lambda.chat

Ginger

12:52

ANNOUNCEMENT: lambda.chat now supports full markdown formatting, including code syntax highlighting!

Ginger

13:43

@RadvylfPrograms ?

Radvylf Programs

oops

Ginger

:　|

todo: make it so that error banners can actually be closed

which they currently cannot

Radvylf Programs

14:01

My errors fade with each keystroke

(The cooldown ones don't, those count down)

Ginger

14:24

hey lemme count how many modules I'm using

- replit db
- markdown
- socketio
- emoji
- bleach
- requests
- pywebpush
- flask
- jellyfish
- eventlet
- pygments
- os
- logging
- html
- json
- base64

Counting stdlib modules, that's 16

so do you want that key or

Radvylf Programs

Oh, yeah. Just a sec.

Ginger

should I encode it with base64?

Radvylf Programs

Encode it however you wish

Ginger

would base64 be more convenient tho

because I can also send it as raw bytes

(in general use)

lyxal

14:43

Just make a private github repo, invite Radvylf as a collaborator and put it there

Radvylf Programs

No, that's a bad idea

lyxal

A text input on your website isn't?

Ginger

I was going to POST it to him

Radvylf Programs

@lyxal No, because it goes straight to my server, can't be intercepted, and doesn't stick around for the rest of time on GH's servers

Ginger

or I could just post it here /s

Radvylf Programs

14:46

My SE password is LyxalIsCool$$$144, just change my username to your key and I'll get HN to change it back

2

Ginger

okay then

OR, I could encode it with your public key and send it to you

Radvylf Programs

I'm getting the server set up, you'll just POST { "pass": "..." } as application/json to https://rto.run/lambda

Ginger

alrighty

I'll send it as base64 then bc I don't think JSON can do bytes

Radvylf Programs

Okay try it now

Ginger

alrighty

Radvylf Programs

15:02

Wait I'm an idiot

It's not forwarding yet

Ginger

lmao

Radvylf Programs

Try again

Ginger

ok, posting now...

502

@RadvylfPrograms ^

Radvylf Programs

Try again

Ginger

ok

502 again

@RadvylfPrograms ^

Radvylf Programs

15:11

I'm getting 400s now, which is better, but none of my logging is telling me why

Ginger

._.

Radvylf Programs

Ooh 502 now

Ginger

so I just realized that replit doesn't let you modify secrets programmatically

so I guess I get to make an encrypted file with the key and store the key for that in secrets :p

Radvylf Programs

Okay it should work now

Ginger

here we go

AYYYYYY 200

Radvylf Programs

15:17

I got it

Ginger

:D

Radvylf Programs

32 bytes, right?

Ginger

let's do a checksum check

Radvylf Programs

Do sha_256("check thu-may-26-2022" + key)

Ginger

sha256

Radvylf Programs

15:19

@RadvylfPrograms This way, the amount of useful information we leak about the key is minimal

Ginger

alright

I'll encode it in base64 so I can post it here

I got RufRLxk8orM6JYd2sW/Ol5XlXzsBDT9DvQy2dvszAHo=

Radvylf Programs

I didn't

Ginger

Did you add the strings before encoding?

I used this code:

base64.b64encode(hashlib.sha256(("check thu-may-26-2022" + key).encode("utf-8")).digest())

Radvylf Programs

Base64 key or binary?

Ginger

b64

Radvylf Programs

15:23

Oh, well what's the point of that?

We know I have the right base64 one

It's the proper decoding of it that I need to confirm

Ginger

hmmmm

okay, lemme do that

Radvylf Programs

I get di0QiGhNEKeKCE6LrXhr8KfTgEEv+/czDWw0Tl/OLL4=

My JS was

btoa([...new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array([...new TextEncoder().encode("check thu-may-26-2022"), ...[...atob(key)].map(c => c.charCodeAt())])))].map(c => String.fromCharCode(c)).join(""));

Ginger

same!

Radvylf Programs

Nice!

Ginger

which I did using base64.b64encode(hashlib.sha256((b"check thu-may-26-2022" + base64.b64decode(key))).digest())

it actually fits on one line lol

well, key verified

so don't lose that lmao

Radvylf Programs

15:27

Instead of application/json, let's just concat sha_256(json + key) in binary to the JSON as UTF-8 and send that as binary

hang on I've just realized what we're doing is essentially an HMAC

That might be a simpler and more secure way to do this

Ginger

which python has a built-in library for

Radvylf Programs

Same w/ JS. So we can just do an HMAC, since our key's already a 256-bit random string we both know.

Ginger

so I send a HMAC along with the data and we compare it?

Radvylf Programs

Yeah. hmac + json

And I can just verify the hmac

Ginger

and if it's invalid?

Radvylf Programs

15:30

I just 400 it

Ginger

okie

but wait

the original reason for this key was so that only I could use this service

but anyone can do a hmac

or am I confused

Radvylf Programs

Yeah, and only you have the key for the hmac

@Ginger An HMAC is like a cross between a hash and a signature

Basically, only someone with the key can create or verify an HMAC

Ginger

oh right

what about the auto-key-update thing?

