« first day (3563 days earlier)      last day (1338 days later) » 

John Zhau
John Zhau
3:10 AM
Let's say I'm connect to a wifi AP but without internet because they're a captive portal. Without logging with the portal, what can I try doing on the network?
 
ThoriumBR
ThoriumBR
3:28 AM
it depends on how the portal is configured
some will redirect everything to the port 80 of the webserver, and answer every DNS request with the captive portal http
some allow "affiliate" traffic, some will forward DNS queries, ICMP, things like that
arp spoofing the gateway can lead you to compromise valid portal credentials
 
John Zhau
John Zhau
4:10 AM
I'm trying crackmapexec on mssql and got this:
`cme mssql target.domain -u '' -p ''`
`MSSQL x.x.x.x 1433 None [-] ERROR(READACTED): Line 1: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.`
Trying it with -u a -p '' returns Login failed for user 'REDACTED\Guest'. but with -u '' -p '' I got something with NT AUTHORITY. Would that be a potential problem?
 
John Zhau
John Zhau
4:24 AM
I'm in an SMB share with READ,WRITE permissions & anonymous login. smbclient //example.com/rw_share -U "a"%"". There are some other shares I'd like to get to but don't have permission. Besides exfiltrating files & uploading code that won't run (because SMB), what can I try to get around?
 
 
3 hours later…
xdtTransform
xdtTransform
7:16 AM
Hi everyone!
Does someone remember if there were a out of bound patch on Win10, and when approximately?
 
 
2 hours later…
Conor Mancone
Conor Mancone
9:17 AM
@reed As an american but "outsider" (in the sense that I'm not invested in Trump being the anti-christ or the savior), I'm pretty sure that he is actually a very intelligent man. Honestly, you don't get as far as he has in business without doing a lot of things right. However, if you record everything that someone says 24/7, it's impossible not to catch them saying some things that are downright stupid in retrospect.
In short, I don't think he has anymore "blunders" than anyone else in politics. However I suspect he has two things going against him in this area. First, lots of people really hate him and try to make everything he says sound as bad as possible. Also he is not a "nice" person and expresses his ass-holery pretty regularly. Naturally, people don't appreciate that, although his "fans" love it about him
@MechMK1 I know the truth about that incident. It totally was his fault. The poor dude who owned that bag of rice couldn't feed his family that week because of Trump.
 
reed
reed
10:05 AM
@ConorMancone yeah, I don't think he's "stupid" meaning he has a low IQ. He's definitely been smart to be able to achieve all those goals (business, winning an election, etc.). So maybe stupid is not the right word, but I can't think of a better synonym. Then as you say the problem is also that the press/journalists/media can make a person look and sound like whatever they want, by distorting information in specific ways.
On the other hand, most politicians don't seem to work too hard to avoid getting into awkward situations. Like, you would think if you wanted to do something illegal you would not talk about it on the phone, right? Or you won't meet criminals in public places, right? Yet lots of politicians (at least in my country) keep on making enormous mistakes all the time
The probably rely on their propaganda, they will probably think "I can do whatever I want, I can always convince the voters with my propaganda"
 
 
2 hours later…
MechMK1
MechMK1
12:03 PM
0
Q: "Memory-Hard" vs. "Memory-Bound" Functions?

QuestionerOne of the approaches in order to prevent Sybil or DoS attacks is CPU-bound PoW. However, because of the influence of Moore’s law, the memory-based approaches are suggested. As actually there are two different terms: (1) memory-hard functions and (2) memory-bound functions; Does it mean that we h...

ddos denial-of-service memory
Anyone feel like verifying that I didn't say absolute dogshit?
 
Conor Mancone
Conor Mancone
12:20 PM
@MechMK1 I'm not familiar with memory bound functions (although your wiki quote touches on that), but you certainly described memory hard functions and their use cases very well
 
MechMK1
MechMK1
Yeah, I can still bullshit my way through security talk
Gonna be a rough awakening for me when one day people start noticing I don't know shit about security
 
reed
reed
I don't understand that 8 GB cache. What do you mean? The last time I heard of caches they were some KB or MB in size
in the context of CPUs
 
MechMK1
MechMK1
@reed Imagine a high-performance ASIC for, say, SHA-256
How large does the ASIC cache need to be for that? One Kilobyte perhaps?
 
