Aaron Toponce ⚛️:debian:

MSCSIA, cryptography, security, locksport, Linux, programming, mathematics, amateur radio, Buddhism, running, anime, and bibliophilia.

Blog: https://pthree.org
GitHub: https://github.com/atoponce
Keybase: https://atoponce.keybase.pub/mastodon.html

Public Key

npub1t9cz9v7zph5jvadd8rjfp25msrx6r0hdxnsyfmx88k8qp3pvv04szt8529

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs9jupzk0pqm6fxwkkn3eys42dcpndphmknfczyanrnmrsqcskx86cpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dseyp8t4

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1t9cz9v7zph5jvadd8rjfp25msrx6r0hdxnsyfmx88k8qp3pvv04szt8529

Show more details

Last Notes

2024-08-15 17:56:29

My husky Cooper (right) and his sister Mika (who only lives a couple houses up the street) having a doggy playdate together.
https://cdn.fosstodon.org/media_attachments/files/112/966/848/028/048/146/original/60cd0ab4f8567947.png

2024-08-06 00:08:03

Curious.
PuTTYgen supports the following SSH key types:
- DSA
- RSA
- ECDSA
- EdDSA
- Ed25519
- Ed448
OpenSSH supports:
- RSA
- ECDSA
- ECDSA-sk
- Ed25519
- Ed25519-sk
Given that the overwhelming majority of #SSH servers are provided by #OpenSSH, it's unfortunate that the two projects don't agree on key types.
#cryptography

2024-07-31 17:40:09

This Venezuelan election vote analysis on Reddit is amazing.
The results are:
Maduro: 51.199997%
Gonzales: 44.199998%
Others: 4.600003%
Almost exactly 51.2%, 44.2%, and 4.6% on the nose.
Why? If you skew the votes in your favor, then you could do something by picking a winning percentage for yourself and losing percentages for everyone else.
EG, of 10,058,774 votes,
51.2% = 5,150,092.288
44.2% = 4,445,978.108
4.6% = 462,703.604
#math #Venezuela
https://redd.it/1eg4am8

2024-07-31 14:51:32

It's amazing to me people trust this #AI shit.
https://www.theverge.com/2024/7/30/24210108/meta-trump-shooting-ai-hallucinations

2024-07-28 20:46:45

#OpenAI could be on the brink of bankruptcy in under 12 months, with projections of $5 billion in losses
Microsoft will bail them out. Can't risk Google picking up the pieces and dominating the space.
#ai
https://www.windowscentral.com/software-apps/openai-could-be-on-the-brink-of-bankruptcy-in-under-12-months-with-projections-of-dollar5-billion-in-losses

2024-07-28 20:04:55

- reply

Source: https://redd.it/1ee6hqu

2024-07-26 01:31:47

I feel bad for Vivian Wilson. Being a trans youth with unsupportive parents is hard enough, but to have your dad be so vocally against you as a person, with the wealth and the large platform Musk has? That must be awful to deal with.

2024-07-26 00:59:13

- reply

An approach I prefer is to generate a random password/passphrase that meets the security requirements, then prepend/append the number of characters/words.
EG, "e\A(."bR|@" is 10 characters long, so "e\A(."bR|@10" is guaranteed to meet the requirement without weakening security.
Similarly, "redeem robot louse apathy match eva" is 6 words long, so "6 redeem robot louse apathy match eva" is also guaranteed to meet the security requirement.

2024-07-26 00:24:52

- reply

To help motivate this, consider the following: I have two d60 dice. On one of the d60, every number is randomly and uniformly distributed through the die. The other, the numbers are in numerical order in a spiral out design with adjacent faces.
Both d60 are machine precision balanced and perfectly fair.
Which die produces more random results when tossed? The randomly distributed d60 or the numerically ordered d60?
Spoiler alert: the toss determines how the d60 lands, not what's printed on it.
https://cdn.fosstodon.org/media_attachments/files/112/849/465/113/934/803/original/fe9697513fe5785a.png
https://cdn.fosstodon.org/media_attachments/files/112/849/465/628/503/701/original/5799f495679aaa52.png

2024-07-26 00:06:39

I've audited a lot of password generators. One thing I see come up occasionally is shuffling the source characters or word list before using a CSPRNG to pick one at random.
For example, something like (pseudocode):
chars = digits + lower + upper + symbols
chars.shuffle()
chars[rng.randint(0, chars.length - 1)]
Shuffling the source character set doesn't increase the entropy of the generation process.
A CSPRNG picking from an ordered list is just as random as one picking from a shuffled list.

