Remote
Aaron Toponce ⚛️
@atoponce@fosstodon.org
mastodon 4.7.3MSCSIA, cryptography, security, locksport, Linux, programming, mathematics, amateur radio, Buddhism, running, anime, and bibliophilia.
3276 Followers
578 Following
50 Posts
Joined May 27, 2021
Blog:
GitHub:
AMD's random number generator (RDSEED, RDRAND) cannot generate a 0.
https://board.flatassembler.net/topic.php?t=24261
#crypto #cryptography
I'm in a local #running club where one runner has OCD about everyone ending their runs on .00 miles. If you end up short at .99, he'll make sure to comment on your Strava run asking why you couldn't just run around the parking lot or whatever to push it over.
Well tomorrow is his 40th birthday, so a friend and I decided to have a bit of fun making a self-referential Strava art: drawing "9.99 MILES" that is indeed 9.99 miles.
Happy Birthday friend!
#Strava #Art #RunnersofMastodon
Still one of my favorite StackOverflow answers.
https://stackoverflow.com/a/1732454
#regex #programming #xml #html
Replying to
@pft@infosec.exchange That's exactly what happened.
https://nitter.meowing.monster/sweis/status/2101484464807596264
I believe this is the correct overview of the #Linux RNG as defined in drivers/char/random.c. Probably have some minor quibbles that needs addressing though.
#cryptography #crypto
First 5K since the Ogden Marathon last month. This is meant to serve as a base to build on this year. I've got 6 more 5K races, 2 10Ks, 1 half marathon, and a 50K on the calendar before 2027.
My goal is to push my CP as high as possible so I have lots of overhead for improving my marathon pace and securing a solid BQ.
I pushed for sub-20 and just missed it! That's okay, as my CP increased from 3.88 to 4.02 W/kg.
Great day!
https://runsignup.com/Race/Results/73944/IndividualResult/RXSpt#U46639795
Replying to
Much better.
Note that you can reach the secure green level with the XKCD 4-word approch if:
- The passphrase is randomly generated.
- The words come from 7-dice Diceware.
If buying isn't owning, then piracy isn't stealing.
Personally, I'll only pirate when something I honestly purchased is removed, is encumbered with Digital Restrictions Management making it impossible to enjoy, or the process to purchase it is too convoluted and difficult.
You can't price gouge, make it difficult to comply, then deny access. You're no longer being honest with your customers.
https://kotaku.com/playstation-store-movies-digital-studio-canal-terminator-2000711013
xorshift32 in #Bash, code golfed.
$ n(){ s=$[s^s<<13];s=$[s^s>>17];s=$[s^s<<5];echo $[s&2**32-1]; }
Example:
$ s=123456789
$ n
2937495369
$ n
559720438
$ n
3924597191
Bash already has $RANDOM and $SRANDOM, so this probably isn't all that useful. Shrug.
The seed $s must be non-zero.
Replying to
@letoams@defcon.social No. Ted Ts'o had SHA-1 in there before Jason fixed it. He replaced it with BLAKE2s.
16 GB DDR4 SODIMM upgrade for my ThinkPad just got delivered.
Purchased it from Amazon. At the time I was looking, it was $109 with a text like "purchase in the next 16 hours for free delivery tomorrow" or something.
I sat on it past the 16 hour window and came back to it like the next day. The price had dropped to $87, without the next day delivery promise.
Sus.
I think I'll sit on that advice more often. Let it expire, watch the price drop, then purchase. Unless I'm in a hurry.
Bastards.
We've had it with Mattermost.
Testing Zulip is a breath of fresh air. It's responsive, doesn't have stupid scrolling bugs, and overall just has a better workflow.
Granted, it's got some quirks I'm not immediately a fan of, such as its threads. But those are vastly out-weighed by how responsive snappy the whole experience is.
Curious how snappy it'll be after migrating over all the data.
Replying to
@fay59@tech.lgbt This has been one of the better articles I've read in a long, long time. Phenomenal writing. As a #sysadmin, my anxiety is slightly elevated.
Replying to
NGL, I'm kinda bummed that there isn't a double-struck "blackboard bold" capital letter standard to represent the surreals.
ℤ → integers
ℕ → naturals
ℙ → primes
ℚ → rationals
ℝ → reals
ℂ → complexes
ℍ → quaternions
𝕆 → octonions
𝕊 → sedenions
𝔽 → finite fields
𝔹 → booleans
{L | R} is descriptive, but lame. Heh.