Conor Mancone
Conor Mancone
The cache for the ASIC is effectively it's on board memory. If your hashing function is designed to require 8GBs of memory, than an ASIC with less than that is useless.
 
MechMK1
MechMK1
Less than that, and you need to stream in data from the memory, which is REALLY SLOW by comparison
More than that, and...well, that's not really an advantage
Either you can fit everything in, then you are fast. Or you can't fit everything in, then yo are slow
As Conor mentioned, if your function requires you to have 8 GB of memory, then you'll be shit out of luck doing that as an ASIC, because you won't get 8 GB of cache
Did that make sense?
 
reed
reed
12:28 PM
Yes but I don't understand why you said it's feasible on a regular desktop computer.
Do regular desktop PCs have such enormous caches?
 
MechMK1
MechMK1
Because you have 8 GB of regular memory. You are "slow" by default
But that's okay
Let's take Keepass as an example, okay?
My Keepass database uses Argon2d, 150 rounds with 16 MB
So on my work laptop, that is roughly one second decryption time
16 MB might actually be a bit small, I think you can build a cache like that
Let's say it's 1 GB, just for the sake of the argument
 
reed
reed
but "regular memory" is not the same as a cache. So either I'm not understanding your argument, or that sentence in the answer is a bit misleading ("Having an 8 Gigabyte large cache for the ASIC is not feasible (yet), but still very much doable for a regular desktop PC, and even mobile devices in reasonable time")
 
MechMK1
MechMK1
Yes, i may have formulated it wrong
I'll edit it later
My point being is that if I can do it on "off-the-shelf" hardware in 1 second, then specialized hardware should not be able to do it much better at the same pricepoint
Meaning, an attacker that spends 10000 USD on a cracking rig containing off-the-shelf hardware will have basically the same power as spending 10000 USD on ASICs
 
reed
reed
Yes, then I understand what you are saying. An ASIC won't really help. Yet that sentence is imprecise because it sounds like you are saying an 8GB cache is feasible on a desktop PC. So you might consider improving the phrasing. ;)
I was like "whoa, time flies, we have 8GB caches on desktops now" LOL
 
MechMK1
MechMK1
I edited it
> Having an 8 GB large cache for an ASIC to ensure maximum performance is still not feasible, but the calculations can still be done on off-the-shelf hardware.
I mean, you can't stop an attacker from just buying twice as much computational power, but you can stop them from spending their money smarter.
 
reed
reed
12:36 PM
yeah, that makes sense
Thought of the day: PoW algorithms don't work well in a capitalist society because of the possible concentration of power available to a single person.
 
MechMK1
MechMK1
I guess the point I was trying to get at is that you can require a certain amount of memory to be used, which is infeasible to do as cache, but is still possible on consumer-grade hardware
@reed I tend to agree, but then you basically attach a cost to the work
So, say, if cracking my PoW scheme costs you X USD, then the expected reward must be more than X USD.
So in a sense, it works. Look at scam emails. The reason why they work so well is because sending one e-mail costs virtually nothing
According to what I have just googled and with no further checking of sources, only roughly one in 12.5 million people answer a spam email.
So if sending one e-mail costs roughly 0.01 cent, then a scammer needs to pay 1250 USD just for one person to answer them, on average
 
ThoriumBR
ThoriumBR
large caches are useful when you have lots of different programs running at the same time. back on the ms-dos days, cache wasn't that important because we ran only one program at a time, and the processor could keep most of the instructions close to it
 
MechMK1
MechMK1
@ThoriumBR Cache as opposed to RAM?
 
ThoriumBR
ThoriumBR
today we have thousands of processes running at the same time (I have right now 2147 processes), and the amount of context switches are so large that if the processor had to fetch everything from RAM all the time, the performance would be terrible and the memory bus would be facing "traffic jams" all the time
 
MechMK1
MechMK1
Yes, on a general PC. But if you assume a purpose-built ASIC just there to run one algorithm, that's a much different story
Being able to calculate the entire hash all in cache is a MASSIVE speedup in comparison to having to talk to memory back and forth
 
ThoriumBR
ThoriumBR
12:46 PM
I saw a presentation for an IBM z system a couple years ago showing how a large cache makes a lot of difference when you have thousands of processes running at the same time... and when you hit the point where the processor cannot keep the instructions on cache, the performance falls from the cliff...
 
