The DMZ

this.josh

00:00

With the American veto on the Security Council?

Google is now providing services to the American Government, its not too far to say they are a National Security interest.

Even if they arn't

Gilles

@thisjosh they are, definitely

the actions of the US government would be severely hampered if Google stopped working

not to mention US interests in general

this.josh

They can be replaced, they don't have a unique value to the Americans.

Gilles

@thisjosh sure, everything can be replaced. But it would take several years and some capital investment.

(or more likely doing whatever it takes to get Google working again)

this.josh

Ah, thats the ticket, now your talking. The question is money.

Not function.

Thomas Pornin

@Gilles Yes, it would send back the society to year 1995 or so. The Stone Age.

this.josh

00:16

maybe 1998, Everyone could go back to Windows 98.

Wow Shriram Kavitark Ram holds $182.000.000 (US) of Google stock

While Eric Schmidt owns only $82.000.000 (US) in google stock

Thomas Pornin

Actually I am more impressed by the amount of cash available in Apple's treasury

around 76 billions of dollars

that's more than 6 times the Gross Domestic Product of Ethiopia

this.josh

Ronald Johnson owns $91.000.000 US of Apple shares.

and no longer works for apple

I see Apple's Total Cash as $25,95B US

and Total Debt as 0

Thomas Pornin

@thisjosh The 76 billions figure was given in the news at late August, right at the time when Apple's treasury began to exceed the Federal treasury.

this.josh

This is for most recent quarter finance.yahoo.com/q/ks?s=AAPL+Key+Statistics

Thomas Pornin

But Apple can probably employ accountants who are good enough to reduce or inflate treasury at will when there is any related fiscal advantage.

this.josh

00:31

September 24th it looks like.

@ThomasPornin Now there is interesting artihmetic at play!

I heard something like that was going on at MF Global.

Odd thing, accountants who can't do the books correctly.

Ninefingers

01:12

I think I'll mention our discussion here, @ThomasPornin since we're clogging up the other room!

What I meant was I'm surprised the JVM bothers with actually doing nullpointer dereferences - unlike say checking for them first, or using some other representation. Perhaps there's something I'm missing though... (I'm not at all familiar with the jvm internals)

Stefano Palazzo

05:44

@ThomasPornin thank you for this fantastic answer on the smooth p-1 question!

I might end up just finding sophie germain primes

Rory Alsop

09:00

@AviD cheers. And Ouch on the cracked rib. Only done that once but it was sore/annoying for quite a while...and I accidentally cracked it again before it was fully healed, just by leaning on something, so take care!

@Gilles hahahahaha - well, that is positive reinforcement for you. It is scary when you don't remember writing it though...

AviD

10:04

@RoryAlsop thanks for the sympathy. I do find myself needing some of that... :)

@RoryAlsop yeah, I do that often too.

@Ninefingers thanks, not so much answer - more consider.

one of the (security) startups that I'm working with, is looking for a brilliant developer familiar with windows kernel / internals. Currently its just one month to implement some bits that a VC is waiting to see actually work, possibly longer term / equity deal after that.

Since my internals expertise is long out of date, and given that I find that you are one of the few that know the internals so much better than I, wanted to know if you were at all interested.

back in pre-Vista/2008 days, I was pretty deep in it. between GINA-hacking, kernel debugging, AD-deepdiving, and general system-level screwing around, I knew my way around pretty well.

since vista/2008, things have changed a lot - credprovs, integrity levels, UAC, etc etc... I know the theory on most of this, but nowhere near experienced enough on it.

Ninefingers

@AviD Sounds interesting, definitely. I've developed a few large win32 apps and know the theory of the kernel reasonably well (I like to think); however, major big kernel projects I haven't yet got involved with, just a bit of part time tinkering/reading around on my own. So I'd be interested, but I'd be feeling my way along in some areas as well - I'm not an authority on the subject by a long way, just someone with a lot of interest.

Ninefingers

10:31

Put it this way - I have a 23 year old's knowledge, rather than a 35 or 40 year old's accumulated experience. I'm still interested though; feel free to email me, or I can find you some other chat details or some such to discuss.

