Mastodon Feed: Posts

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
kianga@tail.ooo ("Kianga 🔜 Purple Clouds") wrote:

You shall not pass! (Unless you have chicken nuggets?)

📍 Reußenstein Castle
📷 @bluish_gecko

#FursuitFriday #Fursuit

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
spud@is-hardly.online ("Spud") wrote:

@asonix fedyeem... Friday?

Boosted by cstanhope@social.coop ("The Luddites were right"):
fribbledom ("muesli") wrote:

Spent my childhood optimizing CONFIG.SYS and AUTOEXEC.BAT to fit everything into 640 KB.

Now one browser tab needs 2 GB of RAM so 17 analytics companies can find out I looked at socks.

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
lrhodes@merveilles.town ("⁂ L. Rhodes") wrote:

Oh, wow. I hadn't considered this angle: "There's also the risk that conversations between an attorney and client could become fair game in legal proceedings; a New York federal judge in February ordered a criminal defendant to provide prosecutors with documents he created for his lawyers because it already had been shared with a third party, which was Anthropic's Claude." https://www.fastcompany.com/91571498/ai-notetaker-work-meetings-privacy-data

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
bbiiirdbPhD ("Dr. bird 🌻 | Inspiring Change") wrote:

Even more excited to become a librarian now that I learned that Fox News called libraries, “drug infested, sex dungeons”.

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
NuclearOatmeal@beige.party ("Nuclear Oatmeal :paranoid:") wrote:

RE: https://mastodon.social/@bbiiirdbPhD/116895680972165118

Man, I went to the wrong libraries growing up

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

RE: https://furry.engineer/@soatok/116896318346322670

Oh, and this isn't even covering like... canonicalization attacks.

If you're encoding data in any way (this includes concatenating two or more input strings), you need your encoding scheme to be unambiguous and injective. Otherwise, attacks will occur.

See https://soatok.blog/2020/07/15/kerlissions-trivial-collisions-in-iotas-hash-function-kerl/

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
sophieschmieg@infosec.exchange ("Sophie Schmieg") wrote:

@soatok https://github.com/lamps-wg/draft-composite-sigs/issues/87

Excuse me, but it was "the empty string is a prefix of every string"

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
cliffle@hachyderm.io wrote:

@soatok oh man, remember how much of a pain it is when you come out and now you have to change all of your passwords to start with "gay?"

Thank goodness the kids these days have password managers.

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

(This isn't going to be a blog post. Fedi exclusive bits of info lol :D)

Anyway, the funniest spiels come from cryptographers who are frustrated at standards orgs.

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

RE: https://furry.engineer/@soatok/116896414813124167

(Also, I typed this on my phone lol)

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

Cryptography might be nightmare magic math that cares what color pen you use, but cryptography engineering is knowing what discipline to bring to the drawing board in the first place.

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

Whenever you hear about "domain separation", this is basically the intuition you need. It isn't always this straightforward, of course.

Boosted by brib@bribstodon.xyz ("brib :neofox_floof:​ :Nonbinary: -> EMF 2026"):
jollysea@chaos.social ("joël") wrote:

maybe today is a good day to remind you all of the existence of https://htck.github.io/bayeux/#!/
the bayeux tapestry (meme) generator

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

Let's try something a bit more impactful.

$user = $db->getUser(['username' => $request->username]);

$cookie = 'username=' . $request->username;

// put pw check here

if ($user->isAdmin()) {
   $cookie .= '&admin=1';
}

$cookieMac = hash_hmac('sha256', $hashInput, SECRET_KEY);
setcookie('login', $cookieMac . $cookie);

And let's assume there are no character restrictions on usernames during registration.

Can you see how to forge an &admin=1 cookie?

fribbledom ("muesli") wrote:

Paying 19 cents per text message was actually peak society. Every message was a meticulously edited, 160-character masterpiece where you weighed the financial cost of a vowel.

cul8r!

glyph ("Glyph") wrote:

RE: https://woof.group/@aphyr/116723922317737094

this thread is _amazing_

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

Why not? Because that's the same as the prefix of an empty string.

If you know the prefix and can choose the inputs based on how you interact with the protocol, you can choose an input that, synthetically, has that prefix.

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

What you want to do is choose unique prefixes (or whatever you do to separate inputs) for every distinct use case you have in your protocol.

The term for this is "domain separation".

What you DON'T want to do is prefix some values and then use a bare cryptographic function in other places.

For example, https://nebuchadnezzar-megolm.github.io/

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

If anyone is confused about why this is funny:

Imagine you have two password fields on two different forms

Form A uses a password hashing function (e.g., Argon2) on your password and stores a hash.

Form B is almost the same, but hashes the string "gay" followed by your password.

If you swap hashes, you only need to prepend "gay" to your usual password for it to succeed.

Okay, so what?

Now imagine you're building a protocol that uses hash functions for different purposes and you used H(m) and H("gay" + m) in two different places, and felt confident that swapping hashes would always fail.

Well.

Bad news lol

pzmyers@freethought.online ("pzmyers 🕷") wrote:

I was bored this week.

https://freethoughtblogs.com/pharyngula/2026/07/10/a-slow-week-at-the-movies/

https://www.youtube.com/watch?v=bZKHoSsKFLs

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

Vaguely incorrectly remembering the time when

@sophieschmieg : "The empty string is the prefix to all strings"

People doing domain separation wrong:

Boosted by glyph ("Glyph"):
pathunstrom@ngmx.com ("Piper Thunstrom") wrote:

I've had a fucking couple of days on llm bullshit.

A project that looked neat on Tuesday turned out to be an llm plagiarism. And the project owners know the look is bad: they squashed the entire project to a single commit.

A long article with citations, except one of the core parts of the topic? Cited an AI "fact-checker" and the article didn't exist anymore.

And today, reading an article that says "AI is of course good" before spending 3 paragraphs describing an existential risk created by the AI and stopped by an exiting engineer who was burning out.

Llm boosters don't even fucking hear themselves anymore. They're destroying their companies, but who cares because "velocity".

Boosted by brib@bribstodon.xyz ("brib :neofox_floof:​ :Nonbinary: -> EMF 2026"):
hecko@app.wafrn.net wrote:

[talking to a plural system] so are you dualbooting or is it more of a docker situation

Boosted by brib@bribstodon.xyz ("brib :neofox_floof:​ :Nonbinary: -> EMF 2026"):
Jgbird@mas.to ("Jerome G") wrote:

Started back up with learning to draw after a six year hiatus. Birds were maybe too advanced so this time I’m starting with flowers.

glyph ("Glyph") wrote:

glyph ("Glyph") wrote:

Really starting to think that maybe the best lack all conviction, while the worst are full of passionate intensity.

glyph ("Glyph") wrote:

So many people who share my views have decided the conflict isn't worth it and have quietly stepped back, transitioned into a different career, or decided to "act their wage" as the kids say, just do their job to keep the insurance, and completely stop existing in public.

glyph ("Glyph") wrote:

I have been struggling to do that work myself for a whole host of reasons, but at the same time as my personal capacity has been greatly diminished, the company within the community we've already built has been making increasingly strident demands that I cognitively self-mutilate in order to achieve some marginal, unquantified "productivity", and as much as I am trying to navigate that as best as I can… I dunno. Maybe we can't.

glyph ("Glyph") wrote:

one of the themes of my work in the last few years, and in particular my public speaking, has been that the building of a software commons, of "open source" if you like, is the work of building community.