MechMK1
MechMK1
Especially if the hash is something like Argon2, where you have to do calculations all across the memory
 
ThoriumBR
ThoriumBR
but on an ASIC, the memory is almost equals to cache anyway...
and a 8GB ASIC would be very, very expensive... like 6 digits kind of expensive
 
MechMK1
MechMK1
Indeed, and it would just become infeasible to do. Because for the same amount of money, you could get much better performance out of off-the-shelf hardware
 
Conor Mancone
Conor Mancone
Chunk Norris can make ASICs with an 8GB cache....
 
ThoriumBR
ThoriumBR
chuck norris don't need asics... nor memory
he can break encryption using bruteforce....
 
MechMK1
MechMK1
12:54 PM
Chuck Norris just knows which plaintext belongs to a given hash.
0
Q: Forcing a machine to occupy a part of RAM for a period of time to prevent it from DoS attack

QuestionerIn order to prevent the participants in a distributed network from Sybil or DoS attacks, one of the solutions is PoW (either compute-based or memory-based). To avoid inefficiencies of PoW, if the participating machines in the networkby using a client code would be forced to occupy a part of their...

attack-prevention denial-of-service memory
Do you understand this question?
 
Conor Mancone
Conor Mancone
@MechMK1 I think the OP is suggesting that the algorithm somehow forces the machine to use a particular physical area of RAM as part of proof of work. The question is very confusing, and I think the suggestion itself also will not work at all/makes no sense.
 
ThoriumBR
ThoriumBR
I kinda understand, but I have no idea how to force a distributed application to allocate part of the RAM to avoid a DoS
back on the DirectConnect days, people were only allowed on some servers if they had a shared folder large enough, so some people would compile "custom" clients that advertised a 500GB shared folder (something gigantic back them) only to be allowed on some razorback servers...
client side restrictions don't usually work...
 
A. Hersean
A. Hersean
1:12 PM
I think the question is about the usual trade-off between computation cycles and memory consumption.
 
ThoriumBR
ThoriumBR
but you cannot rely on clients saying they locked the memory away
and if you need to lock, say, 4gb, someone with 32gb can do without any penalty... if it's a portion, one could create a lot of VMs (or containers) with 128MB of memory and say they locked 75% of their memory
and the clients can just cheat the answer and say they locked memory without really locking it
 
A. Hersean
A. Hersean
Yeah, and even if you could, you would have to prove the exclusive use of the RAM for this one proof. To prevent trivial factorization of proof computing.
I think the OP read about Argon2 or something alike, which uses more memory to be able to use less computation time, and thought to apply the same concept to PoW.
 
MechMK1
MechMK1
1:31 PM
Isn't he just essentially asking about a memory-hard function?
I mean, if we assume that there are no feasible time-memory tradeoff attacks on Argon2, then a PoW using Argon2 with the parameters of, say 1GB memory allocation, would prove that the client in question allocated 1 GB RAM
Or, that they allocated less, for much less performance
 
Conor Mancone
Conor Mancone
@MechMK1 I think that is the answer he is looking for, but I don't think it is the question he asked. I'm thinking this is your classic X-Y question situation, and that is what he really wants to know. Then again I still don't understand the connection to DoS
 
MechMK1
MechMK1
Ask better questions, get better answers.
 
A. Hersean
A. Hersean
@MechMK1 Yes, but the verification of the proof must be asymmetric. It must take less time and memory to verify the proof than to compute it. That's not possible using Argon2.
 
MechMK1
MechMK1
Of course it is
For example, I could say "Find me an input for Argon2, using the following parameters, to which the result begins with at least X bits of zeros"
Or are you referring to the verification of individual inputs?
 
A. Hersean
A. Hersean
Either it's validation of individual inputs (what I think the OP is asking about) and its not possible, or it's classical proof of work but just with a more complex one-way function: the PoW there would still mostly rely on the number of tries, thus way more on CPU usage than memory usage.
 
