Truth, Computing and Fail

  • rss
  • Home
  • About

One time XOR pad with /dev/urandom

anomit | June 27, 2008

I made one :) I think doing a md5 hash of the resulting ciphertext would add an extra layer of security. What do the others think of this idea? Of course, the safe storage and transmission of the XOR key becomes an issue. Check the code and see if you could come up with suggestions to optimize it. I particularly don't like the exponential order for loop at the very end. The XOR key is stored in the xor-key file in the same directory where the code is run.

PYTHON:
import sys

if len(sys.argv)<=1:
    print 'Usage: python basicsalt.py <input file>'
    sys.exit(1)

frandom=open('/dev/urandom','r')  #open the random device
fpickle=open(sys.argv[1],'r')   #open the input file in read-only mode
bytes=1024

key=open('xor-key','w') #open/create the xor-key file

picklebuf=fpickle.read() #read the input file
fpickle.close()

fpickle=open(sys.argv[1],'w')   #open the input file in write mode
                #the ciphertext is stored in the same file
tempicklebuf=''   #temporary buffer for storing the ciphertext

fileLen=len(picklebuf)
print fileLen

#a function that doesn't exactly 'add' the salt in the classical sense of the term
def addsalt(pb,sb,fileLen):
    global tempicklebuf
    for i in range(fileLen):
        tempicklebuf+=chr(ord(pb[i]) ^ ord(sb[i]))  #just plain XOR

bufsalt=frandom.read(fileLen)
addsalt(picklebuf,bufsalt,fileLen)
key.write(bufsalt)

fpickle.write(tempicklebuf)
frandom.close()
key.close()

Comments
2 Comments »
Categories
Coding, GNU/Linux, Security
Tags
cryptography, python
Comments rss Comments rss
Trackback Trackback

Tech blogging: you are doing it wrong

anomit |

Ladies and gentlemen, fasten your seat belts and get ready to be taken through a whirlwind tour through the kingdom of the self proclaimed 'tech bloggers' who profess to live, eat and breathe technology. Soon you would come to know they fart too.

Some generalized observations on the sweeping epidemic that is 'tech blogging' :

1. Someone starts a damn, fucking blog with a nice theme. Point to be noted. He could later throw around that fact and claim to be a CSS geek.

2. He starts writing vociferously about mobile phones, 'gadgets', 'latest tech news' (sic), 'tips and tricks' (did I forget to add Windows here?), 'tweaks' (o yeah, what's next? tweaking nipples video on youtube?) etc etc

3. Uses the term 'geek' atleast once while describing himself.

That is all that is there to it. Uhm..you would say how do I term it as an epidemic? Let me begin with some specific cases in the Indian blogosphere scene. Cases that would make Tim Berners Lee cringe.

--------
Case I:
--------

Ashfame tech blog

What is it about: So this guy is a tech blogger. Heck, he knows he is damn popular. He even tom toms his blog stats in a separate post.

What does his blog offer: Let us allow him to describe it himself, "I blog about blogging, tips and tricks, tutorials, hacking, hardware and reviews. A niche is less than what I blog about."

Fart factor (on a scale of 10): 9.5

Quick analysis: Looking at the first page, I see posts on Opera download, some obscure tool for creating animated gif, 'tips' on using IrfanView (aargh) and write protecting USB drives. No need to take the pain to delve dipper into the guano. Mr. Ashfame, you'd have got a 8 but for your zomg-look-i-am-a-hacker posts. Now Mr. Ashfame has 'tips' for becoming a hacker too! No wonder the old farts at AntiOnline are going to lose their jobs soon. In his md5sum post, he has a radically different view of the security of hash functions:

It is extremely unlikely for two non-identical files to have same md5sum as calculated by hashing algorithms (however the theory says something else).

Extremely unlikely, no way. The very nature of the 128-bit md5 hashing function opens it up to collisions as some researchers have already demonstrated and which I am not fully qualified to discuss. Mr. Ashfame, I have a task for you. I have a XOR encrypted C source file. Let me see you break it. This hint should be enough for you as I presume you have extensive knowledge of something even more secure than this i.e. one-way hashing functions.

--------
Case II
--------

Akshay Gandhi's tips & tricks and blah blah...

What is it about: A blog that would give you tons of info on freeware and...again...*bangs head on a wall* tips & tricks!

What does his blog offer: Again, nothing better than allowing the person himself to demonstrate it to you.

An ALL INCLUSIVE BLOG - Find trivias, graphology, Vista tips, troubleshooting, mobile secrets, mobile code, reviews, freewares, tips, tricks,legal info, law firms, legal view, jokes, interesting facts, etc...

