« first day (2324 days earlier)      last day (2623 days later) » 
00:00 - 17:0017:00 - 00:00

12:35 AM
@SebastianNielsen yes I was referring to the article. My first post has a reply arrow so you can follow the thread
 
Do others find the current stackoverflow top-bar quite "big"? Using a lot of vertical space needlessly?
 
using laptop screen, yeah
but you can disable stickiness in settings so it wont be pinned to the top
 
@paul23 yes, also too light in colour
 
1:11 AM
Am I right that this question should actually be answered by "send mystr.encode(...) instead of mystr through your socket"?
my semivague impression about the bytes/str conundrum is that problems like this exactly arise if you confuse the two, and when you're transferring data you're working with bytes (or at least should be)
 
@AndrasDeak Yes, they need to send bytes, not a string. But there's no need to do any encoding, they can just send a simple bytes object.
 
well, due to them having literals, right?
otherwise, given a string-valued variable, they'd have to encode
or is the bytearray(...) in the answer the right/idiomatic approach?
 
b'\x1b'+47*b'\x00' will work. There's probably a better way, but I'm on my phone and my brain is mush.
 
hmm
tangential: doesn't that have 47 0 bytes instead of 47 "0" characters at the end?
just to determine if I understand what's going on
 
1:28 AM
That answer looks OK. But I think bytes(47) makes a bytestring of the right length, full of zeros... Or maybe im getting mixed up with the bytearray constructor
 
OK, thanks:)
@PM2Ring I worked down my "opened links for future reading" backlog accumulated during the week. I don't know if you've heard of Shamir's Secret Sharing that Antti linked to or seen the link, but if you haven't, it's definitely something that you'd appreciate
 
@AndrasDeak yeah but according to the OP the value of the other 47 bytes don't matter and I think sending nulls is cleaner. OTOH it could yam up something expecting C-style NUL terminated strings
 
ah, that I missed ^
 
@AndrasDeak I read about it years ago but only vaguely remember how it works. Shamir's a pretty smart dude - he's the S in RSA.
 
oh, neat:)
now that I think about it, I don't think I've ever seen what RSA stands for
yeah, definitely not
 
1:38 AM
WTF? The OP just deleted that question. Maybe it's homework...
 
:|
username AlwaysQuestioning, not a good sign in hindsight:D
 
Maybe we should mention him to Bhargav or one of our other friendly neighborhood mods to see if he has a track record of deleting answered questions
But I guess the system picks up that sort of thing automatically.
 
nope
at least I don't think so
you only get question-banned if you keep deleting after you get answers
 
That's what I mean, but I don't know how much of that process is automated.
Hmm 46 questions 3 answers. I reckon 10k+ users should be able to see a list of a user's deleted questions, and 15k should see deleted answers. Maybe it's possible and I just don't know how ;)
 
1:54 AM
no:(
it's already a lesser miracle that 10k+ can search their own deleted posts...
 
BTW, I caught up on the What-If articles and forum threads. I'd been neglecting them for longer than I thought. The last one I'd read was the one about filling a shoebox with expensive stuff.
 
I vaguely remember that one
 
2:06 AM
I'm sitting through the fourth python compile test for today...they're starting to get boring
 
2:22 AM
3.6 or 3.7?
 
I started with 3.7 master, but ctypes (among other things) wouldn't compile. So I switched to 3.6, which has just compiled successfully:)
 
@AndrasDeak There were some interesting suggestions in the thread. Like isotopically pure stuff. I hadn't realised how expensive NaCl is when the chlorine is almost pure chlorine-35.
 
hmm, right, that stuff's basically 50-50 in nature
 
@AndrasDeak weird that ctypes was causing a problem, but I guess you get that kind of thing with alpha builds.
 
yeah, I wasn't looking into bleeding edge, I just wanted to play around with wim's problem:D
might as well take a look at f-strings soon
now I just have to figure out what gives my REPL autocomplete and arrow navigations...
oh, right, there was something about curses...might be related I guess
Python build finished successfully!
The necessary bits to build these optional modules were not found:
_bz2                  _curses               _curses_panel
_dbm                  _gdbm                 _lzma
_sqlite3              _ssl                  _tkinter
readline
To find the necessary bits, look in setup.py in detect_modules() for the module's name.
who needs tkinter anyway
 
