AndreasChris's recent activity

  1. Comment on eMudhra intermediate CA compromise in ~tech

    AndreasChris
    Link Parent
    Although in this case, had you given me this certificate with this prompt and had I found the weak private key, I don't think I would intuitively have suspected this to be a real-world incident...

    Although in this case, had you given me this certificate with this prompt and had I found the weak private key, I don't think I would intuitively have suspected this to be a real-world incident either (apart from the valid signatures chain to a root cert of course). It just seems to easy for that.

  2. Comment on PHP warns it plans to release two emergency patches imminently in ~comp

    AndreasChris
    Link
    Today was absolutely wild with regards to IT security. First the CA certificates, then PHP, all withing 24 hours.. :S

    Today was absolutely wild with regards to IT security. First the CA certificates, then PHP, all withing 24 hours.. :S

  3. Comment on eMudhra intermediate CA compromise in ~tech

    AndreasChris
    Link Parent
    This whole story kinda feels like someone read about the PRNG used by the NSA to generate the ECDSA seeds and thought "Hold my xkcd, I can top that."

    Anyway, what the actual fuck, how is one of the private keys "4"? (meme, and somehow a relevant xkcd)

    This whole story kinda feels like someone read about the PRNG used by the NSA to generate the ECDSA seeds and thought "Hold my xkcd, I can top that."

    3 votes

  4. Comment on eMudhra intermediate CA compromise in ~tech

    AndreasChris
    Link Parent
    That is absolutely wild. In recent months I couldn't help but wonder wether the whole IT security job market will be negatively impacted by new LLMs discovering high volumes of increasingly...

    That is absolutely wild. In recent months I couldn't help but wonder wether the whole IT security job market will be negatively impacted by new LLMs discovering high volumes of increasingly complex bugs in the long term. Then I see stuff like this. If that isn't IT security 101, I don't know what is...

    3 votes

  5. Comment on Sweden's national broadcaster SVT suspects some of the 4,077 songs submitted for Melodifestivalen 2027 were generated using artificial intelligence in ~music

    AndreasChris
    Link Parent
    In the context of the ESC the song needs to be performed by a human live on stage in the end anyway. So I suppose those AI submissions are songs originally generated by AI and re-recorded by a...

    In the context of the ESC the song needs to be performed by a human live on stage in the end anyway. So I suppose those AI submissions are songs originally generated by AI and re-recorded by a human performer, are they? I can see how you wouldn't be able to tell these apart from a song originally conceived by a human from the recording alone.

    8 votes

  6. Comment on Origin of ECDSA curve seed provided by NSA to NIST in 2000 without explanation turns out to be simple PRNG output with UNIX timestamp as seed in ~comp

    AndreasChris
    Link
    In case you don't know what this is about: Simply put ECDSA is a signature algorithm standardized by NIST in 2000 and used in all sorts of places to secure digital communication in day-to-day...

    In case you don't know what this is about:

    Simply put ECDSA is a signature algorithm standardized by NIST in 2000 and used in all sorts of places to secure digital communication in day-to-day applications. Hence the ability to break it, would have huge implications for IT security.

    The algorithm uses a magic seed value that has been provided by the NSA (who generated the curve parameters) without explanation. Over the years this lead to a number of conspiracy theories, that the seed may have been chosen to contain a secret backdoor.

    One day an anecdote surfaced, that the seed may have simply been a SHA-1 hash of some english sentence chosen by a NSA employee. Huge efforts have been made over the years to find out how the seed may have been generated, and there was a five figure cash prize to be paid out to the first person to find it.

    Then yesterday, anthropic posted this blogpost, announcing that some research model of theirs found the actual origin of the seed. Turns out it was just the output of several iterations of a standard PRNG from some 1990s C library seeded with a timestamp. I.e. as basic as it gets when it comes to generating pseudo random numbers.

    This mostly debunks the conspiracy that the seed is part of some grand conspiracy to backdoor ECDSA, so good news I guess. But for the most part I can't help but find it very funny how a large online community spent years and loads of resources hashing random english sentences in the hopes of finding the seed's origin, only for an LLM to reveal it's been the output of a non-cryptographically-secure pseudo random number generator from an old C library all along. :D

    Or in other words (joke): https://www.youtube.com/watch?v=eOQfNT6Jdkg

    19 votes

  8. Comment on Jet Lag Season 19: Japanorama | Trailer in ~hobbies

    AndreasChris
    Link Parent
    Dunno, the pacing of... ...the final ten minutes of the episode was quite well edited in my opinion, so I don't really mind the 'early' conclusion. I found it much more frustrating how some veeery...
    Dunno, the pacing of...

    ...the final ten minutes of the episode was quite well edited in my opinion, so I don't really mind the 'early' conclusion. I found it much more frustrating how some veeery lucky last-minute draws kinda decided this season on pure chance. After this much back-and-forth I really would've preferred a tie in this one.