2024-07-25 18:25:46

- reply

I'm curious if there will be a migration path to Gentoo, or if he's just yeeting the whole thing and doesn't give a flying fuck.

2024-07-25 18:06:20

Daniel Robbins is killing off #Funtoo #Linux. He announced it on Discord, but the official site has yet to be updated.
The project will officially be dead the end of August, or in about six weeks.
https://cdn.fosstodon.org/media_attachments/files/112/847/970/721/278/432/original/af5ba9dcf6d2a7ba.png

2024-07-25 03:11:26

Today is Pioneer Day, a #Utah religious holiday that celebrates the #Mormon pioneers migrating across the plains and settling the state.
However, as an apostate, we celebrate "Pie and Beer Day" instead.
Enjoying a mixed berry pie with a local craft pilsner.
https://cdn.fosstodon.org/media_attachments/files/112/844/445/625/782/533/original/37ac878d9ce21edd.jpg

2024-07-25 00:47:04

- reply

Yeah, it's down. My server suffered a catastrophic hardware failure and I haven't takes the time to get it back online.

2024-07-23 23:26:14

Biology is just applied chemistry.
Chemistry is just applied physics.
Physics is just applied mathematics.
Mathematics is just applied thinking.
Thinking is just applied biology.
And now we've come full circle.
Apropos XKCD: https://xkcd.com/435/
#math #maths

2024-07-23 17:50:13

iOS and macOS run the XNU kernel.
"XNU" is a recursive acronym for "X is Not UNIX".
iOS and macOS are both certified UNIX by the OpenGroup.
kek
#unix

2024-07-23 06:30:21

- reply

Linear.
https://cdn.fosstodon.org/media_attachments/files/112/833/922/264/055/819/original/d96a099d82841695.jpg

2024-07-21 17:08:06

- reply

I've decided I don't like captive bead earrings. Washing my hair this morning, one came out and went down the drain.

2024-07-20 22:40:31

I have a spreadsheet currently with 568 rows and 48 columns.
All to track my #running fitness, form, and fatigue using 4 different scoring systems and 2 different performance models.
My wife and daughter think I'm a nerd. They're not wrong.
https://cdn.fosstodon.org/media_attachments/files/112/820/738/041/511/234/original/2550f864d579fceb.png

2024-07-18 01:40:21

I have three external 4 TB drives in a #ZFS RAID-Z1 for backups.
Recently, one of the drives failed I think primarily due to heat. I replaced that drive today, but decided I wanted something to manage the heat a bit better.
My employer had some aluminium scraps that I could rest the drives on, lifting them off the desk, improving airflow. But being aluminium, they'll also absorb any heat the drives put out.
I also put a USB fan above the drives for cooling. Hopefully this improves lifespan.
https://cdn.fosstodon.org/media_attachments/files/112/804/456/867/582/995/original/d0298a60da95d9ba.png

2024-07-18 01:21:51

Nvidia is moving to fully #OpenSource #Linux kernel modules.
This sounds like good news on the surface, but what they're not telling you is that the kernel module still relies on the GPU System Processor (GSP), which is firmware running on the card itself. The kernel module won't be doing work, just interfacing with the hardware so Linux users have less headaches moving forward.
IE,
- nvidia.ko = open source kernel module
- gsp.bin = proprietary binary firmware blob
https://developer.nvidia.com/blog/nvidia-transitions-fully-towards-open-source-gpu-kernel-modules/

2024-07-15 20:18:13

- reply

I should have realized an exponential function (orange) would fit better than a cubic (blue). Thus:
y = 0.0284598 × 3.62961^x + 1.54071
Unsurprisingly, this has a better R² value of 0.9998.
It makes sense, because every zone should weight higher *per percentage difference* than the previous zone.
This is not true with the cubic between training zones 1 to 2 and 2 to 3. It is true with every zone using the exponential fit.
Anyway, I still haven't heard anything from the researchers.
</nerd>
https://cdn.fosstodon.org/media_attachments/files/112/791/851/354/376/329/original/57ef66c69977a211.png

2024-07-15 02:20:11

Just a reminder, you can text 911 in #Utah.
Could be useful when you can't speak to someone for whatever reason.
Include your type of emergency and physical location in the text if you can.