2:32 AM
@AndrasDeak But the relative mass difference is way larger than stuff like uranium, so it shouldn't be that hard to separate, eg using electrolysis. But I suppose you have to do lots of runs.
 
yeah, diffusion is messy
 
@AndrasDeak Some of those look familiar from the first time I compiled 3.6, especially readline. You can find good suggestions of stuff to install and other info from Antti if you look in the transcripts of that time.
 
thanks for the tip, I might check it out later
I remember it being non-trivial for you, although I'd expect less rough edges to be still around by now
@wim I just realized that os.walk starts with top = fspath(top), i.e. it explicitly gets the string representation of the input...
same in 3.7.0 alpha
 
@AndrasDeak Partly because it was an alpha build but mostly because I'm using an abandoned distro. But with a little tweaking of my repos I was able to install the necessary stuff. That shouldn't be an issue for you, though.
 
2:48 AM
I'm not sure whether I'm missing some dependencies...curses seems to work fine on my system 3.5, and I compiled 3.6 from source
I'll google it later:)
and also check the transcript as you suggested
this isn't high-priority for me at all, especially since I've finished my business with wim's os.walk
 
Fair enough.
I really had to have readline and rlcompleter I'd hate to not have tab-completion in the REPL.
 
me too:/
but 3.5 works fine:D
I'm too lazy to type an additional .6 anyway
 
Back shortly.
 
me too
 
 
2 hours later…
 
3 hours later…
7:39 AM
cbg
@AndrasDeak use an alias
@AndrasDeak and readline you'd need.
@AndrasDeak anyway you didn't listen to my build guide
Jan 28 at 10:05, by Antti Haapala
for example: sudo apt-get build-dep python3.5
 
7:57 AM
Cabbage. Any thoughts?
So local names and local variables are 2 different things. is there any way to see list of local names like we have locals() for local variables. — Vikash Singh 3 hours ago
 
8:14 AM
Are exist sorted dictionaries in Python like std::map in C++?
 
Python has OrderedDict in the collections module and in Python 3.6 normal dict retains insertion order but currently that's just an implementation detail that shouldn't be relied on.
 
@QueueOverflow no
@PM2Ring no
 
@AnttiHaapala It's so sad... :(
 
not like C++ map
@PM2Ring C++ map is a binary tree.
in python there is absolutely no such data structure:(
@QueueOverflow what do you need it for?
@QueueOverflow if you have a constant map, you can sort the keys and use an OrderedDict then.
 
8:30 AM
@AnttiHaapala For perfomance reasons, i.e. to prevent the superfluous sorting.
 
but if you want O(lg n) guarantees with user-constructed import, or that ^, then no.
no no no.
:(
@QueueOverflow again, if it is constant, the complexity is the same, but if it is not constant, there is no workaround I can think of
 
OTOH, a dictionary with sorted keys is a bit inefficient since you'd need to re-sort the underlying keys list if you add an out of order key. So it'd be better to use a tree to hold the key order.
 
Python doesn't have any tree implementation either
 
@AnttiHaapala Thanks for answers. I will profile my code and if the sorting will be bottle neck, I will try non-native solutions, like: grantjenks.com/docs/sortedcontainers/#sortedcontainers
 
yea
@QueueOverflow that is still true as of current 3.7
soneone ought to push this stuff into the Python core.
 
8:32 AM
@PM2Ring for example, red-black tree :)
 
it would be most useful.
 
Sorry I'm a little slow, I'm on my phone.
 
@PM2Ring :d
 
@AnttiHaapala I hope it will be.
 
it never will if people don't complain about it loudly
 
8:33 AM
Cabbage
 
register and open an issue and say: we need to get this into core
 
@QueueOverflow Or AVL tree.
 
@QueueOverflow for example hash randomization would not have been needed for user input in web servers, if there only was a tree dictionary type.
 
