security.stackexchange.com/questions/252015/… this was a very entertaining experience ....

@schroeder Wow... that's... I can't even.

I've heard people claim that blockchain is a replacement for literally everything and is some kind of magic bullet, but this is the first time I've ever heard someone claim it could replace TCP/IP.

but they are right! blockchain-based, tcp/ip-less internet cannot have any security issues because it cannot even work

@forest yep... I work for a company that offers blockchain solutions and the marketing presentations are wild... but even they never got so far off. I should send them this tip

On a related note, I'm trying to wrap my head around an equally crazy (or possibly more crazy) idea... Some conspiracy blog is claiming that the old FROG block cipher is used in Dominion voting systems, and totally misunderstanding how block ciphers (or math) works: scientists4wiredtech.com/2021/02/…

> The master key is an algorithm that the Central Intelligence Agency purchased back in 1999 and I had the pleasure of learning it when it was running on 8 bit processors.

I mean really, this is such a mess. It's like mentally wading through molasses.

> The most incredible part of FROG is that you can’t detect it because it is baked into every encryption algorithm because it’s both a key and program. Almost like genetic crosstalk – it’s quite genius. You don’t have to use the Master FROG as a block cipher to exist. It’s components are “spread across” ALL encryption algorithms today as they are basic machine instructions. Like the terminator, these components come together to form a FROG and run any script, manipulate and redirect data

This is the best part. The truth is that the FROG block cipher, which failed the first round of the AES competition in the 90s which Rijndael ultimately won, feeds the key into an interpreter which changes the order of operations used. Somehow they took from that that you can manipulate data with it.

I am still reading, and I won't get to bed wiser than before...

You'll need to inject your brain with bleach to un-read it.

But if the Dominion voting machines actually use the FROG block cipher, that'd be pretty neat since it's so obscure. It's so hard to tell where they got the idea that it uses it, though.

> my math proves that without identifying the original FROG that can cause detrimental cyberspace chaos rendering AES and other encryption keys useless.

:D:D:D

the related article have some jewels too: you can steal an election with algebra! C1-- and C2++... done!

> Incredibly, the creator of this block cipher attracted the Central Intelligence Agency back in 1998 because it was created to be able to DEFEND “itself” from unknown and unpredictable cyberattacks but also was a fail safe in case AI was ever to get out of hand. In essence, it’s the key to Quantum computing. The block cipher has come a long way from the original pitch below.

oooh myyy gooood

so let's just throw blockchain at the election, problem solved!

now serious... me and some friends were debating how blockchain could solve the electronic election problem, and so far we reached some new solutions that had their own issues, so for now I still have no good answer on that

Ironically, I do think blockchains would be relevant to elections. More so than TCP/IP at least...

> I don’t need a book or paper to remember the most incredible assembly routine that uses only 17 machine instructions that can complete FULL FROG encryptions and decryptions that are BAKED into all AES Encryption used across the world wide web.

Beautiful. I'm having too much fun.

fwiw, this is FROG in reality: web.archive.org/web/20170708064547/http://… (archived from www.grupolotusbrasil.com.br)

on my first month of college, before I even had any superficial knowledge crypto besides "makes data secret", I devised something that used the private key as a series of instructions

so every even byte on the key would have special meaning, like "the next n bytes of the ciphertext are random garbage, ignore them", "the 2nd byte is XORed with 3rd byte and added on the ciphertext", things like that

so every time you encrypted something, the ciphertext would be different, and later I heard about IV...

@ThoriumBR There's no remote exploits with no remote...

@JourneymanGeek There are no software vulnerabilities if there's no software!

Ban software. Go back to the stone age. Ironically, it wouldn't be a bad idea...

You can't hack a block of concrete... without a jackhammer

Computers were a mistake.

Also I thought part of the point of TCP (and more so UDP) that they assume that connections are unreliable and untrustable, and they simply push data through without worrying too much about anything

upper layers handle trustability

Other way around. UDP assumes connections are completely reliable.

TCP assumes potential unreliability and attempts to mitigate it in various ways.

