Demi Marie Obenour

Christopher Peikert quoted me to Daniel Bernstein. I provided @sophieschmieg@infosec.exchange with additional information about the recent Classic McEliece attacks. I’ve also reported multiple “you’re using AEADs wrong” vulnerabilities, and figured out how to quickly set up a quantum-safe secure link over a 300 bytes per second communication channel. I even know enough to pick lattice cryptosystem parameters that, for some applications, would likely be a better fit than the standard ones. I also know why those paramters would be a horrible fit for general-purpose use, and how to use them correctly despite the footgun. And I know how to tweak an existing implementation of ML-KEM to use these new parameters without breaking things. Maybe I should become a cryptographer.

@ska@social.treehouse.systems @ell1e@hachyderm.io @aelspire@aelspire.info @ariadne@social.treehouse.systems There will be backported LLM-assisted commits, and I also don’t consider every LLM-assisted commit to be slop. To me, slop is LLM-generated code of low quality. Code that is of high quality and been thoroughly reviewed by humans is not slop. I have Assisted-by tags in some of my contributions. LLMs have found bugs that I missed. It has found vulnerabilities in third-party code I didn’t spot. I will never submit code I cannot personally vouch for. The only possible exception would be machine-checked formal proofs of a theorem whose claim I have reviewed. in that case I trust the proof checker more than I trust myself.

@sophieschmieg@infosec.exchange Not surprised, though I do wonder how I wound up one without even trying to be.

@dalias@hachyderm.io @ska@social.treehouse.systems @ell1e@hachyderm.io @aelspire@aelspire.info @ariadne@social.treehouse.systems I meant the third one: “not running slop on our own machines with actual privilege or to process and produce things we care about”. LLM output is going to eventually be in all maintained versions of Linux, the toolchains needed to build it, and even the firmware and hardware you use. Avoiding it will require forking the entire computing ecosystem from the hardware up. (This is a prediction I am quite confident in, not a statement about whether this is good or bad.)

I can’t stand websites that log you out for inactivity. My machine is more secure than the website’s servers!

@mei@donotsta.re @sophieschmieg@infosec.exchange By “direct proof”, I mean “not a proof by contradiction”. Security reductions are proofs by contradiction: you assume that there is an attacker who can break the protocol, and show that they can solve a hard problem. Since we assume that the hard problem is not solvable, such an attacker cannot exist. A direct proof would be something like, “The server signed the handshake transcript, and we verified the server’s certificate is authentic. Therefore, the ciphertext we got is the one sent by the server, which means that decapsulating it produces a secret only we and the server know. Replay attacks aren’t possible because both the client and the server include a random value in the transcript, and the whole transcript is hashed, so nobody can mix and match handshakes.”

@sophieschmieg@infosec.exchange Still amazed, though, especially because the way I think doesn’t match what I see in eprints. Notably, I prefer direct proofs of security to ones based on reduction. I find the former to be much easier to follow and provide a better understanding for why a protocol is secure.

@penguin42@mastodon.org.uk @jann@infosec.exchange There is a chicken bit that works around the bug.

@david_chisnall@infosec.exchange Also a very good reason to use microkernels instead of monolithic kernels.

@drakulix@social.dreampi.es Is Vulkan any better?

@dalias@hachyderm.io @jangray@mastodon.social It’s also nearly useless, because it produces extremely skewed results. What I want is a way to collect statistics in a privacy-preserving way. Performing the aggregation in a trusted and attested execution environment is one option. Cryptographic multi-party computation is another, though I don’t know if it’s practical.

There are problems that are merely far out of reach of current technology, and then there are problems explicitly created to be forever unsolveable. The cost of destroying a planet is insignificant compared to the cost of breaking a secure 256-bit cipher. Grover’s algorithm only helps if you don’t care about getting the result in your lifetime.

@dalias@hachyderm.io Office 2024 LTSC?

@mjg59@nondeterministic.computer I don’t think that the people who make weapons of war would care about license compliance.