9:30 AM
"A set containing the names of the hash algorithms guaranteed to be supported by this module on all platforms. Note that ‘md5’ is in this list despite some upstream vendors offering an odd “FIPS compliant” Python build that excludes it."
waht? :D
 
10:06 AM
@IljaEverilä Thanks, i will take that into consideration. I will be using hashlib for passwords, and a self signed SSL cert, also, it's not being used in production environment i'm just playing around with flask. :)
 
@AnonInternational wat, why should you play with that?
@AnonInternational if one is to play a musical instrument, it never actually helps to learn to play incorrectly first.
Rather, it is harmful
you must not use hashlib for passwords. There is passlib that is used for it.
 
Also, if you are referring to the passing of sql queries in form fields, my understanding is that mysql.connector automatically escapes problematic strings
.
"Since mysql.connector is DB API v2.0 compliant, you do not need to escape the data yourself, it does it automatically for you."
 
@AnonInternational yes.
@AnonInternational and the link that you pasted python-course.eu/sql_python.php - specifically circumvents the way how DB API v2.0 works.
any website that has a short article and words: "training" or "school" is always a suspect, those words make me release the safety
hmm I wish I could bold the "not" in the "must not"
alas, 2 minutes gone
 
10:22 AM
Okay, could you elaborate on that?
How should the module be used, what is the correct method of doing this, as that's the only module that's working for me.
 
correction: for passwords you can use these: docs.python.org/3/library/hashlib.html#key-derivation from hashlib if you're 3.4+
it is rather how the dbapi 2.0 is used
a sec..
or a minute
@AnonInternational sorry again, which mysql driver were you using?
 
I said hashlib by mistake as i've honestly not used either modules, but i did actually mean to say passlib. Sorry.
If i use passlib SHA256_crypt with mysql.connector, will that be okay?
 
Okay, great. My apologies for the confusion. >.<
 
here
you must use %s in any place where you'd use an user supplied value.
insert_stmt = (
  "INSERT INTO employees (emp_no, first_name, last_name, hire_date) "
  "VALUES (%s, %s, %s, %s)"
)
then...
you specifically must not use the 'asdfsadf %s %s' % (first, second) construct, that is not safe. Likewise you must not use the format as on that Python course page...
instead, you do:
cursor.execute(insert_stmt, (2, 'Jane', 'Doe', datetime.date(2012, 3, 23))
i.e., first argument is a SQL statement with lots of %s, and the second argument is a tuple of things that should replace these %s.
only then does the mysql.connector escape the data automatically for you.
(also, never trust any tutorial without comments section, nor trust any tutorial with a comment section, but without any criticism)
 
10:33 AM
Okay, thanks. I will take note of that, i'm somewhat familiar with string formatting already. And this seems to be the way it's been shown in the guide i've been following. Very much appreciate it.
 
ok, I am sure you didn't read correctly.
This is not string formatting
this has nothing to do with string formatting
unfortunately, the mysql.connector uses %s, it is unfortunate because people thing this is string formatting. It is not. You must not use % (arguments) yourself :d
@AnonInternational bobby-tables.com/python
hmm that's a rather good page
 
I'm learning from sentdex and the forums here. I just referenced the link as it's the first module i found as a replacement.. Oh right i guess i got confused with that. I will take note of all this though and read through docs etc. I would prefer to do things the right way.
 
10:53 AM
newbies often go to google and they enter the words like "python tutorial mysql" and so on and unfortunately they often end up opening the wrong link. pages like tutorialspoint, w3schools and such really are not to be trusted. They're not professional, they're not correct, they're not approved and they all just exist to generate revenue from advertisement
you can add site:stackoverflow.com in your google searches to get only stack overflow results; usually the Q/A on stack overflow is correct or at least the incorrect advice gets downvoted and/or commented.
if by sentdex you mean pythonprogramming.net these, yeah those are pretty lightweight too
 
Most of my searches lead me to stack exchange sites anyway just honestly, i understand what you mean, i am hesitant to trust information which is why i am here, as i know generally it's made known if information is inaccurate. But the only thing is, for someone who's rather new to programming and python in particular, some of the videos are useful as i would struggle to learn some things without seeing it visually happening.
I started out as a script kid a few years ago, i learned to hack with other peoples tools before i learned to develop my own, but i've been learning how to do things at ground level for the past 18 months, hoping to develop a deeper understanding of how things really work without being destructive. I find a lot of useful information here.
 
