The DMZ

4:52 AM

@Rory ah very nice :D

5:12 AM

@RoryAlsop Congratulations! Sounds like you're pretty excited.

9:44 AM

One of my pet peeves is people recommending key-sizes without distinguishing confidentiality and authentication, which IMO have pretty different requirements.

10:22 AM

@Rory you're moving jobs again? Congrats! :)

@Sadaluk he's a jobwhore :)

or maybe it has to do with the huge ~~gov't bailout~~ bonuses from a couple years ago...

Rory Alsop

10:45 AM

Cheers guys. @AviD- don't think bonuses are at those levels any more! This just seems like a very good role and is a positive career step.

that's what he tells you all. Really is the opportunity to work at the nice shiney RBS head office , with it's own shops and a staff restaurant that you'd actually want to eat in that lured him in I reckon :op

@RoryAlsop heheh, was kidding. Besides, I dont think they gave the bonuses to the professionals, only to the top management and board....

@RoryMcCune Right. I'm sure the chance to check out and verify the security for one of the biggest banks in the world, holds no professional interest for him whatsoever. :)

@AviD compared to shiney offices and good food... nah

back when I worked for RBS we used to get the site-to-site bus over there on a Friday for lunch

@AviD BTW did you see the information about the windows RT jailbreak

@RoryMcCune no?

still under development but looks like they'll have it complete soon, so running unsigned desktop code will be possible

basically someone found a way to use a debugger to remove the signing requirement

10:58 AM

hmm. okay, that's cool... I guess.

well means things like putty are possible

plus any other open source stuff that can get re-compiled for the platform

Sure, lets fight all these silly security requirements, they just get in the way of us trashing our machine.

Or, I dunno... maybe we could get it signed?

heh well it's not for 95% of users but handy if you want to do more technical stuff with it

@RoryMcCune soon? I read that it was at a very early stage and you have to run that exploit every single time you want to use it.

Sounds like a long way to go imo.

unfortunately MS have said no non-MS desktop apps on RT AFAIK

@TerryChia yeah so it's a tethered jailbreak for now, AFAIK once you've run it your fine till reboot

11:00 AM

well, sure. But 95% of those that will use it, will have no clue what they're doing, but just be proud of being Independant, Different, and Fighting back at The Man.

just like jailbreaks on other devices.

Kinda hipster-ish.

@AviD Isn't that reason enough? :P

@TerryChia sorry, I forgot the snarkquotes.

@AviD possibly but then that's just the same as the jailbreak community with every platform :)

@RoryMcCune exactly :)

this is the thread where most of the action seems to be happening forum.xda-developers.com/showthread.php?t=1885399

11:02 AM

@AviD Yeah. I brought myself a signing certificate just because my driver work... well it just makes sense and it isn't all that expensive.

TBH I reckon MS should have just made it a paid option "unlocked" mode that you buy and sign-up to that fact that if you break it, it's your problem not theirs

in truth, I will actually be mostly fine with that restriction (yknow, when I can afford the surface). Otherwise, I would just go for the pro.

I plan on having a usage pattern that would not be affected by this, and would actually benefit from it.

yeah same reason I don't jailbreak my phone or iPad, I like the added security and keep technical work for real computers

I suspect most people's usage pattern benefits from signature enforcement. Much less chance of letting in the bad stuff.

@RoryMcCune right. and as we've discussed, I plan on setting up to do the technical stuff remotely on the RT via rdp.

@Sadaluk not just that.

the whole windows store experience and such, makes it much easier to swap out hardware as needed. native apps are always a bother.

if most of your data is in the cloud, then apps and configs are the only things that need to be ported on upgrade / switch whatever.

11:06 AM

@AviD yeah I really like app stores from that perspective, so much nicer than trying to find serial numbers and installation files...

and I think thats part of where MS is going with this. RT is lightweight, makes it all about the user - the hardware can be switched easily.

supposedly when you sign in on a new device, it syncs all your store apps automatically.

yep it's like tablet computing for business, so I hope it'll be successful

bbl, gotta pick up the kid. wont make her commute by herself in this rain....

