mircea_popescu: "ssl will stop all but the actual attacks you will encounter"
asciilifeform: mircea_popescu: 0days live in the 0day directorat.
mats: use other crypto
Chillum: SSL will stop all but the most advanced of attackers
Chillum: security is layers, that is how the industry works
mircea_popescu: asciilifeform didn't you use to bemoan the fact that "no valued crypto stuff is ever leaked" ?
mats: have you read the openssl code Chillum?
mircea_popescu: what was tikrit then ?
mircea_popescu: "an implementation failure" ? the time we took out usg's most valuable asset and publicly shot it in the head was "an implementation failure" "?
Chillum: read the patches before running it
asciilifeform: Chillum: we have a 'read the fucking source before you build and run it' warning, does that count ?
Chillum: I think it should come with a big "NO SSL" warning next to the download so people are not caught unaware
mircea_popescu: Chillum but they do in fact ALL accept verisign master keys.
Chillum: I saw the diff
asciilifeform: Chillum: i am the one who cut the ssl idiocy from therealbitcoin's bitcoind. and i did it for reasons which had nothing to do with memory footprint (we did not have an embedded device project yet)
mircea_popescu: with the advent of bitcoins, things have changed. a stolen bitcoin is a stolen bitcoin no matter how the theft was perpetuated, or under what color of law.
Chillum: I have worked in computer security for 15 years. While many implementations of SSL host checking are flawed and the hierarchial trust model is a joke the underlying encryption is solid until some learns to find prime factors of large numbers easily.
mircea_popescu: now, this entire "yeah the usg is your main enemy but whatever, you don't really want to protect your fucking tweets from them anyway" worked to propose turdstack = pancake.
mircea_popescu: to date, the most successful bitcoin thief
Chillum: In most practical scenarios the enemy is a person trying to steal bitcoins
mircea_popescu: in most practical scenarios, the only enemy any user will ever encounter is the usg.
asciilifeform: Chillum: you may live on a planet where plaintext is the only alternative to ssl, but here on the third rock from sol there are other cryptosystems
mircea_popescu: otherwise, you're just passing (to yourself, at least) groupthink as oppinions.
mircea_popescu: yes, that's the problem there : in order to have your own oppinions you need to study the groupthink.
asciilifeform: 'When he was returned to Springfield four years later, after slashing his wrists and writing American Gulag in blood on his bedsheets, the doctor wrote, Considerations that [Powers] has some form of psychosis, thought disorder or mental illness are unfounded.' << mega-l0l
Chillum: my own damn opinions keep getting in the way
mircea_popescu: Chillum i suspek you have to do a bunch of log reading to acclimate to the groupthink.
pete_dushenski: ah yes, "what the customer has come to expect"
Chillum: I still think my clients would prefer their api keys encrypted
mircea_popescu: pete_dushenski seems to be the consensus.
pete_dushenski: ssl provides much security theatre and little apparent security
mircea_popescu: apparently wikipedia is keenly aware it exists primarily as an advertising source. just... not for the fucking chinese aaaite ?
mircea_popescu: http://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletion/Log/2015_March_20#Cogobuy << wikilulz of the day. guy makes article about bn dollar chinese company, is told "This is an encyclopedia .... Not a website advertisement service, There are a million and one ways to advertise your company and this place certainly isn't one of them"
mircea_popescu: -NickServ- m_p!~matter_pa@49.207.189.76 failed to login to mircea_popescu. There has been 1 failed login attempt since your last successful login. << check it out ?!
