ryan-c

8 ms·

91.
by ryan-c 3y ago
The first post from my blog that made the #1 slot on hackernews was this one: https://rya.nc/cert-tricks.html and I actually have had a vanity ssh key generator online for years: https://rya.nc/ssh-vanity.ht
92.
Putting an xz Backdoor Payload in a Valid RSA Key(rya.nc)
37 points by ryan-c 3y ago|3 comments
93.
by ryan-c 3y ago
Are you caching a keyed HMAC context? Given the data sizes, it ought to be at least one call of the SHA transform function to set the key, and one to produce the hash. They keying operation isn't dependant on the data and its result ca
94.
by ryan-c 3y ago
Why the string searching? One million bits is 125KB. That would fit in L2 cache. Just build a bitmap of interesting results (small enough to ship with the app), do modulo 1000000, then do a lookup in the bit map. Could even be a byte map wh
95.
by ryan-c 3y ago
They're lying.
96.
by ryan-c 3y ago
Note that this archive project is French.
98.
by ryan-c 3y ago
> However, we cannot prevent a publicly available from being archived by anyone using our "Save code now" feature This is not true. They just had to remove about 500 public repos to comply with my copyright.
99.
by ryan-c 3y ago
Software Heritage aggressively insists on French law... which does not have fair use.
100.
by ryan-c 3y ago
Oh, neat, my gist linked from that post was used as evidence.
101.
by ryan-c 3y ago
> The weird thing is being bad at it hasn't stopped him. "pathological" I think it's literally a compulsion for him.
102.
by ryan-c 3y ago
This is about Faketoshi Notamoto, right? click Yup. This guy is a pathological forger and is bad at it. Here's my write-up from when he got caught doing naughty things with ECDSA: https://rya.nc/sartre.html (as not
103.
by ryan-c 3y ago
It doesn't remove even a single bit of entropy. For an offline attack, where you have to attack Facebook's bespoke "password onion"[1], you would still have to compute both hashes. There is approximately zero impact on c
104.
by ryan-c 3y ago
From the other discussion, there are clear data problems with the source this is based on: https://gs.statcounter.com/os-version-market-share/android/m...
105.
by ryan-c 3y ago
Disabling it would be weird and therefore make you more identifiable.
106.
by ryan-c 3y ago
IP is a pretty good ID...
107.
by ryan-c 3y ago
All the data is based on page views, and they seem to support non-javascript, which means they don't even have the possibility of detecting a lot of bots.
108.
by ryan-c 3y ago
I don't understand why people give any credence to this data. May 2023, for example, screams unfiltered bots: https://gs.statcounter.com/os-version-market-share/android/m...
109.
by ryan-c 3y ago
There's a number of options for replacing the control board on the kinesis advantage (or advantage2) with one that runs QMK, providing the same sort of configurability as the ergodox, and the advantage 360 pro runs on ZMK.
110.
by ryan-c 3y ago
The UK does not require a license for a TV. They require a license to receive live television broadcasts (regardless of medium) and/or use BBC iPlayer. Watching C-SPAN's live stream on your laptop would, for example, require a TV
111.
by ryan-c 3y ago
> what does direct democracy in the US look like? Two wolves and a sheep deciding what to have for dinner. https://en.wikipedia.org/wiki/1978_California_Proposition_13 (massively screwed up the housing market in Cal
112.
by ryan-c 3y ago
`ls` actually supports 24 bit color if you put the sequences in DIRCOLORS
113.
by ryan-c 3y ago
+42 is Czechoslovakia +44 is UK
114.
by ryan-c 3y ago
called a "parasitic traceroute"
115.
by ryan-c 3y ago
> BIND (aka named, the occasional remote sudo implementation) Oh, goodness. dnsmasq got a feature to block site finder - the "bogus-nxdomain" option - which still exists and still mentions 64.94.110.11 in the documentation.
116.
by ryan-c 3y ago
Idiots still do user agent checks and block anything they don't explicitly support.
117.
by ryan-c 3y ago
Roads don't get replaced with ones which are incompatible with unpopular cars on a regular basis.
118.
by ryan-c 3y ago
That could even be done with two completely separate modems.
119.
by ryan-c 3y ago
People have gotten... upset... when I submit pull requests on github as `wget${IFS}r.vc/ghe`@ryanc.org
120.
by ryan-c 3y ago
Programs that need to set environment variables for child processes should use `execvpe` or `execle`.

More ›