The DMZ

Terry Chia

02:53

@TildalWave I think it's because many of us just yell at @AviD in this room when we want something done. :)

Terry Chia

04:41

devs still approach performance of JS code as if they are riding a horse

Tweeted by horse_js on December 30, 2014 at 7:02 PM

AviD

08:22

@TerryChia WHY IS EVERYBODY SHOUTING AT MEEEEE

@TerryChia I dont get it

Terry Chia

@AviD I don't either, but the existence of an account called horse_js is awesome.

AviD

@TerryChia account? There is a framework called horse.js!!

Probably.

hey @TerryChia you pingponged me yesterday?

Terry Chia

@AviD Ah, I got an answer from @RоryMcCune so it's all good.

AviD

re symlinks - always a bad idea, even on supposedly same *nix - implementation is often different. Git guidance is to never explicitly use symlinks (even if internally it kinda uses it)

@RоryMcCune not a hipster anymore, and DEFINITELY not a node.js-er... but yes, kinda

well actually to be accurate, npm is used as a repository. package management is usually something like grunt or bower or one of the other hipster package managers.

Terry Chia

@AviD Isn't npm in itself a package manager though?

AviD

08:35

define "manager".

Terry Chia

@AviD Tool I use to download packages.

AviD

yes, npm can do that.

but oh you can do so much more!

Terry Chia

Isn't grunt more similar to make then a package manager like gem or pip?

I guess the analogous tool to grunt in the ruby ecosystem is rake?

AviD

meh, I wouldnt know, I'm not a javascript hipster.

which you clearly ARE.

Terry Chia

@AviD Hey, I don't write JS. I just hang around HN a lot.

AviD

08:38

seriously though I can keep track of them. you need like a half dozen tools just to get it all going.

Terry Chia

@AviD shrug I just use make for all my stuff.

AviD

see, what I dont get is - it's frikkin java SCRIPT, what the WTF are they trying to build there???

I know, IDEs havent been invented yet, will only be in 2065 that they become functional.

but still.

Terry Chia

@AviD Pfft IDEs. vim editor best editor.

AviD

biggest editor best editor!!

@TerryChia surprised you're not using Atom.

Terry Chia

@AviD There's a yo momma so fat joke in there.

AviD

08:42

@TerryChia biggest wife is best wife!!

ftr I am not calling my wife fat, I am referring to this:

►

Journeyman Geek

You clearly are.

MRS Aaaaaavvvvviiidddddd

AviD

heh.

AviD

11:11

@RoryAlsop you flag ninja

Rory Alsop

11:30

The hazards of waiting to pick up children from swimming. That's when I handle lots of flags

Adnan

15:16

4

AviD

20:11

any cryptoers here? /cc @ThomasPornin @CodesInChaos etc

Is using RC4 as a CSPRNG considered "okay"?

Rory Alsop

@kalina one for you:

3

AviD

also, assuming the answer is "well, kinda-ish, depending" - then how bad would it be if it is seeded with a combination of datetime (to millisecond) and a basic math.random()....

(I know it is in the general direction of "bad", but I'm asking "HOW bad" - like "kinda bad, change it when you can", "pretty bad, fix it asap", "CHRUST THATS BAAAD STOP THE INTERNET NOW UNTIL YOU FIX IT"-bad...)

CodesInChaos

20:28

@AviD It's certainly not the wisest choice.

AviD

@CodesInChaos I figured that, inuitively. Can you elaborate, in lameman's terms?

CodesInChaos

Even if you drop the initial bytes (to avoid their big biases), the stream output is still distinguishable from random data after about a GB of data.

AviD

and, how unwise is it - "meh, not great crypto", "submit security bug", "CVE WITH A CODENAME AND LOGO"

CodesInChaos

closer to "meh"

AviD

@CodesInChaos hmm. they dont drop the initlal byte, but I also dont think its anywhere near that much data.

mostly things like a nonce, or a key here or there

CodesInChaos

20:31

One problem with RC4 is that it's tricky to use. It has related key weaknesses which can lead to practical breaks.

AviD

@CodesInChaos thanks.

CodesInChaos

for example concatenating a key with a seed and using that as RC4 key is fatal.

