« first day (4168 days earlier)      last day (726 days later) » 
00:00 - 21:0021:00 - 23:00

12:02 AM
hm
Rip MechMK1.
 
12:19 AM
Oh, looks like only one of the bad posts was posted while I was online.
 
12:34 AM
@CesarM what happend?
 
Are you not able to see the Trashcan transcript?
 
I clicked on it, it said I had to request permission
 
Oh. It was a conversation from a day ago. I think Mech just used an offensive term, and the conversation itself was rather controversial (it was about transsexuality).
 
I'm surprised the whole thing was removed though, since only one post had any bad words.
 
12:37 AM
ah
 
1:08 AM
Hello @belkarx
 
Hi! how are you
 
Good enough.
 
if you could choose a generation to live in, which would you choose?
 
A recent generation or any generation throughout history?
 
Any generation in history or in the future
 
1:12 AM
Whatever future generation fixes Linux's security issues.
 
Hmmm at that point, would Linux still be unpopular as a consumer OS
 
I'm not waiting for the year of the Linux desktop. :P
 
Why not
 
Because I can already use Linux on my desktop.
 
True but imagine everyone else did too: there would be more bug-finding, more vuln-finding (maybe), and microsoft would suffer without an easy source to an insane amount of user telemetry
 
1:19 AM
Unless everyone used it but it was still just as insecure as it is now.
DEs are awful. I bet everyone would use GNOME.
 
Ah true. Maybe KDE if they're switching from windows
 
KDE's not very secure either. DEs in general are... not good. Microsoft at least has put a lot of effort into hardening their userspace. While Linux may be a great base upon which to build a more secure system, by default it kinda sucks.
 
2:26 AM
Fingerprinting a printed document: news.ycombinator.com/item?id=31364151
 
OOh I saw that. they don't say precisely how they did it tho
 
2:40 AM
@belkarx The speculation in the comments seems realistic.
What's most interesting is the claim that they can tell which GPU the system used, although there are some very likely possibilities. GPU output has always been known to be a fingerprinting vector.
 
Yep, it's impressive how precise their fingerprint was from a printed document. you'd have to have broad knowledge of all of the variations hardware causes to be that specific
 
There's already research into fingerprinting GPUs rasterizer, so they've probably built on that.
 
Huh interesting
I'll have to find some of that research
 
Look up the paper behind "Am I Unique".
 
They use GPU fingerprinting? must have missed that last time i visited
thank you, I'll check it out
 
2:45 AM
It goes into a bunch of state-of-the-art browser fingerprinting techniques, including novel ones based on WebGL, and cites other papers that analyze similar GPU fingerprinting techniques. Although the paper is specific to web browsers, it should give hints into how to generalize it.
1
A: Should we have the [ethics] tag?

forestI don't think we should have an ethics tag. This site is only about cryptography, its use, the theory behind it, and how to attack it. I also have to disagree with this claim: the principle and foremost purpose of cryptography is to facilitate the destruction of the enemy I'm not sure where you...

I got accused of being an NSA shill in the (now-deleted) comments.
feelsgoodman
> "I don't think we should have an ethics tag." , so you suggest that your forum should operate outwith of all moral guidelines? I think that Mr Bekker (your boss) would disagree.
and
> Patriots should support their county, rather than weaken it.
Now... Who is Mr Bekker? I can only think of Bekrar (the Zerodium guy).
 
ethics implies opinion-based, right?
 
Yes. For context, the guy who accused me of it (the OP) is a well-known... well, not quite "troll".
But a conspiracy theorist who thinks that TRNGs and OTPs are the solution to everything and that AES is backdoored.
 
Unintentional troll?
 
Pretty much.
Not a troll so much as wildly misinformed:
> We all know that the principle and foremost purpose of cryptography is to facilitate the destruction of the enemy.
 
Lmfao wonderful. What's the account name, I'd love to see more
 
2:59 AM
It's OP in the linked meta post.
 
Ah okay
 
Just check out his profile and his lowest voted answers. They're... interesting.
 
13.8k rep ...
 
Yeah. Almost all his answers have downvotes, but the few upvotes, being worth +10 vs -2, overpower that.
Unfortunately he self-deleted some of his "best" answers.
 
