tmsr - Log 2018-01-21

trinque: http://btcbase.org/log/2018-01-19#1773147 << I've got several cleanup patches coming before the walletsnip. anybody have a serious objection to me introducing a changelog in the first? ☝︎

a111: Logged on 2018-01-19 17:48 mircea_popescu: incidentally, there's an evident join here : http://btcbase.org/log/2018-01-18#1772670 and http://btcbase.org/log/2017-12-27#1759127 are evidently the same item. have a comment format for it and bam, project philosophy file with press history.

trinque: literature seems exactly the right item to define line of project history, both in the obvious and vtronic sense ☟︎

deedbot: http://www.loper-os.org/?p=2175 << Loper OS - Finite Field Arithmetic. Chapter 8: Interlude: Randomism.

phf: i don't grok the first homework: do you mean produce random computations, and programmatically verify ffa against them?

asciilifeform: phf: should print a, e.g., valid perlism or pythonism, that has an, e.g., foo*bar==baz

asciilifeform: or rather, if foo*bar == baz print "true" else print "false" or in that spirit.

mircea_popescu: http://btcbase.org/log/2018-01-20#1773406 << yeah i think ima have the page style changed. ☝︎

a111: Logged on 2018-01-20 22:55 diana_coman: http://btcbase.org/log/2018-01-20#1773347 <-as I realised I never said this anywhere: this trouble with no-pingbacks on page is part of the reason why I have post+page for this sort of thing (the code reference shelf is one, the bac data another) - so that pingbacks can go at least to the post introducing the page; ugly workaround of sorts

mircea_popescu: http://btcbase.org/log/2018-01-21#1773416 << but make it cool. ☝︎

a111: Logged on 2018-01-21 02:36 trinque: literature seems exactly the right item to define line of project history, both in the obvious and vtronic sense

mircea_popescu: really ?

mircea_popescu: !!pay BingoBoingo 0.25 ☟︎

mircea_popescu: BingoBoingo do a few trades with the locals to get a feeling of the place an' report ; also gpgram me the story of bbisp fiat holdings ab origine. ☟︎

mircea_popescu: meanwhile in "going back to school" footage, http://78.media.tumblr.com/73ffe3190c6d38afe2a384cab6b1b60e/tumblr_oh67lkmHIl1rqo4hto1_400.gif

mircea_popescu: kids can't commit.

mircea_popescu: http://thetarpit.org/posts/y01/038-the-archive.html << this is so fucking endearing. ☟︎

mircea_popescu just re-read it, and it's like... hello 1995! where were you all these years!

mircea_popescu: here's the sad fact of the matter : if you plot the HVF against the IVF, you will discover that the diff doesn't get above water until far far FAR three standard fucking deviations out in right field. for most humans information value is negative.

mircea_popescu: (where HVF is the human value function, ie in most cases http://trilema.com/2014/the-battlefield-of-the-future/#selection-133.333-133.484 ; and IVF the information value function, ie in most cases... http://trilema.com/2014/holy-shit-technical-analysis-is-real/#footnote_0_57849 )

mircea_popescu: and i don't even mean ~subjective~ functions here! it's not a case that "to the exceptionally gifted as identified by ivy league, worth as he is maybe $1000 with clothes included, the subjectively perceived marginal value of information is slightly negative. no, no, no, OBJECTIVE, you can tell him whatever the fuck you will and he will not have any use for it -- i don't mean "he won't be able to find any use, above his $1k pa

mircea_popescu: ygrade", i mean there WILL NOT, period, be anything he could have fucken found.

a111: Logged on 2016-05-30 15:37 asciilifeform: but i find it hard to see how it is not obvious that 'every sewer rat can publish' is a considerable damper on culture

mircea_popescu: that's even a separate problem, naggum's http://btcbase.org/log/2014-02-26#532023 ☝︎

a111: Logged on 2014-02-26 06:23 asciilifeform: channelling herr naggum: 'It is like going to a library full of books that took 50 man-years to produce each, inventing a way to cut down the costs to a few man-months per book by copying and randomly improving on other books, and then wondering why nobody thinks your library full of these cheaper books is an inspiration to future authors.'

mircea_popescu: we're not even considering the point of, "could okcupid/facebook/mit/etc scum rewrite trilema". we are considering whether "the collective of x" COULD EVEN BENEFIT from reading it.

asciilifeform: i suspect that the 'benefits from reading x' circle is never all ~that~ much larger than the corresponding 'could have written x' circle.

