lambda.chat

Oh, yeah. Just a sec.

should I encode it with base64?

Encode it however you wish

would base64 be more convenient tho

because I can also send it as raw bytes

(in general use)

lyxal

2:43 PM

Just make a private github repo, invite Radvylf as a collaborator and put it there

No, that's a bad idea

lyxal

A text input on your website isn't?

I was going to POST it to him

@lyxal No, because it goes straight to my server, can't be intercepted, and doesn't stick around for the rest of time on GH's servers

or I could just post it here /s

2:46 PM

My SE password is LyxalIsCool$$$144, just change my username to your key and I'll get HN to change it back

2

okay then

OR, I could encode it with your public key and send it to you

I'm getting the server set up, you'll just POST { "pass": "..." } as application/json to https://rto.run/lambda

alrighty

I'll send it as base64 then bc I don't think JSON can do bytes

Okay try it now

alrighty

3:02 PM

Wait I'm an idiot

It's not forwarding yet

lmao

Try again

ok, posting now...

502

@RadvylfPrograms ^

Try again

ok

502 again

@RadvylfPrograms ^

3:11 PM

I'm getting 400s now, which is better, but none of my logging is telling me why

._.

Ooh 502 now

so I just realized that replit doesn't let you modify secrets programmatically

so I guess I get to make an encrypted file with the key and store the key for that in secrets :p

Okay it should work now

here we go

AYYYYYY 200

3:17 PM

I got it

:D

32 bytes, right?

let's do a checksum check

Do sha_256("check thu-may-26-2022" + key)

sha256

3:19 PM

@RadvylfPrograms This way, the amount of useful information we leak about the key is minimal

alright

I'll encode it in base64 so I can post it here

I got RufRLxk8orM6JYd2sW/Ol5XlXzsBDT9DvQy2dvszAHo=

I didn't

Did you add the strings before encoding?

I used this code:

base64.b64encode(hashlib.sha256(("check thu-may-26-2022" + key).encode("utf-8")).digest())

Base64 key or binary?

b64

3:23 PM

Oh, well what's the point of that?

We know I have the right base64 one

It's the proper decoding of it that I need to confirm

hmmmm

okay, lemme do that

I get di0QiGhNEKeKCE6LrXhr8KfTgEEv+/czDWw0Tl/OLL4=

My JS was

btoa([...new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array([...new TextEncoder().encode("check thu-may-26-2022"), ...[...atob(key)].map(c => c.charCodeAt())])))].map(c => String.fromCharCode(c)).join(""));

same!

Nice!

which I did using base64.b64encode(hashlib.sha256((b"check thu-may-26-2022" + base64.b64decode(key))).digest())

it actually fits on one line lol

well, key verified

so don't lose that lmao

3:27 PM

Instead of application/json, let's just concat sha_256(json + key) in binary to the JSON as UTF-8 and send that as binary

hang on I've just realized what we're doing is essentially an HMAC

That might be a simpler and more secure way to do this

which python has a built-in library for

Same w/ JS. So we can just do an HMAC, since our key's already a 256-bit random string we both know.

so I send a HMAC along with the data and we compare it?

Yeah. hmac + json

And I can just verify the hmac

and if it's invalid?

3:30 PM

I just 400 it

okie

but wait

the original reason for this key was so that only I could use this service

but anyone can do a hmac

or am I confused

Yeah, and only you have the key for the hmac

@Ginger An HMAC is like a cross between a hash and a signature

Basically, only someone with the key can create or verify an HMAC

oh right

what about the auto-key-update thing?

Not needed with an HMAC

okey dokey

if the key is compromised I guess I can redo this process

3:35 PM

I'm working on doing an example HMAC so we can compare and see if we're using the same algo

python lets you choose which algorithm to use actually

should we use the b64 key or the decoded key?

@Ginger I did an HMAC with SHA-512

3OSuNeACZIzUh9npdXyWmM9I2tL1Qs4LQtnvl3XMvfxS9RWVF0b8lS9UpNOst3oFMS7p3AqIEVCmpS2WoA6gXg== for Hello, World!

alright, one sec

yup!

looks good

Nice!

So we'll just concat that, as binary, before every message

Well, you will.

yup

3:46 PM

In the JSON, include a random 64-bit-or-more ID, which I'll check for uniqueness, to prevent replay attacks

is it constant length?

The HMAC is constant length yeah

niec

brb

Same

3:59 PM

Okay, message format:
- 64-byte SHA-512 HMAC
- the message, JSON encoded with UTF-8
- 64-byte random data

the HMAC is of the encoded JSON data btw

4:41 PM

No, you need to include the random data in the HMAC

I'd do hmac(random + json) random json

The random data only needs to be 8 bytes btw

4:58 PM

Or you can go the CoC route, and instead of running your own server for the transcripts, piggyback off of SE's :p

I finally did it

I added user profiles to room cards

next up: mathjax!

7:20 PM

@Ginger Your link UI sucks

Slightly lighter gray than the text, with no underline, smh

I know, I know

8:01 PM

or not

@RadvylfPrograms hey guess what I just fixed

Oh nice

we're trying to restart

plz wait

i think i broke something

oh god

what did you do

8:17 PM

i think it was because i forgot to end a multi-line codeblock

nope

restarting

Romanp

8:29 PM

unable to wake up

restarting again

for some reason it takes like 20s to load all the modules

6 hours ago, by Ginger

hey lemme count how many modules I'm using

6 hours ago, by Ginger

Counting stdlib modules, that's 16

alright, here we go

So, the transcript storage

yus

8:36 PM

I think I have the HMAC and random ID stuff set up

also, I have finally fixed html stuff

my biggest question is why images do this when you hover over them:

upcoming feature

but yea do yo like my beautiful programmer art?

its amazing

12/10

I find the fact that it's taking 10 seconds to load the room list... sus

8:43 PM

@Ginger Do you have a prototype of your code that would send requests to me? I've got it running now and I want to see if it works

The format is hmac(random + json) + random + json

hmm

64 bytes for the HMAC and 8 for the random

(The reason it's critical that the random is in the HMAC is that if you were to intercept a single "op": "transcript" message, you could copy the HMAC over to a new message with a new random ID, and then send it to my server to steal the transcript data)

working on it

@RadvylfPrograms Where should I send it?

Same place as before, https://rto.run/lambda

okie

message sent

8:51 PM

I got it :D

did it decode?

"{\"test\": \"message\"}"

heyyyyyyyyyyyyyyyyyyyy

Try resending the exact same message if you can

and HMAC verified?

8:52 PM

Yep

:D

resending...

(with different random sadly)

Worked. Now try sending two with the same random

alright

sent first one

and sent second

Worked, the second one was blocked

ayy

anything else?

8:56 PM

If you want you can try changing a byte of the HMAC or something to test that

hmm

But I'm pretty confident in this by now

okay, we'll go with it

thanks for your help

So, now we need to hash out the details of the JSON part of the protocol

[insert HMAC joke here]

9:01 PM

transcript will read some data from a room, room will make a room, post will post something, modify will change a post with the same ID, drop will drop a post, drop_room will drop a room

Should there be one for reading individual messages?

hmmmmmm

You can add it in case it's needed in the future ig

We can just overload that onto transcript probably

So, the only data I'll need to store about rooms is a list of messages, right?

yup, I'll handle the rest

what parameters do I send?