Haha he has a website too with some additional ... interesting ... content
>Public leaks have revealed that what once might have been considered truly random, ain’t necessarily so. Either by conspiracy or cock-up, true random number generators (TRNGs) may not be outputting entirely secure nor Kolmogorov random entropy.
>What comes out of that small green screw connector can sometimes be just as powerful as that from a 120mm smoothbore. Have faith, and bask in the sure knowledge that even sabot rounds cannot penetrate a genuine OTP, drawn from your own trusted TRNG. And it’s entropy source can be built from just four simple components sat on a 9V battery.
 
3:01 AM
He's talking about Dual_EC_DRBG (which was indeed backdoored).
 
@forest Interesting
 
But he extends that to every CSPRNG.
So he claims the only solution is a homemade hardware RNG used for one-time pads.
5
Q: Has this forum been compromised by the NSA BULLRUN program?

Paul UszakToday, this site shows 24 thousand users in Cryptography. It runs in parallel with and is associated with StackOverflow boasting 6 million users. This site then clearly creates some leverage and impact for the cryptographic community, with the power to influence and shape minds. It can then so...

I mean, he's better than someone who tries to invent their own "unbreakable" ciphers, of course.
 
 
1 hour later…
4:10 AM
@MechMK1
-----BEGIN PGP MESSAGE-----

hF4DAAAAAAAAAAASAQdAp4kqMs3ma0sHfQU5LJ+bQ3D+h7teDqJnXgUfsdc2fRYw
M8c5jFwVFreDxm3p3xT8oz1HcxelEOd6AVdPjNjSBs03RiAK4QESytAl15f1T8e+
0uoBNGmo7wkPfRxJYPJjQUFuyPVMrFRiLNY0gIUy5JZcbr7BEJZZgIshm5+7jfWR
jc7jvpeIpwl0mQv1gHixHFFnw/bT+PefOzA08x6FJRb40bQb87iktodXdXhYjROm
EJSnT8TVfnSOHI92uN9Hoy+L+UzIK0I1lTA7hjZmHr4rkQxUlIqm2Zdfww9wGY5O
JsvqCv7a9vls7FRGXQ3eMBMXGv0PsOracAYIRBL2fE4M5iRDO6XfyKfsC0q5gmSk
/iQVEDv56ayND/GfRfV9nYJGCdHgqp6yVTTdQ4QF8ErjWJor2LtXyGPX1IP9FE9O
w/65ApvCW+KIrkaM1k3hQoscIre6RE79u4WiebpkBwylDH0w6Pkh02C458aJ+ud6
 
 
2 hours later…
6:13 AM
tf?
Mech got suspended for a month?!
 
 
5 hours later…
11:08 AM
So Mech is suspended on the main site too
I'm pretty sure he didn't post anything terrible enough to deserve that
I wish the suspension process was more transparent
 
@nobody the chat suspension system is a bit... garbage + I'm guessing there was a mod message involved letting him know exactly what happened
It is/should be to whoeever's suspended, not everyone else
 
Oh okay
 
(there's no way to actually let someone know why they are suspended from just chat privately and...)
You set chat suspensions by the hour
 
So a month long suspension can only be through the site?
 
So given a choice, pain of not using the main site aside, the parent site suspension mechanism gives you more visibility over what happened, and a chance to respond
@nobody I can set a month long suspension by the hour.
BUT I cannot let a user not on the sites I moderate know why
 
11:16 AM
right
 
@forest Only mods can see it
@J-- Uh yes and no
There's a 'standard' escalation of timing that's recommended, but its at our discretion
 
11:57 AM
matrix is not that hard to run
Well yeah I guesssss
But there's also "this is a public space, and we kind of have a 'common' set of rules people tend to ignore"
 
@J-- Worth a shot setting it up. Although I guess it would fall into disuse and be forgotten soon
I kinda like the public space element (except for the rules :-)). It means new people will keep joining every now and then
 
@nobody unfortunately the rules are both non negotiable, and to some extent - needed for having a public space element
There's some leeway but there's certain things that will get people in trouble, or cause folks who might want to join to... not join
Part of the role of local chat mods is to nudge y'all quietly out of trouble before things get too serious, but that needs a certain degree of folks listening, and trust.
 