Fart factor (on a scale of 10): 9

Quick analysis: An all inclusive blog. What more could you ask for, eh? But wait, I thought people satisfied those needs by visiting santabanta.com . Some remarkable gems from the first page: Power Defragmenter 2.0.125, Rapid Typing tutor (they still have openings for typists?) and some shit about System Restore in Vista. Seriously dude, if you need 'tips & tricks' for working on Vista you better re-evaluate your current technical knowledge base.

----------
Case III
----------

John TP

Do I need to say more?

*SIGH* See, how things get redundant after a short trip to only two blogs? Redundancy, as we have come to know, is frowned upon in the computing world. We have extremely reliable and well edited sources of information for gadgets and cellphone news, new softwares, games and OS releases, major policy upheaval by decision makers in Government and all that on the Wired, Ars Technica, Endgadget, ZDNet blogs (no, I won't be mentioning TechCrunch here) and a lot many which I don't visit but have a loyal reader base. The point I'm trying to make here is that don't fucking post just for the sake of it if you don't have anything new to add to the already vast source of information available on the same topic. Why? It gets really frustrating for a newbie who would google for something like optimizing his PC and would end up at the countless sites like the ones mentioned above. Total wastage of his bandwidth and time. If an established site has already covered the same thing, DO NOT fucking post the same thing again. (Do I sound like Brad Pitt here?)

BONUS TIP: Stop using Windows and you'd never need to rummage through such shitholes for optimizing applications. There are enough GNU and other open source tools that come bundled with all *nix OSs which would take care of such nifty matters. Case in point: iptables or Zone Alarm?

Get a cue from the blogs of the numerous FOSS developers and also programming stalwarts like Jeff Atwood. Write something that really matters, has some real content. Else, just fucking get off the tube. You are doing no good to us. Just because you have been handed an internet connection, you can't get away with swinging your fuckin badass boner like it was nobody else's business (read: posting content with 8+ fart factor).

Signing off, as the lords of code would say:

Talk is cheap. Show me the code.

Comments
7 Comments »
Categories
Blog, Coding, GNU/Linux, My Life
Comments rss Comments rss
Trackback Trackback

ISPs and RandomBigMusicCorp- FAIL

anomit | June 20, 2008

A storm of discussions and opinions has been kicked up in the online community regarding the decision of some ISPs to introduce metered access. The argument put forward by the ISPs is that while majority of the people use their internet connection for casual e-mails and browsing stuff, the smartass motherfuckers in this minority get away with downloading tons of movies, music, software etc etc even though both of them shell out the same amount for access. Don't be fooled, all their trash talk about inadequate infrastructure to handle the burgeoning demand of bandwidth is crap. They have been finding a way to deal with since the last 15 years. They would do quite well to repeat the same in the future too. If they are actually concerned about the customer who pays more yet uses less, why don't they introduce some special plan for these kind of users where they would be charged for something like per 500 MB of data transfer? That would be enough to handle your 'casual surfers'. Face it assholes, the internet is no more about just e-mail and HTML 3.1 . We have come a long way since that.

How does the rant against the big music corps figure in this discussion? Well, you would soon see how they are related. Yesterday I was listening to songs on the last.fm recommendations radio with the '80s tag. I came across a band named Kix, which was one of those countless glam metal/sleaze rock bands from L.A. who had a meteoric rise only to fade away that soon. I don't remember the track name but it was terrible shit and someone in the shoutbox said that the band sounds like a 'poor man's version of Ratt'. To put it in a word, batshit. Now, if the big music corps were to have their way, I would have been forced to buy a copy of the whole album only to be stomping over the CD after a single session of listening to it. Don't mention iTunes. I find paying 99 cents for each track equally retarded. If my internet connection was supposedly metered and I was just inching towards the 40 GB limit they imposed on my connection, I would have thought twice before streaming the song, thereby having no other choice but to buy the CD.

The point here is that both these businesses are working on concepts and models that are totally outdated and irrelevant in today's highly advanced technological society. The bands and artists have always made shitloads of money even if their albums have been a modest success at best. 'There can never be adequate compensation for an artist's efforts' is just BS. People have families to look after, kids to raise, ailing parents to tend to. They don't earn just to splurge on some airheaded diva. If RandomBigMusicCorp still plays the same stuck record, tell them to shoot the artists so that they could go to heaven and play with dollar bills and dive in pools of gold coins like Uncle Scrooge.