AviD

shall I put the fellow in touch with you then, and you gus work out the details?

whoooaa, youre 23?

youngling

go 'head make me feel old

not as old as Ol' Man @Rory over there, but still... ;)

Ninefingers

@AviD yep... so as I say, inevitably there is quite a lot I don't know, simply by virtue of the fact I haven't had as much chance to learn it (and the irritating fact that people keep discovering things. I mean what is all that about anyway!)

2

AviD

anyway, you do indeed have the knowledge and experience in current versions of kernel and internals and such?

hehe

they are looking for someone who knows his/her way around already, not really much time for a learning curve... then again, I'm not sure the precise expertise they need.

as you know, kernel expertise is not common amongst windows developers.

would actually be a very interesting product they're working on, though I dont know all the details yet.

anyway, shall I send him to your gmail address?

Ninefingers

@AviD I suspect I wouldn't suit then - I wouldn't rank myself as knowing my way around like the back of my hand.

AviD

really?

from some of your posts on topic, I'd think otherwise.

Rory Alsop

10:38

@AviD thankyou!

@Ninefingers always thought that was a weird phrase. I know the front of my hand way better than the back

AviD

@RoryAlsop well it depends what you're doing with your hand.

e.g. if you usually see your hand whilst grasping something,you're likely to see the back (or even the top) of your hand better.

Ninefingers

Yep. I can read assembly. I can tell you what the functions do where they're documented; I've read a lot of Old new thing blog posts, done a fair bit of research on kernels in general, messed with a rootkit or two on Linux, am currnetly reading the rootkit arsenal on exploiting windows. I've messed with disassemblers and debuggers and read a lot of stuff on that. I've even compiled drivers for windows (spice) and have the ddk installed.

I've even messed with running nt native apps at startup.

But I've not done much work in that area day-in day-out as part of my job.

AviD

@Ninefingers well that already puts you ahead of the crowd. but I dont know what level they're looking for...

but you are familiar with the internal plumbings of e.g. UAC, MIC, DEP, ALSR, and all the other goodies that are built in to the OS?

Ninefingers

@AviD Rory might be being funny, but he's right... in my head I'm in a crossover place. I have a lot of the knowledge I need to get started, but I'm no hardened kernel hacker.

AviD

needing programmer, not cracker.

so, want to try throwing your hat into the ring?

I'll ask him what exactly his requirements are.

Ninefingers

10:44

@AviD I'll throw my hat in, just to see. As you've probably gathered, I'm not the kind of guy to say I can do something I can't.

Rory Alsop

@Ninefingers I do point a few folks at your posts though. I used to code at machine level (maybe 25 years ago) so although I am definitely out of this space I see enough to appreciate your breadth of knowledge.

AviD

excellent

AviD

10:59

so @RoryAlsop what do you actually do for a cracked rib?

just wait it out? drugs and other painkillers?

Rory Alsop

@AviD Yep - in the past they used to strap you up, but it turned out that contributed to a high incidence of pulmonary diseases, so nowadays they just say - eat lots of ibuprofen and take it easy

oh, and don't let children jump on you

AviD

@RoryAlsop i think thats the hard part

so i was surprised they didnt strap me up or anything

Rory Alsop

The decision by doctors around the world appears to have been based on the lung disease numbers. You need to be able to breathe in and out properly

even though it hurts

Ninefingers

0

Q: How hard is it to break Axycrypt?

Can I use Axycrypt to secure my sensitive information? What level of security I can expect? for example: Who can crack -Military/Law Enforcement can't break? Time: -It can be done in a day -Easy/hard to break?

encryption

What do we think? For you guys that is?

AviD

please! no talking about breaking anythign for a while.

Ninefingers

11:08

Sorry...

AviD

hehe

@Ninefingers I think close as too localized.

its not like this axycrypt is a common standard, other than that he doesnt provide enough info for those not familiar with it to be able to sort it out.

Rory Alsop

@AviD yep - the correct answer would be: speak to an axycrypt tech to find out exactly what algorithms are used

if the question was "how hard is it to break AES-128 with key length y etc" then it could work as a question

AviD

@StefanoPalazzo gives a good answer, but to a different question, the one that should have been asked

Rory Alsop

@AviD just spotted that - agreed!

AviD

actually, has been numerous times

Rory Alsop

11:13

@thisjosh and @ninefingers - were you asking about numbers of questions? We have been getting between 6 and 40 new questions a day over the last month or so. Not doing too badly. And 1000 new visits a day!

ooh - talking of stats @AviD - are you taking time off work to recover? If so, you are fourth in terms of rep...need to get a couple of questions/answers in :-)

AviD

wow, fourth? dang.