12:20 PM
@JourneymanGeek Sure I totally understand. But I'm not obligated to like the rules even if they make sense, am I? :P
 
1:19 PM
@nobody Well - not really no
But in a sense, its also part of what folks running a community need to do - is try to make rules make sense
I know stuff like the COC and such sound... unnecessarily fussy
but there's reasons for at least some of it
Which admittedly boils down to "Some people are rules lawyering jerks"
 
 
2 hours later…
3:50 PM
@forest <.< are you
;)
@J-- OPSEC VIOLATION!!!! REDACT THAT STATMENT!
 
I'm pretty sure the first employee wasn't really remarkable
 
Ha someone just told me the time taken to "create" a script should factor in the time it took for me to, for example, learn bash ...
Exactly. But yea this script I hacked together in 5 minutes really took me a year, by that logic (since of course, every time I use bash I've been "learning" it). And that line of reasoning is even funnier when you consider a more complex lang like C++ for which an even stronger case can be made that you've been "learning" it for years and years
For context, this was just an argument on HN about whether or not something was a "complex"/time-consuming project. Someone made a claim that it would take a long time, I made it happen in a very *short* time and they got salty :D
The internet is a glorious place; I love proving people wrong
It is civil, it's just not always ... logical
 
4:20 PM
@J-- What could running Hyper-V and VMWare simultaneously realistically be used for?
 
@J-- In theory, yes. But when I tried it a few months ago, I ran into some problem(s) and eventually decided to just go without WSL
Don't quite remember what error I was getting, but basically it would tell me that I could only use software virtualization
I tried it with Workstation Player 16
Well according to blogs.vmware.com/workstation/2020/05/… it should work on Player too
Didn't notice. Who was it?
 
@J-- Lurking because this chat is interesting but he has nothing to contribute?
 
Ah, they seem to lurk in many rooms, but donn't talk often
 
I did that for a couple of days when I first found this place /shrug
The depth of the technical conversations that go on here can be ... intimidating honestly
 
@belkarx I did that for a couple of months because I was too scared :)
But I'd read the transcript, so it wouldn't show me joining
It's rare... but it does happen sometimes
 
4:34 PM
It's Sunday, right? You are (perhaps) not under any societal obligation to do anything
 
Taking a day off is fine... don't feel guilty about it
 
@J-- Understandable. We only have so much time to do stuff, might as well use it
 
I wonder if leet people like Jann Horn work as hard as you or if it comes (relatively) easy to them
Well since I've never tried, that gives some faint hope to me. Maybe, just maybe, it might be easy for me too
 
Try it and update us on your results
 
@J-- I'm not going to believe that :)
 
4:47 PM
Has ADHD been helpful in any way?
 
Seemed to the professor, or to the people with the disorder?
 
Alright thank you
Imo it depends on what it is.
OCD, for example, can be vanquished w/out meds
It's interesting how various conditions tend to coincide though (neurosciencenews.com/comorbid-mental-health-genetics-20557)
>More than half of people diagnosed with one psychiatric disorder will be diagnosed with a second or third in their lifetime. About a third have four or more.
Cool indeed
 
5:20 PM
@J-- You don't want to write a commercial rootkit for a living, do you?
I mean, its gonna be a cool team, but...
 
