Notices by Howard Chu @ Symas (hyc@mastodon.social)

This shouldn't affect many sites because we always discouraged the use of SHA2 for password hashing, in favor of Argon2 or pbkdf2. SHA2 was always unsuitable for this purpose, it's designed to be fast and is easily optimized in hardware. A good password hash must be hard to generate, slow and hard to optimize.

There's enough SHA2 ASICs in the world now thanks to Bitcoin mining that the hardware to bruteforce SHA2 is plentiful and cheap.

A number of projects found that compiling with -fno-strict-aliasing got it working again, but that sounds like a kludge.

Searching a bit more, we found that OpenSSH has a tweaked copy of Aaron's code, which appears to work even with recent gcc. Digging in further, it appears to have come from OpenBSD in 2005. We're now merging that version into OpenLDAP. https://bugs.openldap.org/show_bug.cgi?id=10611

So, #OpenLDAP has had a /contrib module for using SHA2 for password hashing, since 2009. It includes an implementation of SHA2 written by Aaron Gifford, dated 2001. Recently it was discovered that when compiled with some versions of gcc, it produces invalid hashes.

Searching the web for Aaron, to see if he released any later versions of the code, you find zillions of projects using the same copy from 2001. Worth noting that it still works fine, compiled with clang.

@dalias oh, speaking of old Mozilla bugs... I wrote the backend code to support boolean expressions in MailNews/Thunderbird search/filters 20-some years ago, but still nobody has written a patch to expose it in the UI. https://bugzilla.mozilla.org/show_bug.cgi?id=297852

@clacke I couldn't find the original toot, but I'd be game to port some of my C programs to Algol, just for comparison's sake https://mastodon.social/@hyc/116132403211945619

@skinnylatte Tbf, Ireland is a dairy country, and Kerrygold is really good.

RE: https://masto.hackers.town/@calcifer/117264074868953707

Tbf I've hated the water waste on golf courses for decades, long before data centers came on the radar. Watching their automatic sprinklers on the courses near my house in LA while SoCal was in the midst of a multi-year drought was particularly infuriating. But golf is a rich person's game, and rich people make sure they get to keep playing it wherever they like, no matter what anyone else says.

@fesshole too bad they didn't work on rc4 NTLM and drive M$ out of business

@mhoye @owen why would you bother to build it? Just run our 9 containers on your server. https://github.com/michielbdejong/fxa-self-hosting

The #Monero Project uses Pieter Hintjens' Collective Code Construction Contract https://rfc.zeromq.org/spec/22/ as the basis of its project/contribution rules. With all respect to my friend Pieter who is sorely missed, I think this C4 contract was written for a different era, and is problematic today.

This clause in particular: "Everyone, without distinction or discrimination, SHALL have an equal right to become a Contributor under the terms of this contract." is harmful, IMO.

@thomasfuchs I think it's a distortion of another sentiment, don't bring up problems and just demand that other people fix them. If you're not willing to pitch in on the work required to solve them, you're literally not helping. Especially if you're just pointing out problems that are already known and recognized.

@Alkaris @JessTheUnstill one has to wonder if their skills really atrophied so much so quickly, or were they always incompetent and just successfully faking it for 20+ years?

@VeroniqueB99 in an alternate universe

@dalias @uberduck that sounds ... not so great. Why would anyone want to expose their keys like that? What's your use case?

@skinnylatte ever since someone here posted a while ago about eating Cheetos with chopsticks to keep their fingers clean, yeah I pretty much use them for everything now.

Nice to see these stories of people being helped as a result.

https://www.darknessintolight.ie/fundraisers/howardchu/donegal

@Infoseepage @HeavenlyPossum for trump it was Mission Accomplished. He wasn't placed into the Presidency to govern, he was put there to destroy America from the inside out. His goal is precisely to waste resources and squander influence, not to win.

@dalias I just use tcpdump for packet capture. Then use wireshark on the file of captured packets. There's a "Decode As..." option for selecting what protocol decoder to use.

@ireneista @skinnylatte that site is all in Simplified Chinese, and blocked translate.google.com . I learned Traditional Chinese, and I'm pretty rusty. So it was a challenge to order from there the first few times. But hey, when you gotta have your dumplings...