AviD

@CodesInChaos right, I know that as an encryption algorithm. I just ran into a system using it for csrng.

@CodesInChaos no, the key and seed are mixed in together RC4- like.

CodesInChaos

And CSPRNGs typically get rekeyed frequently to achieve forward secrecy. That might interact badly with the bias of the first couple of bytes.

AviD

@CodesInChaos "interact badly", as in keep repeating the biased bytes?

CodesInChaos

20:34

each time you rekey RC4 you get significantly biased output bytes.

AviD

okay, thats what I thought you meant.

though if they were to skip the first few bytes (they dont), that would obviate that specific problem, right?

CodesInChaos

Skipping enough bytes avoids the biggest issues with RC4. I don't know how many you need to skip, something around 1000.

AviD

@CodesInChaos oh?? I thought it was only the first couple bytes.

regardless, they dont skip any.

CodesInChaos

the bias for the first few bytes is biggest

AviD

though in truth their implementation of RC4 (i knoooowww) seems just a bit non-standard, so they likely have a different set of problems.

CodesInChaos

20:39

I'd say using RC4 by itself is only "meh", but there is a good chance that they misused RC4 enough to end up with a practical attack.

AviD

@CodesInChaos I think so. though I'm still not sure how exploitable it is, if each rekeying is only used for a handful of bytes?

CodesInChaos

how are the keys derived?

AviD

and lets assume (...) that there is still enough entropy in the output for the given requirement, even considering the bias.

@CodesInChaos no keys, its only for csprng.

CodesInChaos

but the RC4 key still comes from somewhere

AviD

the seed for which is math.random() mixed with Date().getTime()

CodesInChaos

20:42

That's doubly fatal.

First of all, the entropy of that seed is too low.

AviD

oh absolutely.

that was the point I started at.

CodesInChaos

And second, that might hit the related key weakness of RC4.

AviD

started pulling at that thread...

CodesInChaos

RC4 leaks some information about the key via the bias in the first few bytes.

So if you use many similar keys, an attacker might learn the shared part even if it has high enough entropy.

AviD

well the only shared part between rekeyings would be the seed for Math.random().

though I suppose that still wouldnt be enough to obscure that seed....

anyway, my point, I plan on submitting them about the low entropy and such - the question is, is the fact they are using RC4 for a CSPRNG enough of an issue for a separate issue, or just mention it as a bad practice in a by-the-by?

CodesInChaos

20:47

Which language is that?

AviD

@CodesInChaos uhh, errrm, ummmm..... java.script

/cc @TerryChia yes yes, I'm a js-hipster. shuddup @Terry.

@CodesInChaos its actually a javascript framework that also has a crypto function.

and yes, I already know the problems of js crypto. but still.

though for anyone who doesnt already know - this is brilliant: matasano.com/articles/javascript-cryptography

CodesInChaos

Exactly how bad RC4 is depends very much on context. But since they need to touch the CSPRNG anyways, they should replace RC4 at the same time.

Many modern browsers already include a CSPRNG, no need to roll your own in one of those.

AviD

@CodesInChaos yeah, what I was thinking.

do you happen to know how widespread that is btw? and how good the implementations typically are? /cc @ManishEarth

CodesInChaos

I think FF, Chrome and IE11 have it.

AviD

@CodesInChaos ah yeah, this agrees with you. developer.mozilla.org/en-US/docs/Web/API/…

not sure how far back they want to be compatible. whatevs.

@CodesInChaos thanks!

as an aside, I want to point out how annoying it is when people think that a bunch of bit-flipping games can improve the entropy.

AviD

21:33

oh fugg it. how am I supposed to take this framework seriously, when this ACTUALLY appears in a comment??

> // Again - DON'T BE INSECURE!!! Security is left as an exercise
// for the reader :)

3

Stephan Heijl

21:48

Not the worst advice ever given in a comment, but certainly not up to modern frameworks' standards.

AviD

@StephanHeijl actually, sadly it is.

but "left for the reader" is basically a great big honking caveat emptor that they dont give a frig about it.