 
2 hours later…
7:44 PM
@J-- Why would you lose nVMX by using two VMs at once? Does one of them turn it off or something?
Oh. So you don't mean simply running them both in parallel.
Huh?
VMX just means virtualization extensions.
huh
Windows virtualization doesn't sound very fun.
I never use anything but QEMU-KVM (although I've used BitVisor and VirtualBox in the past).
@J-- So it's just using the frontend?
I wouldn't be surprised if Hyper-V was more secure than VMWare, so it might be good.
@J-- I wouldn't be surprised. They also stole GPL source code. :D
And got sued for it.
@J-- Why would maintenance be a pain with IRC? There are lots of public IRC servers.
@J-- There are more, although I don't remember how they worked.
And it's closed source and they don't really publish detailed whitepapers.
@J-- In fact, all you have to do is join a server like Libera or OFTC and create a channel. It's easy.
Although getting people to use it is the hard part, since most people are too lazy unless they're already used to IRC.
I want to learn more about KVM. I've been planning on doing something like this guy for a while now.
But I first need to learn a bit more about VMX fundamentals. Mostly though it's just a lack of motivation to read all those loquacious Intel datasheets on VT-x (and VT-d). Pretty much all I know right now is how #VMExit and #VMEnter work and how that maps to the KVM API, and some basic things like configuring certain instructions to conditionally trap in the guest.
@J-- He can join, but he can't talk.
Ah, what's the USER command for IRC again? Do I need to check the RFC?
I mean in the protocol.
Found it.
NICK forest123
USER forest 0 * :blahblah
...
:forest123!~forest@185.220.101.76 MODE forest123 :+i
:CTCPServ!services@services.oftc.net PRIVMSG forest123 :VERSION
:kinetic.oftc.net NOTICE forest123 :Activating Cloak: 8VQAABNZH.tor-irc.dnsbl.oftc.net
JOIN #secse
:forest123!~forest@8VQAABNZH.tor-irc.dnsbl.oftc.net JOIN :#secse
:kinetic.oftc.net 353 forest123 = #secse :forest123 @j--
:kinetic.oftc.net 366 forest123 #secse :End of /NAMES list.
PRIVMSG #secse :yo, connecting from openssl s_client
@J-- Ah, raw s_client is too painful. I'm bowing out.
Because I have to type PRIVMSG #secse : before each message. :P
That's the nice thing about IRC. If you don't have a client, you can always use openssl or netcat.
It's all a result of IRC being a rather simple text-based protocol.
I've written a number of IRC bots, custom scripts for irssi, etc. It's a great protocol.
Very simple. Although beware that the RFC is more a... suggestion...
And real IRC differs a bit from the RFCs in some cases.
I used to be a big pain on EFnet back in the day, with my IRC bots. :P
Yeah. It has less people, but it has people who are generally more clever.
heh
That's just sad.
I've literally never been on Discord, but I can imagine how bad it'd be.
I bet they're pretty easy to scam though.
Make a quick buck!
Wait, really?
(uh, maybe a dumb question, but what's P2C?)
Oh. For video games?
Darknet market "community"
They're just idiots really.
Is it basically script kiddies buying from script kiddies?
That's all the "darknet market" is.
The thing is... even script kiddies can run botnets. So why do they care about cheating in video games?
Why not play with a crappy botnet for fun instead?
ah
wow
It seems like such a waste.
Like, not even the basic theory?
Does he take money in cryptocurrency?
Sounds like a perfect target to make a quick buck from. ;)
For what kind of games?
Someone's gonna steal his cryptocurrency one day when they get pissed at him making money easy.
That's hilarious.
I wonder why the game hacking community has never went in the direction of console RCEs.
Yeah but imagine what they could do if they could remotely pop a PS5.
Not even jailbreaking. Just attacking the console through a game's network.
Although I know next to nothing about game console exploits, but I wouldn't be surprised if games ran privileged.
Not surprising. Have you read that article on hacking the PS4?
Where they found out it used syscall number randomization and shit?
 
8:52 PM
@J-- Its literally a PC running a freebsd varient :D
 
Yeah, it's FreeBSD, but they added so many "new" syscalls that didn't even need to be syscalls.
It's always fun when writing a fuzzer is the hardest part, and the rest is just so easy.
@J-- It's the quintessential introduction to PS4 system hacking.
 
@J-- well in the perspective of "We don't want people to trivially run their own games"
not "We need actual security"
 
FreeBSD ASLR is a joke.
IIRC it only randomizes loaded shared libraries and only with 8 bits of entropy (although I could be wrong, maybe it's better now). That's one of the major things HardenedBSD changed.
Speaking of which, apparently OpnSense switched from HardenedBSD to FreeBSD. :(
 
00:00 - 21:0021:00 - 23:00

« first day (4168 days earlier)      last day (726 days later) »