« first day (2548 days earlier)      last day (2625 days later) » 

01:22
Rhubarb. Should not have started this cryptopals thing.
 
2 hours later…
03:09
Cbg
03:25
cbg
is this the correct way of compiling the regex for matching strings ending with /: re.compile('\\/$') ?
03:41
I have also tried re.compile('/\/$/')...
 
4 hours later…
07:25
@deostroll does re.compile('/$') not work?
Also raw strings are useful when working with backslash-ridden regexen
I'm on mobile so I can't check, but make sure you're not missing re.match vs re.search etc
One of those only matches the beginning of strings
Also in native python there's .endswith('/') if you just want to match
@deostroll re.compile('/$') is 100% the correct regex for "ends with a slash". If it doesn't work, you're using it wrong.
heyy I am a little confused with multithreading in python. If all threads use same function, are the data structure in the function common to all threads
like i do below
for ch in approved_channel_list:
            #print "Channel is " + ch
            toBeProcessed.append((key, date, Execute, ch, interface))
    pool = Pool(cores)
    pool.map(process, toBeProcessed)
    pool.terminate()
    print "Processing done"
My preocess code looks like below
def process(keydata):
    global SendEmail
    processed = True
    #SECTION = {}
    (key, date, Execute, ch, interface2) = keydata
    interface = interface2 #did this so that each thread has different interface
    print "Processing for key: "+key
    #SECTION = readConfig(processorConfigFile, date)
    if ch.strip():
                writeLog("Channel :"+ch)
                for field in interface2:
                        interface[field] = interface2[field].replace("%CH%",ch)
I found that interface (which is a dict) gets updated weirdly ...
07:49
@AndrasDeak that's "raw string literals" for you, mister!
@pythonRcpp That looks like multiprocessing code, not multithreading.
08:26
@davidism @AndrasDeak @Kevin @IljaEverilä seems that the pkcs7 description is wrong. stackoverflow.com/questions/7447242/…
> Yes, you are missing a point. If the data length is a full multiple of the block length (i.e. a multiple of 16 bytes for AES), the padding will append an additional full block (of 0x10 or 16) instead of nothing.
09:07
cbg
in cython at least if you list slice way out of range you get an empty list. e.g. [1,2][100:1001] >> []
is this a python thing or a cython implementation thing
@Rawing yeah yeah yeah. Chars are a precious resource on mobile :P
@AnttiHaapala not there yet
the 16 can be made harder:
make it utf8 :D
Cabbage
For 1.3 I simply tested that the result was ASCII, and to score it I used ` frequent = set(' etaoinshrdlu')` ... score = sum(1 for u in plain if u in frequent)
My ASCII test was primitive: all(32 <= b < 127 for b in s). I had to adjust that for 1.4 to asciibytes = frozenset(b'\t\n\r' + bytes(range(32, 127))) ... asciibytes.issuperset(s)
09:26
@PM2Ring ^this requires a bit more thought if the following constraints are taken into account:
a) the string is decoded as UTF-8. b) all fields must be still present...
even more so if 'ascii' :D
@AnttiHaapala Thanks for the tip. I still haven't started on 1.6, I got a bit distracted...
I noticed people here mentioning AES-ECB, and some people said they were having problems with the Python crypto libraries. So I decided to write some ctypes code to access AES stuff from the OpenSSL library. I figured it couldn't be too hard, since I've done that before with SHA-256 (in order to make a resumable hashing function). But I had a little misunderstanding, and it took longer than I expected. :)
@PM2Ring no, I had problems spelling ECB
install pycrypto; from Crypto.Cipher import AES; AES.new(key, AES.MODE_ECB)
it is so hard to spell ECB after CBC...
09:43
I also used my ECB stuff to implement a simple CFB-8. I assume it'd be faster to use the one in the OpenSSL library, but where's the fun in that? ;)
09:58
@Rawing yes
@Erich That's a plain Python thing. I agree that it can be a little puzzling at first, but it (usually) makes life easier when doing stuff with slicing, since it means you often don't need to add tests to handle out of range indices. There are several good SO posts on this topic.
10:40
17 solved :)
@PM2Ring I can't understand why so many things use CBC
for example openssl
openssl doesn't really make any sense to use cbc
@AnttiHaapala I guess CBC is the traditional alternative that's better than ECB. But it seems dumb to use it these days when you can get better security with virtually the same amount of computation.
And CBC is useless if you need error recovery.
2
Q: Why do the majority of SSL cipher suite used CBC?