Chillum: nubbins`: they use pepper spray around here
nubbins`: lel, protestors have started doxxing the riot police
nubbins`: i always wondered why there was a Future Shop and a Best Buy less than a block away from each other
PeterL: thestringpuller: are you picking on scoopbot? ;)
Chillum: and I will make one to monitor the uptime of yours
thestringpuller: I'm thinking of making a bot to determine uptime of other bots ;)
Chillum: no honey, I swear the assbot is for strictly business purposes!
nubbins`: neither did my wife 8)
Chillum: ahhh, did not get the name
nubbins`: if -otc wants a new bot, someone there can set one up
Chillum: the bandwidth that goes through the API is so small that the SSL module would be using a negligible amount of resources
Chillum: The page could use more information about the security implications and the expected use case though. Someone might get told it is the latest and greatest and not realize security has been bypassed
Chillum: A great idea for a light node though, if the security situation permits it
nubbins`: the idea here is to get a bare-bones reference implementation
Chillum: I am sure the change makes it run faster which is great for embedded devices that don't need to worry _too_ much about malware on the machine
nubbins`: http://therealbitcoin.org/ml/btc-dev/attachments/20141112/bitcoin-asciilifeform_ea4c4745bc4b10fc19bf0a2be7d0797dfd948a33.2-https_snipsnip.patch
Chillum: can't I just MITM the connection without that?
nubbins`: all the patches are written by people in here, and pgp-signed
nubbins`: anyway, check out that pastebin, that's the release notes for 0.5.3.1
Chillum: and the API needs to spit out parsed block data on demand so that 3rd party apps can work with the data
Chillum: If anything QT should have nothing to do with bitcoin other than being in a client that accesses the daemon
Chillum: just like the bittorrent reference client sucked(but did what it needed too, reference the protocol) so does bitcoind
nubbins`: right now people are just ripping the turds out
Chillum: Glad it is still being worked on. But frankly I would like to see a complete re-write of the client
nubbins`: they're all small enough that you can fit each one inside your head enough to understand it
nubbins`: but if you're so inclined, you could actually just grab legacy 0.5.3 from your favourite source, and apply the patches listed on the site
Chillum: I will keep an eye on the project
nubbins`: it's based on the historical 0.5.3
Chillum: is there a changelog?
Chillum: the security implications are significant
Chillum: There is so little information on that site about what the changes actually are or how they have been audited. It seems to have been made in November. It would be a bit like running a custom code version of PGP
nubbins`: if you've a mind to try again on your pi1 (and have a cross-compile toolchain set up), i'd suggest http://thebitcoin.foundation/bitcoin-v0_5_3_1-RELEASE.tar.gz
nubbins`: Chillum prolly 'cause you're using the latest phoundation bloatware
nubbins`: and: the heat sink is on the bottom of the board, so you can take off the lid without repercussion
nubbins`: soooooo, the pogoplug mobile (non-sata) has solder pads for attaching a SATA connector
chetty: thats edumacation these days
Chillum: "in fact, forget about the embassy!"
chetty: <nubbins`> and with the potential to set back scientific research :S// is that even possible?
nubbins`: and with the potential to set back scientific research :S
assbot: Major publisher retracts 43 scientific papers amid wider fake peer-review scandal - The Washington Post ... ( http://bit.ly/1xIDOig )
chetty: http://www.washingtonpost.com/news/morning-mix/wp/2015/03/27/fabricated-peer-reviews-prompt-scientific-journal-to-retract-43-papers-systematic-scheme-may-affect-other-journals/?tid=pm_national_pop
nubbins`: http://shop.lululemon.com/products/clothes-accessories/mens-pants-to-and-from/ABC-Pant-Regular
nubbins`: "Claiming that his operation would be “completely dicked over” by an influx of product, Vice President Joe Biden reportedly became increasingly worried this week that the recent legalization of marijuana in Washington, D.C. could seriously cut into his business."
assbot: Biden Worries Legalized Weed In D.C. Will Cut Into His Business | The Onion - America's Finest News Source ... ( http://bit.ly/1ymrnTY )
nubbins`: http://www.theonion.com/articles/biden-worries-legalized-weed-in-dc-will-cut-into-h,38210/?utm_source=Facebook&utm_medium=SocialMarketing&utm_campaign=LinkPreview:3:Default
nubbins`: funkenstein_ the guy wouldn't sell it to me. total fraud.