Conor Mancone
Conor Mancone
1:45 PM
@MechMK1 Yup, that's exactly how to do it, and I'm pretty sure that is how bitcoin works these days. "Find me an input that hashes to X". Argon2 is much "slower" so you'd probably want to just specify X bits at the start of the hash, but same concept.
@A.Hersean However if you use a memory-hard function, then memory usage becomes critical instead of CPU, as is currently the case
 
MechMK1
MechMK1
I mean, if the function is a memory-hard function, then it's certainly not proof, but it is reasonable enough
So if I solve a PoW for an Argon2 hash with 1 GB parameters, then either 1.) I allocated 1 GB, 2.) I allocated less and used memory swapping at the cost of speed or 3.) I found an exploit in Argon2 that allows me to use less memory.
And oh my god, why are people so bad at statistics!??!?!
"A coin has a 50% chance to land on heads and a 50% chance on tails. If you throw the coin 5 times and it lands 4 times on heads and once on tails, that means that tails is now more likely to occur, to balance this out."
 
A. Hersean
A. Hersean
Thinking more about it, I think that indeed you could build a PoW to be used in a competing context (the bitcoin use-case) that would need relatively more RAM than CPU usage, at least with a ratio memory/cycles that higher that the current one in bitcoin.
 
MechMK1
MechMK1
NO!!!! NO IT DOES NOT!!!!!
 
A. Hersean
A. Hersean
I wonder if such memory-hard one-way functions are already used in some alternative cryptocurrencies.
 
ThoriumBR
ThoriumBR
people see patterns when there are none... and cannot usually tell linked and independent events apart...
 
MechMK1
MechMK1
1:53 PM
It's just a complete misunderstanding of statistics
 
ThoriumBR
ThoriumBR
that's why some people sell programs showing the numbers that have "more luck" on the lottery...
 
MechMK1
MechMK1
Sure, 4 heads 1 tails is not a "likely" outcome, but in the grand scheme of things, it does not matter
 
ThoriumBR
ThoriumBR
see, the number 35 has been on winning tickets 0.5% more than the average
 
MechMK1
MechMK1
in 5,000,000,000 throws, 2,500,004 heads does not matter at all
 
Conor Mancone
Conor Mancone
@MechMK1 I'll have to see if I can find an article, but there are casionos that have made big money as a result of this. There was a roulette table that got some ridiculous number of "reds" in a row (50/50 chance) and so everyone was convinced it would be black next and threw lots of money down. It went red again, winning big money for the casino, and that cycle kept repeating a few times until it finally came up black
 
ThoriumBR
ThoriumBR
1:54 PM
and if you are using a fair coin, even if it lands heads 1000 times, the 1001st have 50% chance on either one
 
MechMK1
MechMK1
@ThoriumBR Of course, that's just random noise
 
Conor Mancone
Conor Mancone
by the time it was done the casino raked in millions of dollars in like 15 minutes
(true story)
 
MechMK1
MechMK1
Gamblers are the worst type of this.
 
ThoriumBR
ThoriumBR
casinos win money by the "law of large numbers"...
 
A. Hersean
A. Hersean
In lottery, for example when numbers are drawn from [1..50], you can optimize you earnings by picking numbers over 31, because people often use their birth date, so if you win you'll have less to share with others.
 
MechMK1
MechMK1
1:55 PM
I recall someone saying "If you don't believe people see patterns where there are none you have never spoken to a gambler"
 
ThoriumBR
ThoriumBR
if the house edge is 5%, they WILL make 5% on the long run
 
MechMK1
MechMK1
Casinos are just making money with statistics
 
Conor Mancone
Conor Mancone
Yup, but it works out nice for them when small number statistics and human psychology tip the odds in their favor more...
 
ThoriumBR
ThoriumBR
and lottery are just a tax on people bad on math
 
MechMK1
MechMK1
But oh my god, the amount of gamblers who believe they win money in a casino regularly when they lose money is INSANE
Imagine someone gambling all night, and losing 1000 USD over the course of a few hours
Then, they get lucky and win 600 USD in one go
They will leave the casino, 100% convinced that they won 600 USD that night
 
ThoriumBR
ThoriumBR
1:58 PM
the same way we see the startups that turned into empires, but not the millions that failed
@MechMK1 it's the "survivor bias"... we always see the ones who earned a lot of money on the lottery every month, but not the millions that didin't earned a penny
I once read a book of a mathematician (the kind that write books on math) and he said he would waste money on a casino regularly
 
A. Hersean
A. Hersean
And think of all the aforementioned survivors that think they succeeded by virtue of hard work and think that all the "loosers" deserve it.
 