11:44 AM
@AnonInternational Instead of string formatting you use placeholders. As @AnttiHaapala said, the MySQLdb driver uses %s as a placeholder, but for example sqlite3 uses ?. SQLAlchemy on the other hand has the text() construct that hides the differences between different DB-API implementations and uses :name style named placeholders.
 
Okay great, i didn't differentiate between the two, but clearly it's important to know that there is a difference when working with these modules. Thanks.
 
12:06 PM
sup guys. With sqlite3, if I run an execute('INSERT ...') and there's a conflict, will the cursor return the lastrowid if the resolution is 'IGNORE'? I assume it will for 'REPLACE', but not sure either...
 
@RichardDunn so try. (i wouldn't know)
 
am going to, but it'll take a few minutes to repopulate data and test...
 
Hey, just had a quick question
I've written some code for a python server with tcp sockets and stuff
And a client
The client also uses Tkinter for the GUI
And I was wondering if it's possible to get the client to run on a webpage, so I can send someone a link and they can pretty much have the code run on the browser and run the client program there without having downloaded anything
 
@AnttiHaapala it would've been yamming hard to follow instructions I don't know about and which I don't know I need, don't you think? :|
cbg
 
@ZeroFunter You can't run Python in a browser. Only JavaScript.
 
12:19 PM
and I don't want to apt-get install python3.6 because I want to make sure it doesn't fubar my system python 3
dependencies are fine that way though, which is just what I'm going to do
 
So the only way would be to re-write everything in JavaScript?
 
With flask you can use some python logic and run functions from a browser.
 
Hm
I'll look into flask and see if it can help
 
GUI wise, yeah, really depends on how your app works, do you need it to run on their machine, or can they just view something that's executed on the server
 
it won't expose your GUI though
 
12:20 PM
Just saw this stackoverflow.com/questions/42378407/…, Does it look like it has a MCVE?
 
I need it to run on their machine
And then they just exchange data with the server
 
Doe's it need to read/write files to memory?
 
Nope
 
@ZeroFunter Then they download your client from somewhere you serve the client
 
Then you should be looking at javascript
 
12:21 PM
and yes ^^
 
Yea I've already tested it, works if they download the client
 
What's wrong with that?
 
Made it exe with easyinstall and they can run it on their windows machines
 
then your option is downloading the client or writing a web application
 
or pyinstaller
 
12:22 PM
what is wrong with downloading the client?
 
It's kind of a hassle to send everyone the client
It does work but I'd prefer if they could join the server without downloading anything
Oh well, thanks for the help though, I guess it isn't possible
 
Web programming is pretty much a must have knowledge tbh, so it sounds like a good excuse to get into JavaScript...
 
Well I'm not that worried yet, I'll get into web programming later, rn I'm not even in college/university so I still have stuff in front of me
 
1:18 PM
hmm, it's surprisingly hard to find a vanilla curses library for my debian...
there's ncurses and a lot of non-python language-specific curses binding libraries...but no libcurses or similar
 
1:29 PM
Well Hello, I have a somewhat stupid question, i'm doing cosine clustering in python using scikt library and the calculation of the matrix at least one step in it causes memory overflow, do you guys have any thoughts on how to calculate it for let's say 400000 records. I do have a way which is too slow and time consuming i need something faster any help would be apreciated
 
1:40 PM
@AndrasDeak
@AndrasDeak hard-headed you
sudo apt-get build-dep python3.5
>>> Levenshtein.ratio('sudo apt-get build-dep python3.5', 'sudo apt-get install python3.6')
0.7741935483870968
 
2:00 PM
@AnttiHaapala not hard-headed, just unobservant:D
well, hard-headed, but that's not apparent in this instance
 
well, yes but the symptoms resemble those of PM who definitely is hard-headed when it comes to doing right
 
well I have my own unique collection of personal flaws, thank you very much:P
 
2:17 PM
cabbage cabbage cabbage cabbage cabbage cabbage cabbage cabbage cabbage
 
python python
 
0:03:17 [ 88/405] test_curses
0:03:17 [ 89/405] test_datetime -- test_curses skipped (resource denied)
@Antti your magic is failing me ^
that's post-build-dep python 3.5
 
hmhm
what did build-dep say?
 
