Hacker News: pseudohadamard

New comment by pseudohadamard in "Space industry lacks workers needed to rebuild satellites lost in war: report"

pseudohadamard — Sun, 06 Sep 2026 12:11:43 +0000

It's also whether it matters if you have people available to replace the things. Any conflict that gets to the point of taking out satellites will almost certainly trigger Kessler syndrome, at which point whether you can launch any more satellites becomes moot.

New comment by pseudohadamard in "Reversing MikroTik's Silent Patch: The RouterOS 7.23.4 Fix They Wouldn't Explain"

pseudohadamard — Sun, 06 Sep 2026 12:07:44 +0000

ai;dr

New comment by pseudohadamard in "Reversing MikroTik's Silent Patch: The RouterOS 7.23.4 Fix They Wouldn't Explain"

pseudohadamard — Sun, 06 Sep 2026 12:06:56 +0000

For anyone else reading this and rolling their own crypto (hint: don't! No really, just don't!):

>a lax PKCS#1 v1.5 RSA signature verifier that failed to enforce the total encoded length (256 bytes) or pin the digest to its correct length for the claimed hash, allowing an attacker to forge a valid-looking signature without the private key

the correct way to do this is encode-then-memcmp(). You can't get it wrong that way because a memcmp() only has two outcomes, match or no match, not a whole range of "seems to work OK on the tests we ran it on".

New comment by pseudohadamard in "Private German rocket makes history, reaches orbit from European soil"

pseudohadamard — Sun, 06 Sep 2026 05:21:19 +0000

Yes, but most of them in the early 1940s.

New comment by pseudohadamard in "The Highest Point in the Netherlands"

pseudohadamard — Sat, 05 Sep 2026 12:43:41 +0000

Bit of an odd comment overall. The fact that I know that the highest point in the Netherlands is in the Caribbean pretty much demonstrates that I'm not from the US.

New comment by pseudohadamard in "RSA-260 Factorized"

pseudohadamard — Sat, 05 Sep 2026 12:38:55 +0000

EdDSA is also quite a mess, see e.g. https://hdevalence.ca/blog/2020-10-04-its-25519am/. Almost no two implementations that aren't the same code base can agree on what is and isn't a valid signature. ECDSA isn't nearly as bad, there's only two forms of the same signature possible and implementations seem to generate either of the two at random (this makes for a great subliminal channel to leak the private key if you don't have the source code). With RSA PKCS #1 (but not PSS) there's one and only one form for a signature.

So oddly enough the supposedly really bad insecure terrible etc PKCS #1 RSA is the only one where the signature is totally unambiguous.

New comment by pseudohadamard in "RSA-260 Factorized"

pseudohadamard — Sat, 05 Sep 2026 12:33:08 +0000

> If you are actually operating a service relying on RSA-1024 security, it is almost certainly pwoned.

If you're running something with code from a large US corporation, or outsourced to contractors, or made in China, or with a web interface, or [3 more pages of stuff] and your main worry is the size of your RSA keys, then I've got a Fortigate security appliance to sell you.

New comment by pseudohadamard in "Norway's Oil Fund Proposes Selling Roughly $80B in U.S. Treasurys"

pseudohadamard — Sat, 05 Sep 2026 09:05:47 +0000

Several of them barely even read, period.

Unless their name is on every powerpoint slide in a large font.

New comment by pseudohadamard in "The auto lobby spent millions on media manipulation"

pseudohadamard — Sat, 05 Sep 2026 08:12:36 +0000

It's also a biased, lopsided report. Guy I know who was an EV pioneer in California said it was so bad that, even though his career consisted of promoting EVs, he told people to avoid watching it because it presents such a skewed picture. Imagine it's been made by Michael Moore to put it into perspective. From what I can remember, and this was 20 years ago, his summary was that the EV1 was introduced purely to meet the ZEV mandate but in practice the vehicles were "saleproof" (his words). There wasn't any conspiracy to kill them.

