FrederikNJS

joined 1 month ago
[–] FrederikNJS@lemmy.zip 1 points 2 days ago (1 children)

It kinda helps if you include the whole constellation:

https://starwalk.space/gallery/images/ursa-major/1920x1080.jpg

[–] FrederikNJS@lemmy.zip 6 points 2 days ago* (last edited 2 days ago) (1 children)

Oh yes... I've printed a bunch of train track parts that doesn't exist otherwise...

For example this piece to go up and down from a carpet is indispensable: https://www.thingiverse.com/thing:4359335

And you can never have too many of these: https://www.thingiverse.com/thing:3325875

[–] FrederikNJS@lemmy.zip 4 points 6 days ago (2 children)

Upper lip or lower lip?

[–] FrederikNJS@lemmy.zip 2 points 1 week ago

I have an education in compsci, and I have worked in software engineering and platform engineering for 8 years now... And I only know of one programming language that makes use of "=/=" which is Erlang. Every other language or scientific papers I know of make use different operators.

Prolog comes close with "==", and Haskell too with "/=", but every other language has either used "!=", "~=" or "<>". The papers I have read that go for a more pseudo-code or mathematical notation has always used "≠".

[–] FrederikNJS@lemmy.zip 1 points 1 week ago (2 children)

To some extent the SQL syntax also kind of makes sense... It's a combination of both "greater than" and "smaller than" operators, which is kind of a different way of saying something is not equal.

The "!=" comes from most programming languages using the "!" character for negation. Negating something is usually read and pronounced "not". So it literally reads "not equal" if you are reading the symbols.

[–] FrederikNJS@lemmy.zip 3 points 1 week ago

You are correct about the miscommunication bit.

But when you lease a car, do you get told when the lease ends?

When you buy a license for a game, do you get told when that license ends?

[–] FrederikNJS@lemmy.zip 3 points 2 weeks ago

You are correct for regular hash functions, but a cryptographic hash function has stronger requirements.

MD5 was supposed be a cryptographic hash function, but it was found to be flawed all the way back in 1996, and has been discouraged ever since... Now it's too weak to be used in a cryptographic setting, and too slow to be used in non-cryptographic settings.

This is why hashes like xxhash is considered a non-cryptographic hash function, while SHA-256 is considered a cryptographic hash function.

[–] FrederikNJS@lemmy.zip 4 points 3 weeks ago* (last edited 3 weeks ago)

Oh shit! You are completely correct... I looked up my math, and apparently I put a mutiplication sign instead of a power-of sign...

That's horrifically wrong, but as you mention, still not strong enough...

I have struck out the parts where I was wrong.

[–] FrederikNJS@lemmy.zip 6 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

Cryptography is the practice of hiding and protecting information.

Modern cryptography is about computer algorithms.

These computer algorithms are notoriously hard to invent, and even just to implement.

Cryptography is a constant cat and mouse game. Some people will attempt to build new algorithms, and some people will be trying to break these algorithms. In some situations people are doing this benevolently, where researchers will look for weaknesses so they can be fixed. In other situations people are malicious and an looking for weaknesses to exploit them.

Inventing a new algorithm usually takes years, and then it's researched for even more years to make sure there are no obvious weaknesses.

Then people implement these algorithms and these implementations are then again researched for long times to look for weaknesses.

Inventing a new algorithm is insanely hard, and only a rather small amount of people around the world has had decent success.

But even if you have a good algorithm that is theoretically secure, then when you try to implement it in actual code, it's again incredibly easy to make mistakes that completely undermine the security.

What the OP did was to try to invent a new algorithm. OPs algorithm is very flawed and easily broken. Then OP wrapped it in a Web page that purported to allow you to securely encrypt something. And used words like "crazy strong encryption" which could lead others to think the service is safe and secure, and rely on it for something critical, only for their security to be utterly compromised.

The mantra in the security community is "Don't roll your own crypt", and OP rolled their own crypto, and failed, without giving a proper disclaimer.

[–] FrederikNJS@lemmy.zip 32 points 3 weeks ago* (last edited 3 weeks ago) (4 children)

So this basically runs key derivation by taking the password, SHA-256 hashing it, and feeding the result to a SecureRandom. Then XORs the output of SecureRandom with the plaintext in CBC mode with a block size of 1 byte... CBC meant this isn't protected against tampering, since the encryption mode isn't authenticated. And the blocksize of 1 byte, means you can attack each character of the ciphertext one at a time.

This is a woefully inadequate key derivation, and the actual encryption seems fairly flawed. I only have a basic Cryptography 101 course under my belt, and while I don't have the skill to obviously break it, it absolutely makes the hair on my neck stand up...

Discounting any weaknesses in the actual crypto, the heaviest part of this algorithm is the actual SHA-256 hash, and with some tweaking, I'm sure someone determined could modify hashcat to attack this encryption directly. I just had a look at some Hashcat benchmark on an AWS p5en.48xlarge instance, which has 8x Nvidia H100 GPUs. These together can churn out 126.9 Giga-hashes per second on SHA-256. ~~Which means it can try ALL alpha-numeric passwords with 12 characters in just around 0.59 nanoseconds.~~ This instance isn't cheap, as it costs around $64 per hour to run, ~~but at that speed you don't have to run it for very long anyway.~~

So even at the worst-case, of having to brute-force your XOR encryption algorithm, breaking it will be trivial.

Please don't roll your own crypto... Or if you do, please make it very clear to anyone that it's your own hobby project, and that it shouldn't be relied upon for actual security.

EDIT: apparently I can't operate a calculator

[–] FrederikNJS@lemmy.zip 5 points 4 weeks ago* (last edited 4 weeks ago)

These DDOS for hire services make use of hacked machines as botnets to perform the DDOS attacks.

So while the people paying for the service didn't hack anything, the people performing the DDOS certainly did.

[–] FrederikNJS@lemmy.zip 22 points 1 month ago (2 children)

I think the key word here is "unknowingly"... I don't think Trump will get us into WWIII "unknowingly"...

"intentionally" seems like a more fitting word for what Trump is up to.

view more: next ›