Natanael

joined 9 months ago
[–] Natanael 8 points 1 week ago* (last edited 1 week ago) (2 children)

What's race based prejudice if it isn't racism? You can't just displace the original meaning and pretend the original never existed

Obviously it's generally much more harmful in one direction, but acting like people aren't all just people with the exact same biases, and acting as if which group has power over which isn't something that has kept changing throughout the history of humanity, and acting as if all of human experience is homogeneous (that all people with the same labels have identical experience), is all nonsensical extremist horseshoe politics stuff.

When you hear people on your own side defend Apartheid but for opposing reasons, you gotta admit those people have gone too far off the deep end. Racist extreme right people push it because they believe people are inherently different and can't integrate. Delusional extreme left people do it because "people of different status and power can't mix without abuse" and so they abdicate from the responsibility to support coexistence and mutual understanding, and so they end up helping racists push their policies.

[–] Natanael 1 points 1 week ago

No, I'm describing sending armed security that outnumber what the feds try to send.

If the feds think they still can instigate shit when outnumbered, they might end up starting a civil war - but the states wouldn't start it.

There's already other stuff like the health compacts in place between some states. Voting safety compacts might also happen

[–] Natanael 4 points 1 week ago* (last edited 1 week ago) (1 children)

Yes, that's the order it has to be done in. And once GOP is out and voting is reformed, you can introduce better parties

[–] Natanael 1 points 1 week ago* (last edited 1 week ago)

It's rated xx

(any Fortran nerds around?)

[–] Natanael 1 points 1 week ago (2 children)

Only the smaller states are at any real risk, and only if they don't cooperate with the larger democratic states to place troops to protect the sites

There's more than enough available to the states if they decide to enforce safety that the feds simply can't do anything

[–] Natanael 5 points 1 week ago (4 children)

Get Republicans out, then fix the damn system by changing the voting system so you guys can finally have more than 2 parties

[–] Natanael 1 points 1 week ago (4 children)

You have no idea how few the federal troops really are, you think they're more powerful than they are because you've only seen reports on where they've been striking performatively.

If Trump sent every federal agent they had into New York city, the city could dedicate less than half of their police force to arrest them all. They wouldn't need to call the national guard, or any other security forces.

And then there's no feds left to try anything in any other state.

[–] Natanael 1 points 1 week ago

I've seen dozens of examples

[–] Natanael 0 points 1 week ago

You're missing my point by miles, do something to oppose him then!

[–] Natanael 5 points 1 week ago (1 children)
[–] Natanael 0 points 1 week ago (2 children)

Who's the one with talking points? Because that one's from the constitution. Push the states to oppose Trump's interference

[–] Natanael 1 points 1 week ago (6 children)

Constitution says no and states get to enforce that no

 

UK wanted global access to decrypt any and all Apple users' iCloud data on request. Apple pulled iCloud encryption from the ADP program instead within UK.

Seems like their idea is to ensure encrypted data outside of UK stays out of UK jurisdiction because the affected feature isn't available there anymore. But this will prevent UK residents from using iCloud end to end encryption in ADP and keeping for example backups of photos and iMessage logs protected, so for example journalists are a lot more exposed to secret warrants and potential insider threats.

9
submitted 8 months ago* (last edited 8 months ago) by Natanael to c/crypto
 

Here's a copy of my own comment from the reddit thread;

Randomness is a property of a source, not of a number. Numbers are not random. Randomness is a distribution of possibilities and a chance based selection of an option from the possibilities.

What we use in cryptography to describe numbers coming from an RNG is entropy expressed in bits - roughly the (base 2 log of) number of equivalent unique possible values, a measure of how difficult it is to predict.

It's also extremely important to keep in mind that RNG algorithms are deterministic. Their behavior will repeat exactly given the same seed value. Given this you can not increase entropy with any kind of RNG algorithm. The entropy is defined exactly by the inputs to the algorithm.

Given this, the entropy of random numbers generated using a password as a seed value is equivalent to the entropy of the password itself, and the entropy of an encrypted message is the entropy of the key + entropy of the message. Encrypting a gigabyte of zeroes with a key has the total entropy of the key + "0" + length in bits, which is far less than the gigabytes worth of bits it produced, so instead of 8 billion bits of entropy, it's 128 + ~1 + 33 bits of entropy.

Then we get to kolgomorov complexity and computational complexity, in other words the shortest way to describe a number. This is also related to compression. The vast majority of numbers have high complexity which can not be described in full with a shorter number, they can not be compressed, and because of this a typical statistical test for randomness would say it passes with a certain probability (given the tests themselves can be encoded as shorter numbers), because the highest complexity test has too low complexity to have a high chance of describing the tested number.

(sidenote 1: The security of encryption depends on mixing in the key with the message sufficiently well that you can't derive the message without knowing the key - the complexity is high - and that the key is too big to bruteforce)
(sidenote 2: the kolgomorov complexity of a securely encrypted message is roughly the entropy + algorithm complexity, but for a weak algorithm it's less because leaking patterns lets you circumvent bruteforcing the key entropy - also we generally discount the algorithm itself as it's expected to be known. Computational complexity is essentially defined by expected runtime of attacks.)

And test suites are bounded. They all have an expected running time, and may be able to fit maybe 20-30 bits of complexity in there, because that's how much much compute resources you can put into a standardized test suite. This means all numbers with a pattern which requires more bits to describe will pass with a high probability.

... And this is why standard tests are easy to fool!

All you have to do is to create an algorithm with 1 more bit of complexity than the limit of the test and now your statistical tests will pass, because while algorithms with 15 bits of complexity will generally fail another bad algorithm with ~35 bits of complexity (above a hypothetical test threshold of 30) will frequently pass despite being insecure.

So if your encryption algorithm doesn't reach beyond the minimum cryptographic thresholds (roughly 100 bits of computational complexity, roughly equivalent to same bits of kolgomorov complexity*), and maybe just hit 35 bits, then your encrypted messages aren't complex enough to resist dedicated cryptoanalysis, and especially not if the adversary knows the algorithm already, even though they pass all standards tests.

What's worse is the attack might even be incredibly efficient once known (nothing says the 35 bit complexity attack has to be slow, it might simply be a 35 bit derived constant folding the rest of the algorithm down to nothing)!

* kolgomorov complexity doesn't account for different costs for memory usage versus processing power, nor for memory latency, so memory is often more expensive

6
submitted 8 months ago by Natanael to c/crypto
8
submitted 9 months ago* (last edited 8 months ago) by Natanael to c/infosecpub
 

Hi all!

On reddit I'm the main moderator for a cryptography subreddit, https://www.reddit.com/r/crypto and I'm considering migrating it.

There's a few cryptography subreddits (one named cryptography which is the main option), the main difference with the one I run is we're a bit stricter about being on topic and thus maintaining higher quality discussions (in part because we're under a heavy flood of spam bots, so we need to filter strictly). We got plenty of people over there who are professional cryptographers

I see there's also a cryptography forum on this instance, but it's very scattered and doesn't really have very high quality posts. I wouldn't want to just take over an existing forum here, if I move the reddit community I'd like to recreate /r/crypto as a new forum here and establish it with all the same rules, etc.

Is there interest from the admins for that here? And how dedicated are the admins to maintaining this instance in the long term? (I don't want to have to move the forum multiple times)

And how much interest is there from the lemmy community?

(sidenote - this time around I'd handle moderation from a separate account, not from my main)

view more: ‹ prev next ›