#math #maths
Replying to
@faduda A possible solution might be toggling chrome://settings/system -> On-device AI, although I haven't been able to confirm, as the 4 GB weights.bin file hasn't shown up on my install yet.
And no, this is strictly Google Chrome browser bloat. It doesn't affect Chromium, Edge, Brave, or any of the other Chromium forks as I understand it.
Replying to
I should build a similar table for passphrases. Because the XKCD "correct horse battery staple" approach that is commonly cited everywhere is flawed, and I get tired of explaining it in detail every time I call it out.
Replying to
In my not-so-humble opinion, their password table comes with the baggage of using specific hardware and assumes a specific hash type with cost.
A better table shows what the raw symmetric bits actually look like. Then it doesn't matter if it's hashed with vanilla MD5 or bcrypt 10. It doesn't matter if it's a single RTX 5090 or a distributed compute cluster.
We know what current brute force rates look like, so the colors in my table follow directly from those results.
https://gist.github.com/atoponce/a7715930ae6eb7d6b487f2f76b57a68d
Here's a fairly comprehensive list of "classical" pencil and paper hand ciphers if you want to practice or get familiar with any of them:
1. Massive list at ACA: https://www.cryptogram.org/resource-area/cipher-types/
2. Hill cipher: https://en.wikipedia.org/wiki/Hill_cipher
3. Solitaire cipher: https://en.wikipedia.org/wiki/Solitaire_(cipher)
4. Chaocipher: https://en.wikipedia.org/wiki/Chaocipher
5. ElsieFour: https://eprint.iacr.org/2017/339
Not that any should be used in place of modern cryptography, but useful for understanding confusion, difussion, and analysis.
Replying to
@evan@cosocial.ca I voted "Yes, but..."
Technically, it's okay. That's just kind of how the Internet works.
Ethically, and possibly even legally (depending on stalking laws), I'd say no. They're clearly communicating that you're not welcome to interact with them.
Personally, I've blocked people only for them to contact me elsewhere. It's been a "lesson learned" on social spaces, privacy, and general behavior online.
Replying to
@tbachner It's not for me which I installed via Flatpak. I've left Chrome running for the past few hours and executed:
% find / -type f -name weights.bin 2> /dev/random
a couple times, with no results.
However, @ferricoxide found it on their machine in ~/.config/google-chrome/
YMMV.
Replying to
@cardinal_reinhardt@mastodon.social Yeah. Most letters are assigned multiple times too. Just sad no one thought about the surreals.
https://en.wikipedia.org/wiki/Blackboard_bold
Replying to
@josephcox@infosec.exchange The data is no longer up on the ShinyHunters Onion site. This can only mean Instructure paid the ransom.
🤣
Replying to
@cardinal_reinhardt@mastodon.social Yeah. Context is king. If you describe your syntax well, there won't be any confusion on your writing.
Still, a "standard" would be great. Heh.
RE: https://mastodon.social/@FirefoxOfficial/116958818480299400
Their post announcing being back on Twitter has since been deleted.
I guessing they learned that engagement on a platform that officially developed an AI bot generating CSAM isn't good for marketing.
This is neither shocking nor new. We've known about this attack since at least 2005. DVI here: https://www.cs.cornell.edu/~shmat/courses/cs6431/zhuang.pdf
What's missing in this new "AI" report is the discussion about alternative keyboard layouts like QWERTZ, AZERTY, Dvorak, Colemak, and Norman just to mention a few. Does this AI acoustic side channel attack also work on those layouts, or was it trained strictly on QWERTY?
https://cyberinsider.com/new-ai-attack-can-reconstruct-typed-text-from-keyboard-sounds/
Replying to
@recollir@mountains.social His OCD is only triggered when you fall short 0.01. For some reason, it doesn't bug him if you go over 0.01. 🤷♂️
Replying to
@RandomDamage@infosec.exchange You would think, but in practice people end up with "i love you more" and "to be or not to be".
Replying to
@wigbert@mastodon.world No, for a few reasons.
Primarily, I'm in better contact with family and friends now than I was before smartphones, without social media.
I've also got the Hitchhiker's Guide to the Galaxy in my pocket now. At any time, I can do a text or photo search to get a quick answer to a curiosity, without AI slop.
The tools are invaluable. Simple things like timers, alarms, and stopwatches. More complex tools like docs. Maps, beacons, and satellite phone.
The tech is too good to pass up.