• 23 Posts
  • 1.41K Comments
Joined 2 years ago
Cake day: June 20th, 2023
  • bamboo@lemmy.blahaj.zonetoProgrammer Humor@programming.dev•I wonder if this was made by AI or a shit programmerEnglish
    1·
    6 days ago

    Not really sure what you mean by reusing UUIDs but theres nothing bad about using UUIDs in URLs for content you don’t want scrapped by bots. Sites like Google Photos are already are using UUIDs in the URL for the photos, and do not require any authentication to see the image as long as you have the URL. You can try this for yourself and copy the URL of an image and open it in a Private Browsing Window. Every so often someone realizes the actual image URL is public and think they’ve found a serious issue, but the reason why it isn’t is because of the massive key space UUID provides and that it would be infeasible to check every possible URL, even if it’s publicly available.

  • bamboo@lemmy.blahaj.zonetoProgrammer Humor@programming.dev•I wonder if this was made by AI or a shit programmerEnglish
    6·
    7 days ago

    a computer powerful enough can guess all possibilities in a matter of minutes, and query them all against the db to discover all files stored within.

    Again, it would be computationally infeasible on any reasonable timescale of human existence. It’s no secret what every possible UUID would be, it’s the fact there are 5316911983139663491615228241121378303 of them and trying each one would be futile. They’re actually all on https://everyuuid.com/ to see for yourself.

    Just for shits, I encrypted a file with a password being a UUIDv4. Here’s the encrypted file as base64:

    YLIR6fL46HfRmueb1tZWiQUFQHYnZOKO9oujOzhvWYpfTtB5RnHtAvMgUgeIsffLC1wz7D17Vp0VT5YIJMb5pA==

    Here’s everything you would need to do to decrypt this file with a password:

    $ echo "YLIR6fL46HfRmueb1tZWiQUFQHYnZOKO9oujOzhvWYpfTtB5RnHtAvMgUgeIsffLC1wz7D17Vp0VT5YIJMb5pA==" | base64 -d > file.enc

$ openssl enc -aes-128-cbc -d -nosalt -in file.enc
enter AES-128-CBC decryption password:
u/01189998819991197253@infosec.pub can't brute force this

    The password to decrypt the file is a UUIDv4. See if you can try every UUID and figure out which one I used as the password.

  • bamboo@lemmy.blahaj.zonetoProgrammer Humor@programming.dev•I wonder if this was made by AI or a shit programmerEnglish
    10·
    7 days ago

    I’m not familiar with NSA’s Translator, so any info would be appreciated.

    I saw your other comment about DES, and it should be noted that DES was with a key length of 56 bits, and that was enforced precisely because the NSA could brute force it. It wasn’t even a secret they could brute force 56 bit encryption, and written into law. Back then, if you wanted to use more than 56 bit encryption in the United States, you had to provide a key escrow system to allow the government to decrypt the content if they needed to. Around the 2000s with the rise of e-commerce, they dropped the export restriction because it was doing more harm than good. No one wanted to use so few bits in the encryption keys, but it was illegal at the time to write software which did.

    A UUID’s 122 bits of randomness are exponentially more than the 56 bits DES offered. My original point being, all crypto is inherently brute forceable on an infinite timescale, but key length and implementation decisions are chosen to so that it would be computationally infeasible to brute force.

  • bamboo@lemmy.blahaj.zonetoProgrammer Humor@programming.dev•I wonder if this was made by AI or a shit programmerEnglish
    19·
    7 days ago

    By this logic, all crypto is bruteforcable, on a long enough timeline.

    A 122 bit random number is 5316911983139663491615228241121378303 possible values. Even if it were possible to check 1 trillion records per second, it would take 168598173000000000 years to check all the UUIDs and get the info on all the users. Even if every human on earth signed up for the app (~8 billion people), and you wanted to just find any one valid UUID, the odds of a generating a UUID and that being valid in their DB is basically 0. You can do the math your self following the Birthday Paradox to determine how many times you would need to guess UUIDs before the probability that any one UUID is valid against a population of the whole world is greater than 50%.

  • bamboo@lemmy.blahaj.zonetoTechnology@beehaw.org•Curl creator mulls nixing bug bounty awards to stop AI slopEnglish
    5·
    18 days ago

    Still this seems like a HackerOne problem, they’re acting as the middleman and I assume are taking part of the payout. What are they doing to earn the money they’re taking? The reason to go with HackerOne is to facilitate the interactions with people and pass the reports. It shouldn’t be a Curl maintainers responsibility to spot obvious AI slop. Maybe this is just the tier they’re on with HackerOne, but considering this is HackerOne’s business model, I would imagine that if huge companies are also dealing with this, then HackerOne will loose a lot of clients.

    Ninja Edit: Obviously the problem is the people creating AI Slop, but HackerOne should be the ones dealing with it, not OpenSource Maintainers.

  • bamboo@lemmy.blahaj.zonetoGreentext@sh.itjust.works•Anon describes experienceEnglish
    18·
    27 days ago

    That’s bs and also reminds me of a joke about two mathematicians at a bar:

    longish math joke

    Two mathematicians are in a bar. The first one says to the second that the average person knows very little about basic mathematics. The second one disagrees, and claims that most people can cope with a reasonable amount of math.

    The first mathematician goes off to the washroom, and in his absence the second calls over the waitress. He tells her that in a few minutes, after his friend has returned, he will call her over and ask her a question. All she has to do is answer one third x cubed.

    She repeats “one thir – dex cue”?

    He repeats “one third x cubed”.

    She says, “one thir dex cuebd”?

    Yes, that’s right, he says. So she agrees, and goes off mumbling to herself, “one thir dex cuebd…”.

    The first guy returns and the second proposes a bet to prove his point, that most people do know something about basic math. He says he will ask the blonde waitress an integral, and the first laughingly agrees. The second man calls over the waitress and asks “what is the integral of x squared?”.

    The waitress says “one third x cubed” and while walking away, turns back and says over her shoulder “plus a constant!”