mircea_popescu: bounce they may not be exactly right. this will take a lot of work.
mircea_popescu: well this has been quite the day hasn't it.
mircea_popescu: talk about a product that owns its market. the french f1
asciilifeform: (german grenade had a convenient, almost identical ring that wasn't attached to the pin)
asciilifeform: like germans who carried captured russian 'limonka' grenades by their rings.
mircea_popescu: this is promising. ty chan, and let it become part of the permanent record : more has been ruined by convenience than by any other sin.
asciilifeform: herr mole couldn't be bothered to learn cvs.
bounce: when did they move to git from cvs?
Naphex: until 12.00 GMT+2 mostly everything was vulnerable, and as the sploit went public everyone started sniffing everything.
Naphex: i'm guessing that was the logic behind it
Naphex: then you get sniffed for all you have
bounce: there was also that = vs == in a linux syscall a while back
asciilifeform: still trying to discern how they got it in << this is by far the least surprising part. next, what, ask how the roaches got in the kitchen?
bounce hasn't checked the repo, if any. probably should.
fluffypony: on that HIGH note, it's bed time here, well as close to bed time as 1:15am is when the wife is fast asleep next to you
mircea_popescu: im still trying to discern how they got it in.
gribble: The Underhanded C Contest: <http://underhanded.xcott.com/>; The Underhanded C Contest » This Year: <http://underhanded.xcott.com/?page_id=5>; The Underhanded C Contest » About: <http://underhanded.xcott.com/?page_id=2>
mircea_popescu: Naphex all the poor souls arguing with me over tor's safety a few months ago. awww.
bounce recalls an irc discussion going on 15 years back, where someone speculated that a nsa backdoor might look like "int foo;" instead of "long foo;". and you just can't tell. well, here we have such an innocuous thingy. and you never can tell. but spectacular, that the effects certainly are.
fluffypony: yeah I'm not talking about mitigating the heartbleed attack
mircea_popescu: fluffypony there's many ways to mitigate a known attack, by the very definition of "known".
fluffypony: mircea_popescu: I still maintain that the damage from something like this could be reduced by mitigating session hijacking
fluffypony: some of them are broken, but enough weren't
asciilifeform: and when people realize the actual root of the problem (as eventually must) they will piss themselves.
mircea_popescu: asciilifeform you know you're in the footnotes for that reason :)
asciilifeform: i specifically mentioned 'openssl' in 'don't blame the mice.' well, nobody want to read a crackpot blog, they will have to learn the lesson on their own arse.
midnightmagic: The attack is just a heartbeat with a size modifier different; it's an overrun read-only flaw. Unless the attack is expanded to something else, there is no targetting. It's "whatever's sitting 64k behind the heap."
midnightmagic: mircea_popescu: Well the wording in that section is slippery. My current understanding is to vary the information requires being able to manipulate program execution in other areas of the program.
mircea_popescu: nevertheless.
bounce: and named it, and registered a domain for the name
midnightmagic: mircea_popescu: That is from the heartbleed site. It implies more information is available, but it's information which is sitting in that specific area. It's a busy area, but it's just that specific area.
mircea_popescu: midnightmagic "There is no total of 64 kilobytes limitation to the attack, that limit applies only to a single heartbeat. Attacker can either keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed."
mircea_popescu just keeps on pasting "nevertheless"
midnightmagic: mircea_popescu: No; that doesn't appear to be accurate. Ask whoever it is who is telling you that to describe how to target specific memory regions, because I'm fairly sure they're wrong.
mircea_popescu: nevertheless.
mircea_popescu: nevertheless.
asciilifeform: the basics of priv elevation on common os variants is a subject beaten to death elsewhere on the net
mike_c: it is the process space for whatever is handling ssl connections.. so all ur keyz belong to us
benkay: cavirtex is sponsoring the caconf
mircea_popescu: or into how things such as the vidcard can be leveraged for this purpose./
mircea_popescu: midnightmagic actually, it's pretty much all the memory. in 64k chunks, yes, but trivial to map it all out.