ThoriumBR
ThoriumBR
and before people threw the math and statistics at his face, he said he KNEW he was throwing money away, and did it on purpose...
 
A. Hersean
A. Hersean
They are the one writing the law, and honestly think that capitalism works.
 
ThoriumBR
ThoriumBR
he said "most of the people have fun going to the movies, paying parking, beverages, and watching a movie while spending $100, I go to the casino and have fun with the same $100"
"I almost always lose that $100, sometimes I don't... but movie goers always lose their $100"
 
Conor Mancone
Conor Mancone
I got it backwards...
 
MechMK1
MechMK1
2:03 PM
I mean, yeah, if you see it as entertainment, sure
But most gamblers actually think they make money
How often have I heard "I was in debt, so I went to the casino to make money"
 
ThoriumBR
ThoriumBR
he said that's his entertainment, not investment... and you are right, most people think of it as investment
 
MechMK1
MechMK1
What I hear a lot is "Well, someone has got to win, right? Might as well be me"
But what they don't see is that they have a chance to win money, but are guaranteed to spend money
 
ThoriumBR
ThoriumBR
and one million lost, it surely won't be me...
 
MechMK1
MechMK1
One "Euromillionen" guess costs 2.50€
Imagine playing 4 tips per week, that's 10€ per week
More than 500€ per year
Let's say a decent restaurant visit for 2 people costs 50€.
You could take out your S.O. for a lovely dinner almost once a month, or play the lottery
 
ThoriumBR
ThoriumBR
I worked with a guy that bet on the lottery every week for 20+ years... he was talking about all the prizes he earned... we did a quick math and he lost 75% of its money... if he saved that money, he would likely have 8x the amount he earned in prizes...
 
MechMK1
MechMK1
2:08 PM
And you want to know the biggest mindfuck? People who actually win the lottery almost always end up being poor afterwards
 
ThoriumBR
ThoriumBR
@MechMK1 the dinner is surely a better investiment
 
MechMK1
MechMK1
@ThoriumBR I 100% agree.
The chance to win the jackpot in Euromillionen is 1:139.838.160
 
ThoriumBR
ThoriumBR
 
MechMK1
MechMK1
So what you can do is write a program that picks a number between 1 and 139838160 and if your number is 1, you won.
@ThoriumBR A bear trap for 1 USD!?
Just let gamblers press that button over and over and over
 
ThoriumBR
ThoriumBR
@MechMK1 happened to a guy on my city: he won a BIG pay on the lottery, quit the job (not before burning the bridges, walls, floor... and everything else), rented a Boeing for his friends and went to Europe for a month... came back in a so large debt that would take a lottery prize to pay
 
MechMK1
MechMK1
2:13 PM
@ThoriumBR Yeah, guess how many people end up like that
I just ran a little simulation for CS:GO case openings. Opened 20 cases, worth 79 USD. The skins were worth 21.04 USD
 
ThoriumBR
ThoriumBR
most of them... people cannot usually process large numbers... so if you make 100k/year, $10M looks like infinite money. but on your spending profile, it's 100 years. but that 10M isn't really 10M, because taxes will eat a substantial amount, and almost everyone steps up the spending quite a lot... they usually buy a luxury car (or a fleet) that depreciates A LOT, and have high taxes, and high insurance...
 
MechMK1
MechMK1
Yeah, people are remarkably bad at math
Because evolutionarily speaking, math is incredibly young
Show a people two pictures with heaps of stuff, and most people can intuitively say which one is more
But ask people to explain the difference between a million and a billion and they will stuggle
Because such numbers are not intuitive
 
reed
reed
The most amazing thing about probability is that, if there's a 1 in 10000000 probability that something might happen, then it might actually happen right now. In other words, if I type some characters at random, like jj83HStkh1293HxM, it is actually possible that I have just typed one of your passwords
maybe I should have said "scary", rather than amazing
 
MechMK1
MechMK1
brb changing passwords quickly
 
reed
reed
lol
 
MechMK1
MechMK1
2:32 PM
So anyways
:D
Nerve damage in the nose is not fun
 
A. Hersean
A. Hersean
My password is ************ so that it does not show when clicking on "reveal password".
 
MechMK1
MechMK1
Yeah, this is big brain time
The best tip I ever got was to make your password something really really perverted, so that you don't want to share it with other people
 