Rory Alsop

11:23 AM

@AviD- have been checking out their security for the last five years. I know them pretty well:-)

But as @rorym says, they have good facilities including a gym on site... might get fit in time for that Tough Mudder thing...

12:29 PM

@RoryAlsop I figured as much. Still, being an outside consultant / auditor is just not the same.

@AviD yeah as an outsider you don't have all the "fun" of really getting involved in the company politics :op

@RoryMcCune hehe, yeah!

actually I think the biggest thing missing is ownership.

true that one cuts both ways, as a consultant you miss out on being able to push something through, but on the other hand your less likely to be carrying the can if it all goes horribly wrong...

If?

@ScottPack I think the "if" in these big corporates usually has to do more with one's personal marketing skills - that is, if you can spin it right, nothing is ever "wrong".

I've certainly seen some horrible failures touted as great successes.

1:30 PM

@CodesInChaos Yeah, but it is OK to recommend using the bigger of the two indiscriminately. You can tolerate smaller keys for authentication, but it is rarely necessary to have smaller keys for authentication.

1:46 PM

While I'd like people to use 256 bit ECC for everything, that doesn't seem realistic for now

For example with SSL I strongly prefer ECDH-RSA with P256 and RSA 1024 over RSA with 2048 bit keys

why is that @CodesInChaos

@RoryAlsop is that where you chase a cheese?

Higher confidentiality and forward secrecy combined with sufficient authentication

vs. medium confidentiality, no forward secrecy and authentication that's unnecessarily slow.

Is it also as widely supported?

lets keep IE6 out of scope

FF and Chrome support it, Opera doesn't

no idea which version of Windows/IE you need

Heh. I wonder if this guy has played Munchkin...

1:52 PM

ah too bad, Opera is my favorite browser

Mine too, but their lack of ECC support is sad

It's funny, most of the people I know that use Opera are German

wow blackhat is expensive... :(

@lynks that's why you make your company pay for it

and you throw in terms like business continuity, cloud and market leading in your request

and of course "synergy"

2:01 PM

@lynks can't forget the synergy.

operational excellence

unfortunately i am part of one of those hipster start-ups that can't afford anything

> Morality.dll kept throwing exceptions, so I just commented it out. Seems to work fine.

6

cracked.com/blog/…

3:24 PM

@AviD very funny!

3:42 PM

ya know I was looking at the General StackExchange Stats (stackexchange.com/sites?view=list#percentanswered) and I reckon we might be the only technical site with 100% answer rate (well depending on whether you count user experience as technical or not...)

@RoryMcCune and the only site with more users than ours that has a 100% answer rate is English Language

it's a good record, some of the sites are pretty low in terms of percent answered..

we get 9k hits a day :o

6.25 per minute

so more than one every ten seconds, not bad at all.

15 questions per day, too. way more than anyone else, apart from EL&U

then again imagine trying to keep up on stackoverflow, they get 5200 questions a day!

I'd say they really need to try and break that site down a bit, surely that's unmanageable

they have a lot of mods and a lot of tags

otoh, it's a damn good stress test for various technological and managerial processes

4:07 PM

@AviD Marketing? Assholes.

4:18 PM

@RoryMcCune It's really hard to get answers on SF, even for easier questions, because people just don't see them passing anymore

@LucasKauffman yeah that was what I was thinking when I was saying they might want to break it up a bit, perhaps by language (e.g. ruby.stackoverflow.com, java.stackoverflow.com etc)

that's a great idea, you should put it up one meta.SO

even if it's just tag filtering

@LucasKauffman And get burned alive.