Naphex: messing up their TX tables and getting bitcoins locked in addresses
mircea_popescu: Naphex keonne was sayin' earlier they got it fixed, waiting for him to pop back in cause i wanted to grill him a little
asciilifeform: 'bob the bridge builder' fucks goat after goat, has done a whole herd, but remains listed in the phone book under 'bridge builder'
asciilifeform: mircea_popescu: beautiful piece - but the fact that the phoundation will still be revered and fellated in the world media tomorrow tells us how firmly the buggers are still in control.
mircea_popescu: an' for the record, just in case : http://trilema.com/2014/the-sins-of-the-group-of-posers-behind-the-so-called-bitcoin-foundation/#comment-98933
mircea_popescu: asciilifeform https://trilema.com/2014/the-sins-of-the-group-of-posers-behind-the-so-called-bitcoin-foundation/ neh ? works if you want it, just, doesn't default to it. compatibility ftw.
mircea_popescu: BingoBoingo: benkay: A jog can't do the things Lithium can though <<< actually, afaik it does.
gribble: Bitcoin Lolcows, the musical. Today, Kludge pe Trilema - Un blog de ...: <http://trilema.com/2012/bitcoin-lolcows-the-musical-today-kludge/>; How does one list on MPEx ? pe Trilema - Un blog de Mircea ...: <http://trilema.com/how-does-one-list-on-mpex>; Bitcoin pe Trilema - Un blog de Mircea Popescu.: <http://trilema.com/category/bitcoin/>
mircea_popescu: ;;google trilema kludge the musical
BCB: mircea_popescu, what was the kluge scam?
mircea_popescu: the rest's on teh exchange.
mircea_popescu: there's that.
ozbot: The list of discontinued assets on MPEx pe Trilema - Un blog de Mircea Popescu.
BCB: mircea_popescu, you have any numbers posted market caps, exits (beisdes the very suspicious satoshi dice)
ozbot: A gas cloud collides with the black hole at the center of our galaxy, and we get to watch | PBS News
mircea_popescu: wait dudes! do you realise god spelled backwards is dog, and so the black lab meme and the bitcoin jesus meme just came together in a total and complete
mike_c: forum lulz @ neobee: "The financial report that you all have been waiting for is ready. Total revenue from date of incorporation to date: ZERO."
Duffer1: change the wording to what though? "a situation eerily similar to that of a fugitive" how is that different?
gribble: WARNING: Currently not authenticated. Trust relationship from user benkay to user Aquent: Level 1: 0, Level 2: 0 via 0 connections. Graph: http://b-otc.com/stg?source=benkay&dest=Aquent | WoT data: http://b-otc.com/vrd?nick=Aquent | Rated since: never
Aquent: especially considering some other rumours
Aquent: right ok I would kindly and very respectfully ask you to change the wording
mircea_popescu: the crispy mille
mircea_popescu: they are visiting meta-graceland, for a party hosted by elvis
fluffypony: got a fabrication facility, and then it's packed and shipped from a picking/qc floor
nubbins`: my square cc reader showed up in the mail today, woo
mircea_popescu: do you build them in your garage like ? or got a little warehouse somewhere ?
fluffypony: OCLHashCat users and the GPGPU/GPUGrid crowd
mircea_popescu: kinda curious because the appalling situation of mining rig arrangements is a bit of a historical lolpoint
mircea_popescu: a well then no need.
fluffypony: mircea_popescu: I'll gladly send you the proposal if you have a bit of time to take a glance at it, just not too keen on sharing it publicly for all and sundry;)
BCB: mircea_popescu, he's still being paid by them
Naphex: mircea_popescu: i'm guessing any decent programmer that implemented the bitstamp API noticed that they do HMAC all wrong, also the guy who posted that, total douche imho :)
mircea_popescu: BCB no need to, because gavin did the right thing and quit.
BCB: mircea_popescu, tells us how you really feel about the BCF
fluffypony: Naphex: the company is already making money, just not enough for the next lot of things we're doing :)
mircea_popescu: "so if you were to perform the request over an unsecured network, you could easily intercept and send a different payload without having to generate a new signature"
fluffypony: it means the trust graphs to me are all unhappy pandas
fluffypony: but because everyone's changed their rating of him to a negative
gribble: WARNING: Currently not authenticated. Trust relationship from user nubbins` to user fluffypony: Level 1: 0, Level 2: 0 via 1 connections. Graph: http://b-otc.com/stg?source=nubbins%60&dest=fluffypony | WoT data: http://b-otc.com/vrd?nick=fluffypony | Rated since: Sat Apr 6 08:20:32 2013
mircea_popescu: http://www.reddit.com/r/Bitcoin/comments/22jv9k/the_sins_of_the_group_of_posers_behind_the_so/ << lol angry redditoars.
mircea_popescu: then it just sorta happens by itself.
mircea_popescu: then that one establishes his credibility, over time.
fluffypony: mircea_popescu: already there
mircea_popescu: fluffypony one first gets into the wot.
