| 00:48.41 | *** join/#qi-hardware fengling (~fengling@111.198.29.53) |
| 01:01.55 | *** join/#qi-hardware MistahDarcy (~crash@fsf/member/MistahDarcy) |
| 01:15.22 | *** join/#qi-hardware azkay (~azkay@c110-23-4-9.rochd7.qld.optusnet.com.au) |
| 02:05.40 | DocScrutinizer05 | apropos server... how's your new one? living up to expectations? |
| 02:06.53 | DocScrutinizer05 | also idly wonders why his own server stopped sending logwatch mails |
| 02:06.57 | *** join/#qi-hardware archang (~archang@111.198.29.53) |
| 02:14.11 | DocScrutinizer05 | hmmm 181-171-244-190.fibertel.com.ar is bruteforcing my server |
| 02:35.47 | *** join/#qi-hardware sandeepkr (~sandeep@111.235.64.4) |
| 02:51.37 | whitequark | kyak: huh, I was really wrong, it seems https://crypto.stackexchange.com/questions/3952/is-it-possible-to-obtain-aes-128-key-from-a-known-ciphertext-plaintext-pair |
| 02:54.04 | *** join/#qi-hardware DocScrutinizer51 (~lagrange@openmoko/engineers/joerg) |
| 03:14.54 | *** join/#qi-hardware DocScrutinizer05 (~saturn@openmoko/engineers/joerg) |
| 03:22.36 | azkay | Ended up getting a (blurry) trinket anyway; i.imgur.com/Cms2udy.jpg |
| 03:35.14 | *** join/#qi-hardware qi-bot (~qi-bot@turandot.qi-hardware.com) |
| 03:35.14 | *** mode/#qi-hardware [+o qi-bot] by ChanServ |
| 03:59.13 | *** join/#qi-hardware xiangfu (~xiangfu@111.198.29.53) |
| 03:59.33 | wpwrak | DocScrutinizer05: server is working fine so far. i'm just missing some bits of config info from the old one before i can properly set it up. seems they forgot to complete the setup :( |
| 04:00.06 | DocScrutinizer05 | who forgot to setup? hetzner? |
| 04:00.18 | wpwrak | DocScrutinizer05: (181-171-244-190.fibertel.com.ar) that doens't look like me :) |
| 04:00.21 | wpwrak | no, amhosting |
| 04:00.31 | DocScrutinizer05 | no, that's not you |
| 04:00.34 | DocScrutinizer05 | :-) |
| 04:01.33 | DocScrutinizer05 | Hetzner vServers have the advantage that moving the VM to another working iron should be a matter of less than 5 seconds |
| 04:01.44 | wpwrak | whitequark: that sounds a lot more in line with what i expected :) |
| 04:02.19 | whitequark | yeah, I'm not sure where I got that |
| 04:03.15 | wpwrak | DocScrutinizer05: yup, the big feature of VMs :) |
| 04:05.27 | *** join/#qi-hardware xiangfu (~xiangfu@111.198.29.53) |
| 04:05.51 | whitequark | well, the VMs which can do online migration, which is not all of them |
| 04:06.08 | whitequark | but yeah. online migration is very neat. |
| 04:08.12 | DocScrutinizer05 | I bet Hetzner using something commercial grade decent for their company virtualization solution |
| 04:09.29 | DocScrutinizer05 | and for sure you/they can start those snapshots you can do now, on any other iron |
| 04:09.45 | DocScrutinizer05 | also only takes a minute |
| 04:10.38 | DocScrutinizer05 | heck, it took less than 10 minutes (prolly even <5) from *ordering* that server to ready-for-login |
| 04:11.47 | DocScrutinizer05 | another 2 minutes for restore of a on-site "tape" backup |
| 04:11.56 | DocScrutinizer05 | done |
| 04:12.39 | DocScrutinizer05 | (if only there was a decent generic server migration restore script) |
| 04:13.46 | DocScrutinizer05 | all those nasty little files in /etc that are actaully iron-specific |
| 04:14.09 | DocScrutinizer05 | "iron", like IP addr etc pp |
| 04:15.03 | DocScrutinizer05 | I wish somebody had written a script to exclude them from getting overwritten during restore |
| 04:21.42 | whitequark | DocScrutinizer05: commercial grade? |
| 04:21.44 | whitequark | hah |
| 04:21.50 | whitequark | can you do `dmesg | grep -i xen` ? |
| 04:22.25 | DocScrutinizer05 | in a VM? |
| 04:22.49 | whitequark | yes |
| 04:23.03 | DocScrutinizer05 | would be surprised to find anything like that |