mircea_popescu: http://trilema.com/2011/la-ce-imi-serveste-mie-radicalurile/ fails to even consider or discuss this point (for sheer lack of interest at the time), BUT : for most people, square roots as the concept do not bring any sort of gain.

shinohai: A monkey hitting keys at random on a typewriter keyboard for an infinite amount of time will surely recreate Trilema!

mircea_popescu: teaching MOST girls basic numeracy is not actually a gain for the most girls in question ; the whole thing is that for the ~very fucking few~ for whom it IS a gain, it is such a thundersome gain it eclipses the "inconvenience" imposed upon the majority.

mircea_popescu: which is why societies that fail to teach basic numeracy to girls as a collective spring up all the time, and quite naturally : they are realising "savings" in the sense of bacteriums.

mircea_popescu: asciilifeform and so what if "Even carpenter" ? most items that crawl out from between woman's legs can never be a carpenter.

mircea_popescu: fucking jesus was a MEDIOCRE carpenter.

mircea_popescu: but yes, asciilifeform 's suspicion is very much my own -- the "chuka writer" and the "chuka reader" circles are very close to identity.

mircea_popescu: (has any of the reformed-judaism-that-calls-itself-xtianity folk even CONSIDER to date that it's fucking weird their divine item was shown as ~a very competent nigger~, talking smack in church and whatnot, but is not even CONSIDERED in terms of his vocation ? where's the passage in the "here's what we stole from torah" where it is gone into detail as to the quality of the man's joints ? because there's oodlebunches of idle pa

mircea_popescu: ges of x begot y who lived z until one falls over. THAT is what interests you ? really ?)

mircea_popescu: i wanna see jesus' carpenting school exam work, not that he fucking impressed a buncha journahos with his "profundity".

asciilifeform: mircea_popescu went to the wrong door, then, lol, the christians dun worship artisanry, the masonic door is down the hall

asciilifeform: ( imho cargocultized artisanry is not particularly more attractive than this item. )

asciilifeform: though could observe, the brotherhood of folx who indeed 'serveste mie radicalurile' went pretty far.

mircea_popescu: if you are to evaluate a <30 yo boy, do you want to see his nigger records or his work records ?

mircea_popescu: consider : http://trilema.com/2012/culture-shock-ama/

mircea_popescu: noob joins trilema, someone asks sto etcetera, noob answers.... "here's a thing i made", and it goes over well.

mircea_popescu: noob answers a la http://btcbase.org/log-search?q=lubos+motl it's not JUST that it doesn't go well. it goes fucking terribad.

mircea_popescu: yet to date we've always evaluated.

mircea_popescu: asciilifeform he has an excellent point though. it's fucking unseemly, EVERYONe must report to google they're reading loper ? come the fuck on.

mircea_popescu: use mp-wp, dun have the problem.

mircea_popescu: i have the feeling we discuss this periodically. what's dynamic ip to do with it ?

mircea_popescu: i think so, yes.

mircea_popescu: my own notes say "he for some reason confused the ip of the people leaving comments with his own, went off tangent ; to be rediscussed later".

mircea_popescu: it's the expectation here.

asciilifeform: mircea_popescu didja ever describe how your spamfilter worked, in the logz ?

hanbot: asciilifeform i'm using mp-wp on nfs and spam works pretty much as expected ---though having ~10k marked spam comments helps.

mircea_popescu: there's a number of parts to it! but it makes no foreign calls / doesn't rely on the akismet bs, if you can run php oyu definitely should be able to run it

asciilifeform: hanbot: what means '10k marked spam comments' ? and didja ever post your patches on mp-wp ?

asciilifeform: and if it works on hanbot's www, it oughta work in mine, unless hanbot's definition of 'works' differs from mine

mircea_popescu: one thing it does is <input type="text" name="author18c6e55" with that hash changing daily (or how often you please) ; another thing it does is a "refuse from ips in spam list" ; there's more i might nor recall right off.

mircea_popescu: asciilifeform i dun expect it is possible for it to not work if wp otherwise does work.

mircea_popescu: it has a queue of items to be reviewed (by default everything with a link goes in there). so in this sense it takes some training.

asciilifeform: other thing, does it require a php that has write permission to the disk ?

mircea_popescu: (well, not exactly, "anything with a link not on a list of permitted links", but anyway)

mircea_popescu: asciilifeform no, it has a db, from wordpress.

hanbot: 10k marked spam comments means spammy ips are stored and attempted comments from same don't show up in admin, subjectively over time it's seemed i need to spend less time mopping shitcomments. and i didn't post proper patches, but will.