@mjg59@nondeterministic.computer I believe NIST recommends against TLS MITM certs, and I remember firewalls having been breached in the past.

@datenwolf@chaos.social @whitequark@social.treehouse.systems I’m actually surprised that isn’t possible. Is the problem the need for current to keep the thyristors on?

@ariadne@social.treehouse.systems How many people would you know in these places?

@sophieschmieg@infosec.exchange All of them, or just the ones that haven’t been broken?

@filippo@abyssdomain.expert I’ve seen FIPS 140 certificates that make almost no sense, and I’m pretty sure it is to avoid these enormous delays. Last I checked, the IBM Cryptographic Coprocessor’s certificate only covers loading of a firmware by the bootloader. The certificate of the Private Machines Enforcer blades is invalidated by booting the Compute Engine. In both cases, the certificate doesn't cover what companies actually buy the hardware for.

@jann@infosec.exchange I think that’s a great idea, though it’s one that can be taken too far. Some things aren’t worth caching.

@dalias@hachyderm.io @ska@social.treehouse.systems @ell1e@hachyderm.io @aelspire@aelspire.info @ariadne@social.treehouse.systems That’s fair. We have different definitions of slop. I do think that avoiding all LLM-generated code is an unwinnable fight. It’s in too many places.

@GrapheneOS@grapheneos.social Is this illegal under antitrust or pro-competition laws? If so, is legal action against it planned?

@sophieschmieg@infosec.exchange @mei@donotsta.re Is there a general guide for what one can and can’t assume when designing protocols? I know a few rules (always hash the full transcript, use randomness in every message, keep secrets twice the security parameter or have other protections from multi-target attacks), but my understanding is that formalizing an authenticated key exchange protocol is really hard, even though making one that’s secure isn’t that hard. I also know that in some cases (Fiat-Shamir) you won’t be able to produce a tight reduction, but everybody ignores that.

@phillmv@hachyderm.io @AT1ST@mstdn.ca @brib@bribstodon.xyz @jneen@unstable.systems One can’t write the tests without first writing the API, and it’s often impossible to figure that out without having first written much of both the code that implements the API and the code that uses it. For mature projects, test-driven development makes more sense.

@r@glauca.space @whitequark@social.treehouse.systems I would not be willing to deal with user-provided images unless I was at a company with lawyers on staff. If I’m not, I’m either outsourcing the whole task or not allowing user-provided images or videos. Text only.

@ireneista@adhd.irenes.space Ah, I thought you were complaining about the amount of boilerplate required.

@ariadne@social.treehouse.systems Can one provide a good user experience for E2EE DMs without reimplementing half or more of Signal?

@datenwolf@chaos.social @whitequark@social.treehouse.systems Can one make “quasi-SRAM” by using a semiconductor with large enough bandgap, and sufficiently long channels, that leakage at room temperature is negligible? Pseudomorphic epitaxially grown AlN/AlGaN HEMTs come to mind. With a bandgap of over 4eV, it ought to be possible to have a turned-off transistor be indistinguishable from an open circuit at DC.

@ariadne@social.treehouse.systems Congratulations!!!! 😂

@icing@chaos.social I suspect the Linux kernel is an exception.

@dalias@hachyderm.io I did indeed mean Office 2024 Home. I suspect that Word, Excel, and PowerPoint are used more than everything else by far. My main concern with Office 2019 is that it’s end of life, meaning one needs to be very careful to never open an untrusted document with it. That’s beyond what I would expect from a non-technical user, unless someone else set them up with a non-networked VM.

@ireneista@adhd.irenes.space Vulkan is designed to be used by large programs and libraries for which the boilerplate is irrelevant.

@phillmv@hachyderm.io @AT1ST@mstdn.ca @brib@bribstodon.xyz @jneen@unstable.systems The other part is that one needs to know the expected behavior before writing the tests, and I often don’t know the expected behavior before I write the code that implements it. I write the code as I figure out what needs to happen.