@RoryMcCune You have my sword!

right I'm going to publish some pre-challenges to prepare for the ctf

status-declined-too-useful

23 hours ago, by Scott Pack

Blog - Stack Exchange: Podcast #40 – Random Musings (Plus a Suprise Guest)

4:28 PM

@LucasKauffman unfortuntely I'd guess that @TerryChia is right about the burned alive piece :)

Stack Exchange

Alex Miller on January 10, 2013

You’re listening to the Stack Exchange Podcast #40 (We apologize to everyone who expected Wil Wheaton last week) Your hosts are David Fullerton, Jay Hanlon, and Joel Spolsky. We also have a surprise special guest: Britton Payne(?), professor of Copyright, Trademark, and Emerging Technologies at Fordham University. He knows a lot of things about software patent law, so we grabbed him as he walked by the studio to talk to us.

About 15 years ago, Congress passed the Digital Millennium Copyright Act to create some useful guidelines for the new digital landscape. We talk about what actually happens with the DMCA takedown notices, including loophole issues that Joel has discovered. …

@RoryMcCune That's what Frodo had to challenge as well and he ended up quite alright (except being mentally challenged)

yeah but I don't have any eagles to fly me straight over Mount doom so I can just drop the equivalent of the ring in :op

Q: A Security Stackexchange CTF team

16

Updates: Added first challenge to prepare Preparing Challenges: This is the first challenge to prepare, it's very easy and requires some very basic crypto and scripting skills. What you need to do is to complete the blowfish level 1 of smash the stack. Go to ssh level1@blowfish.smashthes...

discussion

@RoryMcCune no worries @RoryMcCune we a @ScottPack for that!

@LucasKauffman Wait, what?

4:39 PM

I'm not sure if he's conflating you with an eagle or this is some complex scrubs joke ...

@LucasKauffman Perhaps you should have the challenge in an answer instead? It would make it easier to look for instead of just cluttering the question.

@RoryMcCune EEEEEEEGUUUL!

@TerryChia That's actually a valid and good idea

I shall edit my question!

am I the only one that can't get to SmashTheStack's web server for BLOWFISH?

smashthestack.org/wargames/blowfish

just hangs for me

@Polynomial yea it's broken

is the ssh down again?

4:42 PM

no idea.

they had some problems

yea the web server has been broken for ages

DNS resolves, but no ping response

you just need to ssh into their server and you will have the first challenge

might be blocking ICMP (ugh...) but it could just be down

I just sshed into it

Q: Setting up ASP.NET web application on internet for first time; Are these security measures enough?

4:43 PM

oh, yup, it's up

stupid ICMP blocking

SSH-2.0-OpenSSH_5.1p1 Debian-4

;)

not got an SSH daemon on this box.

erm

SSH client*

0

I have a web application running on IIS 7 in offices on LAN and I wish to upload it to hosting space on (Godaddy) because I like it to be used in my other offices (other cities). This application uses asp.net membership provider for user authentication and the data is gets validated from front a...

.net asp.net sql-server

I can see this becoming a game of whack-a-mole.

@Polynomial I'll give you the question

@LucasKauffman if you had picked io.smashthestack.org I could just sit back and do nothing up to about level 20. You just had to pick the one I haven't looked at before :P

@LucasKauffman hmm?

Here is the Level2 password: GungJnfRnfl
But it's encrypted with a simple substitution cipher.
Decrypt it and log in as level2.

that's it

lol

I hate those kinds of questions.

4:46 PM

@lynks yea I just wanted to piss you of D:

attack the 3 letter word i would say

:D

"here's some ciphertext, go decrypt it!"

and agreed

Jeff Ferland

Reddit line of the morning: Remember how in Halo you could hop in a warthog and fire that machine gun for hours without running out of ammo? I'm pretty sure my first girlfriend remembers that, too.

3 letter word is probably the most obvious

4:48 PM

it isn't and

at least, if it is it isn't super simple

yeah, figured as much

It actually was simple

simpler than I thought

pwnt

@Polynomial in your face :P

I think I've already got most of it

bah

4:51 PM

6 down, 5 to go :P

I actually tried all numbers up to 13. Should really always go there first. I did have a script to do this for all 26, even had it match against a simple dictionary to highlight the one it thought was the most likely.