ThickAsThieves: coins, bills, what's the difference?
fluffypony: if I'm looking to raise BTC-denominated funds privately as a company (angel investing, really) and don't want to go the IPO route in order to at least somewhat stave off the general discovery of trade secrets (for want of a better term), is there a generally accepted way of doing so? proposal has been drawn up already, just not really sure how one goes about finding BTC angel investor types
mircea_popescu: supreme court peering into "the intent of congress" is perhaps the largest inside joke in the us legal profession.
mircea_popescu: there's no such thing, a government/agency/etc is quite incapable of intent.
mircea_popescu: a but unrelatedly, as the possibility of intent in large institutional actors.
mircea_popescu: otherwise, we two could write a bill in that sense, right now. what of it.
benkay: but you know, any of the two are great to have around, right?
benkay: mircea_popescu: more of a comment on myself than the world
mircea_popescu: ThickAsThieves i'd say the converse. a bill is shat, not anything else.
mike_c: the intent of a bill with no chance of passing is PR.
ThickAsThieves: if there's no intent, wtf is a bill?
mircea_popescu: i doubt any of this shit can really HAVe an intent in the first place. people, esp on the forum, keep ascribing intent to large organisational actors
mircea_popescu: there's probably some trying to put in bills to make women wear burkas
ThickAsThieves: nonetheless, i doubt any of the intent of these IRS rulings or bills is to get people to go long
mircea_popescu: who knows, it's like an earthworm. it sorta slugs away but not as a direct result of any of the ganglions.
mircea_popescu: that system is getting et. best you be doin' most of the etin'.
ThickAsThieves: well i agree, but i doubt the USG would intentionally do encourage it
mircea_popescu: upgrading is the only economically rational form of cannibalism.
mircea_popescu: more like in the way a poor farmer with 13 kids needs one in school.
ThickAsThieves: you mena in the same way that a child needs to be slapped sometimes
ThickAsThieves: wtf does US care whether people go long on bitcoin
ThickAsThieves: ugh "Actually, what is needed is to leave it as property but add an exemption for the first $X0,000 of gain, which is what other countries are doing, particularly in Europe. That way it can effectively function as a currency, but investors who go long also get favorable tax treatment."
mircea_popescu: keonne so what are the details re the right hash but wrong block composition thing ? cause yeah it got me scratching my head.
ThickAsThieves: funny thing is when you said that, i didnt check "where", i checked the comma
mircea_popescu: <ThickAsThieves> if neither shoe fits, maybe it doesnt where shoes <<
mircea_popescu: that's the garbage bin of parliaments.
mircea_popescu: TomServo minus the funny. and btw, rickles was fat his whole life.
ThickAsThieves: if neither shoe fits, maybe it doesnt where shoes
bounce: brb, there's a tree here as needs hugging
bounce didn't get it. doesn't mean others won't.
bounce: heartbleed, not beedingheart, and a plurality mismatch in the last paragraph or so
cazalla: i use to do 10km every morning but then i got fat and lazy when it was no longer a challenge
ThickAsThieves: goes to the point of that 50-mile bitcoin runner guy being absolutely delusional or scamming
ThickAsThieves: i always do this, gain enough to buy new clothes, then that triggers me losing the weight so those dont fit either
ThickAsThieves: i picked up jogging again, all this bitcoining made me buy new clothes
ThickAsThieves: that fat girl in the movies now is horribl ethough
ThickAsThieves: the girl on SNL isnt that bad
ThickAsThieves: maybe it's too options for the morbidly obese, outward depression, or a carreer in comedy
mircea_popescu: thestringpuller maybe because they resonate with people inconvenienced by reality, being themselves inconvenienced by same ?
ThickAsThieves: all the reasons that come with being fat
thestringpuller: sad because guys don't want to touch them?
