Why would I need to install go to run this tool? I thought one advantage of go was that devs could just distribute a single binary file that works...
The docker container is now ready to use and documented on the home page
Entropy, a CLI that scans files to find high entropy lines (might be secrets)
91–100 of 141 posts
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#92Earlier quoted context omitted.
I'd love to have it on homebrew but my PR is denied so I'll have to create my own brew tap or convince them to accept it. I'll also create a docker image. I just didn't expect this much popularity so the repo isn't 100% ready te be honest
Making a tap is super easy, you just upload a file with 5 LoC to github. I wouldn’t even bother with brew core.
Oh ok I'll try then
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#93Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#94Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#95Why would I need to install go to run this tool? I thought one advantage of go was that devs could just distribute a single binary file that works...
The docker container is now ready to use and documented on the home page
Just awaiting the Kubernetes setup/Helm charts now and soon almost anyone can use it!
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#96Earlier quoted context omitted.
Entropy is a measure of complexity or disorder of a signal. The interesting part is that the disorder is with respect to the proper basis or dictionary. Something can look complex in one encoding but be low entropy in the right encoding. You need to know the right basis, or figure it out from the context, to accurately determine the entropy of a signal. A much stronger way of building a tool like the OP is to have a…
bookmarking to think about later... does this hold for representing numbers as one base compared to another? Regarding a prime as having higher entropy / less structure than say a perfect square or highly divisible number a prime is a prime in any base, but the number of divisors will differ in non-primes, if the number is divisible by the base then it may appear to have more structure (smaller function necessary to…
Also bookmarking to think about it.
My mind drifted towards Fourier transform. Using the transform as a way of describing a system with less entropy?
Or am I butchering all of mathematics by making this comparison?
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#97I guess a language model like Llama 3 could model surprise on a token-by-token basis and detect the areas that are most surprising, i.e. highest entropy. Because as one example mentioned, the entire alphabet may have high entropy in some regards, but it should be very unsurprising to a code-aware language model that in a codebase you have the Base62 alphabet as a constant.
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#98Earlier quoted context omitted.
> If you make it do double duty as a poor-man's encryption, you are going to have a bad time. For the serious use cases you evidently have in mind, yes, it's folly to have it do double duty, but at the end of the day steganography is an obfuscation technique orthogonal to encryption, so the question of whether to use encryption or not is a nuanced one. Anyhow, I don't think it's fair to characterize this elaborate st…
> Anyhow, I don't think it's fair to characterize this elaborate steganography tech as a poor-man's encryption — LLM tokens are expensive! I guess it's a "rich fool's encryption".
Haha, sure, you can call it that if you want, but foolish is cousin to fun, so one application of this tech would be as a comically overwrought way of communicating subtext to an adversary who may not be able to read between the lines otherwise. Imagine using all this highly sophisticated and expensive technology just to write "you're an asshole" to some armchair intelligence analyst who spent their afternoon and monthly token quota decoding your secret message.
Seed for the message above is 42 by the way.
(Just kidding!)
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#99Earlier quoted context omitted.
If you're trying to improve the security of your product by running random binaries from the Internet you're going to have a bad time
That's how most people run compilers
Wait ... you download random compilers from the internet? Or are you asserting equivalence between getting go from Google or Xcode from Apple and an random home brew install?
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#100Earlier quoted context omitted.
4 diceware words is hardly a good password. It's ~51 bits of entropy, about the same as 8 random ascii symbols. It could be trivially cracked in less than an hour. Your average variable name assigned to the result of an object name with a method name called with a couple parameter names has much more entropy.
If you can crack a single 52bit password in an hour, that's suggesting you can crack a 40bit password every second. That's 1 trillion hashes per second.
350B H/s was achieved in 2012 on consumer hardware. That's over 12 years ago, and several lifetimes of GPU improvements ago. 4
diceware words is simply not appropriate for anything remotely confidential, and it is bad for the community to pretend otherwise.