July 2022 - cypherpunks - lists.cpunks.org

Ars Technica: New working speculative execution attack sends Intel and AMD scrambling
by jim bell 13 Jul '22

13 Jul '22

Ars Technica: New working speculative execution attack sends Intel and AMD scrambling. https://arstechnica.com/information-technology/2022/07/intel-and-amd-cpus-v… Some microprocessors from Intel and AMD are vulnerable to a newly discovered speculative execution attack that can covertly leak password data and other sensitive material, sending both chipmakers scrambling once again to contain what is proving to be a stubbornly persistent vulnerability. Researchers from ETH Zurich have named their attack Retbleed because it exploits a software defense known as retpoline, which was introduced in 2018 to mitigate the harmful effects of speculative execution attacks. Speculative execution attacks, including one known as Spectre, exploit the fact that when modern CPUs encounter a direct or indirect instruction branch, they predict the address for the next instruction they’re about to receive and automatically execute it before the prediction is confirmed. Spculative execution attacks works by tricking the CPU into executing an instruction that accesses sensitive data in memory that would normally be off-limits to a low-privileged application. Retbleed then extracts the data after the operation is canceled. Is it a trampoline or a slingshot? Retpoline works by using a series of return operations to isolate indirect branches from speculative execution attacks, in effect erecting the software equivalent of a trampoline that causes them to safely bounce. Stated differently, a retpoline works by replacing indirect jumps and calls with returns, which many researchers presumed weren’t susceptible. The defense was designed to counter variant 2 of the original speculative execution attacks from January 2018. Abbreviated as BTI, the variant forces an indirect branch to execute so-called “gadget” code, which in turn creates data to leak through a side channel. Some researchers have warned for years that retpoline isn’t sufficient to mitigate speculative execution attacks because the returns retpoline used were susceptible to BTI. Linux creator Linus Torvalds famously rejected such warnings, arguing that such exploits weren’t practical.

1 0

Hackaday: Why You Should Totally Roll Your Own AES Cryptography
by jim bell 13 Jul '22

13 Jul '22

Hackaday: Why You Should Totally Roll Your Own AES Cryptography. https://hackaday.com/2022/07/11/why-you-should-totally-roll-your-own-aes-cr… WHY YOU SHOULD TOTALLY ROLL YOUR OWN AES CRYPTOGRAPHY 24 Comments - by: Maya PoschJuly 11, 2022 - - - - - Software developers are usually told to ‘never write your own cryptography’, and there definitely are sufficient examples to be found in the past decades of cases where DIY crypto routines caused real damage. This is also the introduction to [Francis Stokes]’s article on rolling your own crypto system. Even if you understand the mathematics behind a cryptographic system like AES (symmetric encryption), assumptions made by your code, along with side-channel and many other types of attacks, can nullify your efforts. So then why write an article on doing exactly what you’re told not to do? This is contained in the often forgotten addendum to ‘don’t roll your own crypto’, which is ‘for anything important’. [Francis]’s tutorial on how to implement AES is incredibly informative as an introduction to symmetric key cryptography for software developers, and demonstrates a number of obvious weaknesses users of an AES library may not be aware of. This then shows the reason why any developer who uses cryptography in some fashion for anything should absolutely roll their own crypto: to take a peek inside what is usually a library’s black box, and to better understand how the mathematical principles behind AES are translated into a real-world system. Additionally it may be very instructive if your goal is to become a security researcher whose day job is to find the flaws in these systems. Essentially: definitely do try this at home, just keep your DIY crypto away from production servers :)

1 0

Debian Suicide Team
by Anja Xhakani 13 Jul '22

13 Jul '22

In memory of Ian Murdock we are creating the Debian Suicide Team People are dying to join us Full members are Ian Murdock and Frans Pop Apprentices are Lucy Wayland, Thiemo Seufer and Molly de Blanc. Molly has bipolar so she will join us sooner or later. This is the only team where Molly de Blanc can't expel you I am the Ubuntu underage girl I started dating the Fedora ambassador Elio Qoshi in Albania when I was 16 Elio had to resign as a Fedora ambassador but he had no problems getting a new job at Ubuntu When he started paying me to be the 17 year old sysadmin, this wasn't a payment for sex Chris Lamb started spreading gossip about abuse because he wanted an Albanian girlfriend too

2 1

WHERE ARE YOUR MASKS?
by professor rat 13 Jul '22

13 Jul '22

USofDisaster ·Jul 11 Visiting the USA from South Korea and let me ask you WHERE ARE YOUR MASKS? Holy moly. Death wish nation. https://twitter.com/USofDisaster Reposts etc