mircea_popescu: i have Spam (17,852)

asciilifeform: hanbot: i'd luvv a working-with-nfs patchset on mp's wp. unfortunately my own wwwism proved insufficient to make it go.

mircea_popescu: these are all distinct ips as at some point (maybe 2015 ish ?) i wiped dupes. but i get maaaybe 1 spam item in review queue per day

mircea_popescu: in fact, let's look here : cheap Path of Exile currency on 2018/01/21 at 4:03 p.m. soehakef on 2018/01/21 at 2:30 a.m. kenyaso60 on 2018/01/20 at 11:44 p.m. zunepudaz on 2018/01/20 at 4:00 a.m. CraigSmild on 2018/01/19 at 2:41 p.m.

mircea_popescu: that's the past 5, covering a coupla days. so i guess it's more than 1/day

mircea_popescu: but not by much.

asciilifeform: sometimes i see obvious spamola on trilema. but always assume that mircea_popescu let it through for lulz/collectiblevalue

mircea_popescu: yeah, in order to show up i have to approve it, so it's no accident.

mircea_popescu: anyway; game gold 1, viagra 2, pron 1, russki weird 1, pretty balanced.

mircea_popescu: lol.

mircea_popescu: ahaha check this shit out!

mircea_popescu: Obedience training should be calm, firm, [url=<snip>wholesalenfljerseyscheap.cc/]Cheap NFL Jerseys Wholesale[/url], quiet,[url=<snip>wholesalenfljerseyscheap.cc/]Cheap Jerseys Online[/url], and persuasive, rather then demanding or sharp. This is why; getting all the information about most suitable nuts and bolts detroit company is important.Another benefit of renting construction equipment is that you get to manage your budge

mircea_popescu: t well because you only have to pay for the number of days and weeks that the equipment would be used.The back office library is like a gold mine of thousand dollar methods used by the leading earners in the business.

mircea_popescu: adaptive text!

mircea_popescu: aaand holy shit! "Предлагаем нашим покупателям удивительное средство для похудения сироп Мангустина. С его помощью можно избавиться от 10 kg за 2 недели."

mircea_popescu: !#s mangosteen

mircea_popescu: LOWTAX LIVES!! in russia!

mircea_popescu: nah some plant ; ancient internet lulz.

asciilifeform in 'museum of komunnist konsoomer' leafed through ancient ro mags, and ran into the 'gerovital' lulgem

mircea_popescu: https://encyclopediadramatica.rs/Lowtax << primer

mircea_popescu: asciilifeform thatactuallyworked.!!!

asciilifeform: it was hilarious, i went into a couplea pharmacies, saw ~nuffin that was recognizable as actual pharma, mostly various gerovitals, groundhog fats, snake oils (literally)

mircea_popescu: they sell better.

mircea_popescu: meanwhile in "this is what YOU MUST DO! TODAY!!! so your shithole country/town/life/whatever picks up", http://78.media.tumblr.com/c04a49b94572fe2aaeb4208cc78b4a6e/tumblr_od98qpXtJo1uu92gho1_1280.png

hanbot: hey shinohai, what is wp-patch2.diff in the mp-wp hosted @ http://btcinfo.sdf.org/uploads/wp-mp.tar.gz ? i see no sig, no...from where/whom is it? ☟︎☟︎

shinohai: I was unsure hanbot, I don't recall if I ever asked mp about it, or why it was included in the copy I got originally.

shinohai: The only garbage I remember in the one on my site was I changed icons in the images/ directory, otherwise I believe as I received.

shinohai: Worth looking into tho, I should grep and see if this patch was applied at some point in there. Thanks for notifying!

BingoBoingo: <mircea_popescu> BingoBoingo do a few trades with the locals to get a feeling of the place an' report ; also gpgram me the story of bbisp fiat holdings ab origine. << Will do

mircea_popescu: hm, i don't recall that diff file hanbot

hanbot: mircea_popescu no wonder --looks like you published it (for phf & asciilifeform) on july 3rd of 2016, file date is july 23rd

a111: Logged on 2016-07-03 23:19 phf: asciilifeform: i also made a patch, but sounds like you don't need it anymore http://107.170.141.103/wp-content/uploads/2016/07/wp-comments.diff

mircea_popescu: genesisless patches ftw.

mircea_popescu: sometimes (often) wordpress manages to lose a pingback ; that thing will walk your db, spit out properly formatted xml payloads for all links in all your (published) posts. the resuilt can be run as a bash script to catch up on any missed pingbacks.