MinajI am looking at a wireshark capture of the cipher suites sent by my browser to the server during an SSL handshake; however, almost 90% of them use CBC, with 2 or 3 having GCM. Why is CBC most used? Is there a specific property that makes CBC preferred by web communications? Also literature sug...

here
@PM2Ring cbc "can" recover from errors which mean "delete a part of file"
but you cannot delete a part of socket stream.
you can mutate bits, so CTR would work alike there.
11:01
Yeah, ok. I guess CBC's behaviour is ok in some contexts, but as you say, it's not so good for streams. Wiki says: "a one-bit change to the ciphertext causes complete corruption of the corresponding block of plaintext, and inverts the corresponding bit in the following block of plaintext, but the rest of the blocks remain intact".
11:25
I cheated for the MT19937 - there is Python source code for that in wikipedia
11:52
@H.鄭 too recent, please see the room rules
@AnttiHaapala I used the cryptography package :-P
I'm stuck on 2.10, CBC decryption, right now.
Not sure if their instuctions are vague / misleading or I'm just missing something.
you're supposed to take the ECB, and read the CBC description on wikipedia
while there's not much point in making the AES ECB in itself, implementing CBC makes sense because it allows you to easily see how to attack it
12:09
Currently, I interpreted the rules as "for each input chunk, ecb encrypt it then xor it with the previous processed chunk."
exactly.
though.. not
you're decrypting
It says "taking the ECB function you wrote earlier, making it encrypt instead of decrypt"
I tried decrypt though, and only the first chunk worked.
just forget the text entirely and look at this picture:
this is what you need to do for cbc decryption, each box is ecb decrypt
but in the very next step you need cbc encrypt too
@davidism it is the ciphertext, not the plaintext that you need to xor with the output from the block cipher decryption
Oh, I think I know what I'm missing... ^
Yeah, it's the original block not the processed block.
Yep, just had to swap two lines.
12:26
reversing mt19937 is ... bwaah
I found a code to reverse in another language... even porting it to python is painful
12:51
23 completed phwe.
 
1 hour later…
14:01
No offence, but I do sometimes wonder if some of you actually do any "work" related work. :-p
I'm sure it's all about the time zones
that reminds me: I should be looking at 1.7
@AndrasDeak yeah, forget that a lot. I usually come here during my office hours -_-
14:47
1.6 wasn't too bad. The final stage was straight-forward: my heuristics from 1.4 worked ok. For the middle section my core logic is:
def mean_distance(blocksize, numblocks):
    blocks = [int.from_bytes(data[i:i+blocksize], 'big')
        for i in range(0, numblocks * blocksize, blocksize)]
    score = sum(popcount(u ^ v)
        for u, v in combinations(blocks, 2))
    numpairs = numblocks * (numblocks - 1) // 2
    return score / numpairs

counts = Counter()
for numblocks in range(2, 16):
    a = []
    for keysize in range(2, 40):
        d = mean_distance(keysize, numblocks) / keysize
            a.append((d, keysize))
    a.sort()
@PM2Ring I did cross product of all blocks, and the numbers are pretty clear!
Yes, I saw you talking about that. And so I decided to restrict the range a little and see if any clear patterns emerge. Which they did. :) My code could be written more efficiently, but it's not so bad: the whole thing runs in just under 0.9 seconds on this old 2GHz machine.
I could reduce those loop parameters to numblocks in range(2, 5) and keysize in range(2, 30), but it only saves about 0.04 seconds, and it's kinda cheating once you know what the key length needs to be. :)
15:16
I guess I should quote Kevin here: "Rule of thumb: problems that take place in the code are more well-received on Stack Overflow, compared to problems that take place in the asker's mind" — Antti Haapala 9 secs ago
@Kevin :^
Different language. Magic crystal balls work better with C.
16:09
@AnttiHaapala Hmmm. They make some good points, but I wonder how good their expertise is. They said: "And they found that many of the answers endorsed by the Stack Overflow community led to insecure code. For example, accepted answers often recommended the use of MD5 and SHA-1 crypto algorithms – despite the fact that they're insecure and should not be used".
True, both MD5 and SHA1 are less secure than originally thought & are weaker than more modern crypto hashes that use larger bit sizes. But they are only insecure in certain situations. For stuff like HMAC they're still perfectly secure, although it's certainly a good idea to use a bigger hash if you're writing for a new system.
18
Q: Is HMAC-MD5 considered secure for authenticating encrypted data?