@patrick@retro.social @alex@feed.yopp.me One way to solve this would be to only provide remote attestation collateral for servers and for devices enrolled in MDM. Client devices without MDM would only support local attestation: one could obtain the public keys from a boot splash screen provided by the firmware, but there would be no way to verify this remotely. Local attestation is sufficient for most legitimate uses, such as Qubes OS’s Anti-Evil Maid.

@dalias@hachyderm.io @jangray@mastodon.social I had not thought of it from a human subject research perspective. Personally, I think it is in most users interests to have telemetry on, provided that they can trust it to be privacy-preserving. Developers simply cannot do as good a job without accurate usage statistics. The tyrrany of defaults means that explicit opt-in will not produce those. The best I can think of is: Have an explicit “yes or no”, with no default.Explicitly state what is being collected. Probably stuff like OS, hardware, rate at which various features are used, and other similar things.State (and ensure!) that the data is encrypted and processed in a trusted execution environment, and that only aggregate results are made available outside of it.Explain that these statistics are used to guide development, so if a user keeps telemetry off, their usage won’t appear in it.

@jneen@unstable.systems “hypervigilance, famously, destroys your mind and body” Link to that? As an aside, I think that any open source maintainer that receives a lot of outside contributions from untrusted people already needs to be hypervigilant. I treat LLM output as if it came from an untrusted new contributor.

@mttaggart@infosec.exchange @cloudflare@noc.social I suspect they view this decision as one that should be left up to courts. One problem with this argument is that the court system is (by design) far too slow.

@thesamesam@social.treehouse.systems The Xen-related code in Linux is maintained by the Xen Project. Xen has a completely separate process for handling vulnerabilities, and also keeps vulnerabilities under embargo until patches are available. Therefore, pointing out the security marking in the commit message is safe and logical.

@dalias@hachyderm.io To clarify, I’m concerned about attackers using N-day vulnerabilities in software that won’t be patched. Those build up over time, and once an exploit is written, it can be used even by script kiddies.

@mjg59@nondeterministic.computer My first thought would be that the SPI flash has been corrupted somehow.

@kirakira@furry.engineer @jneen@unstable.systems I used an LLM to write a test suite for some code I wrote myself. I also asked it to keep in mind the spec the code is supposed to implement. The LLM figured out how to achieve almost 100% MC/DC coverage using only the public API. It (correctly) justified condition that could not be tested. Some of the tests failed, and when they did, the LLM pointed out that the problem was with the code. In one case, it wrote a 2 line fix (add missing Vec::clears) I used directly. In one case, it suggested a 1 line change (use the correct Rust struct). In the others, I fixed the code myself. I didn’t do this because tests are unimportant. I did it because writing a test suite with good coverage by hand is very difficult. Is this a silver bullet? Of course not. I still need to cleanup and validate the test suite, and I need to write integration tests. But it saved me a lot of time, and resulted in much better test coverage. If nothing else, this makes regressions much less likely.

@phillmv@hachyderm.io @AT1ST@mstdn.ca @brib@bribstodon.xyz @jneen@unstable.systems In statically typed languages, the tests will not compile until the API is written. I’d rather have static type checking than easy test mocking, though that is admittedly a tradeoff.

@dfx4509b @GrapheneOS@grapheneos.social Such action could be under EU laws too.

@emily_rugburn@lgbtqia.space @mcnado@mstdn.social Not surprised. I expect that most doctors would need to be paid more to work there.

@chris@social.losno.co It’s a natural response, but it isn’t always the best one. For instance, allegations of abuse or harrassment need to be taken seriously.

@sparklepanic@infosec.exchange Not surprised. The only practical way to ship Chromium is to just use the upstream tarball with everything bundled. Yes, even the prebuilt clang. The advantage of doing things this way is that one gets a build under a FOSS license without Google integration.

@mgorny@social.treehouse.systems It’s due to a labor shortage, which is in turn due to a funding shortage. Same reason there are so many unfixed syzbot reports. The companies that would pay for such things all have their own forks.