log☇︎
1100+ entries in 0.367s
mircea_popescu: you're not trying to argue that gpg is to be replaced are you ?
asciilifeform: how easy it would have been to bitwalk it (like the braindead 'secmem' thing in gpg insists on doing PER SEGMENT !!?!!!)
asciilifeform collected five versions of gpg, not in one is the thing actually implemented
asciilifeform: ;;google m_debug gpg never worked
asciilifeform spent more or less his entire free time in the past 2 wks reverse-engineering and auditing gpg, incl. compiled binaries. this has a certain effect on the soul.
asciilifeform: http://log.bitcoin-assets.com/?date=04-11-2015#1315736 << the way to do it is gpg --homedir /tmp/dirthatyoumadefortheoccasion ☝︎
asciilifeform: ;;later tell mod6 in your 'v', gpg doesn't seem to be confined to a temporary state dir !!!?
asciilifeform: mircea_popescu: phun phakt: M_DEBUG in gpg-1.4 never worked
mircea_popescu: Krystyl well then get gpg and make one.
asciilifeform: i would not be much surprised to discover that plaintext matching the description of a gpg sig is being silently massaged, at random, somewhere in the backbonez. ☟︎
ascii_field: and actually gpg --verify ... ?
ascii_field: gcc 5.2 won't build gpg 1.4.
ascii_field: there are 3 separate rng subsystems in gpg 1.4 - but more on this later)
asciilifeform: where do i meet all of these mythical people who own a computer, use gpg, but do not know enough english to operate it without this garbage ? ☟︎
asciilifeform: and are we really 'gpg --keyserver pool.sks-keyservers.net --recv-keys FAB953C4'-ing ?
asciilifeform likes all of this with the very definite exception of the 'gpg --keyserver pool.sks-keyservers.net --recv-keys 0x......'
mircea_popescu: (and yes, cwcd, not possible w/o bitcoin, gpg, people involved, an actual infrastructure)
mircea_popescu: http://log.bitcoin-assets.com/?date=29-10-2015#1310760 << would be VERY useful to fuzz the shit out of it, and actually we'd be doing this if gpg weren't slated for removal. trivial to instrument, replace /urand with a counter and let it run and compare the output. ☝︎
asciilifeform: http://log.bitcoin-assets.com/?date=29-10-2015#1310695 << basic idea: go and try to actually TEST, e.g., gpg key generator. as in, deterministically. this is nontrivial - gotta saw off the entropy collector and replace with something. ☝︎☟︎
mircea_popescu: what are you trying to fix, the atrocious gpg malleability issues ? ☟︎
asciilifeform: the beauty is that with a few hundred bytes of overhead, it can eat standard gpg messages
asciilifeform: it is relatively simple if you are mircea_popescu and the only thing that needs to run is lynx and gpg 1.4
mircea_popescu: moreover she didn't want to / understand she has to make a gpg, and i dun wanna encourage the demuring damsels.
mircea_popescu: http://log.bitcoin-assets.com/?date=23-10-2015#1306332 << and if you were to be against gpg, or against signed commits, or against "not everyone is/can be a contriobutor" or for "women in tech" in the sense of lipstick in the optic drive or a bunch of other equally nutty notionms, you could equally say "i don't think i am alone" and more importantly, FIND YOURSELF INCLINED TO SAY IT ☝︎
mircea_popescu: Send code snippets and GPG signed material in separate GPG encrypted blocks. This protects them from painful mutilation. < ? !
mircea_popescu: BingoBoingo " The submission may be, usually ought to be GPG encrypted" no lassitudo. pick one, stick with it.
ascii_field: but gpg went with md5.
ascii_field: gpg 1.4.10.
asciilifeform: http://log.bitcoin-assets.com/?date=17-10-2015#1300865 << interestingly, they are ~not~ in the mpi seen in gpg 1.4.10... hence the 'where??' ☝︎
mircea_popescu: bitcoind is frozen on 0.5.x ; gpg is frozen on 1.4.x ; eulora is frozen in cs dependencies on X Y Z. guess why ?