ThickAsThieves: because they are sad
Naphex: mircea_popescu: upboat for the reddit post ;]
mircea_popescu: the message there's pretty much this : civil court does not protect fugitives. ancient principle, too.
mircea_popescu: judge ordered him to show up in court if he intends to ask the court to protect him from his creditors.
jurov: http://www.reddit.com/r/Bitcoin/comments/22jv9k/the_sins_of_the_group_of_posers_behind_the_so/
benkay: you're a fan of the lynching?
mircea_popescu: benkay either that or a good idea.
ozbot: The sins of the group of posers behind the so called “Bitcoin Foundation” pe Trilema - Un blog d
mircea_popescu: http://trilema.com/2014/the-sins-of-the-group-of-posers-behind-the-so-called-bitcoin-foundation/
gribble: WARNING: Currently not authenticated. Trust relationship from user benkay to user thestringpuller: Level 1: 1, Level 2: 3 via 3 connections. Graph: http://b-otc.com/stg?source=benkay&dest=thestringpuller | WoT data: http://b-otc.com/vrd?nick=thestringpuller | Rated since: Mon Oct 15 18:46:37 2012
benkay: ;;gettrust thestringpuller
ThickAsThieves: offered to have me get a Letter to the Editor published
ThickAsThieves: i spoke with the reporter today about the Narcotic Checkpoint issue, went pretty well, she's gonna do more research
bounce: so we're how many years on and I haven't looked but am I to understand there's still not much of a protocol spec? looks like the foundation sure set some useful priorities.
mircea_popescu: an' im working on the killshot as we speak.
bounce: well, there's a new chief developer guy now. everything gonna be better now, right?
mircea_popescu: then when i say satoshi quit mostly because he didn't want to be involved with these fucktards anymore people act as if this is somehow controversial.
mircea_popescu: and .9 was the fix for .8.x, which was... broken.
mike_c: it's not released yet. it is the fix for 0.9, which is vulnerable
mircea_popescu: i mean other than to point and laugh.
mircea_popescu: mike_c: it is pretty horrible to run this against one of your servers and watch its memory get dumped to screen. << now imagine if hearn & co had their way and openssl was bundled in every "reference" bitcoin client.
jurov: as if they fear two login attempts per minute
mike_c: "There is no total of 64 kilobytes limitation to the attack, that limit applies only to a single heartbeat. Attacker can either keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed."
midnightmagic: MisterE: It's just a chunk of the heap. to get different data, the heap contents must change in between attacks. That is, you can't just dump the process' entire memory space.
midnightmagic: bounce: No, it's not a random 64k block. It's the same block each time you run the attack.
MisterE: bounce: it is not a random 64k block and you can continue requesting them until you get all the info you want
gribble: WARNING: Currently not authenticated. Trust relationship from user thestringpuller to user mike_c: Level 1: 0, Level 2: 4 via 2 connections. Graph: http://b-otc.com/stg?source=thestringpuller&dest=mike_c | WoT data: http://b-otc.com/vrd?nick=mike_c | Rated since: Sun Nov 24 21:18:22 2013
bounce: AFAIK you get a random 64k block back, so whatever's in there you can get
midnightmagic: and even if your wallet is unlocked, your privkeys aren't vulnerable. Only (so far) the last rpc command used in the server.
midnightmagic: You have to specifically turn on rpcbind access to the outside world. You have to have specifically taken an action to expose yourself.
bounce: not all of your assumptions are going to be reasonable, actually. ssl is fairly logical when enabling rpc ("instant security" amirite or amirite), but restricting IPaddresses only so if either you have enough clue or someone in your vicinity does. similarly, plenty reasons why you'd leave the wallet unlocked.
midnightmagic: and the answer is, "One that needs patching immediately. If you're on ubuntu: apt-get update ; apt-get install openssl"
Namworld: What kind of bug allows anyone to just read the memory?
midnightmagic: the leak is minimal
bounce: "the industry" is made up out of at least 90% deliberate FUDmongering
midnightmagic: bounce: Only if you've allowed rpc connections from random douches, have turned on ssl, aren't limiting it based on IP, *and* they have your wallet.dat already and have been able to query your bitcoind constantly over time and caught you using the rpc command that unlocks your wallet.
Namworld: lel, what? "The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content."
Mats_cd03: 'heartbleed', who knew security researchers had a flair for the dramatic
Mats_cd03: id still be there if it wasnt ungodly expensive
MisterE: perfect weather for me, best in US
MisterE: Oh yea we built a datacenter build there, it is nice area
MisterE: I was in real estate in the US
MisterE: I imagine is sucked a bit before then heh
Mats_cd03: i left just as some of the high speed rails were being built
MisterE: most of the multis that dont want to go intot he emerging markets in SE Asia service them from .sg
MisterE: English is excellent there
Mats_cd03: i live in the us now
MisterE: Are you Chinese or live in China Mats_cd03? I recall one regular here at least lives there
MisterE: so their customers' funds are too
Mats_cd03: so the funds are frozen i imagine
Mats_cd03: the bank received a directive to shut down fxbtc's bank account
Apocalyptic: what are they shutting down ?