Rory Alsop

LOL

AviD

actually I've been kinda sparse on the site lately as is, mostly just lurking and catching flags and such when I can.

been extremely busy....

and getting to be even more so.

running 2 startups in addition to my consulting, besides the usual family bits, doesnt leave much time for fun... :S

Stefano Palazzo

@RoryAlsop there happened to be an article on it in the german wikipedia, this is where I got the idea that it uses aes128.

for all I know, it truncates and zero-pads the password to generate its key, or whatever.

i.e. it might be absolutely awful. so I stuck to what I can can find out

Rory Alsop

@StefanoPalazzo :-) Implementation is always the problem

Stefano Palazzo

11:28

speaking of which,

I want to have easy-to-use encrypt() and decrypt() functions in my crypto-library, and I'm currently thinking about how they should work, and about sensible default values. do you mind looking over it quickly, letting me know if there's any big blunder in my design?

here's how it works:

the password is encoded from unicode to raw bytes, then stuck into PBKDF2, with a 16 byte salt, 4096 iterations, and hmac-sha256. this gives me a 48 byte key

AviD

@RoryAlsop and implementation does belong here, but then again we have no way of knowing.

Stefano Palazzo

I use the first 16 bytes for the AES key, and the later 32 bytes for the HMAC key.

then I encrypt, then hmac, and return all of this stuff

random numbers are generated via /dev/urandom or (whatever the windows equivalent is called, I forget)

does that sound okay?

I'm thinking it'd be more dangerous not to include these functions, since people who don't know or care about crypto will assemble the primitives into something worse

Rory Alsop

That seems okay to me (as a series of basic steps) but @Ninefingers and @ThomasPornin - we need you :-)

Stefano Palazzo

this is an example output:

{
    "count": 4096,
    "ciphertext": "HM7phy3IFuvKorYWcQQ5FA==",
    "iv": "DM+grKrD4VxX36CaQbfAPQ==",
    "version": 1,
    "salt": "th8XAf4BS6b+Lqe8sMXBFw==",
    "hmac": "zQgWGzVZouoGbRkjW1peB2NJISrqRyv5R7HCYg8amN4=",
    "cipher": "aes128"
}

(the result of encrypt("", ""))

I wonder if using hmac-sha384 for the kdf would add any security. (as I'm generating a 48 byte key)

oh yes, I also check the pkcs7 padding, make sure it's correct and fail if it isn't. and the mmo is CBC.

Ninefingers

11:45

@StefanoPalazzo /dev/urandom should be fine as a source of randomness. @ThomasPornin has supplied that answer on here I believe!

Stefano Palazzo

I'm using an abstract function, python's "os.urandom". which tries to use either /dev/urandom or windows' CryptGenRandom

if neither are there, it'll not use a weak source, but fail with a NotImplementedError

Rory Alsop

@AviD 2? In different industries? Or both infosec?

Stefano Palazzo

and I'm having a hard time understanding why my competitors all ship with their own PRNGs...

Ninefingers

@StefanoPalazzo this bit I'd be uncertain about, i.e. deriving both the hmac key and the encryption key from the same source. I personally can't see how it would be a problem - a HMAC key is just a secret known only to the two parties. Modes like EAX combine authentication with encryption and I believe EAX uses a single key for both, so they're not even splitting PBKDF output, just re-using the same key. That said, huge disclaimer: I'm not a professional cryptographic researcher.

Thomas Pornin

12:33

@StefanoPalazzo Obtaining the key for encryption and the key for MAC from the same source is OK as long as the key derivation function is "proper" (PBKDF2 is believed "proper"); that's what SSL does.

Ninefingers

I knew that ;p

Thomas Pornin

HMAC/SHA-384 is "stronger" than HMAC/SHA-256 only in a theoretical, unrealistic sense (it can be stronger only if you can envision that HMAC/SHA-256 can be attacked, which is not sensible right now)

On the other hand, if you want to implement SHA-384 on, say, a Javascript platform, you will suffer greatly (both in performance and in mental health)

So go for SHA-256

For your HMAC, you must take care of what to include in the HMAC input

If you compute HMAC over the plaintext (before encryption), then that's fine (on a theoretical basis, this needs HMAC to be a little more than a MAC, it must also avoid leaking information about the input data, but with HMAC this property is achieved)

If you compute HMAC over the ciphertext (after encryption), you MUST include not only the ciphertext but also the IV and the algorithm specification (the "aes128" string)

otherwise, someone could change the IV or switch to a different algorithm, leading to a distinct plaintext, without HMAC noticing anything.

