321–330 of 576 posts
Earlier quoted context omitted.
> sha1's weakness would require you to be the creator of the torrent Huh, why?
because you can create two hashes that match, but you cannot create a hash that matches an arbitrary hash you do not control. That is a much more serious weakness called a "second pre-image attack"
Earlier quoted context omitted.
Well in New Zealand we used to charge-per-byte but as things got cheaper this has largely gone away. Some of the cheaper how fibre accounts have something like a 100G/month limit but I guess it isn't worth the trouble to charge even here where bandwidth is much more expensive than the US.
Flashback: I was on Actrix which charged $5 per megabyte. Downloading Netscape Navigator 2 nearly bankrupted me. I used to browse the internet with images disabled, which ironically gave me an appreciation for accessibility issues which served me well later in life. When Xtra came out at $2.50 per hour, it was a complete game changer.
It changed our internet browsing habits so much. With hourly charges, you would try to plan out what you would do before connecting and instead of reading webpages, you would save them to disk for reading later.
With unlimited, you could just sit there and browse. Or leave it on overnight to download files.
At some point we got a second phoneline and I was downloading torrents on dialup all day and night for years before we finally moved somewhere with ADSL in 2006.
Earlier quoted context omitted.
I'm not an expert here, but I'm thinking about it like this: Creating a SHA-1 collision is doable, but it's still hard. If you want to serve someone a malicious piece of data, that's already one hash of the two colliding hashes that you've used up. Now you have to create harmless or "benevolent" data that collides with the hash of your malicious data so that you can create a positive reputation for your file from use…
It sounds like the perfect scenario for movie companies to target pirates.
Earlier quoted context omitted.
It's simple: it is an abject failure as a currency. It is fairly successful as a security for the purpose of speculation. If you aren't a financial speculator, you really don't need to pay attention to it.
It's also fairly successful as a way to transfer money.
Earlier quoted context omitted.
because you can create two hashes that match, but you cannot create a hash that matches an arbitrary hash you do not control. That is a much more serious weakness called a "second pre-image attack"
So, as I understand, that's expected to happen in foreseeable future. Otherwise, why switch from SHA1 if you can't create a collision with unaltered data?
This class of attacks is MUCH harder to construct against a cryptographic hash.
Earlier quoted context omitted.
Only if blocks have the same offset in the same binary and if they align with the block boundaries. Otherwise, different hashes would be generated. I don't expect that to happen a lot.
Well if files in an ISO are aligned to some boundary it would help a lot, similar to how filesystems on disk have a sector size, where all files begin at the start of a sector. However, I don't know if this is true in ISO9660 or any of its extensions.
also need to watch out for compression
> not only uses a hash tree, but it forms a hash tree for every file in the torrent [...] > Files that are identical can also more easily be identified across different swarms, since their root hash only depends on the content of the file. Wait, content addressed blobs across swarms... does that mean torrents made by completely different people at different times that happen to contain one or more identical files can…
Yes. It also makes your files more discoverable for copyright trolls. They will be able to fully automate the process of sending takedown notices for each copy of zlib's README.txt, that was "stolen" from their software by evil pirates.
Earlier quoted context omitted.
This is exactly the problem with all cryptocurrency currently. It’s a massive user experience issue, in the sense that users have to experience the technical bullshit of how the currencies work, completely missing the brilliant part of real money: it just works. I hand people money, they give me things. I swipe my credit card, I get things. I can’t remember who aid it originally, but there’s a great test you can give…
It has been a few years, and despite a few attempts, I still don't really understand bitcoin. Yes yes ledgers and proof of work and yada yada, but I still don't know what I would need to do to buy something with bitcoin right now. As I understand I need to do something that's pretty much exactly like opening a bank account, but transactions take forever, they cost money, and the currency is not accepted by any busine…
I saw Bitcoin project on GitHub's artic code vault[1] and advertised heavily. But I couldn't find libbitorrent on it besides it being hosted on GitHub as well. Is this because the project owner hasn't enabled it or is there some other reason behind it?
Earlier quoted context omitted.
Don't people always say exactly that? What are the chances of a collision if we simultaneously use multiple hashes, does it become significantly less likely?
> Don't people always say exactly that? No, "they" don't. SHA1 collisions had been "in the wind" for a while, they had been in sight ever since MD5 started showing signs of clear weakness in the early '00s. Wikipedia has a Rivest quote about it from 2005. There is nothing like that for SHA2, although attacks are improving. > What are the chances of a collision if we simultaneously use multiple hashes Define "simultan…