mircea_popescu: well so why do you want him to also write it in c ? go is
a better choice neh ?
mircea_popescu: well you know it occurs to me it'd be
a lot more productive if you go in early with
a "hey, could it please be c ? i would like to run this on mips" discussion than
a late paniucwhen guy picks whatever he happened to pick.
mircea_popescu: so c is
a gnu proprietary language ? what's
a proprietary language ?
davout: "later add the option do the crypto via
a shell out to gpg"
artifexd: <asciilifeform> speaking of which, did artifexd follow mircea_popescu's prescription and use
a hacked gpg for 'gossip' ? << No. I'm using go's openpgp code. However, I'm structuring the code so that I can later add the option do the crypto via
a shell out to gpg. Then you can use whatever version of gpg your heart desires.
mircea_popescu: so... what do you mean not everybody on the internet is
a dumbass ?
davout: they kind of think that some random guy that never heard about bitcoin will be thrilled to receive
a fraction of
a cent in magic internet money, redeem it, and start spreading adopshun
mircea_popescu: also, if they never hear
a dissenting opinion ever again that'll be soon enough.
teward: mircea_popescu: please don't force me to sit through
a 4 hour lecture on my own state's history without some distraction >.>
mircea_popescu: teward you are aware this place has
a history and so on, right ? read it and all ?
PinkPosixPXE: morning ben_vulpes .. sorry, I got pulled into
a meeting hehe
mircea_popescu: well, depending of what you actually need to sign, never putting your signed matter over the wire unencrypted can help
a lot.
joecool: but i will continue to read on this and see if i can come up with
a better way to handle it
mircea_popescu: and inasmuch as you're
a person rather than an organisation, "forced coercion" is really not very much use.
joecool: an adversary with large resources will likely be able to get around that through forced coercion before even needing to try to attack the implementation (which I still believe would be
a nontrivial task unless the system had
a rootkit installed that maliciously generated signatures, that i would see on the counter)
joecool: mircea_popescu: there are two major problems with this implementation that i see. both are problems the cardano solves, 1. the system knows it's
a smartcard and malicious software could use it, and 2. weak entropy generation for signing
mircea_popescu: nobody ever said "if i'm ever in
a fire i'll have bigger problems than this tiny fire hydrant can solve"
joecool: if i needed to protect from
a 3-letter agency i'd have bigger problems than the shortcomings of
a smartcard
mircea_popescu: cazalla not particularly. unless you either have exclusivity,
a scoop or actual documents,
cazalla: i use to cover the company
A raises X amount of capital but have been skipping them as you could really just word replace the amount and company name from
a previous article and be done with it. does anyone actually care about such things and wishes to see them?
mircea_popescu: it's
a huge no-no. you can't go into afterlife anymore.
cazalla: talk is cheap! make them illegal, be
a doer like bill gates
undata: asciilifeform: I guess I'm speaking as
a guy in his 20s
undata: this pot legality thing is just another american political football. no one ever had trouble getting weed, nor passing
a drug test. its
a distraction issue.
pete_dushenski: which should conceivably always be cheaper than
a whole hoard of congressmen
mircea_popescu: herpy-derp an'
a bottle of rum... well not rum. ginger ale.
mircea_popescu: "The reason for doing this is that we can better reason about the output of
a CSPRNG; by contrast, it is difficult to reason about the output of the entropy source." << gotta love the sweet innocence on display here tho.
kakobrekla: <mircea_popescu> well whos the guy ? < fuck if i know. i just made
a bet he wont reply, but he did. iirc.
pete_dushenski:
a yes, where that *other* very bad racist joo is trying to sell the basketball team
assbot: Go ahead Jim Prentice: raise taxes in Alberta and see if by 2025 the province isn’t an economic shithole like Quebec and Ontario. | Contravex:
A blog by Pete Dushenski ... (
http://bit.ly/1C81kEe )
jurov: but these people nave
a need to construct such reasoning
jurov: Thus, it is possible to say that the resulting device is at least as secure as
a CSPRNG, but, since we have
a constant stream of new seeds, we can be confident that it is actually
a better source of random numbers than
a CSPRNG that is seeded less frequently.
jurov: The output of the conditioner is then fed into
a cryptographically secure pseudo-random number generator (CSPRNG). The reason for doing this is that we can better reason about the output of
a CSPRNG; by contrast, it is difficult to reason about the output of the entropy source.