@lynks I just did all 26 and then just read the output

It would probably take longer for me to find a dictionary :p

:P i have loads you can have

this is also useful simonsingh.net/The_Black_Chamber/caesar.html

got it

:P

and yeah, it was.

threw myself off at first by trying to make it more complex than it needed to be

@LucasKauffman is level 2 pastable? or does it require an executable

4:56 PM

I prefer the executable stuff.

yeah io was awesome

i still have a bunch of passwords somwhere, assuming the havent changed them...

I keep meaning to do a really basic CTF for binary reversing

for beginners

@CodesInChaos What hash algorithm do you prefer with these: For example with SSL I strongly prefer ECDH-RSA with P256 and RSA 1024 over RSA with 2048 bit keys

have you hit io.smashthestack? iirc it starts out pretty easy

past about level 10 and it's an evenings work per challenge

@lynks I haven't looked at challenge two yet :( haven't had time yet

5:00 PM

@LucasKauffman :P np

5:16 PM

@makerofthings7 Doesn't really matter. MACs fall in the "authentication" category, and even HMAC-MD5 is still secure enough for that today. Guess SHA-256 for key-derivation and GCM as MAC would be ideal.

@CodesInChaos I was mainly thinking of client compatibility... (SHA1 vs SHA2)... what is best in your experience? Did SHA2 work on Opera?

.. or does SHA2 in this context not apply to a TLS/ HTTPS session?

tylerl

I've actually been thinking of building a set of CTF-for-web-developers challenges based on the OWASP top 10. Dead-simple for security pros to go through, but useful for security-unaware programmers so that they can learn security by breaking it.

The challenge isn't building the problem set, it's coming up with the right amount of hand-holding so that they actually complete each task, but learn something in the process....

5:36 PM

@makerofthings7 SHA-2 applies to TLS, depending on the version. SSL 3.0, TLS 1.0 and TLS 1.1 use a combination of MD5 and SHA-1 internally, and (usually) HMAC/SHA-1 for integrity. With TLS 1.2, the hash function is configurable through the cipher suite, but in practice it is SHA-256 everywhere.

5:55 PM

For me the part that really matters is ECDHE>DHE>non forward secret suites

Opera supports DHE, but it seems to cause performance problems for the server in some cases. But since I don't run any SSL servers myself, I don't have any practical experience with that matter

I'm creating a MSFT CA based on ECDSA P256. I'm not sure if that is ECDHE or DHE or what the difference is.

Ffs traffic jam :(

(EC)DHE create a new keypair for each connection

So if the private key associated with your certificate leaks, your conversations still can't be decrypted

You can use (EC)DHE together with any kind of certificate

6:10 PM

This is my GUI for reference: i.stack.imgur.com/4BTHL.png

For the certificate I'd still use RSA for compatibility

@code can you configure that side by side with regulars ssl/tls?

While using a standard RSA certificate you can configure ECDHE_RSA support in your server

so firefox+chrome will use those suite

I believe that's what gmail does

@CodesInChaos OK I see... the CA cert selection != what is used in the TLS session (and negotiated during TLS session construction)

The cert is used for authentication with all suites, and for confidentiality in plain RSA suites

googleonlinesecurity.blogspot.de/2011/11/…

6:14 PM

So authentication means "your server X and I'm browser Y (perhaps with or without a client cert)"?

Authentication is saying "I'm authorized to serve example.com, and here's my certificate to prove it"

Plain RSA suites prove that by decrypting a client chosen key

which then doubles as the key used to encrypt the connection

ECDHE_RSA suites generate a new elliptic curve key, sign it with their RSA key and then use that EC key to negotiate a key to encrypt the connection

@CodesInChaos You still need the certificate to be fit for signatures. A RSA, DSA or ECDSA key is fine, but the certificate can include extensions which forbid use for signing (Key Usage extension without the digitalSignature flag).

So I suppose I'm trying to reconcile best practices (most secure) for Browser / TLS sessions versus the CA infrastructure that is constructed prior to the webserver getting the certificate to-be-negotiated (as you describe ECDH-RSA with P256 is pretty good)

If you use only an ECDSA certificate, your site can't communicate with opera at all, and configuring multiple certificates seems hard.