2024-07-13 03:48:26

2024 #Utah Olympian send-off - 10K fun run.
Ran with Clayton Young (marathon), although there was no way I could keep up with him.
Met with Clayton, Conner Mantz (marathon), and James Corrigan (steeple).
Other Olympian runners from Utah include Grant Fisher (5K, 10K), Courtney Wayment (steeple), Whittni Morgan (5K), and Kenneth Rooks (steeple).
#running #Olympics #Olympics2024
https://cdn.fosstodon.org/media_attachments/files/112/776/656/837/348/525/original/069c1bf827f67f4a.jpg
https://cdn.fosstodon.org/media_attachments/files/112/776/657/021/882/604/original/35e688840d64e776.jpg
https://cdn.fosstodon.org/media_attachments/files/112/776/657/351/176/824/original/e2f05c9293d4d39d.jpg
https://cdn.fosstodon.org/media_attachments/files/112/776/658/210/024/728/original/9aa0699969060fce.jpg

2024-07-12 18:44:58

It's triple digit temperatures outside on this #friday, so Lavender is wondering why she is being forced to wear a sweater indoors.
https://cdn.fosstodon.org/media_attachments/files/112/774/521/107/290/979/original/862214617a659720.png

2024-07-12 18:23:23

- reply

I should mention one more thing: that cubic assumes the same power distribution curve as the world class elite cyclists, which obviously won't align with recreational cyclists.
The paper doesn't address how to setup your training zones such that it meets the requirement of strictly increasing zone percentage differences.
No doubt it'll be based on your power distribution curve, but that also means ignoring every training zone provided by coaches, software, books, other papers, etc.

2024-07-12 18:21:41

- reply

Obviously, spending 100% of my time in zone 3 should score higher than spending 100% of my time in zone 2, which further should score higher than spending 100% of my time in zone 1.
But when that cubic is applied instead of using the zone percentage differences, then the zone score breakdown becomes:
Zone 1: 6.92
Zone 2: 9.12
Zone 3: 10.15
Zone 4: 26.90
Zone 5: 76.30
Much better.
I reached out to the researchers. I'll update this thread if they respond.

2024-07-12 18:20:07

- reply

I found a cubic equation that fits the data in the paper with an R² value of 0.999264, which is phenomenal. It is:
0.7225x^3 - 4.48536x^2 + 8.96214x - 3.578
Where "x" is the zone number.
This works regardless of how your zones are setup, meaning their percentage differences don't need to be strictly increasing.
For example, if I spend 100% of my time in a zone, the PPi values for my #running training zones become:
Zone 1: 81.64
Zone 2: 46.65
Zone 3: 41.79
Zone 4: 54.58
Zone 5: 235.86

2024-07-12 06:28:32

I'll state the obvious: very few people are willing to be seen in public with VR strapped to their head.
Lack of software support and sticker price aside, wearing this puts you on the cover of a 1980s Popular Mechanics magazine with a special article by Isaac Asimov.
It's just not the vibe the general public is interested in. No matter how many times you try. Snap, Google, Oculus, etc.
Sitting in your basement gaming? Sure.
At the coffee shop telecommuting? Newp.
https://gizmodo.com/apple-vision-pro-u-s-sales-2000469302

2024-07-11 23:47:02

- reply

This adds to the list of training scores:
- TRIMP (Banister's OG and Edwards', Lucia's, and Stagno's variations)
- RSS (Stryd)
- TSS (TrainingPeaks rTSS, hrTSS, etc.)
- HRSS (Elevate for Strava, normalized hrTSS using TRIMP)
- SRPE (Foster)
- Fitness, Form, & Fatigue (Strava)
TSS is the gold standard due to its simplicity and the elegance of not needing weighting factors.
SRPE however has shown to be the most reliable at predicting performance.
PPI might be more reliable than SRPE however.

2024-07-11 23:41:51

- reply

This is exciting to me as a runner, because this could obviously be extended to #running for those who run with a power meter.
However, as demonstrated in the paper, the power zone percent differences must be monotonic, otherwise the metric is not reliable.
So #Stryd, instead of picking zones arbitrarily, they should be based on your own PDC.
Also, the weighting factor "K" will need to be re-evaluated for runners due to the different metabolic demands running has versus cycling.