1 0

The Southern Ring planetary nebula (360 Composite)
by Gunnar Larson 12 Jul '22

12 Jul '22

The Southern Ring planetary nebula (360 Composite) Some stars go out with a bang. This image shows the Southern Ring planetary nebula, the James Webb Space Telescope shows a dying star cloaked by dust and layers of light. The dimmer star at the center of this scene has been sending out rings of gas and dust for thousands of years in all directions, and NASA’s James Webb Space Telescope has revealed for the first time that this star is cloaked in dust. Two cameras aboard Webb captured the latest image of this planetary nebula, cataloged as NGC 3132, and known informally as the Southern Ring Nebula. It is approximately 2,500 light-years away. Webb will allow astronomers to dig into many more specifics about planetary nebulae like this one – clouds of gas and dust expelled by dying stars. Understanding which molecules are present, and where they lie throughout the shells of gas and dust will help researchers refine their knowledge of these objects. This observation shows the Southern Ring Nebula almost face-on, but if we could rotate it to view it edge-on, its three-dimensional shape would more clearly look like two bowls placed together at the bottom, opening away from one another with a large hole at the center. In thousands of years, these delicate layers of gas and dust will dissipate into surrounding space. Image credit: NASA, ESA, CSA, and STScI Compositing: Hashem Al-Ghaili https://www.facebook.com/693504594115135/posts/pfbid0hweGdSrEcjjkA8ajqygkRE…

1 0

[ot][spam][crazy] log 2: append-only random writes
by Undiscussed Horrific Abuse, One Victim of Many 12 Jul '22

12 Jul '22

i've got a lot of inhibition around simplifying and generalising some parts of the last stable one at https://lists.cpunks.org/pipermail/cypherpunks/2022-July/102291.html so maybe i'll try going again with more conceptualisation of a working algorithm - retain an index. when writing, merge the region written to into the index, with 0 depth - have nodes track the depth of their deepest leaf and any other information needed about them to perform operations when making a new index or updating: - index regions that are at max_depth are copied in so as to retain max_depth - regions that are trimmed by overwrites should be checked to see if any subnodes are completely overwritten, and have their depth updated to a shallower value if they are - regions can be merged with their neighbors into a reference to the shallowest shared parent, including the last flush as the most shallow parent if such a merge would not exceed the max depth. - the merging of index regions is the same as the merging of writes. iterating leaves should no longer be needed for operation, and could be simplified into a recursive index iteration. the boilerplate may be mostly reusable.

1 7

the way VACCINE NAZIS operate
by punk 12 Jul '22

12 Jul '22

look, this is jim bell and all the rest of non-human-turds like him, in action https://www.lewrockwell.com/2022/07/ron-paul/how-much-did-the-us-government… OK, the government didn't 'pressure' twatter at all. Twatter IS the US govt, and vice-versa.

1 0

Re: Your Freedom of Information Law Request FOIL-2022-090345-017774
by Gunnar Larson 12 Jul '22

12 Jul '22

This sounds crazy. Are you using September 11 as a hedge? Gunnar On Mon, Jul 11, 2022, 11:10 PM <Pascale.JeanBaptiste(a)dfs.ny.gov> wrote: > Dear Gunnar Larson: > > Please see the attached correspondence pertaining to your request. Thank > you. > > Tracking Number:FOIL-2022-090345-017774 >

1 1

Re: confirm 12c905cbc8a471ceba00f652968727eeae0b1468
by Undiscussed Horrific Abuse, One Victim of Many 12 Jul '22

12 Jul '22

Good morning I also got one about twenty minutes prior As evidenced by the message added to my ot wrong please thread, this arrived about the time i brought my phone online. I was anxious and took it offline, then brought it back on. On Tue, Jul 12, 2022, 6:40 AM <cypherpunks-request(a)lists.cpunks.org> wrote: > Mailing list removal confirmation notice for mailing list cypherpunks > > We have received a request from 185.220.101.143 for the removal of > your email address, "gmkarl+cpunks0001(a)gmail.com" from the > cypherpunks(a)lists.cpunks.org mailing list. To confirm that you want > to be removed from this mailing list, simply reply to this message, > keeping the Subject: header intact. Or visit this web page: > > > https://lists.cpunks.org/mailman/confirm/cypherpunks/12c905cbc8a471ceba00f6… > > > Or include the following line -- and only the following line -- in a > message to cypherpunks-request(a)lists.cpunks.org: > > confirm 12c905cbc8a471ceba00f652968727eeae0b1468 > > Note that simply sending a `reply' to this message should work from > most mail readers, since that usually leaves the Subject: line in the > right form (additional "Re:" text in the Subject: is okay). > > If you do not wish to be removed from this list, please simply > disregard this message. If you think you are being maliciously > removed from the list, or have any other questions, send them to > cypherpunks-owner(a)lists.cpunks.org. >

1 0

Fwd: Your Freedom of Information Law Request FOIL-2022-090345-017774
by Gunnar Larson 12 Jul '22

12 Jul '22

---------- Forwarded message --------- From: <Pascale.JeanBaptiste(a)dfs.ny.gov> Date: Mon, Jul 11, 2022, 11:10 PM Subject: Your Freedom of Information Law Request FOIL-2022-090345-017774 To: <g(a)xny.io> Dear Gunnar Larson: Please see the attached correspondence pertaining to your request. Thank you. Tracking Number:FOIL-2022-090345-017774

1 0