log☇︎
800+ entries in 0.247s
asciilifeform: (other gpg retardations -- naturally -- will.)
asciilifeform: mircea_popescu: imho the smart thing to do with bad olde gpg is to use it as demonstrated in my original vtron -- sans keyring.
asciilifeform: there's now 1 key for asciilifeform , from nao until gpg shitburial day ( same modulus as always )
mircea_popescu: the only thing is that gpg is already obsoleted becauyse of its inane fingerprinting scheme
asciilifeform: mircea_popescu: we had half a dozen people here repeatedly build gpg-1.4.10 back in august, recall
mircea_popescu: asciilifeform stronger argument than it seems. leaving aside the static issue, it's not even a given gpg compiles at all.
asciilifeform: iirc argument was ' i dun wanna recompile gpg '
mircea_popescu: and gpg is not very far off this ; neither are ALL usg produced programs you are running.
asciilifeform: veen: there's the one you described (conventional gpg with string '/dev/random' ripped out and replaced with the correct) ;
asciilifeform: see also http://qntra.net/2016/08/rng-whitening-bug-weakened-all-versions-of-gpg .
asciilifeform: veen: rng in gpg has serious problems , on top of using /dev/random
asciilifeform: i would say 'replace /dev/random in gpg source with /dev/fg and build' but the rng in gpg is monumentally retarded and i disrecommend its use entirely
mircea_popescu: now, this said, we still should prolly replace gpg.
asciilifeform: mircea_popescu: yes but this does 0 for gpg fp.
mircea_popescu: apparently replacing gpg just became top priority.
mircea_popescu: if you --import it gpg will probably update trinque's key under your signature won't it.
mircea_popescu: asciilifeform o hey, consider this situation : 1. i know your fp, so i make fake key for that fp. 2. i know trinque 's fp, so i make fake key for that fp too. 3. i know you keep a signed copy of trinque's key on your keyring ; so : 4. i proceed to sign trinque's fake key with your fake key and 5. pretend to be a noob and give you my gpg pubkey. ☟︎
asciilifeform: to revisit upstack, for whoever may have forgotten, gpg sigs ONLY contain 64bit keyid. e.g., from my vpatch sigs, 0xB98228A001ABFFC7 .
asciilifeform: the sha1 people posted the algo. shouldn't take too much work to turn it into a, e.g., gpg fp clobberer.
mircea_popescu: http://btcbase.org/log/2017-02-04#1611353 << sounds like this ip should be advertised, i wouldn't mind getting a box or two there. epic uptime + gpg awareness = win ☝︎
mircea_popescu: http://btcbase.org/log/2017-02-03#1611095 << this is not actually true. trb wallet encryptor is pretty strong. not ideal, but there's no actual cause of worry if you lose an encrypted bitcoi nwallet (still, doesn't encrypt metadata, has many other warts discussed in http://trilema.com/2016/the-ideal-bitcoin-wallet/ ) ; i wouldn't say same re gpg keyring. ☝︎
asciilifeform: simonpenner: register a gpg key, per http://deedbot.org/help.html , then you will be able to voice yourself.
asciilifeform: mircea_popescu: 3.x linux kernel; gcc 4.9; musltronic toolchain; emacs 24; trb; v; gpg 1.4+rngpatch+timingleakpatch .
mircea_popescu: o mention ancient strongholds of usgism such as kock-gpg, tor or (again) openssl are being butchered left and right. the attempted anti-bitcoins failed to catch on.
mircea_popescu: in gpg you mean ? nah, and i wouldn't trust it anyway. ok to wait, it waited for a year before masochist guy found the rake in grass to step on
mircea_popescu: gpg
asciilifeform: and shouldn't change again (until we retire gpg)
asciilifeform: re 'open sores', even a ~very~ small gadget, and in fact one that started life as a stand-alone library: mpi (bignum) piece of gpg 1.4, was quite astonishingly painful to properly saw off the kochball
asciilifeform: ben_vulpes: gpg does.
asciilifeform: ^ not a valid gpg key for some reason, though not flipolade.
asciilifeform: (won't import in gpg, but ~will~ in js www-based shitpgptrons)
mircea_popescu: http://btcbase.org/log/2016-12-28#1591566 << very much this. trusting gpg in this manner is irresponsible. ☝︎
asciilifeform: it'd seem to me that if i throw in a seal that crashes gpg, ben_vulpes's vtron will say 'good signature' !
asciilifeform: unrelated, ben_vulpes : how come you search the gpg output for 'bad signature' rather than 'good signature...' ?