2024-07-11 23:39:28

This is an interesting paper than creates a new training score called "Power Profile Index" or "PPI".
It weights activity stress based on the amount of time spent in each training zone. In the paper, 6 #cycling zones are modeled.
What's the most interesting to me is that it doesn't prioritize volume, but rather intensity. Things like time trials, elevation grades, flat easy efforts, etc. drive the score, not time in the saddle.
https://www.mdpi.com/2076-3417/12/21/11020

2024-07-07 23:32:47

When coding in dark mode, would whitespace be called blackspace?
#programming #showerthoughts

2024-07-04 03:32:15

I'm not a #NixOS user. I've never installed it. I've only seen discussion about it on Reddit. I'm vaguely familiar with its intended audience and purpose.
But this purge is wild. I mean, you can't separate politics from software. Software is inherently political strictly because the developer who is writing it has political opinions which will inevitably make it into their project.
But for the vocal minority to overwhelm a project, its founders, and core devs? Wow.
https://lunduke.locals.com/post/5819317/nixos-commits-a-purge-of-nazi-contributors-forces-abdication-of-founder

2024-06-27 22:41:10

#Linux chaos from bad to worse:
# sort /dev/urandom
# :(){ :|:& };:
# chmod -x $(command -v chmod)
# [ $[ $RANDOM % 6 ] == 0 ] && rm -rf /* || echo "click"

2024-06-21 15:32:55

Sounds like a great campaign to stop people from using Oracle Java and instead switch to one of the many open JDKs available.
https://www.theregister.com/2024/06/20/oracle_java_licence_teams/?td=rt-3a

2024-06-21 15:14:33

YouTube confirms crackdown on VPN users accessing cheaper Premium plans
No no, you guys don't understand.
If Google pays taxes in a random country, to cheat the system and save money, that's clever because "Globalism".
If you do it, you get banned though.
https://techcrunch.com/2024/06/20/youtube-confirms-crackdown-on-vpn-users-accessing-cheaper-premium-plans/

2024-06-21 15:09:41

- reply

What a stupid poll.
Rather than spread ineffective toxicity, why not focus on positively spreading Free Software? Demonstrate the advantages and values of open hardware and software.
Use social media to improve the lives of those you can influence.

2024-06-20 19:38:37

- reply

Useful for hills and wind. I can keep the effort consistent and let the pace be variable.
Useful especially for races. If I know I can hold a certain power for the duration of the race to hit a goal time, then regardless of the gradient, if I stick to the target power, I'll hit my goal without blowing up.
It's also more responsive than HR for speed work. Even though I'm more likely to target specific paces, targeting by power can be useful in a training block also.

2024-06-20 17:56:44

- reply

What's weird, is Eliud Kipchoge is sponsored by Coros and Courtney Deauwalter by Suunto.
Both are elite endurance runners that have wide influence in the running community. Yet, it seems that most runners still prefer Garmin or Apple.
Suunto and Coros seem to be not be understanding the right way to capitalize on their sponsorships if finances are the concern.

2024-06-20 17:44:30

- reply

So armed with that, if you setup a new #Stryd account, I recommend setting your weight to 100 kg.
Thus, when your watch is showing you #running at 403 W, you know you're actually running at 4.03 W/kg. The math is trivial. Just move the decimal two places to the left.
Same with PowerCenter. If your CP is 415 watts, you know you should be able to sustain 4.15 W/kg for about 40 minutes.
This would be a good 10k race prediction tool to have in your chest, don't you think?
5/5

2024-06-20 17:41:15

- reply

This isn't surprising. Losing excess body fat is a great way to improve #running performance. It's something you can control. It just makes predicting race times challenging.
Now suppose I use the same calculater, but this with with 4.2 W/kg as my FTP/CP. Then it doesn't matter what my weight is, my marathon finish time ranges from 3:03:59 to 03:13:39.
W/kg shows effort in the run, not total work averaged over the duration. This is the key difference.
Yet #Stryd is all-in with Watts.
4/5

2024-06-20 17:37:26

- reply

For example, when using Steve Palladino's Super Power Calculator to predict race times, it is 100% dependent on weight when using watts.
If I wanted to predict my marathon finish time, and I knew the following:
- Weight: 80 kg
- FTP/CP: 320 W
- Riegel exponents: -0.08 to -0.10
- Target RE: 0.99 to 1.01
I can expect to finish between 3:14:00 to 3:24:27. But if my weight drops to 75 kg, all else equal, I can expect to finish between 3:00:52 to 3:10:18.
#running #Stryd
https://superpowercalculator.com/calculators/11