mircea_popescu: basically mechanized http://btcbase.org/log/2018-01-20#1773304 ☝︎

a111: Logged on 2018-01-20 15:43 mircea_popescu: spyked re pingback thing, doesn't even have to be that hand-generated ; just walk the db, extract all links, construct the calls as shown and make curl calls. can be a bash script.

trinque: google "asciilifeform_kills_integer_retardation", get >> https://pbs.twimg.com/media/CJKpqS2UYAAAA9i.jpg

trinque: anyhow if anyone recalls specifically why int64_t was present on some systems and not others, I'd be interested for the HISTORY file.

trinque: my current wager is folks that had it were using a gcc5, which is defaulted to a later standard for C ☟︎

mircea_popescu: trinque i can tell you it was a multi-week pain in the ass to clear the shit out of eulora codebase.

mircea_popescu: basically, 32 bit had an int type that became incompatible with 64 bit for ~no reason

mircea_popescu: it all comes back down to "byte is machine word but idiots wanna do dumb shit", im pretty sure

phf: http://btcbase.org/log/2018-01-21#1773562 << pretty sure that's one of mine, it's either comments.diff or it could be a diff against the baseline wp of that vintage (i wanted to see what kind of modifications exactly mp version introduced) ☝︎

a111: Logged on 2018-01-21 19:23 hanbot: hey shinohai, what is wp-patch2.diff in the mp-wp hosted @ http://btcinfo.sdf.org/uploads/wp-mp.tar.gz ? i see no sig, no...from where/whom is it?

mircea_popescu: yesbut! YOU SEE ?

mircea_popescu: don't do that.

phf: did you get the source directly from mp, or did i republish it? i remember being asked for the source and putting it up at some point, but i don't remember by whom and too lazy to log in this case

phf: eh, at best an idle curiosity. in any case original prod didn't have any diffs in it

mircea_popescu: BingoBoingo how the hell can that thing contain NO numeric characters ?! do it properly, x - y - z - k = q.

mircea_popescu: meanwhile in "i'm just the doorman", http://78.media.tumblr.com/6c5e2674d445a6547e578c7061b531e2/tumblr_inline_o2qnfetugT1thjhje_1280.jpg

hanbot: i'm trying to make a genesis for mp-wp ; first coupla lines of vdiff's output could be a problem: http://wotpaste.cascadianhacker.com/pastes/irACN/?raw=true . what's the policy on this?

phf: hanbot: there's no policy on this, it's an unsolved problem with lots of different solutions

phf: the oldest solution, by i believe mp, is "replace all the mp-wp images with their svg equivalents"

mircea_popescu: myeah. phf will your differ properly handle binaries by hash ?

phf: second solution that was entertained by ascii was to base64 encode binaries and have a second pass with something like makefile to pack them back into place

phf: third solution, that's latest conversation in logs on subj is that perhaps binary blobs don't really belong in a vdiff which is a human readable code container, and should just be packed separately into e.g. a signed TAR archive and unpacked into place as a second pass

mircea_popescu: hanbot honestly looking at the list, just delete them

mircea_popescu: let people provide their fucking own avatar favicon etc.

phf: you're going to run into png's that are admin interface ux elements that you can't just delete

mircea_popescu: how come not on her list ?

phf: mircea_popescu: it's not clear to me what "properly handle" is, given the many conversations on the subj. there's no reason why it couldn't if there was some direction as far as proper. i'm personally leaning towards the idea that binary blobs shouldn't be in vpatch (as per latest thread on subj), but it's a non-pragmatic take ☟︎

mircea_popescu: phf there's no direction re proper cuz of first principle issues, i dun want to make dumb part of the history.

phf: (there's yet another solution is to actually provide a binary patcher, that uses some minimal delta algorithm to patch files, while also providing the patching details in plain text. so you could say that the result is readable in a sense that it takes file FOO and replaces bits #10 #1343 #325435 etc)

mircea_popescu: kinda what i was asking

mircea_popescu: and why minimal. do actual fragment recognition.

douchebag: mircea_popescu: I'm a little bored at the moment and I'm looking to practice my web application pentesting skills, would you mind if I took a look at your site and try to identify any potenial vulnerabilities?

mircea_popescu: go ahead. which site is that ?

mircea_popescu: sure.

douchebag: Alright forsure, if I were to find something how would you want me to disclose the information to you in a secure manner?

mircea_popescu: can just say it here.

douchebag: Last night I found a rather interesting vulnerability in a website for a bug bounty, second time I've been able to leverage SSRF to XXE, very fun stuff.

mircea_popescu: douchebag you mean like http://btcbase.org/log/2018-01-15#1770657 ? ☝︎

mircea_popescu: notreally ; republic mostly despises the sv-powered "tech" ; you'll find pmarca's notion of "the web" doesn't carry much water, or interest, among actually competent computer folk.