Mats_cd03: and some other things about pursuing legal action if dudes keep accusing them of running with the money
MisterE: their language, is it proper formal business?
MisterE: Mats_cd03: what is your impression of the people's credibility? Do they seem like a branch manager of one of the biggest Chinese banks?
mike_c: PBOC will drop the hammer on RMB << what do you mean by this? will let the exchange rate float more?
Mats_cd03: oh and its by the 15
Mats_cd03: sounds like thats what theyre talking about
MisterE: supposedly an interview with a Chinese bank manager that was taken with an iphone has been posted where he confirms PBOC will drop the hammer on RMB
BingoBoingo: The horns show its malevolence
BingoBoingo: truffles: There is a difference between people and "ppl"
truffles: oh, feel like ppl get sensy on the nets though
BingoBoingo: truffles: Only one way to find out the log's contents...
truffles: boingo what percent of the blog is about u vs btc?
truffles: doesnt seem like too many r authenticated
BingoBoingo: mike_c: Thx, Well I figure for all of the porn there is less unpleasant buggery happening here
gribble: WARNING: Currently not authenticated. Trust relationship from user danielpbarron to user againbackson: Level 1: 1, Level 2: 0 via 0 connections. Graph: http://b-otc.com/stg?source=danielpbarron&dest=againbackson | WoT data: http://b-otc.com/vrd?nick=againbackson | Rated since: Tue Apr 8 11:58:58 2014
gribble: WARNING: Currently not authenticated. Trust relationship from user benkay to user againbackson: Level 1: 0, Level 2: 0 via 0 connections. Graph: http://b-otc.com/stg?source=benkay&dest=againbackson | WoT data: http://b-otc.com/vrd?nick=againbackson | Rated since: Tue Apr 8 11:58:58 2014
gribble: WARNING: Currently not authenticated. Trust relationship from user benkay to user truffles: Level 1: 0, Level 2: 0 via 0 connections. Graph: http://b-otc.com/stg?source=benkay&dest=truffles | WoT data: http://b-otc.com/vrd?nick=truffles | Rated since: never
mike_c: BingoBoingo: much better. good post. although not apples to apples, it is interesting to compare their activity #'s against http://stats.bitcoin-assets.com/
BingoBoingo: Reading moar is the best prevention against getting buggered sore
truffles: if its boring id rather not
mike_c: trilema.com will do ssl connections, but you can't get the blog.
BingoBoingo: Well, No SSL == NotHeartBleed
benkay: granted, it can be hard to get up in the morning much less work out when catatonically depressed.
benkay: i'm not saying that mental health is purely a function of workout frequency. i've been larned better than that by the DSMi. it's just all too frequent that people resort to drugs without actually putting in the work to get their physical health dialed.
truffles: might take a lil more than that for the clincially insane
BingoBoingo: benkay: A jog can't do the things Lithium can though
cgcardona_: dude I just got an email from heroku about the ssl bug w/ this as my list of potentially affected apps: Here are your affected applications:
truffles: i feel like any other option is purposely handicapping urself
benkay: funny how people go for the meds first and never think to go run in circles for thirty minutes...
cgcardona_: well there are meds for that...
truffles: provided the brilliant doesnt come with lazi, id go brilliant every time
gribble: From the Stacks: Why I Never Hire Brilliant Men | TaoYue.com: <http://taoyue.com/stacks/articles/brilliant-men.html>; The Joel on Software Discussion Group (CLOSED) - Why I Never Hire ...: <http://discuss.joelonsoftware.com/default.asp?joel.3.558118.24>; The Old Joel on Software Forum - Hiring superstars?: <http://discuss.fogcreek.com/joelonsoftware/?cmd=show&ixPost=17864>
benkay: well-practiced and hard working is super valuable, well-practiced and smart is super valuable, smart and hard working comes in at the bottom untempered by practice.
benkay: in the same way men tell each other "smart/pretty/sane, pick two", managers are always looking for some combination of "smart/well-practiced/hard working".
truffles: nerd comment wasnt that random, other chat was qualifiying what it is to be one
cgcardona_: heh. Around tha world—around tha world (daft punk theme)
cgcardona_: There is no such thing as strong coffee—only weak men.
gribble: WARNING: Currently not authenticated. Trust relationship from user thestringpuller to user keonne: Level 1: 0, Level 2: 0 via 0 connections. Graph: http://b-otc.com/stg?source=thestringpuller&dest=keonne | WoT data: http://b-otc.com/vrd?nick=keonne | Rated since: never