2024-06-20 17:33:26

- reply

TL;DR- When you change your weight in #Stryd, you can no longer compare current runs to past run, must immediately update your critical power, and wait 90 days before the runs with the old weight are outside of their calculations.
IE, it's problematic *for their own platform*.
This could be solved though if they standardized on W/kg. Not only do the past problems disappear, but race calculations, training predictions, and just all around post-run data analysis, becomes easier.
#running
2/n

2024-06-20 17:29:59

This has been an interesting morning for me regarding #running. I already shared the news about the #Suunto layoffs. Now it's time to rant about #Stryd.
First, let me be clear: I love my Stryd pods. They will be immediately replaced if damaged, lost, stolen, or dead.
But what irritates me most about the Stryd ecosystem is their integration of watts (W) rather than watts per kilogram (W/kg).
The problem is changing your weight, as per this Reddit thread:
https://redd.it/rfrxad
1/n

2024-06-20 14:48:41

- reply

I plan on running my 9 Baro into the ground (pun intended)—it was just too expensive. But I'm keeping my options open on a replacement, and if you were to ask me right now, it would be between Garmin and Coros.
#Suunto #running
4/4
https://cdn.fosstodon.org/media_attachments/files/112/649/021/023/326/534/original/fc3bfbcc909bb3c0.jpg

2024-06-20 14:46:07

- reply

Garmin, Polar, Coros, and Apple don't have these problems.
So if it takes firing 76 employees to become more agile, responsive, and productive towards making robust software and firmware for their watches, then I'm here for it. I don't care about the deep Finnish roots and pride of Suunto's history. What I care about is a watch that doesn't feel like an expensive beta test.
#running #Suunto
3/n

2024-06-20 14:44:59

- reply

But their firmware leaves a lot to be desired. In both by Ambit3 Peak and 9 Baro, I have a hefty list of irritants, that each individually don't amount to much, but on the whole, make using the watch feel cheap and rushed out the door.
For example, #Suunto is well known for zero-drops while recording an activity, where the watch just doesn't record any data for a second or more. UI sluggishness, poor auto-lap detection, dim display, button press lag, Bluetooth pairing woes, etc.
#running
2/n

2024-06-20 14:42:32

#Suunto just fired 76 employees out of 300 while moving part of production and part of development to China. Here's my take.
Suunto is known for their robust hardware. They historically have designed watches specifically towards mountaineers and alpinists. I purchased my first Suunto in 2001 before GPS watches existed. It is stainless steel, taken a beating, and held up beautifully. It's very clear what their mission was. These watches are built to last.
#running
1/n
https://the5krunner.com/2024/06/20/breaking-suunto-lays-off-76-out-of-300-staff/

2024-06-20 04:11:46

- reply

She is already familiar with that. In fact, she could tell you the probable path of evolution through the velociraptor and archaeopteryx.

2024-06-20 03:49:35

- reply

That's exactly my daughter! She's corrected a number of people about the difference between Tyrannosaurus Rex and Allosaurus, how Brontosaurus never existed, how dinosaurs are not lizards, and why pterosaurs are not dinosaurs.
Oh man, the conversations she would have with random strangers at museums, theme parks, during movies, ...
Haha.

2024-06-20 03:27:39

My daughter has always been interested in dinosaurs, since like 3 years old. She could trivially name off each of the epochs, dozens and dozens of dinosaurs, where they lived, what they ate, where to find fossils, etc.
As an off-hand comment, I mentioned we have evidence to suggest that some dinosaurs were warm-blooded and perhaps some even hot-blooded.
I've just shaken her whole world.
She's now deep in the Internet looking up everything she can about warm-blooded and hot-blooded dinosaurs.

2024-06-20 02:31:03

Apple Pie bites. For $3.14. Someone at the store has a sense of humor.
#math #maths
https://cdn.fosstodon.org/media_attachments/files/112/646/123/142/365/233/original/3ccc4ac23654e4bf.jpg

2024-06-16 17:58:09

Had friends over for a movie night last night, and one of them brought over blue raspberry lemonade flavored candy.
Blue raspberry lemonade.
What is wrong with the food industry?

2024-06-14 23:15:36

- reply

Confession: I haven't seen any of the Saw movies.