NuojiI've read something to the effect that the HMAC construct is able to lessen the problem of collisions in the underlying hash. Does that mean that something like HMAC-MD5 still might be considered safe for authenticating encrypted data?

And of course if you're using them in a password generation scheme you might as well use a bigger hash: not just for the extra security of the larger bit length, but also because they're slower to compute.
"This means that any collision in H((K xor ipad) || m) will result in a colliding HMAC, even with two different messages."
Yes, I've seen that page before. I'm not saying that MD5 / SHA1 HMAC will always be secure, but they currently are. Sure, any day now someone may discover an attack. And any day now, someone may figure out a fast way of factorizing that breaks RSA... ;)
but then we don't even know if it was for hmac
I know i know... let's read the paper :D
16:17
hi guys, whatsup
"4.3.3 Password Hashing. We found six posts related to hash-
ing passwords with MD5 or SHA-1 to store the user credentials
in a database. However, these hashing functions were found in-
secure [99, 100]."
"The asker even shared a completely wrong understanding
of secure hashing: “The security of hash algorithms really is MD5
(strongest) > SHA-1 > SHA-256 > SHA-512 (weakest)"
@AnttiHaapala What the actual yam?!
Finding 10: Three of six hashing-relevant posts accepted
vulnerable solutions as correct answers, indicating that de-
velopers were unaware of the best practice of secure pro-
gramming. Their wrong knowledge or practice can propagate
among StackOverflow users and negatively influence people.
Hi Harvey. We're having fun breaking the first rule of crypto: Don't roll your own crypto. :D
:D
@PM2Ring python docs don't mention that MD5 and SHA1 are both b0rken
16:30
@AnttiHaapala Good point. Although the HMAC docs say "Deprecated since version 3.4: MD5 as implicit default digest for digestmod is deprecated." docs.python.org/3/library/hmac.html#hmac.new
it is as Schneier said: things are getting worse, not better, so Idk why the docs couldn't mention that..
also the default arg is really doubly b0rken as in there
> Internet traffic is often compressed to save bandwidth. Until recently, this included HTTPS headers, and it still includes the contents of responses.
interesting!
Can someone see what I'm not seeing and tell me why this code isn't exiting the while loop when 1 or 0 is entered:
run_mode = 'Default'
while run_mode == 'Default':
    print('Please select mode:\n'
          'Enter 0 for Quick mode, or 1 for Full Mode')
    run_mode_selection = input('Mode: ')
    if run_mode_selection is False:
        run_mode = False
    if run_mode_selection is True:
        run_mode = True
python 2 or 3?
16:34
@toonarmycaptain in Python 3 input returns a string, which is neither true nor false.
in python 3 you're reading a string
also if it were bool, you should just use if run_mode_selection: ... else: ...
also it's not nice to first define run_mode to be a string then overwriting it with a bool
also, you ask for 1 or 0, so they'd be strings "1" or "0"
don't reinvent the wheel
Ah. Fair enough. Figured I could escape a try/except.
@toonarmycaptain See the last section here in PEP-0008
if some_condition is True: isn't quite as bad as if a is 1:, but it's close. ;)
I was trying to avoid if .. == 1, that's all. I'll use try/except
16:43
@PM2Ring True is a singleton and therefore preferred that way; of course it doesn't work here though
So I see if...if not would be better than is True/False
Is this better:
while True:
    try:
        print('Please select mode:\n'
              'Enter 0 for Quick mode, or 1 for Full Mode')
        run_mode_selection = input('Mode: ')
        if int(run_mode_selection) == 0:
            run_mode = False
            break
        if int(run_mode_selection) == 1:
            run_mode = True
            break
    except ValueError:
        continue
17:00
The script I'm modifying is one that downloads every xkcd comic. I'd already set it up to skip downloading if the image is previously downloaded. I'm setting it up with two modes, where it trys every comic, and a new one where it stops when it encounters an already downloaded comic.
This way it doesn't take half an hour to run every time.
...and after deleting the last 3 comics...it worked in 2.13 seconds...I'm actually pretty chuffed that it worked first time.
17:11
@toonarmycaptain Ah, ok. Have you looked at the relevant thread in the xkcd Coding forum? You'll see some of my old code in there. I hope you're using the JSON feed & not directly scraping the main comic page...
@PM2Ring I am scraping the main page...that's what Automate used, with bs4/requests.
17:23
@toonarmycaptain Please don't do that. Using the JSON puts less strain on the server, and it's heaps easier. And you get extra goodies, like the transcript. And IIRC, it has less problems dealing with the weird comics like "Time".
Well the JSON info will be useful when I tackle grabbing the alt-text as well. There used to be way to have the alt-text appear in an image file's properties, I thought?
Oh so you can use the JSON for the next comic, get the title and then use the title to download directly, rather than downloading the whole page? That's useful.
@toonarmycaptain As for that code, this isn't exactly equivalent, but it's close. And much more compact. And IMHO, more readable:
run_mode = run_mode_selection == '1'
Can you do a = b == '1'?
@toonarmycaptain Sure!
If you need identical functionality to your code, you can do this, but I prefer my simpler version.
while True:
    print('Please select mode:\n'
        'Enter 0 for Quick mode, or 1 for Full Mode')
    run_mode_selection = input('Mode: ')
    if run_mode_selection in '01':
        run_mode = run_mode_selection == '1'
        break
@PM2Ring I don't get how that's working in that while loop...
All I'm doing is putting a check for run_mode later, when it comes to an image name that already exists, and if we're in quick mode, breaking out of the loop.
This is what I've got so far:
I'll rbrb I gotta put my kids down for a nap, thanks @PM2Ring, do you mind if I pick your brain another time?
17:43
@toonarmycaptain Sorry. I was suggesting you get rid of the while loop and replace it with this:
print('Please select mode:\n'
    'Enter 0 for Quick mode, or 1 for Full Mode')
run_mode = run_mode_selection == '1'
So if the user enters 1 they get Full mode, anything else gives them Quick mode.
Or you can reverse the logic and make Full mode the default:
print('Please select mode:\n'
    'Enter 0 for Quick mode, or 1 for Full Mode')
run_mode = run_mode_selection != '0'
18:39
seriously, I don't want to debate this user who wanted to answer low quality questions
I've always got capacity for that :P If the question is around after our movie, I can start :D
Get to 20k already so you can skip the delv wait.
OK, I should go to the Python meetup and work on Cryptopals instead of worrying about this.
18:55
nah, I'm sure fending off no-effort noobs is more fulfilling
19:21
You ask about VM placement and such and do not even care to address arrays starting from index 0! There's no helping you. — Antti Haapala 10 secs ago
<3
@AnttiHaapala That reminds me of one of my favourite xkcds:
:D
which date is it?
Oh, 8803rd of September.
probably in vain: but othere Dutch people alive here?
19:38
@AnttiHaapala From xkcd.com/163/info.0.json it's 27 Sept 2006
@PM2Ring I mean today :D
@paul23 Occasionally, but not right now.
@paul23 no, you're alone.
@AnttiHaapala Oh, right. :)
forever
19:39
@paul23 well, there's this one robot, I wouldn't go as far as to classify it alive...
19:51
Well no point littering here about a signature needed for a referendum about internet privacy that popped up once again in the netherlands.
Seems like our government keeps wishing to abolish privacy. Each 3-4 years there's another "new" idea to give the secret services here more power to wiretap mass data. And each time a referendum conclusively decides this is unwanted.
Yet it keeps coming back.
 