mircea_popescu: hanbot ima put this in and see. standby

mircea_popescu: incidentally re http://btcbase.org/log/2018-01-07#1766550 : https://archive.is/56zkT#selection-2319.1-2318.1 ☝︎

a111: Logged on 2018-01-07 20:28 mircea_popescu: he also wrote a lisp-is-faster-than-c item back in the days the microsoft hired hands were pissing all over o'reilly&marc "my middle name is cocksucker" andressen's java

mircea_popescu: 2000 vintage no less.

mircea_popescu: douchebag you're familiar with how there's a group of idle cocksuckers holding conferences and printing books about "technology!" which immutably consists of pointless websites run as investor swindles ? groupon, facebook, what have you. http://trilema.com/2015/you-know-what-gets-no-airplay-unflattering-truth/ sorta thing.

mircea_popescu: sv there stands for silly-cons valey.

mircea_popescu: and con stands for confidence game, ie scam.

mircea_popescu: hanbot http://trilema.com/2018/iti-minca-cinii-din-straita/ << pretty terrible, lost all transparency etc. but WILL WORK.

mircea_popescu: i would definitely put up with this in exchange for all-svg.

mircea_popescu: and at 5kb which is mostly comment crap...

douchebag: Ohh right, I understand. I agree, however to me I treat web application pentesting as almost a sort of game or puzzle, in my opinion it is rather entertaining challenge to be able to modify a web applications behavior in a way that leads to total comprimise.

mircea_popescu: i guess. stuff like http://trilema.com/2016/to-the-dao-and-the-ethereum-community-fuck-you/ pays better.

mircea_popescu: but yes, fucking up the empire's "technology" ie, websites, is a perfectly fine entry point towards actual life.

douchebag: I plan on learning more about low level memory exploitation in the future, however it's a bit more difficult these days due to stack canaries and other protections to prevent that sort of stuff from happening.

mircea_popescu: i thought the whole "memory security" shit sandwich just got blown to smithereens coupla weeks ago.

mircea_popescu: how old are you, if you don't mind teh asking ?

mircea_popescu: to quote the universal george c. "that's a fun age!"

hanbot: mircea_popescu : if you'd prefer, there's also a format to encapsulate em as base64: http://wotpaste.cascadianhacker.com/pastes/RlPyK/?raw=true

mircea_popescu: anyway, you're on to something here douchebag ; work on it, with serious dedication, by the time you're as old as the rest of these guys you'll prolly be more valuable than them.

mircea_popescu: hanbot o shit yeah! you just cracked this nut wide open.

mircea_popescu: do me a favour and walk the list of binary images, applying one or the other as best fits.

mircea_popescu: no-binary mp-wp is a major fucking progress ; and if we set the groundwork for eventual complete rejection of all binary formats, image and then video, holy hell we got it.

douchebag: Thanks man, I've been spending a lot of my time focusing on security research and helping others get involved in the InfoSec community. I have a pretty decent resume compared to most people I go to college with because I have a pretty decent amount of experience, and when it comes to InfoSec jobs experience is probably the most important factor for most employers ☟︎

spyked: http://btcbase.org/log/2018-01-21#1773463 <-- lol! and quite naive, didn't actually consider information value at all; kinda begs the question of the ifv in the ol' library of alexandria. probably a lot higher than the web, given the economy of writing (imposed by those times' tech). brings us back full circle to http://btcbase.org/log/2016-05-30#1473632 ☝︎☝︎

a111: Logged on 2018-01-21 16:51 mircea_popescu: http://thetarpit.org/posts/y01/038-the-archive.html << this is so fucking endearing.

a111: Logged on 2016-05-30 15:37 asciilifeform: but i find it hard to see how it is not obvious that 'every sewer rat can publish' is a considerable damper on culture

spyked: http://btcbase.org/log/2018-01-21#1773596 <-- iirc intN_t are C99-specific types, but gcc 4.8 and 4.9 compile just fine, assuming stdint.h is included (workedfor me even with -std=c90) ☝︎

a111: Logged on 2018-01-21 21:38 trinque: my current wager is folks that had it were using a gcc5, which is defaulted to a later standard for C

trinque: my question was particularly what let people get by without it, and it appears to be a question of what c standard was the default in what gcc

spyked looked at the patch. admits to not being able to compile an example with gcc 4.9 nor 5; so there's probably more to it, e.g. C++ voodoo. I'm curious of asciilifeform's answer ☟︎