2024-06-14 23:14:17

Someone should make a Saw movie geared towards network and system admins.
"Your server is infected with a worm, but the ethernet cable is in a rat's mess of cables plugged into the switch. Only one will remove the server from the network. Pick the wrong one, and your friend's website loses millions of revenue per second."
#SysAdmin #friday

2024-06-14 03:46:15

- reply

Those ones bug also. My problem with "-" is fat-fingering the <Enter> key. Drives me crazy.

2024-06-14 03:39:43

As a #Dvorak typist, I loathe using "-" as a passphrase separator. I've gotten into the habit of using the standard space " " instead.
At first, it was real weird, but it's grown on me, and now I find it quite natural, just like typing normal sentences.
I won't smash the words together though, as that could weaken security and I loathe pressing the <Shift> key when I don't have to.
#passwords

2024-06-12 15:48:57

Violin plots are bad and you should feel bad for using them. Either pick a histogram or a box plot, but not the violin plot which combines both and is worse for doing so.
#math #maths
https://youtube.com/watch?v=_0QMKFzW9fw

2024-06-12 03:12:37

- reply

First, Blowish is a symmetric cipher, while bcrypt is a one-way password hashing algorithm. bcrypt does use Blowfish's expensive keysetup, which is where the confusion comes from.
md5crypt, sha256crypt, and sha512crypt are all password hashing functions that are based on MD5, SHA-256, and SHA-512 respectively, but have introduced a cost parameter to make it expensive for password cracking.
All of them have integrated a salt to prevent precomputed table attacks.

2024-06-12 00:37:57

- reply

Right now, I'm irritated with Python's crypt library:
>>> print(*crypt.methods, sep="\n")
<crypt.METHOD_SHA512>
<crypt.METHOD_SHA256>
<crypt.METHOD_BLOWFISH>
<crypt.METHOD_MD5>
<crypt.METHOD_CRYPT>

2024-06-12 00:15:39

<rant>
- bcrypt is not Blowfish
- sha512crypt is not SHA-512
- sha256crypt is not SHA-256
- md5crypt is not MD5
</rant>
#crypto #cryptography #passwords

2024-06-11 23:52:05

- reply

When I first saw one in the movie "Angels in the Outfield", I wanted one. But it just wasn't in the cards, and by the time I could afford a PDA, the Newton was dead, and Palm was King.

2024-06-06 20:16:15

- reply

64.2% good, 64.2% lawful.
https://cdn.fosstodon.org/media_attachments/files/112/571/040/722/792/697/original/700cdae058dc24c4.png

2024-06-06 00:34:41

- reply

Rationals are more than just broken. Haha.
https://cdn.fosstodon.org/media_attachments/files/112/566/395/080/454/129/original/495a2757fcb649df.png

2024-06-05 17:43:38

#Debian is switching to a tmpfs /tmp.
#linux
https://lists.debian.org/debian-devel/2024/05/msg00014.html

2024-06-05 03:33:49

As humans, we have a great tradition of naming "new" types of numbers with hostility, don't we?
- Negative
- Irrational
- Complex
- Imaginary
#math

2024-06-05 03:10:30

- reply

HIPAA has very strict requirements about how the data is transferred, where the data is stored, and who has access to the data. I'm almost 100% certain no AI company is meeting HIPAA requirements for medical health records.

2024-06-05 02:15:18

- reply

Are you in the United States? If so, I would imagine utilizing AI for health reasons would violate HIPAA laws.

2024-06-05 01:12:44

If you're a runner, you might have heard of the news of Spring Energy gels not living up to the nutrition facts they claim on the label.
A Reddit user in April did some math and realized that Awesome Sauce contained about 1/3 the claimed carbs. This led to a big debate on Reddit with Sage Canaday, who is sponsored by Spring Energy and has a flavor named after him.
Others have since sent in samples for analysis, and every Spring Energy gel has fallen short.
#running
https://www.irunfar.com/spring-energy-awesome-sauce-gel-controversy-lab-results

2024-06-04 18:36:54

One more poll:
How do you pronounce your "g" in both "gif" and "regex"? Be honest.

