Conversation

Notices

1. menherahair (menherahair@eientei.org)'s status on Thursday, 06-Apr-2023 04:38:13 JST menherahair

   • Yukkuri

   am I retarded?? the keys don’t match I’ve never done this before :beacringe: @iamtakingiteasy

   •  (mint@ryona.agency)'s status on Thursday, 06-Apr-2023 04:38:12 JST 

     in reply to

     • Yukkuri
     @menherahair @iamtakingiteasy Might be a malicious exit node MitMing SSH.
   • Yukkuri (iamtakingiteasy@eientei.org)'s status on Thursday, 06-Apr-2023 04:59:49 JST Yukkuri

     in reply to

     • 
     @menherahair @mint You really should link the page you are referring to, screenshots are just a waste of time when not used for purely illustrative purposes. Gitalb already had issues with generating correct fingerprints on /help/instance_configuration page and there were attempts of fixing in 11.x, but it still reproduces, on 15.4, 15.8 and gitlab.com itself as well. Simply ignore whatever glorified shellscript tells you with markup runes, trust proper C implementation of ssh-keyscan/ssh-keygen.
      likes this.
   • menherahair (menherahair@eientei.org)'s status on Thursday, 06-Apr-2023 04:59:50 JST menherahair

     in reply to

     • 
     • Yukkuri

     @mint @iamtakingiteasy same with no tor

   • Yukkuri (iamtakingiteasy@eientei.org)'s status on Thursday, 06-Apr-2023 05:23:15 JST Yukkuri

     in reply to

     • 
     @menherahair @mint I had the fun of implementing RTMP server before webrtc became a thing and flash was the way to go for streaming. There is official semi-public adobe documentation that does two things: demands you comply to the spec and tells you handshake C1/C2/S1/S2 packets contents should be random. In reality, the random bytes are used for simple DH key exchange with keys hidden in random data on calculated offsets, making any FOSS implementation following the publicized spec incapable of communicating with commercial counterparts, including the flash plugin. But luckily, it was reversed, so actual implementation examples also exist.
      likes this.
   • menherahair (menherahair@eientei.org)'s status on Thursday, 06-Apr-2023 05:23:16 JST menherahair

     in reply to

     • 
     • Yukkuri
     @iamtakingiteasy @mint >Sometimes on purpose (hi, adobe).
     can't exactly call myself surprised, but that's still fucked up. tell me more
   • Yukkuri (iamtakingiteasy@eientei.org)'s status on Thursday, 06-Apr-2023 05:23:17 JST Yukkuri

     in reply to

     • 
     @menherahair @mint Documentation always lies. Sometimes on purpose (hi, adobe). Trust only the sources and only after you built it yourself.
   • menherahair (menherahair@eientei.org)'s status on Thursday, 06-Apr-2023 05:23:18 JST menherahair

     in reply to

     • 
     • Yukkuri

     @iamtakingiteasy @mint never listen to documentation, got it

   •  (mint@ryona.agency)'s status on Thursday, 06-Apr-2023 05:24:27 JST 

     in reply to

     • Yukkuri
     @iamtakingiteasy @menherahair Reminds me of how AOL used to break unofficial ICQ clients like QIP, with the same pseudo-random numbers during handshake.