Hmm, is it nontrivial to re configure? I just called make clean; ./configure ...
 
2:27 PM
@AnttiHaapala There's a difference between being unwilling to change due to sheer obstinacy vs mere inertia and technological debt .;-p
 
I am not sure
Python 3.6.0+ (default, Jan 21 2017, 08:04:41)
[GCC 6.2.0 20161005] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import curses
hmm
 
@AnttiHaapala nothing in particular
the weird part is that curses works fine for 3.5
 
soo you did make clean, configure, and...
 
and then make, at which point the test failed for curses
 
this I've built only with: ./configure --prefix=/opt/python3.6 --enable-optimizations
 
2:30 PM
./configure --enable-optimizations in my case
I'll get back to this later, rhubarb for now
 
better to use a prefix too
easier to uninstall - just rm -rf
 
well now I just rm -rf /usr/local/{bin,lib}/python3.6 :P
I'd never remember to look for it in /opt half a year from now
 
rm -rf is the best command ever
it makes all the problems go away
 
(even though I'm aware that stuff like this should go there)
@idjaw most problems
 
details
 
2:35 PM
I've got 99 problems but a filesystem ain't one...
 
cbg
 
Do we have a canonical for this? stackoverflow.com/questions/42456590/…
 
>>> isinstance(object, type)
True
>>> isinstance(type, object)
True
 
Weird... that showed the gravatar image and not the usual image...
 
yeah, gravatar is buggy again
 
2:42 PM
again?
@PM2Ring not necessarily
 
@BhargavRao who'd have thought that's possible from such a remarkably reliable system :p
 
oh yeah, it always was. So "again" is incorrect.
 
"again" is just redundant :)
 
@JonClements lol, yep
 
http://pastebin.com/TN0NgLJQ
http://pastebin.com/HdRpK7L9
what's wrong with server-side output? I'm always getting this: http://imgur.com/a/msXK3
 
2:45 PM
What do you think is wrong with the output?
 
um, I think it should print initial message
 
You've provided way too much code
Where did your troubleshooting lead you to believe the problem is in your code?
What should the output be?
 
I want to see what is sent from client. But getting blank b''
 
please put together a better MCVE to narrow down your question more explicitly
so, you want to know what the client is sending
so, look at your client code to see what it is you are sending
then look at your server for what receives taht exact call
 
Yes, exactly
 
2:48 PM
and see what it looks like there
exactly
so do that
get some logging going. Tail the server logs, send the request see what is happening
 
3:11 PM
>>> isinstance(object, type)
True
>>> isinstance(type, type)
True
>>> isinstance(type, object)
True
>>> isinstance(object, object)
True
 
3:22 PM
yeah, that's some trippy stuff there
I forget what article I was reading about type/object
throwing in type.__class__ and object.__class__ doesn't really reduce the amount of mind blowing going on.
 
type's and object's metaclass is type, and everything inherits from object, including object iself.
 
type's or object's all the way down ;)
 
>>> object().__class__
<type 'object'>
@AndrasDeak I am not sure ifsome of those things is held in the configure caches
 
@AndrasDeak ahha I looked at the makefile, to really remove the configure artefacts you ought to run make clobber
or perhaps "distclean"
 
3:35 PM
hi
can anybody help me with git
 
No, this is the Python room.
 
@WayneWerner The diagram in the OP's link is useful :
 
All is clear now.
 
naturally
@AndroidDev git-scm.com/docs
there you go, help with git!
all the help you should need, really
 
so, metaclasses are isa-relationships for classes themselves.
@PM2Ring actually that is not a really good drawing, I don't like the "base of all other types"
 
so, let's call type a class, and object a "thing"
then we can say: every thing is a thing... even a class is a thing... however if thing is a classification of every thing then thing is a class...
but I am not sure why type's metaclass should be type :D
now that I think of it, it suddenly doesn't make sense.
 
