log☇︎
1200+ entries in 0.383s
asciilifeform: (offtopic: perhaps the single most asinine aspect of gpg signature as-we-have-it is the lack of a clearly delineated space to write ~why~ you are signing something.)
mircea_popescu: you ever read the gpg contracts article on trilema ?
mircea_popescu: appstore gpg ?!
ascii_field: use gpg 1.4
ascii_field: can also use gpg --recv-key [keyid]
mircea_popescu: i didnmt think to ask for a gpg sig. bought her an icecream and we even kissed!
asciilifeform: programmatizing gpg is a pain, though.
mircea_popescu: gpg: encrypted with 4096-bit RSA key, ID 16B8E32E, created 2011-07-22
mircea_popescu: gpg: encrypted with RSA key, ID 3594E367
ascii_field: jurov: the problem is that gpg 'escaping' is not a reversible operation
ascii_field: aka gpg --deatch-sig
ascii_field: i don't see why i oughta custom gpg, custom squirrelmail, custom shoelaces
ascii_field: gpg does!
mircea_popescu: mail yes, but i hope to see it disused eventually. gpg does not ? afaik ?
ascii_field: mircea_popescu: gpg rapes.
mircea_popescu: gpg: BAD signature from "Stanislav Datskovskiy <stas@loper-os.org>"
mircea_popescu: gpg: Signature made Wed 05 Aug 2015 12:13:13 AM ART using RSA key ID 01ABFFC7
ascii_field: gpg: BAD signature from "Stanislav Datskovskiy <stas@loper-os.org>"
ascii_field: gpg: Signature made Tue Aug 4 23:13:13 2015 EDT using RSA key ID 01ABFFC7
ascii_field: gpg: invalid armor header:
mircea_popescu: asciilifeform here's what i want to accomplish, as a goal : i want to be able to put up a linux system, then go curl http://trilema.com/autobitcoin.sh | gpg -verify > autobitcoin.sh. and then run that autobitcoin.sh, which auto-follows the changes of people i have selected for this task, builds them and runs them ☟︎
mircea_popescu: gpg: Can't check signature: general error
mircea_popescu: gpg: WARNING: signature digest conflict in message
mircea_popescu: gpg: Signature made Wed 05 Aug 2015 12:13:13 AM ART using RSA key ID 01ABFFC7
asciilifeform: 'GPG for data at rest. TLS for data in motion. You can also use Guttman’s cryptlib, which has a sane API. Or Google Keyczar. They both have really simple interfaces, and they try to make it hard to do the wrong thing.' << l0l!!
mircea_popescu: why is it that the greatest republic in history uses "antiquated" software from 1990 as in the case of gpg, why are we on irc, etc etc ? because rapid pace of what ?
asciilifeform: hanbot: ben_vulpes sent a gpg-native binary sig instead of a standard ascii-armoured one by mistake.
asciilifeform: ;;later tell ben_vulpes if you still have the original of that thing on your disk, please send to me (gpg)
asciilifeform: 'gpg -a ...' por favor.
asciilifeform: gpg --print-mds ak47_488e72a1a0f765c614518e0ca67bd733a4117e8f.sh
asciilifeform: 'gpg: Fatal: zlib inflate problem: invalid literal/lengths set'
asciilifeform: hanbot: which gpg ver ?
mircea_popescu: and guess what... "Vlad likes long romantic walks on the beach, e-mail him sweet nothings to vlad@tsyrklevich.net using his gpg key." links to keybase.
mircea_popescu: you knoiw you can just do gpg --encrypt --armor -r one -r theother righjt ?
ascii_field: this is a good summary of why, e.g., voice model and gpg mechanizm
asciilifeform: trinque: know that gpg was built just like this.
mircea_popescu: solrodar do you know what gpg is ?