mircea_popescu: i thought you were testing if the gpg crashes.
asciilifeform: pgp verification ought to be invoked 'gpg --verify pubkey payload'
mircea_popescu: in fact gpg has a lot in commnon with bitcoin : an original prototype of a good idea, with a lot of quick and dirty stuff, ☟︎
asciilifeform: point being, gpg --keyserver wherever.the.fuck --recv-key 0xfingerprint can now return magical key.
mircea_popescu: otherwise yes, gpg is, and remains, slated for replacement.
ascii_field: 'GPG throws a warning [3] that the message could have been modified, but other implementations do not differentiate between SE and SEIP.' << what 'other implementations' ? microshit crypto ?
mircea_popescu: if so inclined, i could just set a box too old to be bitcoin node to generate and register gpg sigs
mircea_popescu: first, we rewritre gpg.
asciilifeform: http://log.bitcoin-assets.com/?date=18-09-2015#1278910 << there is a good chunk that can be thrown out (things not implemented in classical gpg) but after this you still have a steaming pile of shit. ☝︎
mircea_popescu: actually the gpg specification is so miserable, a code prototype in the way of bitcoind as an intermediate step to rescuing the standard and restating it properly is prolly unavoidable.
mircea_popescu: anton_osika a) gpg contracts are already defined, cuz that article ; b) we don't agree.
asciilifeform: gpg: 73708B0E: There is no assurance this key belongs to the named user
ascii_field struggles to think of even one useful tool that doesn't have a retarded usgized variant - e.g., gpg
mircea_popescu: wtf. i also use gpg.
asciilifeform: http://log.bitcoin-assets.com/?date=09-09-2015#1267190 << not using classical gpg, no. ☝︎
mircea_popescu: http://log.bitcoin-assets.com/?date=09-09-2015#1267251 << moreover, if gpg messages were code rather than data i'd have gpg rewritten to a thing that keeps messages strictly as data. BingoBoingo exactly has it : there is no room nor need for every bit of text to be "really code". i want my nano to be UNABLE to do anything whatsoever with the text. which is why i use nano rather than emacs. ☝︎
asciilifeform: ;;gpg everify freenode:#bitcoin-otc:58850f1a13a4e710af8dc3a896a0d761067daf11abe9fddc336a23aa
asciilifeform: ;;gpg eauth asciilifeform ☟︎
asciilifeform: mircea_popescu: 'v' elementarily cannot work with 1) gpg 2) non-detached sigs.
mircea_popescu: gpg: Good signature from "Mircea Popescu (Acest articol are apriori
mircea_popescu: gpg: Signature made Fri 04 Sep 2015 11:22:04 PM ART using RSA key ID 2FB7B452
mircea_popescu: $ gpg --verify florianweimer.fuckeveryonewhowaseverinvolvedincomputersyouarethereasonthingsuckihopeyougetcanceranddie.asc florianweimer.fuckeveryonewhowaseverinvolvedincomputersyouarethereasonthingsuckihopeyougetcanceranddie
asciilifeform: gpg: BAD signature from "Mircea Popescu (Acest articol are apriori avantajul aliteralitatii alaturi.) <office@polimedia.us>"
asciilifeform: gpg: Signature made Fri Sep 4 19:06:50 2015 EDT using RSA key ID 2FB7B452
asciilifeform: $ gpg --verify florianweimer-general.asc
asciilifeform: gpg: BAD signature from "Mircea Popescu (Acest articol are apriori avantajul aliteralitatii alaturi.) <office@polimedia.us>"
asciilifeform: gpg: Signature made Fri Sep 4 18:26:16 2015 EDT using RSA key ID 2FB7B452
asciilifeform: $ gpg --verify florianweimer.txt.asc
asciilifeform: ben_vulpes: partly because there is no handy gpg callout lib for cl
mircea_popescu: the concept as intuited by gpg users is meaningless.