@AnttiHaapala Sure, but I only said it was useful, not that it was great.;) It doesn't really illustrate the whole metaclass thing.
 
hmm so how do we call a metaclass :D
 
@AnttiHaapala type is the base metaclass, similar to how object is the base class.
But every object has to have a class (type) so it gets a bit incestuous.
The relationship between Python's object and type is even worse than Haskell's monads: once you understand it, you can no longer explain it, even to yourself. :D
 
do those nomads ride alots?
 
3:55 PM
Yamming auto-correct...
 
4:08 PM
I can hardly wait for the bread to cool so that I can have some sholet, mhmm
 
Thanks pup
 
@idjaw you can do that too you know:D
 
@AndrasDeak home made bread?
 
You've got italics ya know :)
 
4:09 PM
yup, missus baked it
 
yeah yeah...I was waiting to see if it actually stopped to do one clean up
 
yeah right
 
You're playing the Canada card on me aren't you
 
I was hoping it's obvious :D
 
I deserved that
 
4:11 PM
Yes.
but you like good food and good editors, so we're cool for now
 
I'm going to hold on to those two for as long as I can
 
Could use some help getting Flask-SQLAlchemy 2.2 milestone finished, if anyone wants to pitch in.
 
Keep getting (understandably) pestered to make a new release.
 
Let me take a look see if I can do anything with those
 
4:14 PM
Mostly it's just coming up with thorough solutions to the tablename detection and generation code.
 
alright...let me fork and run unit tests...see how this looks like
 
shit gcc crashes when trying to build python
even gcc gives up
 
4:29 PM
Well that was fast
First time I ever look at the SQLAlchemy code. I was not expecting just two files holding all the code
and most of it in the init
 
I'm going to split it up for v3. The hard part is that splitting it up breaks all unmerged pull requests.
 
suprising, innit?
 
:-|
 
^^
 
@idjaw it is "flask-sqlalchemy" not sqlalchemy
@davidism can you unsuck it by v3?
 
4:38 PM
@AnttiHaapala which parts, specifically?
 
@AnttiHaapala Yeah I know that. Implied that, now too late to edit to explicitly be explicit about that :D
 
I've never had any issues using it, although I recognize that there are issues.
 
I wonder if git has the same sha-1 collisions problem
i.e., that it will hork the repo if you try checking in the files like that
 
As far as I understand, no, it's not quite the same on git.
 
Just thought I ought to let you guys know : my Mum passed away peacefully last night. She had her family around her for most of her last hours, and was listening to music as she faded out of consciousness. And she managed to have a small drink of beer too. )
 
4:40 PM
@davidism git prefixes the file it commits with 'blob' and something else (can't remember what).
All that that means is that you need to take that prefix into account when generating a file that'll collide.
That's just a question of time.
 
@MartijnPieters I'm assuming HG is similar too.
 
It's when, not if.
 
@PM2Ring I'm sorry to hear that - it's "good" it was peaceful though manly hugs
 
@davidism -> github.com/mitsuhiko/flask-sqlalchemy/pull/454/files is it just a unittest missing?
what part do you need help with exactly
 
@PM2Ring :( though +1 for peacefully
 
Thanks, guys.
 
@PM2Ring I'm so sorry:(
 
@PM2Ring Sorry to hear PM. Peacefully is nice to hear, and condolences to you and your family. All the best.
 
@PM2Ring going out with a beer is a pretty good thing, I think. Sorry to hear and hope your family is doing ok.
 
@PM2Ring my condolences :(
 
4:44 PM
 
I didn't mention it earlier because I was waiting for a few of the regulars to turn up.
 
I don't know how badly broken a git or hg repo would be when you commit both documents.
 
@MartijnPieters since you're here, do you have any insight into SHA-1 as it's used in HMAC and PBKDF2 for secure signing and password hashing? I don't think the collisions matter in those cases, but I don't really understand how they interact.
 