@forest I always figured UDP was YOLO, LETS JUST PUSH THE DATA WITH NO SAFEGUARDS

@JourneymanGeek It's more "some other layer is doing session handling so let's not add overhead"

then let the upper layers deal with the unreliability

Although UDP does have safeguards against corruption (ref).

Just not against lost or reordered datagrams.

and even in theory, if the damned thing worked...

blockchain's meant to keep a long term record of something?

so... do I need to check back in, IDK, 10 minutes, if I got one specific packet of my download of I donno loki correctly?

wot

I need to know right now if the packet, or other unit of data is correct, and if its not to resend it

@forest can't remember if it was here...

Well that's what TCP is for.

Our covid-19 vaccination certs are basically etherium backed certs...

lol

@forest or for the client to check

@forest oh, no mining, just the protocol, run by a central authority

But practically, they could have just thrown a traditional cert on a QR code on it but nooooo

Still stupid.

but its still a legitimate use of it

Blockchain is great for what it does. Not for this.

@forest more so than... uh....

blockchain for network integrety

true :p

@forest considering that it wouldn't be too hard for a small country to have a complete database of every single citizen with easily built in primary keys through officially issued IDs?

Its really dumb

but its still better than this :D

It'd be better if they attempted anonymous attestation of COVID vaccine status, similarly to how a TPM can use DAA to verify a system's state without revealing the per-TPM key.

@forest nothing is anonymous here :D

@JourneymanGeek That sounds awful.

@forest its reality

I just forge whatever I need. Thankfully there are no COVID IDs here.

@forest you did get the vaccine right? :D

(If its possible)

or at least arn't one of those cray cray anti vaccers

Why would I get the vaccine? I live in the middle of nowhere with a couple crazy neighbors who never go anywhere. If anyone in my area got COVID, we'd all know.

@forest I'd probably need it to travel in 6-8

(months? years?)

@forest well - I kinda work for exactly the kinda government agency you hate, and I'm high risk allegedly :D

Only government agencies I hate are those tax collection agencies and the intelligence community.

@forest eh, I guess its more an in case thing. I mean, if you don't think you need it, I guessssss

@forest our equivilent of the ICE :D

oh lol

I'm more-or-less ambivalent about ICE.

But that's probably partially because I haven't looked into them much.

Oh, thr US ones are terrible

Ours uh...

@JourneymanGeek The thing about living in a fairly isolated community is that everyone knows everyone, and interactions with the outside are sufficiently limited that the risk of disease is low.

"We need all your biometric info so we can get a really cool system where we don't need you to get in line to scan your passports"

jesus

@forest this is public info :D

I'm not surprised, but I am disappointed.

@forest If you're 'local' - coming into the country is a little like a metro turnstile

you walk into this thing, scan your passport yourself, scan your finger and it just lets you in

the 'plan'when tech allows is...

I can't possibly imagine a reason to want to go to Singapore. No offense.

@forest I live here :D

basically have overhead cams or something, and have officers mobile with tablets...

I do have to travel periodically, but haven't done much since COVID.

anyone looks off, they come to you

@JourneymanGeek Sounds like TSA here in the US.

Are they as inept?

@forest hmm

Not really

well from the outside anyway :D

I can't share the fun stories

NDA + OSA

And these are the folks you work for?

but they're generally good folks

indirectly

The TSA seem to be... thugs...

Our side's generally pretty nice and polite and hardly power hungry

@forest naw

Too loyal? :D

wierdly - if my employer didn't meet my ethical standards, I'd rather quit or whistleblow than take money.

You may feel like your gov't looks after you, but they'll spit you out and step on you as soon as you stop being useful.

@forest lol. Well actually I work for a vendor for them

and its less 'loyalty' than personal ethics

And the vendor processes or deals with classified information?

I'm not at liberty to say

I was always under the impression that the "fact of" classification is rarely classified.

I'm pretty sure its trivial to find out but... I'm not saying

But maybe it works differently over there.

I'm not sure if it is :D

Well, is the only thing protecting the information NDA and various confidentiality agreements?

Naw

Or did you need to go through a vetting program from your government other than those needed to get a license?

Uh...

licence?