A. Hersean
A. Hersean
Good one
 
MechMK1
MechMK1
Like, think of the most depraved fetish you have, and make your password related to that
 
A. Hersean
A. Hersean
Until a judge asks you one in front of the whole tribunal
 
MechMK1
MechMK1
2:35 PM
Because you might want to share lemonade2020 with a coworker, but not IWishSakuyaIzayoiWouldDressMeLikeAMaid01
Gotta have those numbers in the password for extra security
 
A. Hersean
A. Hersean
And you'll get jail time if you keep your password for yourself but get innocented if you reveal it
 
MechMK1
MechMK1
That's why you use a password manager and a 2FA token with a static long random password, that you can dispose of
 
A. Hersean
A. Hersean
And CamelCase because that's not predictable at all
 
MechMK1
MechMK1
"I could not tell you my password even if I wanted to"
 
reed
reed
@A.Hersean OMG that's an awesome password, I want it too
 
MechMK1
MechMK1
2:37 PM
In all honesty, length trumps complexity any day of the week
I have an idea, let's create a perfectly secure password and then tell everyone to use that
 
reed
reed
My password is "tooLongToTellYou". What's your password? I told you, it's "tooLongToTellYou". Tell me anyway! I told you!
 
ThoriumBR
ThoriumBR
@reed I once wrote a program to a college assignment to determine if a number was prime or not... I keyboard smashed a 14 digits number, and alas, it was a prime! I even sent the number to real prime finding programs, and it was indeed a prime
 
MechMK1
MechMK1
:DDDDDDDDDDD
 
reed
reed
@ThoriumBR But as I said, the most amazing thing about probability is that there's a probability that your program was actually bugged, AND you also found a bug in other programs that find prime numbers
so you thought it was a prime, but it was actually a very unlikely bug. LOL
 
ThoriumBR
ThoriumBR
@reed I don't think so.. it was an implementation of the sieve of Eratosthenes
 
MechMK1
MechMK1
2:41 PM
Just like...save all the primes, man. Easy
Y'all computer people make stuff too hard
 
ThoriumBR
ThoriumBR
and the math either works or not at all... so if my program said that 11 is a prime, and 1023 is a prime, it will say my 14-digit prime is a prime
 
MechMK1
MechMK1
@ThoriumBR But that would be true of a program that would claim any number is a prime
 
A. Hersean
A. Hersean
When I was studying RSA in class, the big random prime number generation algorithm was : 1. Pick a big number at random, 2. use miller-rabin to test its primality. 3. if not prime go back to 1.
 
ThoriumBR
ThoriumBR
I incremented that number by one, and it said wasn't a prime
 
A. Hersean
A. Hersean
It was surprisingly fast, even though written in python.
 
MechMK1
MechMK1
2:43 PM
The only thing I remember about primality tests is that when the numbers get twice as long, primes become 1/4th as common
So if your chance that a random N bit long number is a prime is X, then your chance of finding a 2N bit long number is X/4
Roughly
 
A. Hersean
A. Hersean
The problem of incrementing by one is that it introduce a bias towards certain primes.
 
ThoriumBR
ThoriumBR
prime numbers are... funny...
 
MechMK1
MechMK1
@A.Hersean How so?
 
reed
reed
if ($input < 10) {
if ($input == 1 || $input == 3 | $input == 5 | $input == 7) {
print "It's a prime number!!!";
} else {
print "Not a prime number."
}
} else {
print "Please insert a smaller number. Large numbers are not supported yet."
}
that would be my algorithm, I think it's pretty good
 
MechMK1
MechMK1
The fact that this is not properly indented makes me fell feelings I'd rather not feel.
2
 
A. Hersean
A. Hersean
2:47 PM
I do not remember how this property of primes is called, but a surprising number of primes are primes adjacent to other (meaning they are a couple of primes in the form {k, k+2}).
 
reed
reed
yeah but I pasted it and the indentation was lost. We recently talked about indentation here with Conor, because I actually have to deal with a programmer that does NOT indent his code consistently, and it drives me crazy
 
