log
152 entries in 0.344s
asciilifeform: mircea_popescu: the spot check model is, again, wholly inadequate. if you have ONE debianism or heartbleed etc. it literally does not matter worth a shit how 'clean' the remainder of it may have been.
asciilifeform: does, e.g., heartbleed, qualify as 'good toy' ? considering that openssl was known, to everyone who gave half a rat's arse, to be a cistern of liquishit, long prior ?
asciilifeform: heartbleed also sat 'without trouble'.
a111: Logged on 2017-01-14 01:28 mircea_popescu: aqnyway, the "hive mind" is fucking comedic already. FIVE YEARS with the subverted python, got them nowhere. close to five years pushing rust, nothing to show for it. systemd is still mostly a joke, and the hatred is growing exponentially while the pustule is growing logarithmic at that. meanwhile the republic cracked open the heartbleed in quite the painful fashion, no matter how much effort went into "rehappening" it. not t
mircea_popescu: aqnyway, the "hive mind" is fucking comedic already. FIVE YEARS with the subverted python, got them nowhere. close to five years pushing rust, nothing to show for it. systemd is still mostly a joke, and the hatred is growing exponentially while the pustule is growing logarithmic at that. meanwhile the republic cracked open the heartbleed in quite the painful fashion, no matter how much effort went into "rehappening" it. not t
Framedragger: i think he's just young (https://github.com/FiloSottile). i remember his heartbleed test tool, it wasn't innovative but was useful. (but i hear what mircea_popescu is saying)
mircea_popescu: notice how he glued himself to heartbleed (which, unlike the normal hanno bockian crap, was a surprise to the empire).
thestringpuller: after heartbleed OpenSSL should have been avoided like the plague
asciilifeform: hoose to use corporate-maintained tools like OpenSSL, which are deeply compromised. Do you think the people responsible for HeartBleed were held accountable, and fundamental changes were made? Guess again. It’s simply ignored by most of Linux. (You’ll notice real UNIXes like OpenBSD did not ignore it and have begun serious changes. Yet even there, it took such a serious, obvious exploit for them to see the engineering problem.)'
asciilifeform: 'Remember Heartbleed? Don’t let that example escape your attention. OpenSSL is open, yet it is so large and poorly designed that it’s a dark mystery. Heartbleed was easily shown to be a deliberate hack, and was even deliberately coded to hide itself from tools that would otherwise have shown the leak. And it was sitting there in ‘open’ sight. Instead of using small, well-reviewed crypto libraries, corporate Linux developers c
asciilifeform: none of it is even 'heartbleed'-grade.
hanbot: for the record, it's not just phuctor that your friend Boeck [could have done] did. See also [could have] found Heartbleed: http://www.openwall.com/lists/oss-security/2015/04/07/7
BingoBoingo: <davout> for some reason this hoaxtoshi stuff seems very interesting to journos << Heartbleed and the bash vulnerability made radio
asciilifeform: the modus operandi of the enemy is to insert 'bugs', e.g., 'heartbleed', and to prevent attribution.
asciilifeform: the 'why' of this is best illustrated by the heartbleed incident.
asciilifeform: same story as, e.g., heartbleed.
assbot: Logged on 06-01-2016 15:46:58; ascii_butugychag: 'Filippo Valsorda. I'm Italian and I work on the CloudFlare Security Team in London. I built the public Heartbleed test and I mess with cryptography. Public speaker. Motorbike rider. Frequent flyer. Hacker School F'13.'
ascii_butugychag: 'Filippo Valsorda. I'm Italian and I work on the CloudFlare Security Team in London. I built the public Heartbleed test and I mess with cryptography. Public speaker. Motorbike rider. Frequent flyer. Hacker School F'13.'
assbot: Logged on 31-07-2015 03:53:10; asciilifeform: coderwill: on top of the thousand and one other sins, tor linked in ssl at the height of 'heartbleed' - something which pretty much nobody is speaking of today
asciilifeform: coderwill: on top of the thousand and one other sins, tor linked in ssl at the height of 'heartbleed' - something which pretty much nobody is speaking of today
trinque: your point about heartbleed is well taken
asciilifeform: http://www.businessinsider.com/heartbleed-fix-faw-openssl-hacking
asciilifeform: i personally refuse to make any distinction between someone who wrote, e.g., 'heartbleed', into existence - and some other fella who ~knew of it and didn't tell me~
BingoBoingo: <asciilifeform> 'Andy confirmed that Coverity does not spot the heartbleed flaw and said that it remained stubborn even when they tweaked various analysis settings.' << Can't spot heartbleed because custom OpenSSL malloc
asciilifeform: 'Andy confirmed that Coverity does not spot the heartbleed flaw and said that it remained stubborn even when they tweaked various analysis settings.'
thestringpuller: mircea_popescu: do you have the source for the pull request where hearn tried to merge in heartbleed?