So applying the MAC on the ciphertext, while being "better" in a "provable cryptography" way, is a bit trickier since you must define an encoding which aggregates the plaintext, IV and algorithm specification in a deterministic sequence of bytes.

For details on that MAC+encrypt question, see:

22

Q: Should we MAC-then-encrypt or encrypt-then-MAC ?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which include a MAC (EAX, GCM...) but let's assume that we are doing old-style crypto, so we have a standalon...

mac protocol-design

Oh yeah, another important point: you have some padding, and CBC

if, upon decryption, you find a wrong padding, and report it as such, then you have a weakness (that's the "padding oracle attack").

If you apply the MAC on the ciphertext, no problem: you decrypt only if the MAC said "that's good", and you can report a bad padding in any way you wish

On the other hand, if you apply the MAC on the plaintext, then you must decrypt first, before verifying the MAC.

In that case, it is crucial that you always compute the MAC, even if the padding was all wrong, and that you report "bad padding" and "bad MAC" in exactly the same way (it must not be possible, from the outside, to distinguish between the two occurrences -- hence the requirement for always computing the MAC, so that the timing is constant).

Summary: encryption+MAC, that's tricky. Maybe you should use a combined mode which already handles the subtleties.

I suggest EAX

EAX mode

EAX mode is a mode of operation for cryptographic block ciphers. It is an Authenticated Encryption with Associated Data (AEAD) algorithm designed to simultaneously provide both authentication and privacy of the message (authenticated encryption) with a two-pass scheme, one pass for achieving privacy and one for authenticity for each block. EAX mode was submitted on October 3, 2003 to the attention of NIST in order to replace CCM as standard AEAD mode of operation, since CCM mode lacks some desirable attributes of EAX and is more complex. Encryption and authentication EAX is a flexible no...

It is an encryption mode over a block cipher (AES), which combines encryption and MAC using a single 128-bit key in a safe way.

It is also lighter on IV requirement: you just need a non-repeating IV; it needs not be uniformly random and unpredictable, as CBC needs (but a random IV from Python's "os.urandom" will be fine for both EAX and CBC)

Dog eat cat world

12:51

Does anyone know if you can send/recv to unix sockets (owned by others), with chmod o+r?

Thomas Pornin

@Dogeatcatworld It depends on the Unix brand

Dog eat cat world

for my case, its linux

Thomas Pornin

Linux will reject the connection attempt if you do not have read and write access, as specified by the access rights

BSD systems (and probably MacOS) will ignore the access rights on the socket itself

(all systems enforce access rights on the directory which contains the socket, though)

so on a Linux you will not be able to connect(), let alone send() and recv()

on a BSD system you will connect(), send() and recv() at will

on a Windows system with Cygwin, or with SFU... anything goes

I do not think there is a system where you can have read but not write access; sockets are a bit all-or-nothing that way

If you want to enforce access rights portably, I suggest using a specific subdirectory and use the access rights on that directory

Dog eat cat world

Got this on linux 3.0.0: socket.error: [Errno 13] Permission denied

permission was o=rx

Reason I asked, was because I found a race-condition vulnerability where sockets were created 755, then chmodded to 600

but I guess there is no real vulnerability, since its a linux only code, and the access restriction does not actually change...

Thomas Pornin

@Dogeatcatworld It still deserves at least an explicit comment (when I read "Linux-only code", I understand "this will not be ported to another system until next month (hopefully)")

Dog eat cat world

13:04

it was pretty much linux specific code... but it might already have been ported to bsd ;)

think of it as: #ifdef linux ... #endif

I take it back, im pretty sure its for *bsd as well

Thomas Pornin

So there you have, race condition. Pretty !

Dog eat cat world

sure is! believe this is a local privilege escalation vuln

Dog eat cat world

13:28

thanks for input, but too bad I don't have any bsd systems to test this on...

