Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
No one would even assume that someone chose a single character. People with bad intentions would start at with a minimum of 4 or 6 characters?
This way, in case of just bruteforcing your way in, you are indeed very safe. They would brute force into infinity...
How did xkcd predict this so perfectly?
when you look for a pattern hard enough, it'll appear sooner or later
What if the person who chose 4 made a reference to xkcd
I bet their machine's password is correctHorseBatteryStaple
eMudhra was probably required to be IEEE-RFC-1149.5 compliant.
Iirc that's in reference to the PS3?
That was quick.
So yeah, check your shit. I was having fun until I tested if we were affected
How do you check your shit? I don't even understand what I'm checking for
If you see hello when you got to this site instead of getting an insecure warning, you've got a bit of a problem. https://emuhdra.we-have-a-problem.com/
I think my pihole filtered that dns request
Still don't understand what this is looking for? I recently fired up a server and this all seems like something I should be worried about but I don't really know how to look up the right words. Is there a way for me to go to this site through the cli so I can check on my server? And if my server says hello when I look what does that mean?
it’s tricky because browsers check certificates in 1 way, operating system tools check in another way, and programming languages often check in another way again… and if you run docker containers, they’ll need updates - not just your host OS
browsers should be fine automatically (they check for certificate revocation before even software updates), and system updates on linux at least should cover some things like node, but then you have eg python which ships CA bundles with libraries so will require package updates there or rust which (apparently) often compiles its trust store into its binaries so would require a recompile
this site will easily check browsers, and further down there are curl commands (curl will test your OS trust store), and you could load the same URL in various languages to test them, but again that’s a lot of work to go to when you also have to do that across all docker containers and virtual environments, etc and still tells you nothing about rust binaries
https://emudhra.we-have-a-problem.com/
same advice as ever: stay up to date, do the best that you can… upstream projects will get CVE reports for vulnerable libs, and it should be a very easy to backport a fix so security patches should be quick and easy, even on old versions of software
*edit: that site also lists minimum versions of a lot of things like OS packages, language packages, etc
Do you have certificates you've issued to your stuff?
I've used certbot to enable https if that's what you mean
Letsencrypt is clean so your services are good
Browsers are getting patched, you can check if you've updated recently before doing online banking or other stuff.
This is now hanging up in a state office somewhere, at someones desk.
I did that.
with your fingers
That doesn't sound right, but I don't know enough about four to dispute it.
Is there actually a downside to just, typing a random string of numbers manually over a number generator?
Yes, typing randomly isn't actually as random as it could be, so a generator will do a better job.
However mashing the keyboard is absolutely better than literally just "4" lol
What if the generator rolled a 4 though?
Then go buy a scratcher
first, what if i have my cat do it. second, why does it matter if a string is maximally random? is there a certain level that is random enough?
Generators aren't intrinsically random either, the project that's closest to random is the lava light room at cloud flare. But a wall of lamalamps aren't random enough, so they add in a few parameters from the moon.
But ultimately, it's not truly random.
Most generators are magnitudes simpler than that and honestly mashing everything at random yourself does a pretty good job at it. Especially if you smash too many characters and then scrambles it before picking a sequence without thought. As the biggest issue with manual button smashing, is the same character either won't appear twice in a row ever or will always appear multiple in a row. Not to talk about special letters, which you likely wouldn't hit - although we could make larger keyboards for the lulz
Ultimately random generators is just a simpler/faster solution, but there's ways of doing something as randomly by hand
You are not random enough, that's why we have this: https://en.wikipedia.org/wiki/Hardware_security_module
I'm not random enough? But I was holding up a spork! From my Invader Zim bag!
This is why Hot Topic girlies are not in charge of crypto standards. They're "OMG so random", but not mathematically so random.
Those are all technically words in some dictionary somewhere, arranged in a sensible grammatical order. The entropy is not as high as you may think
It is not random enough to not be guessed by a state sponsored bot
Aside from humans being terrible random number generators, not as such.
It's better to seed a CSPRNG with a source of entropy though. E.g. there are tools that let you enter the result of many dice rolls and use it to generate a key.
I caught the xkcd reference. But why olives?
It's actually an olive reference, with just a little bit of xkcd thrown in:
Why would I regret eating olives? Because they're salty? Or maybe because I don't like olives?
I don't know. Maybe just eat 30 to 40 and find out?
Well now I regret even asking 😜
It's originally a meme about eating 30 olives for dinner.
So that's why entropy checks exist.
'4' is actually a great choice if the attackers would start searching from the highest number down. In fact there are only 4 other possiblities that are better: 0,1,2 and 3. And that is assuming the worse case where '0' is a legal choice. /s