nubbins`: curious to see how much the SD chokes
nubbins`: okay, sweet. i've got a 60GB SSD and a 64gb UHS-1 SD card on the way.
nubbins`: "Hey guys I am down at the Texas Bitcoin Conference and someone took my red notebook. There was not a whole lot of valuable info in it but it was a gift. If you saw it tonight at marias taco xpress or know where it wound up please notify me. I thought this was outside bitcoiners' character but I am never surprised in this space"
nubbins`: <+pete_dushenski> No longer shall the egg shell be made from delicious Cadbury Dairy Milk chocolate. It will instead be made from disgusting, foul, vomit-inducing “standard cocoa mix chocolate”. <<< you think that's bad? get this: in the usa, cadbury chocolate is manufactured by /hershey's/. and they don't even get the milk from jersey cows.
pete_dushenski: mebbe "bitcoind pogo afficionados" is near the threshold for obscurity
pete_dushenski: is there nothing unworthy of having a conference about ?
assbot: What a masculinity conference taught me about the state of men | Life and style | The Guardian ... ( http://bit.ly/1IGm4om )
pete_dushenski: http://www.theguardian.com/lifeandstyle/2015/mar/12/what-a-masculinity-conference-taught-me-about-the-state-of-men
trinque: pete_dushenski: got the "ssl everywhere" extension?
mircea_popescu: who the fuck hijacks blog dns's ? and also... www just goes to plain domain.
mircea_popescu: you must have some weird dns issue ? what's the perceived ip ?
trinque: dunno that there ever was a time where rule of law did matter here; I'm neither old enough nor educated enough to say
trinque: in my lifetime the perception that rule of law is either real or honest seems to have been fading
mircea_popescu: you come riding at the border in a flying submarine
pete_dushenski: you're saying they can't ask "from whence ferrari?"
pete_dushenski: i was under the impression that every line had to be explained.
mircea_popescu: it can do whatever the fuck it feels like, with its own data.
pete_dushenski: "The CRA has broad powers to investigate suspected tax cheats. In the process of conducting a civil audit to assess how much tax a person really owes, the tax agency can call up bank records, freeze accounts, compel the release of business, payroll and other records, and root through land registries and other government data." << sop
assbot: Logged on 27-03-2015 23:32:15; asciilifeform: <mircea_popescu> who the fuck explains their income ? <ben_vulpes> in the states, if they think they have a case they freeze your assets. << aha. sit on the stake until explained, yes.
mircea_popescu: something like "always output 0 if the previous 7th output was 1" or whatever ?
mircea_popescu: i mean, a biased source is a biased source. do you mean it's not actually biased, but the bits are correlated ?
Chillum: that are not next to each other
mircea_popescu: in the case of your lamp, it basically extracts phase transition errors
Chillum: there is also periodicity
pete_dushenski: mircea_popescu: sounds like 'repositioning' the creme egg in the uk is akin to 'repositioning' baby george's nose from his face to his ass.
Chillum: but if the source is a lamp humming 60hz how does the algo filter the pattern from the entropy without diluting the entropy?
mircea_popescu: there's this algorithm which consists of : flip biased coin twice. if flips agree, one thing. iof they disagree, another thing.
pete_dushenski: "The Cadbury Creme Egg was a rare thing in this modern age. Its subtle blend of delicious chocolate and sweet, creamy/cremey yolk was a throwback to the days when chocolatiers took pride in their work." << right. the thing of which 500 mn are made per year, 2/3 of which are consumed in the uk (no wonder they have rotten teeth), is "boutique"
Chillum: you lost me there
mircea_popescu: this is not the same.