Stephan Heijl

Somewhere there is a code author thinking "Wew - dodged a bullet there"

AviD

hehe

Stephan Heijl

Frankly, I'm just amazed at the existence of a framework called Horse-js

AviD

yeah, like when they flip some binary bits in javascript so its "moar random"

Stephan Heijl

21:52

Good thing nobody has access to a page's Javascript

AviD

heh

Stephan Heijl

Oh wow, this thing even includes 'abstract airborne dressage' and 'horseless projects'

jQuery doesn't even do normal airborne dressage, it looks like I'll be switching

Gilles

@AviD It's ok as long as you skip the first few bytes of the output after initialization. Not something to use in a new design but not a showstopper either.

AviD

@Gilles yeah thanks, @Codes walked me through it.

though "first few bytes" seems to be closer to 1000.... also there are bigger issues than that anyway.

Gilles

ah, yes, I see CodesInChaos said pretty much what I'd have said

AviD

22:00

the source of entropy is still the biggest issue.

Gilles

@AviD IIRC there's one bit in the first byte that's guaranteed, and there's a bias in the first few hundred bytes that can be a problem in some applications

AviD

I think they thought that simply using the CSPRNG (RC4 in this case) was enough to provide the entropy automagically.

Gilles

AviD

@Gilles I think its the 2nd byte actually.

but yeah, same thing.

anyway, thanks @Gilles.

Gilles

I was in the same situation as you a while ago...

(probably not for the same product)

15

A: Evaluating the entropy gathering in a PRNG

"Entropy" is a measure of what some data element could have been. We say that we have n bits of entropy in a bunch of bits if those bits could have, collectively, assumed 2n distinct values with uniform probability (there is a whole lot of complexity which hides under the "uniform" term). To make...

AviD

22:03

ah yeah, seen that one again not too long ago.

@Gilles no, I'm sure its not the same.

at least you had the embedded system, respek. not some hipster-js framework.

Gilles

@AviD hipsterjs.org ?

AviD

heh

wait, is that real??

Gilles

> hipster.js — DYNAMICALLY STATIC

makes you wonder

AviD

I honestly cant figure out if thats serious or a parody

then again that is true about most js frameworks

Gilles

> April 17, 2013

is that 7 a typo?

AviD

22:10

> JS Frameworks: "It was all harmless idiocy, until one day..."

3

Stephan Heijl

The sidebar sounds like a joke, but it seems like a serious effort.

It looks like Jekyll but more work...

AviD

@StephanHeijl effort... to do what??

Stephan Heijl

An effort to provide people with a needlessly complex way to broadcast their every longform thought.

AviD

ah, right.

TildalWave

@AviD Lameman's terms? Was that a Freudian slip?

AviD

22:18

@TildalWave isn't that what people say?

;-)

TildalWave

Dunno, I don't listen to what people say :P

AviD

yknow, "explain it to me in lameman's terms"

TildalWave

layman's ... but ok

AviD

hehe

TildalWave

sounds almost the same :)

AviD

22:21

aaaaand which do you think makes more sense, in context? ;-)

TildalWave

none when you're asking about crypto

or either

AviD

how about javascript?

ftr, I know exactly what I was saying (and what the real word is). I'm just trying to make it a thing.

dont try and tell me that my way doesnt make more sense.

TildalWave

I know you know, I'm just bored

nearly fell asleep with full belly in front of telly and missus asked me if I'm asleep just as I would have been LOL

AviD

@TildalWave @tildakalina

Stephan Heijl

I know this was asked a few years ago on this very exchange, but I'm curious as to whether there have been any changes

Is there any reason to get an Organization Validation certificate over a domain validation certificate?

Specifically, end user wise?

I realize that the OV certificate probably has more research behind it, but does this affect anyone looking at a normal webpage in their regular ol' browser in any way?

AviD

22:31

@StephanHeijl is that the same as an EV cert?

Stephan Heijl

No, the extended validation has a separate category. I know that those show a green bar with the organization name.

TildalWave

@StephanHeijl not really no, see security.stackexchange.com/a/36170/20074

Stephan Heijl

Ah, great, that just saved me € 22,50 :)

TildalWave

:)

AviD

22:46

ahh that.

Terry Chia

23:04

@TildalWave You just cost someone a new Mercedes. I hope you're happy.

TildalWave

23:26

@TerryChia extremely, never liked those "gastarbeiter class" wagons

Transcript for