231–240 of 267 posts
Senator Robert F. Kennedy, June 6 1966 (South Africa address)
Earlier quoted context omitted.
Some feedback: * don't use md5 as a security feature! I suggest to replace the use of md5sum with sha256sum (not even sha1sum is really safe anymore). The only use of seeing md5 in security contexts is to indicate that the person recommending its use doesn't understand security, which may admittedly be a worthwhile feature in itself. Perhaps you're really saying "this is one of the weak links in our security chain, t…
Good points. Thanks. I used md5sum mainly because it was given on the original sites from which software was downloaded, but if sha256sum is more unique then I'll use that instead. Although there are some systems where I'm familiar with the code - such as Bitmessage - in most cases I havn't personally checked the code myself. Ideally Freedombone would be a pure blend (I think that's also the aim of FreedomBox), but f…
That makes it sound like you're thinking that the chances for a conflict (same hash value) depend just on the size of the hash value. But it's worse than that, thanks to algorithmic insights, inputs that produce the same hash value can be found more cheaply than just by chance. Also, they can be found so cheaply that it's computationally trivial to do even for an individual [1]. Thus anyone who can change what data you receive, can trivially also make it hash to the same MD5. (I haven't checked whether publicly available software exists to generate conflicting files that are also, for example, valid gzip files, but I surely expect that an entity like the NSA (and perhaps blackhats, too) can create such software on their own.)
[1] "produce a collision for two inputs with specified prefixes within hours, using off-the-shelf computing hardware": https://en.wikipedia.org/wiki/Md5#Security
Yes, there are many sites that still tell users to check MD5 hashes. I think it's evident that those are totally worthless for some years now. Worse, it may be giving some people a false sense of security. OTOH those places might give those who do know a hint that perhaps the authors or distributors don't know about security. (Sorry for the harsh words...)
Earlier quoted context omitted.
Some feedback: * don't use md5 as a security feature! I suggest to replace the use of md5sum with sha256sum (not even sha1sum is really safe anymore). The only use of seeing md5 in security contexts is to indicate that the person recommending its use doesn't understand security, which may admittedly be a worthwhile feature in itself. Perhaps you're really saying "this is one of the weak links in our security chain, t…
Good points. Thanks. I used md5sum mainly because it was given on the original sites from which software was downloaded, but if sha256sum is more unique then I'll use that instead. Although there are some systems where I'm familiar with the code - such as Bitmessage - in most cases I havn't personally checked the code myself. Ideally Freedombone would be a pure blend (I think that's also the aim of FreedomBox), but f…
That is indeed a limitation. I'd suggest you explain what md5sum is, how to use it, and what its limitations are -- specifically that collisions are now trivial to instrument.
Developers / vendors still relying on md5sum really should be named and shamed these days.
Earlier quoted context omitted.
You're not following, but that's expected. It's not exactly difficult to see reasons for why governments should not exist. They're all around you, and there are countless of them. As a very simple example, why are laws like SOPA and CISPA passed in secret, unless there's a massive uprising against them? Obviously, they're passed in secret, or stealthily, or all of a sudden - they're just rammed through exactly becaus…
Yeah, having roads and running water are just awful. Schools, sanitation, energy, parks, rights for minorities and laborers. I just HATE that stuff.
Earlier quoted context omitted.
I'm actually curious how long it takes before Google adds it to their frontpage :)
They seem to be celebrating "Safer Internet Day"
Might just as well play flappy bird instead, it will do about as much good.