2024-06-04 18:29:06

- reply

Second, for those that use #KeePass, do you use upstream KeePass, @npub16s6…2ny3, or KeeWeb?
#passwords

2024-06-04 18:26:17

I have a couple password manager polls for you.
First, for those that use @npub1ajf…rx6k, do you use it with their own cloud service, self-hosted Bitwarden, or Vaultwarden?
#passwords

2024-06-02 02:39:22

- reply

Want an actual challenging #math puzzle? Try this:
https://cdn.fosstodon.org/media_attachments/files/112/544/234/402/133/685/original/e57b66b084174486.jpg

2024-06-02 02:37:11

3/2 🍓 = 6 → 🍓 = 12/3
3/2 🍊 = 2 → 🍊 = 4/3
3 🍅 = 10 → 🍅 = 10/3
🍓 × 🍊 × 🍅 =
12/3 × 4/3 × 10/3 =
480/27 =
160/9
Who designs #math puzzles where the fruit emoji is are not whole numbers?
https://cdn.fosstodon.org/media_attachments/files/112/544/205/614/692/784/original/b36087cc76eef124.jpg

2024-06-01 00:59:33

Remember when Google kept its products in beta for years and years?
Remember when software was thoroughly tested before releasing to the public?
I guess the public is QA now.
https://www.telegraph.co.uk/business/2024/05/31/google-curbs-ai-search-tool/

2024-05-28 05:52:59

- reply

I have a plastic Hario v60 01, and I find it very portable. The fact that the AeroPress chart says otherwise is just flat out misleading.

2024-05-28 03:10:26

AeroPress announced a new "AeroPress Go Plus" which comes with a tumbler and a modified AeroPress clear which fits into the tumbler.
For $80?! Hard pass.
Worse, they're comparing the #AeroPress to other popular #coffee brewing methods and wins overwhelmingly in almost every category.
get it, you want to sell the AeroPress. But come on. Let's make somewhat of an attempt at honesty?
https://aeropress.com/products/aeropress-go-plus
https://cdn.fosstodon.org/media_attachments/files/112/516/032/706/647/873/original/d51dff49d8e8b7d4.png
https://cdn.fosstodon.org/media_attachments/files/112/516/032/717/245/480/original/cdce6c727910893d.png
https://cdn.fosstodon.org/media_attachments/files/112/516/032/737/813/708/original/15efa2d5d076130f.png
https://cdn.fosstodon.org/media_attachments/files/112/516/032/748/316/650/original/48439fb26aa1fc28.png

2024-05-26 17:44:45

- reply

I found it. It was discussing 52 factorial, or the number of unique shuffles in a deck of playing cards.
/me adds to bookmarks
https://czep.net/weblog/52cards.html

2024-05-26 08:09:41

- reply

Kerckhoffs's Principle only states that the system should remain secure if everything is known about it except the key. It doesn't state that the algorithm has to be revealed. See NSA Suite A Cryptography as an example.

2024-05-26 03:08:49

- reply

No, but that's a good one. This one had a person doing physical labor, like shoveling dirt, or moving buckets/pails of water/dirt. It referenced the Earth going around the Sun and you were walking from point A to point B.

2024-05-26 03:03:34

There was a great page I stumbled upon some years ago that described just how big 256 bits (2^256) is by using work instead of time.
But I can't find it, because I can barely remember any of the details.
If I remember correctly, it had something to do with moving dirt across the the country, or moving water out of the ocean, or something. Speed wasn't important.
Anyone stumble on this page before? It's an alternate approach to Bruce Schneier's thermodynamics analysis.

2024-05-24 23:13:50

Pushing software updates on Friday before the long weekend. What could go wrong? Good thing I'm on-call I guess.
#sysadmin #linux #yolo

2024-05-24 18:36:19

https://cdn.fosstodon.org/media_attachments/files/112/497/034/590/588/856/original/eb7ffe7517943c6a.png

2024-05-23 19:50:11

- reply

Related, but natural diamonds are just dirty rare gems.
Synthetic diamonds created in controlled laboratory processes are almost always far superior in quality to natural diamonds. No inclusions, perfect clarity, and made to order.
https://www.livescience.com/chemistry/scientists-grow-diamonds-from-scratch-in-15-minutes-thanks-to-groundbreaking-new-process

2024-05-23 19:19:09

- reply

Knowing this, it's not surprising then that the ciphertext also is cyclic over 14 characters when encrypting the same character repeatedly:
AZYXWVUTSRQPOBAZYXWVUTSRQPOBAZYXWVUTSRQPOBAZYXWVUT...
--->
AZYXWVUTSRQPOB
AZYXWVUTSRQPOB
AZYXWVUTSRQPOB
AZYXWVUT...
Eek.

2024-05-23 19:14:21

- reply

It appears that the operations performed on the left and right alphabets are linear given the output above. As such, Chaocipher is vulnerable to known-plaintext attacks.
But, given that the full keyspace is not realized during encryption, we should also be able to launch a key recovery attack and recover both alphabets if enough ciphertext is provided.
Which means, a ciphertext-only attack seems within reach. Famous last words of course, but I think this one is very practical.