So here is to both of you,

fail

P.S. Haven't posted anything technical for a while. Surely will make up for it within the next 3-4 days :)

Comments
No Comments »
Categories
Uncategorized
Tags
rant, suppression
Comments rss Comments rss
Trackback Trackback

A first look at Firefox 3 through the eyes of a sleep-deprived troll

anomit | June 18, 2008

Most of my smarter fellow 'tech bloggers' might have already informed you of the Firefox 3 release, the clamor for a world record and their subsequent reviews with lots of eye-candy screenshots and inconsequential shit like how the new smooth, rounded buttons and neater icons make them want to crap in their pants.

This is coming from a user who made the jump straight from v2.0.0.14 to v3 with only a couple of times of using the beta versions that were released over the past 2 months. As you type in the address bar, as I had already noted in the beta versions, FF takes a dictionary based indexing approach to the page titles in addition to the standard indexing on URL. This is much better when you remember the context of a page you visited but not the URL. The memory load is significantly lower than the previous version as a quick qualitative analysis of the processes currently running shows. The drop down choices in the input boxes have a quick, jumpy fade out effect which, well, could be improved. It looks cheesy. The bookmarks toolbar has a 'most visited' folder. I haven't yet uninstalled v2 as I'd like to make a better comparison between the two.

I enjoyed the live stream the Mozilla team put up at air.mozilla.com :)
Oh, btw, if you still don't know the link, here it is (only for linux distros). Hopefully changing os=windows in the URL would be good for you dowze boys.

P.S.: It has been raining here for 32 hours non-stop and it is sickening. I haven't been able to step out of the house. Hence the trollish behavior.

Comments
No Comments »
Categories
Uncategorized
Comments rss Comments rss
Trackback Trackback

Senior Project

anomit | June 11, 2008

Just imagine the apocalyptic response from the faculty if someone tries to do this in a college here :P
Do check out his presentation too.

Comments
No Comments »
Categories
Uncategorized
Tags
college, faculty, stupidity
Comments rss Comments rss
Trackback Trackback

New Page

anomit | June 8, 2008

Created a new, plain Jane page at /ssf-projects that would record my progress in working with the SSF framework and the various network models supplied with it. I figured out I needed a large area for displaying the code, so dropped the idea of including it as a static page. Before that I toyed with the idea of creating a static page that would display only posts from the SSF category and excluding posts from that category from being displayed on the main blog. Got to know of a couple of nice ideas from Sindhu and Aditya. I also think that explaining what I'm working on simply wouldn't be worth the effort as unless someone is working on that framework, it wouldn't interest him/her.

Comments
No Comments »
Categories
SSF
Comments rss Comments rss
Trackback Trackback

So…sup?

anomit | June 5, 2008

After relaxing for 5 days and staying away from the internet as much as possible, I'm back to some serious work.

Wrote a client and server process in python where the client sends inorder arithmetic expressions(not parenthesized, as of yet) and the server evaluates them and returns the result to the client. Pretty lame but I think it was good for an hour's effort :D . And Harsh, if you are thinking it is a threaded server, sorry its not :P
Server
Client

Coming to the other thing I'm working on, it is simulation of a network model with SSFNet and I won't lie, at the moment I am not able make any head or tail of how to proceed with the work.

If you don't wanna take the trouble of downloading the files and just want to check the code, read on:
Read the rest of this entry »

Comments
No Comments »
Categories
Coding, My Life
Comments rss Comments rss
Trackback Trackback

What's in

  • Democracy and freedom: We don’t deserve it
  • Parsing XML in Python
  • Wuss R Us
  • Round robin process scheduling simulation
  • Just what I have been saying

 

June 2008
M T W T F S S
« May   Jul »
 1
2345678
9101112131415
16171819202122
23242526272829
30  

Blogroll

  • Akhshay’s blog
  • Harsh J
  • Hullap
  • LUG manipal
  • Manish Sinha
  • Sindhu S
  • Swap

Tags

aircrack assembly build college cryptography faculty fuckery gnuplot hacking mpd NASM plugin python rant scheduler simulation SSFNet stupidity suppression syscall syscalls unix xchat xml

Archives

  • November 2008
  • September 2008
  • August 2008
  • July 2008
  • June 2008
  • May 2008
  • April 2008
  • March 2008
  • February 2008
  • January 2008
  • October 2007
  • September 2007
  • July 2007
  • June 2007
  • May 2007
  • April 2007
  • March 2007

License

Creative Commons License
This work by Anomit Ghosh is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 2.5 India License.
rss Comments rss valid xhtml 1.1 design by jide powered by Wordpress get firefox