2 hours later…
22:10
In today's edition of "Surely They Can't Be Serious": Converting a .wav file to .mp3
@PM2Ring how about the renaming answer?
problem solved *wipes hands*
That renaming answer, really?
Haha, amazing.
I really want to know how they tried it and it worked.
they wrote it right there: the audio player still plays it
this is where using windows will lead to
Oh of course, it doesn't care about the extension.
22:18
Many music players support multiple formats and pick the decoder based on the file metadata.
Just yesterday I failed to open a py file on my phone because the text editor refused on account of an "unknown file format". And the built-in file browser doesn't let me change the extension, because why would you ever want to do that?
But not all music players support WAV..
I love the The compression isn't really the important part comment by the OP.
Uhm, hate to break it to you, but the whole point of MP3 is the compression algorithm.
no, the point of mp3 is that it takes up less space, why do you have to be so confused?
Sure, removing every second byte is a lossy compression algorithm too. If only an MP3 player would actually grasp that!
if only there was a way to get rid of the unnecessary bytes
22:22
Ah, I see the issue, they didn't throw enough bytes out! Quoting Wikipedia:
> It uses a form of lossy data compression to encode data using inexact approximations and partial data discarding to reduce file sizes, typically by a factor of 10
Replace the 2 in the range with 10, problem solved!
python makes that easy

« first day (2548 days earlier)      last day (2625 days later) »