mircea_popescu: to keep with gpg ?
asciilifeform: mircea_popescu: gpg used PKCS #1 v1.5 (see rfc4880)
asciilifeform: gpg used the weakest known padding scheme iirc.
mircea_popescu: gpg.
asciilifeform: phf: mircea_popescu's method , to be used in the battlefield, still needs some means of tying the keys together formally -- and something that doesn't reduce to the horror of gpg's 'subkeys'
mircea_popescu: you can literally come up with an idea for a thing while travelling ; go to internet cafe ; spin up gpg to make you a new key while you bash it down ; then sign the patch with that key which you don't even bother taking from there.
asciilifeform: in all extant vtrons, gpg keyring is nulled at boot
asciilifeform: at least when using gpg.
mircea_popescu: and in general this exactly mirrors everything - we tried to work with gpg turns out gpg doesn't want to work, not WITH anyone, it actually does not want to work, at all. ditto for the ssh. ditto for everyone and everything.
mircea_popescu: thestringpuller the two evident avenues would be a) power differential analysis (ie, see how much electricity it eats, and parasite waveforms it induces). this is amply discussed on web re subverting gpg (eventually they got it to work with mere microphone, but same principle)
asciilifeform: solution is that deedbot eats ordinary standalone gpg sigs.
asciilifeform: 'This IRC + GPG idea is growing legs. Lots of legs: RT @riking27: messages are max 512 bytes, it fits in a single RSA block it's perfect!'
mircea_popescu: shinohai ironically we're also giving up on gpg, for the exactly opposite reason.
mircea_popescu: ah alf, remember the happy days a few years ago when we actually thought gpg ~= pgp ?
mircea_popescu: http://btcbase.org/log/2016-12-12#1581948 << dude what ? link me where you tried it wouldja, i recall it working fine when eg gpg source. ☝︎
asciilifeform: they approve of the type of work that gpg turd is.
mircea_popescu: fuck standard gpg. in principle - this must work.
asciilifeform: afaik: not with standard gpg, or such that standard gpg will eat the result
mircea_popescu: ie, the reason koch-gpg-clearsing worked ok for us for a long time is that while flawed as alf correctly (and repeatedly for a year now) points out, nevertheless its hole falls atop a hole of v, namely that it doesn't do "-----"
mircea_popescu: http://btcbase.org/log/2016-12-11#1581221 << when i had to put in, eg, gpg tarball i apparently used base64 of it. ☝︎
mircea_popescu: http://btcbase.org/log/2016-12-11#1581194 << "gpg dying" in usg speak is "tmsr is taking control of gpg" and no more. ☝︎
asciilifeform: or, alternatively, a much easier sha1 collision, in which case i only fool ~all extant gpg clients~ but not a d00d with magnifying glass actually multiplying out the rsa
asciilifeform: i'll point out that i can forge , e.g., gpg signature from mircea_popescu if i find ONE collision
asciilifeform: gotta wonder -- any of these folx ever generate gpg key..?
mircea_popescu: because thatg's the only way you're guaranteed to not have the current gpg problem
asciilifeform: mircea_popescu: that would make problem even worse, could no longer search logs for a gpg fp
mircea_popescu: no deedbot-payable gpg-based ordering huh
mircea_popescu: asciilifeform the whole "ssh key made on debian recast as gpg key" thing is pretty bizarre.
asciilifeform: promisetronic 'verifications' are an eternal plague among the stupid. consider even the timestamp in gpg (to make the phuctor sig from last night's qntra, i used ordinary gpg 1.4, with patch). what business does a userland proggy have asking for the wall clock time without permission? if i want it to have a time, i will pipe 'date' to it...
mircea_popescu: gpg: Good signature from "Seclab Signing Key 2016 <seclab@airgapped.sec.t-labs.tu-berlin.de>"
mircea_popescu: gpg: Good signature from "Seclab Signing Key 2016 <seclab@airgapped.sec.t-labs.tu-berlin.de>"
mircea_popescu: Framedragger note that i don't particularly see the value in restrictioning anything. in principle anyone should be able to register a domain for his bitcent - even if he puts no gpg key in there. he just won't be able to admin it, big whoop./ ☟︎
mircea_popescu: even the notion of "expire" as implemented in gpg.koch is nonsense. should be replaced with "disused", as in, "i took it out of deedbot and am not using it anymore"
mircea_popescu: trinque any idea why it rejects ? i see gpg: Good signature from "Mariono (Marionobitcointalk)
asciilifeform: not even, as in phf's case, calling exotic gpg-via-ffi crapola
mircea_popescu: lol! review the history. the bar in 2016 is "make a bot" ; the bar in 2014 was "get a gpg key". ☟︎
mircea_popescu: wtf is "gpg-2"
mircea_popescu: considering we have millions of keys, and considering the sort of shenanigans we've seen currently, including werner koch's gpg subversion most recently ; it would not be inconceivable at this point if a good chunk - thousands, hundreds of thousands of keys can actually be factored once we figure out which exact 20, 30, whatever bits are actual entropy , and how the nextprime is chosen on the basis of that.