Thomas Pornin

13:39

@Dogeatcatworld It is easy enough to install a test BSD system in a virtual machine (although this will take one hour or two, so this may be overkill for just a test). I recommend VIrtualBox (for the VM) and FreeBSD (for the OS).

Stefano Palazzo

Thank you very much @Thomas, @Ninefingers

looks like I'm good to go

Dog eat cat world

@ThomasPornin, Thanks, I'll try freebsd... have not touched bsd in ~8 years now, its scary

Stefano Palazzo

When I first heard about the padding oracle, I just made it a general policy to never return chatty error messages. After all, real world users don't care whether padding or hmac failed, they only care about either a wrong password or a corrupt file format.

AviD

@RoryAlsop well, my main one is in security. I was just pulled in to join (ie. develop) another, smaller one - but should probably play out much quicker.

the second startup is in a different field - startups :)

so yeah, thats why I'm busier than ever, though I have a painful feeling that might have to change now.... :(

Thomas Pornin

14:08

@StefanoPalazzo In my experience, chatty error messages are good for debugging, once the system has been deployed. But for some parts of cryptography, they are bad. Also, remembers that you can be unwillingly "chatty" by the time your system takes to process a message.

Stefano Palazzo

@ThomasPornin I meant to ask about that now that you mention it,

In my implementation of AES, I've used lots of look up tables for a start, but I think there are still some bits of code that take different amounts of time depending on the input (it's got to be readable as well)

aside from unrolling loops and that kind of thing, what are some of the techniques used to secure against timing attacks?

for instance, do people just put in random sleeps?

Thomas Pornin

@StefanoPalazzo random sleeps do not work well; they can be filtered out statistically

for symmetric cryptography, we arrange for having no data-dependent code path

In the case of AES, the table lookups are actually a trouble, because on systems with cache, you can theoretically force cache misses for some entries and not for others, and this leaks information (this was demonstrated in lab conditions, not "in the wild")

For asymmetric cryptography, avoiding data-dependent code paths (an "if") is harder, so we have to use various masking techniques

for instance, for RSA, instead of computing m^d mod n, we select a random value r and we compute ((r^e)*m)^d / r mod n

Stefano Palazzo

that's in order to avoid exponentiation by squaring?

I fear that'll be too slow to be practical (in the case of RSA)

Incognito

Hrmm, wondering what causes this because it crops up for me often, when I'm in SSH, sometimes my key bindings like backspace send strange encoding like [A or others to the terminal, happes with putty or cygwin's ssh, etc.

Thomas Pornin

It is not the squaring which are a problem, rather the multiplies (in the "square and multiply" algorithm). Details are a bit intricate and involve the Chinese Remainder THeorem

@StefanoPalazzo It is practical; overhead is below 30%

I do it for my implementations, as do many others

there is a slightly weakened version which is faster (about 5% overhead) that OpenSSL uses.

Stefano Palazzo

14:21

that doesn't sound so bad though, 30%.

I'll run a test. should r be about as large as n?

Rory Alsop

@Incognito ??

Thomas Pornin

@StefanoPalazzo It should be a random integer modulo n, so "as large as n"

preferably a uniformly random integer modulo n

Stefano Palazzo

right. oh my world it's slow. I'm still waiting for the decryption :)

Thomas Pornin

@StefanoPalazzo The modular division is a bugger; it can be fast, but that's not totally easy

Jeff Ferland

So, how many kWH do you suppose Google spends every second on computing password hashes?

Stefano Palazzo

14:32

I would've thought it's the (r ^ e) that really kills it

Thomas Pornin

With pure Java code, on a 2.4 GHz Core2 CPU, I get over 300 RSA decryptions per second (1024-bit RSA)

@StefanoPalazzo The "30%" figure assumes that e is small, as is customary (e = 65537 is the most often used value)

Stefano Palazzo

that's the one I use

here's how I generate keys:

def make_keys(bits=2048, e=65537):
    ''' Return two tuples, public and private key, as (n, e), (n, d) '''
    p, q = get_prime(bits // 2), get_prime(bits // 2)
    n = p * q
    phi_n = phi(n, p, q)
    d = mult_inv(e, phi_n)
    return (n, e), (n, d)

RSA is really lovely. look at how simple this is.