Obviously, we now know that SVN deals rather badly with the situation; repository corruption.
 
It came up with itsdangerous and Werkzeug's generate_password_hash.
 
4:45 PM
I don't have any, I haven't given that any thought.
 
@davidism doesn't matter a thing.
 
HMAC and PBKDF2 are pluggable, just don't use SHA1 just like you wouldn't use MD5.
 
but sha1 there isn't affected by this at all
 
Yeah, I figured that we could just upgrade to SHA-2 anyway, but I wanted to understand the correspondence more.
I think it's just used for intermediate padding.
 
We're all pretty teary, but we're hanging in there. And we feel privileged to have witnessed her strength and dignity even in her final hours.
 
4:48 PM
As for Mercurial and SHA1, it isn't based on just the content, but also on the parent ids.
So you'd have to craft documents that collide for specific locations in the tree. See mercurial-scm.org/wiki/Nodeid
 
HMAC wouldn't be affected either
also, to those who asked about git, Linus' comment is on wikipedia SHA1 page
 
this makes it far less practical. Unless you can control what else is committed to the repo, you can't really predict what hashes are going to be used for other commits, so you can't easily produce colliding SHA1 hashes in the nodes.
So I'm not worried for mercurial repos being corrupted as easily as the Subversion demonstration we have just seen.
 
In cryptography, SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function designed by the United States National Security Agency and is a U.S. Federal Information Processing Standard published by the United States NIST. SHA-1 produces a 160-bit (20-byte) hash value known as a message digest. A SHA-1 hash value is typically rendered as a hexadecimal number, 40 digits long. SHA-1 is no longer considered secure against well-funded opponents. In 2005, cryptanalysts found attacks on SHA-1 suggesting that the algorithm might not be secure enough for ongoing use, and since 2010 many organizations...
" One of the reasons I care is for the kernel, we had a break in on one of the BitKeeper sites where people tried to corrupt the kernel source code repositories.[23] However Git does not require the second preimage resistance of SHA-1 as a security feature, since it will always prefer to keep the earliest version of an object in case of collision, preventing an attacker from surreptitiously overwriting files.[24]"
@PM2Ring it is quite late there now?
 
@AnttiHaapala exactly. Mercurial is the same here.
 
this is a second preimage attack...
 
4:51 PM
So the only risk is corruption, and that risk is, for mercurial at least, so small as to be non-existent. Other methods are far easier to pull of.
 
it is possible that someone can trick someone to pull a broken repository, but... again this is a second preimage attack, so they'd have to had that original file pulled in too
 
@MartijnPieters It'd be pretty hard to exploit these kinds of constructed collisions when multiple hashes are performed. IIRC, HMAC is still OK with MD5, let alone SHA-1. And when you're chaining zillions of hashes as in PBKDF2 the risk is indistinguishable from someone breaking a strong password by pure chance.
 
@PM2Ring there you go.
16
Q: Is HMAC-MD5 considered secure for authenticating encrypted data?

NuojiI've read something to the effect that the HMAC construct is able to lessen the problem of collisions in the underlying hash. Does that mean that something like HMAC-MD5 still might be considered safe for authenticating encrypted data?

 
ah yeah sorry :D
 
@davidism: basically, if you are using HMAC on a secret key, then even HMAC-MD5 is secure still, no need to worry about SHA-1.
 
4:57 PM
the shattack is not a 2nd preimage, but just collision
and pbkdf should be safe too
 
I should update that answer I wrote yesterday.
We get occasional issues submitted over concern about SHA-1.
 
> There is a known weakness to SHA1 that allows someone to compute a collision in less time than expected; there is no known way to apply that to HMAC-SHA1, and so there are no known methods of attack (other than, as I mentioned just now, brute force, and guessing the tags randomly).
The Shattered breakthrough provided proof that the 'compute a collision in less time than expected' weakness is real; HMAC-SHA1 is still secure.
 
00:00 - 17:0017:00 - 00:00

« first day (2324 days earlier)      last day (2623 days later) »