mircea_popescu: $google gpg key
mircea_popescu: ok, fine. hereby is announced a 1 BTC prize for the best fanfic published on the blog of someone with a gpg key deedbot knows about.
mircea_popescu: thestringpuller don't be the messenger. kid can gpg like anyone else.
asciilifeform: produced wholesale - no. gpg would probably be the closest to this, to date.
asciilifeform: same .vpatch.sig, vpatch, key --- what does gpg from command line output ?
asciilifeform: asciilifeform is specifically interested in the 'foo' in 'gpg --blah .... < foo' -> sigsegv
asciilifeform: (thing spawns gpg as process, neh ?)
asciilifeform: is there a gpg segfault in /var/log/messages ?
mircea_popescu: http://btcbase.org/log/2016-08-24#1528973 << i don't understand how you think gpg works. explain this to me ? ☝︎
mircea_popescu: abrr i was talking to shinohai ; what you have to do is register your gpg key with deedbot and get the game client running. you got either of these ?
asciilifeform: and is the only way to get ~sane behaviour out of gpg.
asciilifeform: 'For end users, the switch to the new branch will likely only be noticeable in a few situations—and perhaps only if one is looking carefully. For instance, the gpg-agent process will prompt the user for the passphrase to unlock a key, rather than the gpg process, but the workflow itself will not be altered otherwise. Users who have existing keyrings on their machines will have those keyrings automatically updated to the new storage
asciilifeform: BingoBoingo: http://qntra.net/2016/08/rng-whitening-bug-weakened-all-versions-of-gpg/#comment-67939 << answr.
mircea_popescu: http://btcbase.org/log/2016-08-22#1526691 << the "consensus" is that if you're unwilling to follow the proper wot and wish to import random strange from whenever, you're stuck handcurating gpg keys manually. ☝︎
asciilifeform: ;;later tell mircea_popescu http://www.gossamer-threads.com/lists/gnupg/devel/68250 << gpg lulz.
mircea_popescu: so far the major problem is irc usage ; and gpg/deedbot a very distant second.
mircea_popescu: nah, the retardation making it ~impossible to compile gpg 2."current" has 0 to do with automake.
asciilifeform: gpg 1.4.10 has a 'configure 800K in mass.
mircea_popescu: shinohai i need some noobs to labour for me in eulora. put a post up wherever it fits, jobs board if they have it ? saying that i'll pay 1 bitcent / 2 hours of work. first task is to get gpg key made and registered with deedbot after which install game and ask for acct. once they're in they get the first bitcent, after which they'll get tasks.
mircea_popescu: first case of koch-gpg / openshit-ssh keys sharing a factor. pity it's such a lulzy one, HOWEVER, it does make the "sks error" nonsense just a little more lulzy.
mircea_popescu: ;;later tell bingoboingo "Following the news of a serious RNG bug affecting all GPG versions a low energy shitgnome campaign of apologetics and "not that bad" followed." << can i get a "The fact that hundreds of GPG keys have been Phuctored in the past year has, of course, nothing to do with all this." added ?
asciilifeform: this thread is quite reminiscent of the gpg key-revocation thread.
mircea_popescu: asciilifeform no, no, looky : For GnuPG 2.1 things are different because there is a long running process (gpg-agent) which creates all keys.
mircea_popescu: http://btcbase.org/log/2016-08-19#1525751 << epic. werner ADMITS "mp was right all along - gpg 1.4.x is the right way to go, 2.x is weak" ☝︎
mircea_popescu: asciilifeform same people who check the gpg rng unwhitened.
asciilifeform: in other lulz, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834829 << 'gpg-agent'
asciilifeform: the ~implementation~ of the latter in gpg - is other question entirely.
asciilifeform: incidentally, mr. lolcow just gave away, unwittingly, another gpg laugh - recall what else comes out of rng when you generate key, after the primes ?