Digital Fire

Good Afternoon/Morning Folks

6:21 PM

firefox doesn't seem to support DSA certs

so it looks like RSA certs are still the way to go

i.e. use ECDHE_RSA as preferred suites, then DHE_RSA if the performance hit is acceptable, and plain RSA as fallback

FF seems to support DSA certs, but they're called DSS in SSL terminology, and it doesn't support mixing them with ECDHE, so RSA is still the best choice

RSA for the PKI with a key length of 2048?

.. and perhaps RSA1024 or ECDH P256 for the TLS 1.0 session?

might be a bit of overkill.

RSA1024 for the server, and RSA2048 for the CAs sounds fine

Though I'd probably go up to 1280 for the server

But personally I don't think the key strength used for authentication is that important, as long as it's at least RSA 1024

Would it be true to say that the PKI configuration has a much less impact on a user's perceived performance than the TLS encryption between a browser and a web server?

I'm not an expert on that. But it shouldn't affect server load.

Only the size of the server's key and the ciphersuite affect the server load

(... or browser / mobile device performance ?)

6:33 PM

Measure it, but I doubt it matters

Yup, I'm standing up several CAs to test on various browsers, but am still fielding out what I need to test. This is helpful

My knowledge of SSL is largely theoretical

@makerofthings7 Size of the server key can have an impact if the server processes an awful lot of new connections per second. But a simple PC core can already do hundreds of those per second, even with a 2048-bit RSA key, so this effect will be hard to demonstrate.

If you are Amazon or Ebay, you will have to care about these issues

but not really otherwise. Just use a 2048-bit RSA key.

My recommendation is to configure ECDHE_RSA as preferred suites, and otherwise not worry too much unless you have numbers to prove it's an issue

@ThomasPornin So key size is more of a server issue than client issue for CPU cycles? (assuming cryptographic support in the client)

6:36 PM

@makerofthings7 If using a plain RSA cipher suite (no DHE or ECDHE), then it will work everywhere and will be fast even for tiny clients (e.g. 33 MHz ARM7 processors)

If using a DHE suite, then tiny clients may experience some extra delays (up to a few seconds for 2048-bit DH parameters). But merely small clients will not notice it.

"Small" meaning "at least 200 MHz"

Smartphones and tablets are "medium" and are more than fast enough to totally ignore all these issues.

ECDHE is lighter on CPU resources than DHE, but not many SSL implementations support it yet.

@ThomasPornin Is ECDHE supported in PKI? I don't think I see it in this list: i.stack.imgur.com/4BTHL.png

@makerofthings7 ECDHE is done at the SSL level; this is out of reach of the PKI

With DHE and ECDHE, the server has a certificate fit for signature, with a RSA or DSA or ECDSA or whatever key in it.

The SSL server then generate a (transient) Diffie-Hellman (or ECDH) key pair, signs the public part with the server private key, and sends that to the client as a SSL ServerKeyExchange message.

A "TLS_DHE_RSA" cipher suite means: "the server has a RSA key pair, and uses it for signatures; the SSL/TLS connection will do a key exchange with Diffie-Hellman; the server signs his half of the DH key exchange with his RSA key"

What you must take care of, on the CA, is to configure the "Key Usage" extension in the certificate you wiltl issue to the server: that extension must include the "digitalSignature" flag (alternatively, don't put any Key Usage extension at all, but the presence of this extension is the default with Microsoft's CA).

@ThomasPornin Guessing you might like today's Numberphile:

►

Too bad they haven't posted the explanation of how it was broken, yet.

Oh, and this comment is great:

> So if there's an argument about whether mathematics is any use to society, and a proponent of mathematics brings out the Enigma machine, is that Godwin's law in action?

@Iszi I refrain from looking at videos from work, because that would mean downloading them over my 3G quota, which is not big.

@ThomasPornin Ah. Well, it's pretty much an overview of how the Enigma Machine works and an explanation of the maths behind its key strength.