mircea_popescu: http://log.bitcoin-assets.com/?date=06-07-2015#1189139 << ideally tho, dpaste is used for stuff like encrypted sends, in lieu of mail (which i love tbh, who knew irc + gpg obsoletes email!) or else for stuff like deedbotting. or generally, for spurious useless shit. ☝︎
mircea_popescu: kakobrekla oh and e) have it deedbot a statement gpg'd to the owner's key each month, listing their assets.
asciilifeform: ;;later tell mircea_popescu incoming gpg - june broadcast.
asciilifeform: i sorta want to start doing this thing where we for blocks 0 ... n, sha512sum block_n | gpg ... ☟︎
mircea_popescu: well, again, gpg has a probabilistic test for primality baked in.
mircea_popescu: but it's what gpg does anyway
ascii_field: (normal shell-only gpg builds fine on mac)
mircea_popescu: i guess you can't do that till you sort gpg huh
mircea_popescu: if you run gpg correctrly, whic his to say locally, use plaintext email
asciilifeform: re: t3rr0r1sm!!111!!!1: for all the loud usg idiocy, the head-choppers have yet to chop a head, on camera, on top of a carpet with their gpg fingeprint embroidered on it
mircea_popescu: let the man learn enough about how to use a computer to get a gpg sig and register it with the bot.
mircea_popescu: a number of explanations are readily available : a) M works on specific code that happened to be wrung out of openssh codebase somehow. differential reading of gpg and openssh should indicate it then, and patch history should show us who knows better.
mircea_popescu: even if gpg signed ?
mircea_popescu: then i was like a! wait... you can't copyedit gpg signed matter!
asciilifeform: the restless folks are also invited to visit #b-a (or my personal mailbox, gpg plz.)
mircea_popescu: yes yes. in any case, mtgox ended exactly the way faux gpg, or system d, or gavincoin, or the sec or the fbi are gonna end
mircea_popescu: http://log.bitcoin-assets.com/?date=04-06-2015#1153835 << /me would much rather see this on 8chan rather than any othe imageboard seeing how the owner of any other imageboard is a poopyhead without a gpg account. ☝︎
mircea_popescu: gpg: Good signature from "Mat Koce
mircea_popescu: curl http://mpex.co/assets/s.bbet-1F2489E8.txt | gpg gpg: Signature made Sat 05 Jan 2013 02:13:25 AM ART using RSA key ID 1F2489E8
mircea_popescu: gpg: BAD signature from "Mir
mircea_popescu hates "html email". why would anyone want html gpg
mircea_popescu: http://log.bitcoin-assets.com/?date=03-06-2015#1152160 gpg --encrypt --armor -r <yourname> hit enter then put whatever passwords in there, hit ctrl-d and save the output. ☝︎
asciilifeform: typically users of pgp/gpg upload their public keys there, and they can later be retrieved by anyone using a hash of the key
asciilifeform: mircea_popescu: again, signing a key - on ordinary gpg - does not throw your whole modulus in it
mircea_popescu: force them to have someone on 24/7 with a valid gpg sign, the works.
mircea_popescu: Hasimir minus the fact that it imports unsigned keys (badly signed it rejects, but unsigned at all seem an exception ?), gpg generally doesn't import the diddled exponent keys yeah
mircea_popescu: what you mean by deep in gpg py bowels ? is it exploitable even ?
mircea_popescu: now a bug in [some] gpg... who the fuck knows.
ascii_field: (and i'm still at a loss to craft a situation where gpg's p and q will occupy varying number of 'limbs' and lead to catastrophe in the given line)
ascii_field: well aye, but traditional gpg built for mingw doesn't do this
mircea_popescu: http://log.bitcoin-assets.com/?date=20-05-2015#1139680 << speaking of this, am I the only one nonplussed by all this "we use <<best practices>> fixed exponent" bs ? it's an unavoidalbe magic number , okay, but it's tyhe sort that should eminently be a knob for the user. a proper gpg would have e user-settable at the key generation phase (with 65536+1 as a default, sure) ☝︎☟︎
asciilifeform: mod6 et al: iirc mircea_popescu once posted his vintage tarball of gpg src
mircea_popescu: justJanne http://trilema.com/2012/gpg-contracts/ << start there.