| 04:23.32 | whitequark | try it |
| 04:23.35 | whitequark | you may be surprised |
| 04:23.54 | DocScrutinizer05 | no, I'm not. Zilch |
| 04:24.00 | whitequark | ah |
| 04:24.02 | whitequark | it's KVM |
| 04:24.05 | whitequark | not Xen |
| 04:24.16 | DocScrutinizer05 | afaik Hetzner using vmware |
| 04:24.40 | DocScrutinizer05 | the enterbrise solution |
| 04:25.21 | whitequark | does kvm also not grep in dmesg? |
| 04:25.48 | whitequark | hmm, might be vmware, yeah. been a while since i cared about that host |
| 04:28.32 | DocScrutinizer05 | vsphere or similar stuff prolly |
| 04:39.36 | kyak | whitequark: yep, i've already read it yesterday.. There is one interesting thing though. It turns out that when knowing plaintext and being able to modify ciphertext, it is possible to inject arbitrary data into every second block of ciphertext |
| 04:40.07 | kyak | this has nothing to do with what i originally asked, but just an interesting fact that i came across while reading |
| 04:40.30 | kyak | i'm talking about AES-CBC |
| 04:40.48 | kyak | and i also understand larsc's comment regarding pinguin :) |
| 04:41.21 | kyak | it also turns out that IV doesn't really matter |
| 04:41.38 | kyak | if you don't know IV, but know the key, you will loose just the first block |
| 04:42.07 | kyak | and this first block is sometimes filled with random data, so that the IV doesn't matter anyway |
| 04:42.42 | kyak | the main purpose of IV is to make the same plaintext look different every time you encrypt it (wasn't obvious for me) |
| 04:43.05 | *** join/#qi-hardware sb0 (~lekernel@59.152.213.90) |
| 04:43.16 | kyak | so "salt it!" doesn't help with encryption by itself |
| 04:43.33 | kyak | it just makes pinguins go away :) |
| 04:46.41 | DocScrutinizer05 | wants to see the pinguin too |
| 04:50.33 | wpwrak | kyak: hmm, i wonder how these modes you're talking about work, if they really have the properties you describe |
| 04:52.28 | wpwrak | one common pattern works as follows: you use the crypto algo to produce a "one-time pad", a unique bitstring. then you xor the plaintext with the OPT. that is you cyphertext. |
| 04:52.51 | wpwrak | to reverse, you generate the same OPT, and XOR again. |
| 04:53.14 | wpwrak | even if your algorithm works completely differently, you can always express it in such a way |
| 04:56.57 | wpwrak | now, the interesting bit is thus how you generate that OTP. a common design pattern there would be a function that does some variation of hash(key, "salt", position) or hash(key, "salt", last_state) |
| 04:58.10 | DocScrutinizer05 | wpwrak: is your mail working again? |
| 04:58.22 | wpwrak | only gmail |
| 04:58.59 | whitequark | kyak: yes, malleability |
| 04:59.05 | whitequark | that's why you need authenticated encryption |
| 04:59.15 | whitequark | and why you need to authenticate *after* encrypting |
| 05:04.37 | wpwrak | ideally, you'd ensure key integrity right at the start, e.g., by including an (unencrypted) good hash (CRC or such, something efficient) of the key :) |
| 05:05.14 | wpwrak | works best of keys come from a relatively small vocabulary, e.g., human-readable words, not random bits or hashed passphrases :) |
| 05:06.19 | wpwrak | (this sort of things has actually been done ;-) |
| 05:15.24 | kyak | wpwrak: yes, the key word is malleability as whitequark pointed out.. http://www.jakoblell.com/blog/2013/12/22/practical-malleability-attack-against-cbc-encrypted-luks-partitions/ |
| 05:16.34 | kyak | there is a picture in the article in the wiki as well that explains how AES-CBC decryptions works and how this attack becomes possible |
| 05:20.18 | kyak | DocScrutinizer05: the pinguin: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_Codebook_.28ECB.29 |