Cryptanalysis of the Enigma

6:50 PM

@Iszi There is also a lot of info there:

Cryptanalysis of the Enigma enabled the western Allies in World War II to read substantial amounts of secret Morse-coded radio communications of the Axis powers that had been enciphered using Enigma machines. This yielded military intelligence which, along with that from other decrypted Axis radio and teleprinter transmissions, was given the codename Ultra. This was considered by western Supreme Allied Commander Dwight D. Eisenhower to have been "decisive" to the Allied victory. The Enigma machines were a family of portable cipher machines with rotor scramblers. Good operating procedures,...

But I guess that moving pictures are just better.

@ThomasPornin I'm sure. But I like the way James Grime explains things.

On the phone with a Citrix Netscaler engineer and he says that Perfect Forward Secrecy applies to VPNs and never seen it applied to HTTPS/TLS

.. even if DH is used on the device

IPSec and IKE work with DH .... though

<correction> he found docs that allow for DH on the netscaler... they are hard to find.

support.citrix.com/proddocs/topic/netscaler-ssl-92/…

7:53 PM

gmail uses ECDHE to provide forward secrecy

8:42 PM

@AviD My wife came across that one yesterday, too. Love TBBT! They won a People's Choice last night, by the way.

Ed scudid bought one

tylerl

8:55 PM

So... it has come to this...

2

[root@web1 /]# grep -Iirl hacked /home/*/public_html/

Sordid state of affairs.

worse: when the admin/webmaster considers sed -i s/hacked// **/* to be a good enough fix

Ladies.

and laddies?

@Scott 'mam

9:16 PM

@LucasKauffman So what were you on about earlier?

So, even though she's sitting here with a 102.5F fever the little one still plugs her ears and averts her eyes when Kenickie and Rizzo start making out in the back of his beater.

9:34 PM

blowfish.smackthestash.org is down. Has one of you guys been DoSing it?

@Gilles smackthestash itself is down here.

been down for about an hour.

I gave up trying to find what I was looking for and instead I prepped my bootloader environment to test my homebrew kernel...!

@Sadaluk "homebrew kernel"...? You're a masochist.

@AviD Well...

Do you pay women to spank you?

No...

9:45 PM

or is this all just part of a "learning experiment"...

@AviD s/pay/get paid by/

hehe

@Gilles well, I've never been to France.

I get paid to write a kernel, not to get spanked

@AviD learning experiment. Y'know, like the one where you said "rebuild process monitor"?! (That's actually making much more progress. I can do IO filtering, I can walk the list of loaded drivers, processes, system handles etc... just need to get that info back to userland atm)

@Gilles ohhh. That makes more sense.

9:47 PM

Yeah and at the risk of seriously punning, it's not that hard (sorry) to write a kernel. It's hard to make it do anything remotely useful, but that's another matter.

@Sadaluk hahaha, wow. I didnt say "rebuild it", I said "if you have the knowledge to hypothetically build something like that"....

@AviD Yeah well

@Sadaluk oh sure. At uni we all had to write a barebones kernel.

I found it to be a stupid, yet enlightening, excercise.

I suppose you did only say "could you". Well, the answer is now "yes, yes I can".

@Sadaluk I guess you never really know, until you know.

Well, now you know.

9:50 PM

@AviD yep. I've no great ambitions for my project. Just want to have a play with intel-vt really. To do that, I either need to break the linux kernel, or I need something simpler.

I opted for simpler.

As in design simpler. KVM, or Xen, are both quite complex.

I also might have a go with rings other than 0/3 in my kernel e.g. 1 and 2.

intel-vt and simpler dont usually appear in the same sentence, unless its in reverse order and separated by "than".

And generally try stuff out, security related things.

@AviD Pah. It's easy to set up a vm once you're in a position to enter the vmm! It's just that it only emulates the cpu, so you have to do the hardware.

The vmm I think will be simple to write. All the rest of it? Nope. V hard.

So one of the lessons I'd learned from the kernel-writing excercise, was that I had no interest in writing kernels. Ever.