mircea_popescu: understand, opsec is extremely weak all over. including among supposedly experienced hackers. so, a simple scenario : guy with owned userland gpg sends secret info to hpa, it is magically encrypted to wrong key, email sniffed en route, secret is now known, but only to the people knowing what to look for. hpa responds with something like bad key, guy re-encrypts it and resends it.
mircea_popescu: especially amusingm, the "key was damaged in transit" one. people p2p HD movies all day, nobody's seen this. gpg data moves around as archives - try flipping a byte in an archive see if you can stil lget the content. etc.
mircea_popescu: anyway, im not entirely sure we might ever see the diddled gpg that goes with this didlded key to produce anything interesting
mircea_popescu: mats gpg always did afaik, special algo foir this
mircea_popescu: davout two pairs of gpg keys are known, in the sense that their pubkey modulus has been factored.
asciilifeform: the thing that does the gruntwork is in c, uses gmp (as gpg uses)
mircea_popescu: copypaste https://8ch.net/btc/res/113.html#146 << ppls like the gpg lol
mircea_popescu: copypaste how does the gpg signature thing werk btw ?
ascii_field: not that extant gpg honors expiration dates, to virtually everybody's great annoyance
mircea_popescu: there are some things that don't need fixing. what needs fixing re gpg is to use rsa throughout, rather than the current lulzatron.
mircea_popescu: http://log.bitcoin-assets.com/?date=14-05-2015#1132130 << the "key deadness" as somehow a part of the key itself, is not only conceptually ridiculous but practically unimplementable. forget it, it's about as relevant to gpg as "the gnu foundation" ☝︎
mircea_popescu:  Good signature from Fredrick Brennan <admin@8chan.co>. Verify this message yourself << check out this shit, a gpg-ready chan
mircea_popescu: copypaste you know it'd be a great idea to make and register a gpg identity, that way you won't have to lose your identity
mircea_popescu: cazalla : it only imported gpg based identities, not bitcoin address based.
mircea_popescu: today. when it was decided that "well, we don't really give a shit about the debian-dominated gpg strong set"
mircea_popescu: anyway, the exercise is interesting because it puts a ceiling on costs. doing a mathematically intricate, non-parallelizable task over ~the entire space of gpg keys~, all 4mn of them, is < 10k usd.
ascii_field: sks is retarded, so i gotta write a slicer that parses the gpg blobs and reassociates the email/selfsig/pubkey fragments into usable key packets
mircea_popescu: and after, of course, the phuctor is started on processing gpg signs
ascii_field: mircea_popescu: THE DAMNED GPG KEYS!111 << dealing with sks retardation; see log
mircea_popescu pokes asciilifeform the conquering hero as to THE STATE OF THE DAMNED GPG KEYS!111
mircea_popescu: gpg nbetwork calls it "the strong set"
ascii_field: then rewrote with gmp (what gpg uses)
asciilifeform: <decimation> asciilifeform: is there a gpg keyserver that just holds pubkeys, dumps on request? << the sks servs dump, but in this mega-blob format where you get ~25MB of continuous gpg binary packet
mircea_popescu: asciilifeform no listen, so you construct the db, then have gpg spit out the list of fingerprints, then query it over that list. produces pubkyes.
asciilifeform: http://unix.stackexchange.com/questions/110110/list-all-gpg-pgp-keys-of-a-local-sks-key-server << other folks also pissed
asciilifeform: i keep thinking gpg has the key slicer functionality built in somewhere
mircea_popescu: ascii_field more on point : consider how much of the windows turdball self-cleanned by simply making gpg required for voice here.
ascii_field: unrelated: that sks key mega-dump is in a ludicrous format - .gpg binary turds with 10,000s of pubkeys in each ☟︎
mircea_popescu: jurov gpg does the same thing, yeah, but then again that was the 80s.
mircea_popescu: Error: Was that really a GPG public key? Try again.