Thomas Pornin

Of course, by not using the CRT, you lose a x4 factor.

With a small e, the masking cost should be small with regards to the core exponentiation

If it is not, you are doing something wrong

Stefano Palazzo

yes, I must be

I feel like I can use the multiplicative inverse to do the modular division, for some reason

maybe that's thinking too complicated, is modular division as tricky as I think it is?

Thomas Pornin

@StefanoPalazzo You can do it with an exponentiation but that's slow (1/x = x^(n-2) mod n)

Otherwise, you need some variant of the extended GCD

Extended Euclidean algorithm

The extended Euclidean algorithm is an extension to the Euclidean algorithm. Besides finding the greatest common divisor of integers a and b, as the Euclidean algorithm does, it also finds integers x and y (one of which is typically negative) that satisfy Bézout's identity : ax + by = \gcd(a, b). The extended Euclidean algorithm is particularly useful when a and b are coprime, since x is the multiplicative inverse of a modulo b, and y is the multiplicative inverse of b modulo a. Informal formulation of the algorithm {|class="wikitable" align=left !Dividend!!Divisor!!Quotient!!Remainder |...

Stefano Palazzo

14:40

yes, right. Instead of dividing, I can multiply by the multiplicative inverse

Thomas Pornin

Go see this: cacr.math.uwaterloo.ca/ecc

It is about a book on elliptic curve

there is a free sample chapter which can be downloaded

that chapter is not about elliptic curve, but about computations in finite fields

it will be very informative for understanding how it is done for RSA

The bottom-line is that a modular division has roughly the cost of 80 modular multiplications, if done properly

Stefano Palazzo

well the exponentiation is slow as well ← never mind that, it was just a typo.

haven't had the patience to let it get to the division yet :)

thanks for the link, that's pretty much exactly what I need

M'vy

14:59

Hi there

You're on the RSA implementation @StefanoPalazzo?

Stefano Palazzo

yep @Mvy

M'vy

^^. Still reading history

Stefano Palazzo

I must be doing something wrong still. it's plenty fast now but I get the wrong result. I don't understand why "e" is there

M'vy

You found the modular exponentiation then?

Stefano Palazzo

this is what I have: (pow(pow(r, e, n) * m, d, n) // r) % n

pow(a, b, m) means "a^b (mod m)"

this is in place of m^d mod n

so, how did e get in there?

M'vy

15:04

what is e? (And from where are you reading things by the way?)

Stefano Palazzo

48 mins ago, by Thomas Pornin

for instance, for RSA, instead of computing m^d mod n, we select a random value r and we compute ((r^e)*m)^d / r mod n

e is the rsa exponent, 65537

I just jumped to my RSA code and punched it in, we were talking about timing attacks on aes to begin with :)

r is some random number in 0..n-1

people here have spent more than enough time on my many questions, I guess I better take this one to crypto.se

Thomas Pornin

@StefanoPalazzo ((r^e)*m)^d / r = r^(e*d)*(m^d) / r = m^d puisque r^(e*d) = r mod n

Stefano Palazzo

(still looking at it)

Rory Alsop

15:20

@ThomasPornin 'puisque' ?

Stefano Palazzo

@RoryAlsop "because"

Thomas Pornin

@RoryAlsop Sorry, I am multitasking with a meeting in French. "since"

Rory Alsop

thanks :-)

Scott Pack

@Rory!

Stefano Palazzo

15:37

there we go

the solution was right in front of me :)

awesome @ThomasPornin, thanks again

Instead of dividing, I just multiply by the multiplicative inverse (like you said)

(pow((pow(r, e, n) * c) % n, d, n) * mult_inv(r, n)) % n

and mult_inv is just the extended euclidean algorithm, where I add n to x in case x is negative. fantastic.

and yes, it might well be 30% slower, but it doesn't matter since that's 30% of "no time at all"

Rory Alsop

@ScottPack yay!

Ninefingers

20:06

1

Q: Javascript + .Net cryptography to protect sensitive data on public server

We need an expert opinion about the actual encryption and safety in the following case: There are some very sensitive data stored in a public hosted sql database server and we need to protect them! Actually we have the full machine (it should be a virtual server) and no db adbmin or else could...

asp.net security encryption rsa aes

thoughts for here?

this.josh

21:25

@Ninefingers You mean migration or answer?

Transcript for