But no, I don't think I can answer that either

heh

Which I suspect is an answer in itself :D

Thing is, I'm so unfamiliar with your part of the world that my ability to gauge what you work in is extremely limited. I'm far too used to US spooks.

lol

If I told you 'I had to do a form G219' (that's a real form, but nothing to do with security), it would be trivial to look up :D

Well, mostly what I'm attempting to judge is whether or not you have some kind of security clearance (I think unlikely), work closely with people who do (unknown), or merely have to obey strict corporate NDAs and stay within various gov't standards like the equiv of FIPS (probably).

.... if it wasn't a chinese hugh way

ah

@forest what I'm trying to judge is why :D

@JourneymanGeek Bored, half-assed recon. Useful to know how hard to try to convince you. :D

Also the unfamiliarity shows - I mentioned something earlier that's a giveaway

lol

Well, all I see is that you worked for a vendor which supplies your country's equivalent of ICE.

yup

actually there's a bit more info, but yes, you don't know if I handle info, fix computers, or supply tongue depressors :D

Precisely. I know you work in some kind of tech support, or used to, at least, but that job type varies from "have you tried turning it off and on again?" to multi-million dollar high-stakes contracts.

So if I had to guess, it'd be closer to "fix computers" than any of those others.

:D

I miss that

Well I miss working in a studio

In the US at least, the openness of people who work with sensitive information is inversely-proportional to the usefulness of the information they work with.

But I'm somewhere off 'have you turning it off and on again'

What I find amusing is when people brag about having access to all sorts of confidential data, and it turns out that all they have is the non-public instruction manual for some corporate software.

lol

Does it at least work reliably?

Given that I couldn't get access to the software itself, no, it was quite useless.

And I had a very, very hard time getting him to understand how to obtain it.

Well - you probably couldn't get access to most of the software I run/use for work cause its corporate software...

and you probably couldn't buy some of it cause they'll disavow it ever existed due to sheer embarrassment

Probably true, especially if they don't have versions in English.

Embarrassment due to the software's purpose or its quality?

the latter

That's not too surprising. Corporate software is only one step above academic software.

it belongs to an ex corporate parent, so for our next update, we'll likely need to replace it

I hope its something less shitty

heh

Let me guess, database software?

Oh, not exactly

I can't rant about the horribleness of our database system without talking about stuff I can't talk about :D

@JourneymanGeek For clarification, I don't intend or desire to hack you or whoever you work for. I just like collecting information that's otherwise harder to find. Sometimes, datasheets > shells.

@forest hmm

@forest well - this is about the same level of access other than "I literally work inside <foo>" that the folks at Root Access get :D

+ work politics, but that's borrrrringgg

Well, if you worked for ICE here at the US, it'd be more interesting I'm sure.

Considering all the drama surrounding it.

(anyway, since its supposed to be on linkedin eventually - I used to be an onsite engineer for an application. I got side-moted to 'Monitoring Engineer')

ah

Exact same internal classification tho

I work for the company that used to be CSC (with bits of HPE's enterprise software division added)

CSC?

:D

THat's roughly enough for you to find out who I work for with a google search

@forest big american outsourcing org

ah

Much like my current employer, no one seems to care what it stands for :D

twitter.com/RSAConference/status/1411480627455614991

@nobody yeah, I think they used the wrong template

What are we supposed to use instead of strcpy in C? strlcpy or strncpy?

@nobody If you have strlcpy it may be better. Note that strncpy is not intended for security and can actually be bad for security because it doesn't always null terminate the destination.

There's also strscpy in the Linux kernel which is better than any of those.

You can use LKL (Linux Kernel Library) which allows you to use these functions outside of the kernel. For strscpy, see github.com/lkl/linux/blob/master/lib/string.c#L156 (relevant functions copied below):

#ifndef __HAVE_ARCH_STRSCPY
/**
 * strscpy - Copy a C-string into a sized buffer
 * @dest: Where to copy the string to
 * @src: Where to copy the string from
 * @count: Size of destination buffer
 *
 * Copy the string, or as much of it as fits, into the dest buffer.  The
 * behavior is undefined if the string buffers overlap.  The destination
 * buffer is always NUL terminated, unless it's zero-sized.
 *
 * Preferred to strlcpy() since the API doesn't require reading memory
 * from the src string beyond the specified "count" bytes, and since