mircea_popescu: note for instance that the various "emergency problem - update required" stuff is in NEW-ish versions. like, heartbleed ? ubuntu 10.04 was fine. 12.04 ? owned.
ascii_field: 'When we tried wget, it detected errors, retried, and finally succeeded. It said the error was a bad length field in a TLS packet. That didn't make sense at first because we thought TLS packets were error corrected by TCP.' << incidentally, i am not certain that i agree with the author's conclusion ('reverse heartbleed'.) it may very well be an attempt to exploit other braindamage in http stack
mircea_popescu: "Heartbleed is a read buffer overflow. What that means is that an application is reading outside the boundaries of a buffer. For example, imagine an application has a space in memory that's 10 bytes long. If the software tries to read 20 bytes from that buffer, you have a read buffer overflow."
assbot: How Heartbleed could've been found - Hanno's blog ... ( http://bit.ly/1GlIn4J )
mats: https://blog.hboeck.de/archives/868-How-Heartbleed-couldve-been-found.html << uses afl!
mircea_popescu: if there isn't another heartbleed in there, someone's been slacking on their job.
BingoBoingo: <thestringpuller> well only OpenSSL had heartbleed << The other big SSL implementations had their own flaws unveiled in the following months that essentially accomplished the same insecurity.
thestringpuller: well only OpenSSL had heartbleed
assbot: Logged on 29-03-2015 16:49:24; Chillum: most protocols have had a vulnerability at some point. Heartbleed was a bug in openssl, not a bug in ssl
mircea_popescu: http://log1.bitcoin-assets.com/?date=29-03-2015#1078817 << heartbleed was a bug in PKI. outright.
Chillum: most protocols have had a vulnerability at some point. Heartbleed was a bug in openssl, not a bug in ssl
asciilifeform: <Chillum> Routers are a sad state of affair. Something like 70% of consumer wifi routers in the wild are vulnerable to heartbleed << and a fella who knows this, is still fond of ssl ? amazing
Chillum: Routers are a sad state of affair. Something like 70% of consumer wifi routers in the wild are vulnerable to heartbleed
Chillum: I am aware of heartbleed, an implementation failure
asciilifeform: Chillum: if you worked in security, did you sleep through 'heartbleed' ?
asciilifeform: mats: if you have philosophical objections to 'behave as if X even if possibly ~X is true' then try to come up with some other syllogism. but it -must- end in 'the people who gave us heartbleed and dual_ec DO NOT GET TO MAKE CRYPTO ANY MORE'
assbot: Logged on 27-09-2014 02:35:49; asciilifeform: if you create a 'heartbleed' - you are a вредитель. and whether you did it intentionally, given the impossibility of proof - does not matter.
decimation: not that heartbleed really matters for our purposes
asciilifeform: i suggest fixing by using a pre-heartbleed openssl
pete_dushenski: mr. heartbleed ?
asciilifeform: at any rate, no https, no heartbleed
thestringpuller: kinda weird how older clients naturally won't have heartbleed
asciilifeform did not test with anything other than the shortly post-heartbleed turdball specified in 'portatronic'
assbot: heartbleed in rust ... ( http://bit.ly/1Dz2WFT )
BingoBoingo: http://www.tedunangst.com/flak/post/heartbleed-in-rust << implied lolz
thestringpuller: asciilifeform: or a lot of malice in the case of heartbleed
asciilifeform found it very surprising that tor survived as a going concern after 'heartbleed'
mircea_popescu: leaving aside that nobody i ever knew was seriously using the newer debian releases anyway for any purpose, you';d have to be fucking insane to think the way this goes is, we kill their heartbleed and they sit and wait.
mircea_popescu: "A failure to properly filter specially formed packets makes it possible for attackers to execute attack code of their choosing by sending malicious traffic to a Windows-based server." << sounds like windows had a replica of heartbleed.
mircea_popescu: and that n is pretty fuckingly scary high, what with the heartbleed headshot and all the other outlays generously handed out by la serenissima.
thestringpuller: mircea_popescu: what if someone doesn't sign "heartbleed introduction" then no one is accountable and system is moot
bounce: you think heartbleed was intentional?
asciilifeform: the hidden little shitgnomes like author of heartbleed - they are the ones who needs the lethal sunlight rays the most.
asciilifeform: if you create a 'heartbleed' - you are a вредитель. and whether you did it intentionally, given the impossibility of proof - does not matter.
asciilifeform: (and yes - we know author of 'heartbleed.' and he's alive and well and still contributing code to public projects, afaik. why? don't ask me)
mircea_popescu: this is like saying that heartbleed affected the better ssh implementation.