Haha yeah. Well, the way I see it people either try to write a kernel or a compiler. I've no real interest in compilers, plus they're in danger of being useful/usable. Couldn't have that!

Don't get me wrong, it is absolutely great stuff to know, I think every programmer should be forced to go through it at least once, to better appreciate what he's building on, not to mention actually understand how a computer system really works.

It's just that I dont want to be involved in that.

@Sadaluk a huge part of writing a compiler is lexical analysis and code parsing. Boring for most people.

9:56 PM

@AviD Exactly. Yawn. Kernels on the other hand... joke, joke!

hehe. right.

The process monitor thingy is probably more fun because it involves a bit of working out how windows does its thing.

Plus, when it's a bit more stable I might be able to actually give it to other people!

since then I've had the dubious pleasure of having to dive into the kernel - via debugging or source - not the parts I've enjoyed the most, but definitely challenging. I at least took pleasure in knowing that I didn't need to write the damn thing.

@Sadaluk cool. any features not present in the original?

@AviD Yeah, well - one thing I will say is that my kernel does not TYPEDEF EVERYTHING!

oo, how about expose it all via powershell...?

9:59 PM

Actually y'know I bloody love powershell. I had to learn it for research at work and I'm sold!

@AviD No not yet. I'm sort-of combining the procexp like features with procmon ones, because one driver can do both.

I think, but am not sure, that my walking the loaded drivers might be a new feature.

Unfortunately at present I'm walking undocumented structs without any kind of locking... so I need to work that one out.

Or things might get hairy.

@AviD do you use powershell frequently? I'm imagining it

'd actually make a pretty good audit tool.

Since you can just collect everything up in a script.

@Sadaluk I'm not sure, but I think I remember seeing that in on of those tools.

@AviD DeviceTree does a pretty thorough job of it.

@Sadaluk no too often, no.

only know it superficially, its on my list to get to know much better. When I have the time :S

@Sadaluk @RoryMcCune's faerywife is giving a talk about exactly that.

10:14 PM

@AviD some of these might help: bitbucket.org/arv/scripts/src/23fe6ec5375c/windows?at=master

The add-signature one actually comes from the powershell docs.

Also, you need to know about execution policies: technet.microsoft.com/en-us/library/ee176961.aspx

Otherwise nothing you write actually runs :(

cheers. now I just need some time....

@AviD Yep, always the issue.

I had a work mandate to "understand" powershell, plus my current work involves quite long delays, so I've had time to play.

sadly, its not quite at the top of my priorities....

Oh the other thing I'd say is definitely use the ISE. It makes life much easier plus it has tab completion and intellisense and other magic. The ordinary I-am-a-blue-cmd-exe isn't so good for writing scripts.

Q: is it possible to create a file given an md5 hash

10:56 PM

what's our canonical answer (undoubtedly by the bear) explaining how 2^128 is a big number and one does not just brute force 2^128 possibilities?

come to think of it, this must have been asked here or on Cryptography already?

2

I know this is a strange question, and I know that md5sum is nearly impossible to break... but I'm just wondering if someone here knows if it is possible to recreate a file given it's md5sum hash? I mean, not necessarily the same file as the original but a file that would equate to the same md5s...

md5sum

besides it's not really on-topic on U&L

A: Amount of simple operations that is safely out of reach for all humanity?

11:29 PM

34

As a starting point, we will consider that each elementary operation implies a minimal expense of energy; Laundauer's principle sets that limit at 0.0178 eV, which is 2.85*10-21 J. On the other hand, the total mass of the Solar system, if converted in its entirety to energy, would yield about 1.8...

1

Q: reverse of md5sum

This might be out of ignorance, I apologize, but how complex of a problem might it be to generate a file of size N whose md5sum is X? For example, ls -l wczasp.rb -rwxrwxrwx 1 master master 7273877 2011-01-30 17:13 wczasp.rb md5sum wczasp.rb acf3602b5eb9a2db3e365d3043682faf wczasp.rb ...

hash md5 preimage-resistance 2nd-preimage-resistance