Chillum: but the egg thing is bad too
pete_dushenski: if a chocolate egg is unsettling the balance, by golly bitcoin barely needs to sneeze in the uk's general direction
pete_dushenski: Already, this egg announcement is threatening the stability of the UK government. What havoc will this monster wreak next?
pete_dushenski: The spokesman said the new chocolate had been tested on “consumers” – industry shorthand for “idiots”, clearly – and had been “found to be the best one for Creme Egg”.
pete_dushenski: No longer shall the egg shell be made from delicious Cadbury Dairy Milk chocolate. It will instead be made from disgusting, foul, vomit-inducing “standard cocoa mix chocolate”.
pete_dushenski: The day when it was revealed that Cadbury’s Creme Eggs have changed for ever.
pete_dushenski: maybe one day i'll add "signs papers" to the back ;)
Chillum: Say I start creating variants on a 6hz tone and create keys with that tool. I may just make the same key as someone else who used it near a lamp
Chillum: if you have complete control of your noise source then I suppose it would work
Chillum: it all gets mixed together
Chillum: the debiaser can't tell entropy from pattern
jurov: and you think since there will be some hum, any entropy is lost?
Chillum: the results will be hard to predict though
Chillum: the pi in particular has poor sheilding
jurov: but it's something you can control, such as making suitable noise while the addy is generated
jurov: Chillum, I added microphone to the rng mix for similar rpi application
asciilifeform: 'It had an airport, railway and dungeons. Most of Pingfang was burnt by the Japanese to destroy evidence but the incinerator where the remains of victims were burnt remains and is still in use as part of a factory.' -- pediwikil0l
nubbins`: "things changed since, and both GNU and BSD recent versions of tar have support for storing extended attributes. They use incompatible formats"
asciilifeform: not around here. nobody cancelled the traditional pull-down cage
asciilifeform: exactly the mouse
decimation: lol like the mouse
asciilifeform: http://solutions.3m.com/wps/portal/3M/en_US/Window_Film/Solutions/Markets-Products/Residential/Safety-Security_Window_Films << the 'break-in attempt' film is a mega-l0l
decimation: all I want is to 'run faster than you' away from the bear
decimation: they are also quite useless against a well-bezzled actor
mircea_popescu: decimation makes door lock the weak point again is all.
decimation: all these kinds of security gizmos are quite useless if there's not ability to summon a human to inspect what is going on
asciilifeform: and wouldn't it be in a sense counterproductive? as in, burglars will often themselves glue film to windows before breaking them, to silence the sound
decimation: not the snatch n' grab job
asciilifeform: so he break & then cuts with knife ?
mircea_popescu: asciilifeform it's not policarbonate replacement for glass in window. it's a very highly adhesive foil, which you stick on the window
decimation: yes, they make laminate for window reinforcement
asciilifeform: no, brick in the widow
mircea_popescu: trivial to make windows bulletproof tho, these days.
decimation: asciilifeform: I'm toying with the idea of buying slightly better deadbolts
Chillum: depending on the price
Chillum: If I could hook up a little device to the usb or serial that gave me numbers I would be more confident in then I would do that
asciilifeform: Chillum: this has been known to the public for months, to me for years, and to #b-a for at least a year and a half.
asciilifeform: but because of the known relationship between bit N and N+k
asciilifeform: incidentally, i will use this occasion to point out that prng is not deadly because enemy can somehow get the exact bits again
Chillum: I doubt there is a modern computer out there that does not have some black box software or firmware
asciilifeform: nubbins`: the number 3 is very random by same token.
asciilifeform: could be avalanche. could also be marsaglia seeded with phase of the moon.
asciilifeform: and manufacturer has one of the worst histories of stonewalling and fraudulently 'open' source of any.
asciilifeform: Chillum: it is not know for a fact to be anything other than prng
asciilifeform: but other than that - sure
mircea_popescu: first time ppl that wander in here and a) aren't going to spaceghost the bitcoin ; b) aren't retarded.
asciilifeform: only trouble spot is the rng
Chillum: so I reimaged the sd with a base raspbian and wrote some python code to get addresses from vanitygen and print them
asciilifeform: they are good for printing onetimepads.
asciilifeform: i like thermal printers.
Chillum: and a thermal receipt printer
asciilifeform: Chillum: what is in the box ?