BingoBoingo: Seems Heartbleed gave OpenBSD the full paranoia as well
ben_vulpes: this guy helped shut watch-only wallets and addresses out of the core client, while merging in heartbleed.
ben_vulpes: <asciilifeform> no heartbleed, no pagerank. << search engines. next frontier of bitcoin.
asciilifeform: no heartbleed, no pagerank.
mircea_popescu: GinAddict1 mike is the chief enemy plant in bitcoin. he's the guy that merged heartbleed in bitcoin for absolutely no legitimatereason, and he's the guy that forced a hard fork, idem.
assbot: The author of the OpenSSL Heartbleed bug also wrote the spec : programming
asciilifeform: (what list? the one containing this fellow: http://www.reddit.com/r/programming/comments/22i30k/the_author_of_the_openssl_heartbleed_bug_also)
decimation: imagine if you could be publicly executed for distributing heartbleed
asciilifeform: everybody can get behind the impalement of author of 'heartbleed' but problem goes deeper.
mircea_popescu: he also merged heartbleed into the codebase.
mircea_popescu: btw, speaking of the derp foundation : did it yet get around to pointing out that people who had stopped updating bitcoin pre 8.0 were invulnerable to heartbleed, whereas people who hadn't stopped updating lost all their key material in the interval ?
mircea_popescu: <asciilifeform> this is also the answer for why 'heartbleed' was necessary, considering that usg has at-will access to root certs << not that simple.
asciilifeform: this is also the answer for why 'heartbleed' was necessary, considering that usg has at-will access to root certs
dignork: mircea_popescu: might be heartbleed probes
assbot: Meet Cupid, the Heartbleed attack that spawns evil Wi-Fi networks | Ars Technica
BingoBoingo: http://arstechnica.com/security/2014/06/meet-cupid-the-heartbleed-attack-spawns-evil-wi-fi-networks/
asciilifeform: same hearn who tried to slip heartbleed into bitcoind ?
HeySteve: they hint it's related to heartbleed, NRPE or Ebury, not that I'd heard of the other 2
mircea_popescu: and we wiped their heartbleed.
mircea_popescu: ThickAsThieves i dare not think they perhaps haven't reported on heartbleed yet, because well...
mircea_popescu: on that note, often manufacturers explicitly forbid to install updates and servicepacks since it might well break the app. << since heartbleed i'm going to forbid any upgrades as part of the contract in all cases, always and forever.
fluffypony: HeySteve: it depends - if you're trading with them then they generally have to auth; whilst you can check with nickserv if they have enforce on and are identified Freenode have said that it's possible NS passwords were leaked coz of heartbleed
ozbot: Canadians arrest a Heartbleed hacker - Apr. 16, 2014
fluffypony: http://money.cnn.com/2014/04/16/technology/security/canada-heartbleed/
fluffypony: davout: I'll fathom that they had logins etc. scraped when they were Heartbleed vulnerable, and the attackers waited till now to use them
ozbot: This reader mocked Heartbleed, posted his passwords online. Guess what happened next.
BingoBoingo: http://www.washingtonpost.com/blogs/the-switch/wp/2014/04/15/this-reader-mocked-heartbleed-by-posting-his-passwords-online-youll-never-guess-what-happened-next/
jurov: http://thecodelesscode.com/case/140?topic=Heartbleed+Bug also :D
mike_c: test its servers for heartbleed?
mircea_popescu: ahaha! check out the GRIBBLE HEARTBLEED
asciilifeform: wonder if i'm the only one who automatically thought 'diversion' when the heartbleed crap came out.
asciilifeform: <robwizz22> complete lie, meant to play on people's recognition of the word "heartbleed bug" without knowing what it is. There is no SSL anywhere within 100 miles of a Cardano, nor did I ever mention it. You seem to be playing off of your audience's ignorance. Is this really want you want to be doing with your life? Selling snake oil? Being a fraud?
asciilifeform: <robwizz22> the shelf usb storage to store a private key and pass phrase). You are lying about its benefits. You've come up with something absolutely and utterly useless. If it's a scam, good job. I like how you spread FUD about me trying to "introduce heartbleed" (which doesn't make any sense - the Cardano is a USB device) when I pointed this out. You obviously are smart enough to know that is a simple a
ozbot: Heartbleed certificate revocation tsunami yet to arrive | Netcraft
asciilifeform: http://news.netcraft.com/archives/2014/04/11/heartbleed-certificate-revocation-tsunami-yet-to-arrive.html
asciilifeform: since my original paste on how robwhiz22 tried to persuade me to include heartbleed in cardano has been censored (!), here's a new one, of same: http://pastebin.com/yvhVVs7C
gribble: NSA knew about Heartbleed for two years - Bloomberg — RT USA: <http://rt.com/usa/nsa-knew-heartbleed-hacking-years-004/>; DO NOT USE TOR RIGHT NOW. HEARTBLEED IS AFFECTING ALL ...: <http://www.reddit.com/r/DarkNetMarkets/comments/22k76z/do_not_use_tor_right_now_heartbleed_is_affecting/>; If You Want Privacy or Anonymity or Security, Stay Off the Internet ...: (1 more message)
asciilifeform: ;;google tor heartbleed