ascii_field: yes, i would ~like~ a gcc library; (and a gpg library.) but i understand the authors' logic re: how this could easily and catastrophically help the enemy
asciilifeform: no gpg-compatible anything of any other kind exists anywhere.
asciilifeform: oh and if it isn't clear, python-gnupg just shell-callouts to ordinary gpg.
mircea_popescu: notrly, just send your gpg to gribble
mircea_popescu: lol. if you're using the stock scheme of logs, they dump like gpg dumps. only a portion
asciilifeform: '(GnuPG/MacGPG2) 2.0.20 - gpg (GnuPG) 1.4.15 TB 24.0.1 Enigmail version 1.6 (20131006-1849)'
asciilifeform: http://gnupg.10057.n7.nabble.com/template/NamlServlet.jtp?macro=user_nodes&user=87 << charly avital. gpg tester ?
asciilifeform: mod6: give gpg both args
asciilifeform: 'gpg: encrypted with RSA key, ID 00000000' << win
asciilifeform: where he perhaps gpg --decrypt ..... ... >> massive_turd.txt
asciilifeform: williamdunne: if you want to pgp, you're mostly stuck with shell call-outs to classical gpg.
asciilifeform: williamdunne: my current understanding is that there is not, on this planet, a 'gpg library that actually works' - period, full-stop.
asciilifeform: if simply trying to verify sigs, the python-gpg crud sorta works.
asciilifeform: thing to realize is that gpg was written to be maximally un-librarifiable. like gcc. ☟︎☟︎
asciilifeform: mike_c: gpgme is a wrapper for gpg !!
asciilifeform: mircea_popescu: it's a shell-callout to gpg
asciilifeform: there is nothing to use but classical gpg
asciilifeform: the garden-variety gpg is closest i know of
asciilifeform: mats: to the point, there are ~NO~ usable reimplementations of gpg presently.
asciilifeform: (modern gpg does not sign only the 16)
asciilifeform: realize that this has nothing at all to do with modern gpg...
mircea_popescu: i guess the next top priority in making cardano which was making bitcoin which was making vdiff is now making gpg.
mircea_popescu: gpg as-is is at best a duct tape solution.
mircea_popescu: lol buttcoin engaging danielpbarron over gpg etc was pretty lulzy to read.
ascii_field: btw here's another thing to add to the 'gpg is mega-retarded' list: gpg sig does not contain a sig of self !!
mircea_popescu: which is a harder proposition than nobody ever used gpg.
mircea_popescu: so basically diff is, much like gpg, not actually usable.
asciilifeform: mircea_popescu et al: what was the deal with the gpg sig thing ?!
mircea_popescu: and it's necessarily safe to s/|GPG|// than to s/- //
asciilifeform: gpg: There is no indication that the signature belongs to the owner.
asciilifeform: gpg: WARNING: This key is not certified with a trusted signature!
asciilifeform: gpg: Good signature from "punkman"
asciilifeform: gpg: Signature made Thu Aug 20 05:23:31 2015 EDT using RSA key ID 8B232B13
asciilifeform: not as retrieved by gpg.
asciilifeform: http://log.bitcoin-assets.com/?date=20-08-2015#1245324 << ditto 'v.' i'm not ever writing anything that uses anything other than detached sigs in gpg. ☝︎
mircea_popescu: incidentally : if gpg had the fucking sense to include MORE information on its information line, we wouldn't have the problem with the dashes. ☟︎
mircea_popescu: curl http://w.b-a.link/otp/90f89eec52021b96 | gpg
mircea_popescu: put it in gpg
asciilifeform: http://log.bitcoin-assets.com/?date=20-08-2015#1244925 << if you have a copy of gpg, verify with that ☝︎
asciilifeform: http://log.bitcoin-assets.com/?date=20-08-2015#1244909 << yes. and if anyone really wants me to gpg-sign this 'yes', i will ☝︎