Chillum: tty thermal printer has no memory
assbot: The conference, third edition pe Trilema - Un blog de Mircea Popescu. ... ( http://bit.ly/1Gy87tF )
Adlai: mircea_popescu: http://trilema.com/2014/the-conference-third-edition/#footnote_1_54701 << s/3rd/4th/?
Chillum: The problem with the mycelium key is the same printers that accept USB sticks also have internal memory
asciilifeform: i meant, not merely the seal, but the trivially bent box (as shown in film linked earlier)
asciilifeform: mircea_popescu et al : i would almost dare to suggest that the idiot seal was a deliberate smoke grenade to distract from the idiocy of the 'mycelium' produce itself
Adlai: danielpbarron: ie, the entire container is a seal?
asciilifeform: mass produced seals, sold commercially, are approximately as useful as the lock on a typical home door
Chillum: he shows how to remove and return the seals used on shipping containers
Chillum: short story, they are not very good
Chillum: This is a really good talk page the effectiveness(or lack there of) of tamper evident devices: https://www.youtube.com/watch?v=SIQml3MBJoE
asciilifeform: note also the 'pouch' quite large enough for a passenger car
asciilifeform: this includes customs inspectors (who are supposes to stay the fuck away)
Adlai: danielpbarron: you don't have to touch the seal if the packaging itself is easier to replicate
asciilifeform: by vienna convention (1815 iirc) diplo couriers are permitted to treat any attack upon their cargo or person as an act of war
decimation: the business end of a nuke is not large at all
asciilifeform: envelope has other side, edges
Chillum: old school method that still works today. If you can defeat it then you should sell the method to our fav government
Chillum: wax absored into the paper
mircea_popescu: maybe you can't detach the seal.
asciilifeform: Chillum: unless the seal encloses the entire package, all you need to do is recreate the box and reattach the seal.
asciilifeform: in the linked example, no one had to even build a second box - original opened and closed undamaged.
Chillum: under the assumption that you could not produce identical scratches
asciilifeform: Chillum: very hard to reproduce the identical swirls << l0l. you don't need to reproduce the seal. only the box.
Chillum: in nuclear regulatory systems they seal with a metal button and then scratch it up with a pin and photograph the scratches
Chillum: very hard to reproduce the identical swirls
decimation: yes, it was the honorable route
Adlai almost starts to feel respect for truecrypt devs, who at least admitted, behind their veil of anonimity, that they have nfc what they're doing
asciilifeform: make them secret << the only tamper-evident concept worth anything is the kind only evident to the intended recipient.
nubbins`: "pretty sad that a fuckin sticker determines whether our device is a paperweight or not"
Chillum: asciilifeform: I think attaching to the underside of ships
nubbins`: hardware and software security, that there was such a simple oversight.
nubbins`: <rassah> I would have secured them better by adding a sticker on the other side too (I got them the way you got them before shipping), but I had very few extra stickers. Should have been put on the front. I dont know what happened here. Maybe they were putting them on the sides without realizing how flexible the box is, and only realized when they almost ran out? Pretty sad that after such a huge amount of work adding and improving internal
Chillum: I assume since we are on IRC this is hypothetical
Chillum: Semi-submersible latches onto side of cargo ship below the water lines, gets carried
mircea_popescu: first step being, make them secret.
Chillum: If you want to make sure the government has not tampered with a package, put some weed in there. If the weed is still there they probably did not look lol
asciilifeform: Chillum: for a hypothetical smuggler, balloon only needs to land within range of cell tower and connect for a few seconds, send enciphered coords
decimation: ^ which is why the device must be inspectible/audit-able by user
asciilifeform: esp. if you have them made at somebody else's press
asciilifeform: i would also add that the 'uncopyability' of hologram is greatly exaggerated.
assbot: What is the point of the "tamper evident" sticker on the Mycellium entropy devices? - YouTube ... ( http://bit.ly/1I1FBi8 )
asciilifeform: dropped thermite and hexagen