    4 votes

  9. Comment on Jet Lag Season 19: Japanorama | Trailer in ~hobbies

    AndreasChris
    Link Parent
    I've only watched the beginning of episode 8 so far, but the first few minutes... ...went as I expected/feared. It would've really surprised me if they did a random draw, actually lost their...
    I've only watched the beginning of episode 8 so far, but the first few minutes... ...went as I expected/feared. It would've really surprised me if they did a random draw, actually lost their Shinkansen card, and still made the penultimate episode end on that cliffhanger.

  10. Comment on Jet Lag Season 19: Japanorama | Trailer in ~hobbies

  11. Comment on Jet Lag Season 19: Japanorama | Trailer in ~hobbies

  12. Comment on Jet Lag Season 19: Japanorama | Trailer in ~hobbies

    AndreasChris
    Link Parent
    Yeah, they already 'apologized' for... ...the cliffhanger in the layover podcast xD: But yeah, that ending was absolutely wild. I kinda want to believe "Team Fight" makes a miracle-comeback and...
    Yeah, they already 'apologized' for...

    ...the cliffhanger in the layover podcast xD:

    Ben: And look, we formally apologize for this cliffhanger. It was to good to not do. We had – we had to do it.
    Sam: Right, we get ooone –
    Ben: We get one mean cliffhanger, and its before the finale, and its to good.

    But yeah, that ending was absolutely wild. I kinda want to believe "Team Fight" makes a miracle-comeback and manages to win, but given how much content is left my feeling tells me that Sen&Bam won't lose their Shinkansen card prematurely.

    1 vote

  13. Comment on Jet Lag Season 19: Japanorama | Trailer in ~hobbies

  14. Comment on Jet Lag Season 19: Japanorama | Trailer in ~hobbies

  15. Comment on ‘Woman Unknown’ wins Golden Lion in Venice in ~movies

    AndreasChris
    Link Parent
    That sounds... counterintuitive. Especially given that one of the two deadlock candidates now won the 'silver lion' (i.e. second place I suppose), and the other one won the 'special jury prize'...

    That sounds... counterintuitive. Especially given that one of the two deadlock candidates now won the 'silver lion' (i.e. second place I suppose), and the other one won the 'special jury prize' (whatever that is). Shouldn't the scenario you cited give rise to a second place deadlock as well?

    3 votes

  16. Comment on Recommendations for noise cancelling, over ear headphones in ~tech

    AndreasChris
    Link Parent
    I second the Bose Quiet Comfort. I got an earlier model of those in 2018, took them with me and used them basically every day, and they worked without a problem until I lost them a few months ago...

    I second the Bose Quiet Comfort. I got an earlier model of those in 2018, took them with me and used them basically every day, and they worked without a problem until I lost them a few months ago (after 8 years of constant use!). And by lost them I don't mean they broke, but I physically left them somewhere.

    The only thing that I replaced a few times are the pads that go on your ears, but there are some affordable off-brand variants, so you have some choice with regards to looks and properties and don't need to stick with the expensive branded spare parts.

    In fact it was such a good experience that I've since gotten the Bose QuietComfort SC headphones as a replacement. The SC simply stands for soft case. It's the same model but a bit cheaper and without the hard case, which I still have from the ones I lost.

    Usually I would've done a bit more research before getting new ones, but the experience and durability of the headphones was just so nice that I really wanted to keep the same ones.

    Note that back when I got the first pair in 2018 they were the 'flagship' model so to say, whereas now there's a more expensive 'ultimate' model of the quiet comfort line that looks a bit different, but I personally prefer the original design.

    1 vote

  17. Comment on <deleted topic> in ~tildes

    AndreasChris
    Link Parent
    Unfortunately when the time came, it chose the bad gateway. Just like Robert Frost put it: Two gateways diverged in a reverse proxy, and tildes tildes took the one less traveled by, and that has...

    Unfortunately when the time came, it chose the bad gateway. Just like Robert Frost put it:

    Two gateways diverged in a reverse proxy, and tildes
    tildes took the one less traveled by,
    and that has caused all the errors.

    Or something like that.

    22 votes

  18. Comment on How I feel about LLM (AI) writing in ~tech

    AndreasChris
    Link
    Out of cutiosity: How would you define the term 'slop'? Does it encompas anything AI genrated or assisted, is there some qualitative metric to it, or where should the line be drawn?

    Out of cutiosity: How would you define the term 'slop'? Does it encompas anything AI genrated or assisted, is there some qualitative metric to it, or where should the line be drawn?

    5 votes

  19. Comment on Tildes Survey #3: What country were you born in? (Results) in ~talk

  20. Comment on “Dungeon Crawler Carl” now available to libraries exclusively on Libby in ~books

    AndreasChris
    Link Parent
    I highly doubt that, but there are some shady mirrors and impostor sites out there for sure.

    looks like libgen requires using Discord to download any books

    I highly doubt that, but there are some shady mirrors and impostor sites out there for sure.