2024-05-23 19:02:45

- reply

Here's some Chaocipher analysis.
Set the left and right alphabets to "ABCDEFGHIJKLMNOPQRSTUVWXYZ" and encrypt a string of 50 "A"s.
Print the left/right alphabets while encrypting each "A" then print the final ciphertext (test vector from Moshe Rubin included to ensure we have a correct implementation):
https://gist.github.com/atoponce/88271fe9c412ea922993fad461c7f1e7
Note that 12 characters in the left alphabet ("CDEFGHIJKLMN") and 12 characters in the right alphabet ("PQRSTUVWXYZA") never change. The rest are cyclic.
#cryptography

2024-05-23 17:19:35

#LastPass is finally encrypting URLs.
https://www.bleepingcomputer.com/news/security/lastpass-is-now-encrypting-urls-in-password-vaults-for-better-security/
#passwords

2024-05-22 00:38:55

- reply

Tangentially related, when I do a recovery run the day after a hard workout, I force myself to stay at or below 5:30 min./km. It's insanely slow for me with my HR trivially in zone 1.
If I let my mind drift thinking about my next race, qualifying for Boston, or anything else that gets me excited, I'll find myself running at 5 min./km. and HR in zone 2.
Dammit.

2024-05-18 01:57:15

#Running the Ogden #HalfMarathon tomorrow.
I've been training to hit 1:25 since my half marathon at St. George last October. My PR is 1:29.
Unfortunately, the training hasn't gone to plan. Despite running hills, threshold intervals, long tempos, and lots of slow easy runs, the best I can probably hope for is 1:28.
However, this course is more difficult having about 1/3 the elevation drop of St. George and some rolling hills. 1:28 would mean a significant fitness improvement.
Here we go.
https://cdn.fosstodon.org/media_attachments/files/112/459/113/753/850/662/original/3b6e463a9255446a.jpeg
https://cdn.fosstodon.org/media_attachments/files/112/459/125/875/177/246/original/1a3c2b0565ad226b.png

2024-05-17 00:01:59

- reply

You mean @npub17my…5jdj ?

2024-05-16 23:31:38

- reply

I don't know that I buy the artist's justification for his off-by-one error.

2024-05-16 23:13:30

2² + 3² = 4²
Proof by off-by-one error.
#math #maths
https://cdn.fosstodon.org/media_attachments/files/112/452/818/387/313/898/original/94a24b41afc3f9e5.png

2024-05-16 22:42:57

- reply

That would be great.... if aespipe(1) supported it.

2024-05-16 19:13:30

- reply

Okay, playing with it, it's not *horrible*.
% echo "hello world" | aespipe
Password:
Error: Password must be at least 20 characters.
Of course, it's is stopping me from doing providing "00000000000000000000" as the password either:
% echo "hello world" | aespipe | xxd
Password:
00000000: 403b 05ac 272e 04ad 2238 61a9 0363 fba0 @;..'..."8a..c..

2024-05-16 19:01:57

- reply

Yeah, I noticed that also. I intend on digging through the source code to verify, but I suspect it's not a typo.
1 pass of SHA-256, then 1+ iterations of AES-128 before finalizing.

2024-05-16 18:53:15

- reply

Don't use aespipe(1).

2024-05-16 18:52:57

- reply

We CAN specify the iteration count:
> -C itercountk
> Runs hashed passphrase through itercountk thousand iterations of AES-256 before using it for data encryption. This consumes lots of CPU cycles at program start time but not there‐ after. In combination with passphrase seed this slows down dictionary attacks. Iteration is not done in multi-key mode.
No recommendations what the count should be, no min count enforced, and specifying the iteration count is not default.
#crypto #cryptography

2024-05-16 18:50:32

- reply

> -H phash
> Uses phash function to hash passphrase. Available hash functions are sha256, sha384, sha512 and rmd160. unhashed1 and unhashed2 functions also exist for compatibility with some obsolete implementations. Hash type names are case insensitive.
SHA-256, SHA-384, SHA-512 are not great, but if we have some ability to do some custom iterations, maybe it won't be terrible.
RIPEMD-160 is definitely a questionable choie.
But unhashed1, and unhashed2? WTF?
#crypto #cryptography
2/3