New comment by pseudohadamard in "Searching for the Best Silicone USB Cable"

pseudohadamard — Sat, 05 Sep 2026 07:37:03 +0000

Just beware that an awful lot of "silicone" cabling coming from China is actually overplasticized PVC, particular cabling used in instrument probes. It feels like silicone until it starts getting stiff while at the same time outgassing plasticizer like crazy, or you touch it with a soldering iron or similar. I would expect most or even all of the cat-ran-across-the-keyboard Amazon brands to be overplasticized PVC, not silicone (hint: Use the Knockoff plugin for Chromefox, https://github.com/Shpigford/knockoff, which will warn you for stuff that's sold on Temu West, aka.Amazon, it's warning on almost all of the pseudo-brands listed in the article).

I've also run into way too much cabling that's CCA or even CCS. Garbage on the outside, garbage on the inside.

New comment by pseudohadamard in "The Highest Point in the Netherlands"

pseudohadamard — Sat, 05 Sep 2026 07:20:32 +0000

Don't ever use that word outside of a Serious Screenplay.

New comment by pseudohadamard in "Welcome to the Porcelain Insulator Collector's World of Mud"

pseudohadamard — Sat, 05 Sep 2026 07:18:02 +0000

If you're interested in insulators you may also be interested in the telegraph poles that they're mounted on, for which we have the Telegraph Pole Appreciation Society, https://www.telegraphpoleappreciationsociety.org/. Do sign up, it's only UKP 10 for lifetime memebership.

New comment by pseudohadamard in "RSA-260 Factorized"

pseudohadamard — Sat, 05 Sep 2026 04:41:42 +0000

Why not? What's the actual threat? Let's say I'm using RSA-1024 on my firewall today. What happens next?

New comment by pseudohadamard in "RSA-260 Factorized"

pseudohadamard — Sat, 05 Sep 2026 04:21:16 +0000

There's also the question of why anyone would bother. You can factor RSA-1024 today in about a year with a national-lab-level supercomputer. Which 1k-bit RSA key would you shut down a national lab for a year for to factor? Heck, which key would you shut it down for a week for to factor? There's no single key out there of any interest when you can just spear-phish your intended target, or get RCE on their unpatched router, or get the cleaners to plug in a USB key and let it do its thing while they're vaccuuming, or whatever.

New comment by pseudohadamard in "The Wormhole Hall of Shame"

pseudohadamard — Sat, 05 Sep 2026 04:09:04 +0000

Philomena Cunk also discusses wormholes with Prof.Brian Cox, https://www.youtube.com/watch?v=YPX0v9NzzrM.

New comment by pseudohadamard in "RSA-260 Factorized"

pseudohadamard — Sat, 05 Sep 2026 04:04:59 +0000

I'd say ECDSA is even worse, because almost anything you get even slightly wrong with Schnorr schemes ends up leaking the private key. With RSA OTOH you just use a decent library and something like encode-and-compare for signing and you're done. I'm much more nervous about something using ECDSA than RSA once I've had a look at the code and verified that it's at least somewhat competently written.

New comment by pseudohadamard in "The Highest Point in the Netherlands"

pseudohadamard — Thu, 03 Sep 2026 12:57:22 +0000

The Netherlands isn't that flat. Its highest point is Mt.Scenery at 870m.

New comment by pseudohadamard in "Bank of America Vice President Fatally Stabbed in Times Square"

pseudohadamard — Thu, 03 Sep 2026 12:46:18 +0000

"Vice President of Pest Control, Nighttime Security, Non-arboreal Gardening Services, and Tenant-related Easements and Liens".

New comment by pseudohadamard in "If You Knew God Exists, Wouldn't You Become a Priest?"

pseudohadamard — Thu, 03 Sep 2026 12:40:17 +0000

Linus may be a bit abrasive at times but he's not malevolent. And I run Linux so I guess I'm in the clergy already.

New comment by pseudohadamard in "Why do so many tools have JSON config files?"

pseudohadamard — Thu, 03 Sep 2026 08:07:23 +0000

A lot of that is already in ASN.1, for example for UTF-16 you've already got UTF-8 and given that even Microsoft have abandoned BMP strings I doubt any attempt to reintroduce it will get much traction, relative OIDs already exist, BCD strings are just constrained PrintableStrings and in any case UTF-8 won for all of the string types, Reference sounds like an EXTERNAL, OOB sounds like an ANY DEFINED BY, etc.