Radvylf Programs

Not needed with an HMAC

Ginger

okey dokey

if the key is compromised I guess I can redo this process

Radvylf Programs

15:35

I'm working on doing an example HMAC so we can compare and see if we're using the same algo

Ginger

python lets you choose which algorithm to use actually

should we use the b64 key or the decoded key?

Radvylf Programs

@Ginger I did an HMAC with SHA-512

3OSuNeACZIzUh9npdXyWmM9I2tL1Qs4LQtnvl3XMvfxS9RWVF0b8lS9UpNOst3oFMS7p3AqIEVCmpS2WoA6gXg== for Hello, World!

Ginger

alright, one sec

yup!

looks good

Radvylf Programs

Nice!

So we'll just concat that, as binary, before every message

Well, you will.

Ginger

yup

Radvylf Programs

15:46

In the JSON, include a random 64-bit-or-more ID, which I'll check for uniqueness, to prevent replay attacks

Ginger

is it constant length?

Radvylf Programs

The HMAC is constant length yeah

Ginger

niec

brb

Radvylf Programs

Same

Ginger

15:59

Okay, message format:
- 64-byte SHA-512 HMAC
- the message, JSON encoded with UTF-8
- 64-byte random data

the HMAC is of the encoded JSON data btw

Radvylf Programs

16:41

No, you need to include the random data in the HMAC

I'd do hmac(random + json) random json

The random data only needs to be 8 bytes btw

Radvylf Programs

16:58

Or you can go the CoC route, and instead of running your own server for the transcripts, piggyback off of SE's :p

Ginger

I finally did it

I added user profiles to room cards

next up: mathjax!

Radvylf Programs

19:20

@Ginger Your link UI sucks

Slightly lighter gray than the text, with no underline, smh

Ginger

I know, I know

des54321

Ginger

20:01

or not

@RadvylfPrograms hey guess what I just fixed

Radvylf Programs

Oh nice

Ginger

we're trying to restart

plz wait

des54321

i think i broke something

Ginger

oh god

what did you do

des54321

20:17

i think it was because i forgot to end a multi-line codeblock

nope

Ginger

restarting

Romanp

20:29

unable to wake up

Ginger

restarting again

for some reason it takes like 20s to load all the modules

des54321

6 hours ago, by Ginger

hey lemme count how many modules I'm using

6 hours ago, by Ginger

Counting stdlib modules, that's 16

Ginger

alright, here we go

Radvylf Programs

So, the transcript storage

Ginger

yus

Radvylf Programs

20:36

I think I have the HMAC and random ID stuff set up

Ginger

also, I have finally fixed html stuff

des54321

my biggest question is why images do this when you hover over them:

Ginger

upcoming feature

but yea do yo like my beautiful programmer art?

des54321

its amazing

12/10

Ginger

I find the fact that it's taking 10 seconds to load the room list... sus

Radvylf Programs

20:43

@Ginger Do you have a prototype of your code that would send requests to me? I've got it running now and I want to see if it works

The format is hmac(random + json) + random + json

Ginger

hmm

Radvylf Programs

64 bytes for the HMAC and 8 for the random

(The reason it's critical that the random is in the HMAC is that if you were to intercept a single "op": "transcript" message, you could copy the HMAC over to a new message with a new random ID, and then send it to my server to steal the transcript data)

Ginger

working on it

@RadvylfPrograms Where should I send it?

Radvylf Programs

Same place as before, https://rto.run/lambda

Ginger

okie

message sent

Radvylf Programs

20:51

I got it :D

Ginger

did it decode?

Radvylf Programs

"{\"test\": \"message\"}"

Ginger

heyyyyyyyyyyyyyyyyyyyy

Radvylf Programs

Try resending the exact same message if you can

Ginger

and HMAC verified?

Radvylf Programs

20:52

Yep

Ginger

:D

resending...

(with different random sadly)

Radvylf Programs

Worked. Now try sending two with the same random

Ginger

alright

sent first one

and sent second

Radvylf Programs

Worked, the second one was blocked

Ginger

ayy

anything else?

Radvylf Programs

20:56

If you want you can try changing a byte of the HMAC or something to test that

Ginger

hmm

Radvylf Programs

But I'm pretty confident in this by now

Ginger

okay, we'll go with it

thanks for your help

Radvylf Programs

So, now we need to hash out the details of the JSON part of the protocol

Ginger

[insert HMAC joke here]

Radvylf Programs

21:01

transcript will read some data from a room, room will make a room, post will post something, modify will change a post with the same ID, drop will drop a post, drop_room will drop a room

Should there be one for reading individual messages?

Ginger

hmmmmmm

You can add it in case it's needed in the future ig

Radvylf Programs

We can just overload that onto transcript probably

So, the only data I'll need to store about rooms is a list of messages, right?

Ginger

yup, I'll handle the rest

what parameters do I send?

Radvylf Programs

21:16

Working on that

Radvylf Programs

23:01

Okay, it should be fully working now

des54321

you dont get these problems with CoC

Radvylf Programs

23:18

@Ginger Docs

Transcript for