A. Hersean
A. Hersean
By incrementing, you are far more likely to get a "k" prime than a "k+2" prime
 
reed
reed
it's even wrong because I typed it fast and didn't even write the "or" correctly
 
A. Hersean
A. Hersean
I do not know if this bias can be exploited to break RSA however
 
MechMK1
MechMK1
@reed That's why you do it all via post-commit hooks
@A.Hersean Really? Fascinating! I wonder if it really allows you to break RSA
 
A. Hersean
A. Hersean
2:49 PM
It would only work on RSA implementations that have this bias.
 
ThoriumBR
ThoriumBR
my algo was fast, and easy to understand
primes[] = {1, 2, 3, 5, 7, 11, 13, 17,19} // pre-fill some primes
for (i = 20; i < isThisPrime ; i++) {
for (j=0; j < sizeof(primes); j++)
if i mod prime[j] > 0
primes[] = i
break;
}
}
if primes[j] == isThisPrime println("number is prime") else println("number is not prime")
 
MechMK1
MechMK1
But wouldn't you just generate an RSA private key by selecting a random number, checking, and then just select a random again?
Or like, select a random, then set the lowest bit to 1?
I recall that something like this is done, because you don't need evens
 
ThoriumBR
ThoriumBR
so I start the vector primes with some primes, and calculate the modulus of every integer from 20 to the number being tested... if the modulus isn't zero, add the number to the list and increment the number
 
MechMK1
MechMK1
A 1024 bit long prime only has 1023 bits of entropy, since the lowest bit must always be a 1
 
ThoriumBR
ThoriumBR
I believe I didn't used the even numbers, or numbers ending in 5 either
 
A. Hersean
A. Hersean
2:52 PM
@MechMK1 That's usually how it's done, AFAIK
 
MechMK1
MechMK1
@A.Hersean I really would not know. Crypto code is black magic, kept working by human sacrifices to the Elder Gods.
Or so I was told
 
A. Hersean
A. Hersean
Well, EC cryptography is indeed non-euclidian, so that not so far from a ritual to elder gods
 
MechMK1
MechMK1
As long as it doesn't involve Abigail Williams
 
A. Hersean
A. Hersean
In France we do not invoke the Salem event, we invoke Jeane d'Arc.
 
MechMK1
MechMK1
Jeanne or Jeanne Alter?
Fate Grand Order joke incoming, please be advised
 
ThoriumBR
ThoriumBR
3:00 PM
the Salem event was a mess...
 
MechMK1
MechMK1
It was
 
ThoriumBR
ThoriumBR
I left my char for 4 minutes, and my 2 yo got my mouse, changed settings on 3 gkrellm panels, close one program and moved the other to another workspace...
 
MechMK1
MechMK1
Rookie mistake
 
ThoriumBR
ThoriumBR
*chair...
 
MechMK1
MechMK1
3:17 PM
God, this fucking app
It randomly puts full-screen advertisements as an overlay, and you have the buttons "Exit" and "Previous page"
And when you tap "Exit" the app quits
 
Conor Mancone
Conor Mancone
lol! That's what we call a UI failure...
 
ThoriumBR
ThoriumBR
isn't the sole purpose of this app showing you ads? so you see the previous ad if you want, and quit the app if you think you saw enough ads?
 
MechMK1
MechMK1
It's not a fail, it's by design
I see no reason why any in-app button should actually ever quit an application
 
 
3 hours later…
ThoriumBR
ThoriumBR
6:00 PM
how I hate laggy VDI environments! I have to pause for 2-3 seconds every time I have to click on something, otherwise the cursor moved away and I misclick...
windows-centric, outlook, sharepoint, the like... have to click on everything and even the mouse lags
 
 
2 hours later…
reed
reed
8:07 PM
Please tell me how worrying or ridiculous this article is: thehackernews.com/2020/09/dark-web-cybersecurity-report.html
I have no idea if it's exaggerated or anything, I haven't investigated. But if it's accurate, I'll be pretty surprised. I can't believe cybersecurity firms can make so many security blunders
 
ThoriumBR
ThoriumBR
8:24 PM
70% of the statistics aren't trustworthy, and the other 60% are misleading. Only the remaining 15% are true... <joke>
how can they know 97% of the companies?
 

« first day (3563 days earlier)      last day (1338 days later) »