| 05:23.50 | wpwrak | hmm, i was hoping for whitequark to jump up and shout. but maybe he got a stroke instead :) just to be clear: the CRC stuff i described above would be rather horrible, for it would allow you to brute-force the password much more efficiently than by trying to decrypt the data and checking the integrity of the decrypted message |
| 05:24.31 | wpwrak | likewise, it's a bad idea to have an unencrypted checksum of the plaintext |
| 05:43.58 | *** join/#qi-hardware mth (rwwdcsvs@88.159.34.112) |
| 06:05.38 | *** join/#qi-hardware wej (~j@2a00:1768:2001:7:1::3e) |
| 06:41.32 | *** join/#qi-hardware xiangfu (~xiangfu@111.198.29.53) |
| 07:12.51 | *** join/#qi-hardware xiangfu_ (~xiangfu@111.198.29.53) |
| 07:34.31 | wpwrak | DocScrutinizer05: evil sysadmin idea of the day: for /etc file, create some FUSE config file processor that you mount on /etc very early during boot. then let that one make substitutions. e.g., /etc/hostname -> <$HOST$> /etc/hosts 127.0.0.1 <$HOST$>.<$DOMAIN$> localhost etc. |
| 07:34.57 | wpwrak | then all you need is /evil-sysadmin.conf |
| 07:54.50 | wpwrak | hmm, debugging TLS in postfix sucks. it has a nice logging option .. that seems to be far too familiar with the works of schroedinger |
| 08:02.51 | whitequark | wpwrak: I was afk |
| 08:48.12 | *** join/#qi-hardware pcercuei (~paul@137.71.226.54) |
| 08:53.16 | *** join/#qi-hardware xiangfu_ (~xiangfu@111.198.29.53) |
| 08:55.25 | *** join/#qi-hardware jwhitmore (~jwhitmore@86-41-129-22-dynamic.b-ras2.rtd.sligo.eircom.net) |
| 09:19.27 | wpwrak | DocScrutinizer05: bonus idea, for the evil sysadmin: make file names that expand as well. e.g., /etc/foo/<$HOST$>.conf |
| 09:21.35 | wpwrak | access to /etc/foo/bar.conf would first try /etc/foo/bar.conf, then scan /etc/foo/ for expandable names and look for a match, then try /etc, etc. if it expands a dirname, add the remaining path and try again |
| 09:22.57 | wpwrak | probably should allow climbing above the first expansion, though that may mess a bit with the user's head :) |
| 11:49.47 | *** join/#qi-hardware azkay_ (~azkay@c110-23-4-9.rochd7.qld.optusnet.com.au) |
| 12:35.38 | *** join/#qi-hardware azkay__ (~azkay@c110-23-4-9.rochd7.qld.optusnet.com.au) |
| 14:07.17 | *** join/#qi-hardware Nik05 (~Nik05@unaffiliated/nik05) |
| 14:08.03 | *** join/#qi-hardware sb0 (~lekernel@123202036228.ctinets.com) |
| 14:29.41 | wpwrak | grrr. ssmtp proudly supports "AuthMethod" to set the SMTP authentication method. the server offers PLAIN and LOGIN. ssmtp always chooses LOGIN, no matter what i try. |
| 14:30.21 | wpwrak | turns out it doesn't support PLAIN at all. plus, it doesn't check that AuthMethod has any value it actually supports. very funny :( |
| 15:41.59 | *** join/#qi-hardware azkay_ (~azkay@c110-23-4-9.rochd7.qld.optusnet.com.au) |
| 16:44.34 | *** join/#qi-hardware azkay__ (~azkay@c110-23-4-9.rochd7.qld.optusnet.com.au) |
| 17:00.53 | *** join/#qi-hardware rjeffries (~rjeffries@97-86-152-169.dhcp.stls.mo.charter.com) |
| 17:42.00 | *** join/#qi-hardware jwhitmore (~jwhitmore@109.76.210.123) |
| 17:50.32 | *** join/#qi-hardware sandeepkr (~sandeep@111.235.64.4) |
| 17:52.57 | *** join/#qi-hardware sandeepkr (~sandeep@111.235.64.4) |
| 18:03.07 | *** join/#qi-hardware rjeffries (~rjeffries@97-86-152-169.dhcp.stls.mo.charter.com) |
| 18:50.08 | *** join/#qi-hardware sandeepkr_ (~sandeep@111.235.64.4) |
| 19:43.57 | *** join/#qi-hardware jwhitmore (~jwhitmore@109.76.210.123) |
| 22:42.30 | *** join/#qi-hardware MistahDarcy (~crash@66-169-224-12.dhcp.gvrb.ca.charter.com) |
| 22:42.30 | *** join/#qi-hardware MistahDarcy (~crash@fsf/member/MistahDarcy) |
| 22:44.08 | wpwrak | new server is processing mail :) so far, everything looks healthy |
| 23:30.00 | MistahDarcy | NanoNote 2, where are you? |