Blog/February 2017/Feb 24th - Revision history

Ron at 07:13, 3 March 2017

2017-03-03T07:13:40Z

Ron at 09:11, 24 February 2017

2017-02-24T09:11:03Z

Ron at 09:10, 24 February 2017

2017-02-24T09:10:24Z

Ron: Created page with " {{blog}} '''February 24th''' Well, my wife and I have been battling colds off and on. She started it, and passed it o..."

2017-02-24T08:16:27Z

Created page with " {{blog}} '''February 24th''' Well, my wife and I have been battling colds off and on. She started it, and passed it o..."

New page

{{blog}}

'''February 24th'''

Well, my wife and I have been battling colds off and on. She started it, and passed it on to me. My resistance to her is very low (in all regards), so I took up where she left off. It started with a very painful sore throat, which passed in a few days. I thought it was over, but no; my entire mucus production system has gone into overdrive, and now I sound like a gravel-eating frog.

At least there’s Sudafed.

Speaking of medical issues, I took Esther to have a [http://www.mayoclinic.org/tests-procedures/colonoscopy/basics/definition/prc-20013624 routine colonoscopy] this week. I wouldn’t normally publicly divulge that sort of information about her, but she suggested that perhaps it might spur others to do the same. And given my family history of waiting too long to be checked-out, I agreed with her. So. Everything was fine, B”H; though they did take a couple polyps for further examination. She’ll revisit the doctor after ''pesaḥ'' to hear if there’s any reason to make her visits more frequent.

A few minutes of discomfort can save your life.

There was a very significant development in the crypto-world this week. Researchers at Google and the CWI Institute in Amsterdam [https://www.schneier.com/blog/archives/2017/02/sha-1_collision.html created an SHA-1 hash collision] in a “practical” manner. It’s been known for years that SHA-1 has theoretical weaknesses, but this is the first publicly known intentional hash-collision. I say “practical” in quotes, because the computation required 6,500 years-worth of CPU time and 110 years of GPU time. That’s a lot of computing power, but clearly if Google could pull it off, the NSA and the Chinese could also do it. Perhaps large criminal enterprises could also manage it.

What does it mean for you? Not too much in the near-term. However, in practical terms it means that it is now possible (if not truly feasible) for someone to create a fake electronic document which is “identical with” some other document — “identical” as far as its [https://en.wikipedia.org/wiki/SHA-1#SHA-0 SHA-1 hash] is concerned. This matters because quite a few software products rely on using SHA-1 to determine the authenticity of a document. For example, the [https://git-scm.com/book/en/v2/Git-Internals-Git-Objects git software-control system] as well as [https://www.fossil-scm.org/index.html/doc/trunk/www/index.wiki fossil], which hundreds of thousands of developers use to store their code, use SHA-1 hashes to validate that code has or hasn’t been modified. A determined attacker could possibly create virus-laden code which produces the same SHA-1 hash as “good” code, and thereby subvert the source-code of some product used by millions. For instance: the Linux kernel. That’s not a good thing.

''Jew Haiku'':<blockquote>
Hashes collide now<br>
Nothing done<br>
We own your code base
</blockquote>

Daniela and Jeremy returned to the USA from their trip to England. Sarah’s got plans for a short European trip (more on that next week). And Esther and I hope, some day, to be able to vacation in [https://en.wikipedia.org/wiki/Dimona Dimona]. I hear it’s nice there, this time of year.

I’ve been juggling two contracts as well as [http://8th-dev.com/forum/index.php/topic,1194.msg6440.html 8th development] and a cold. And catching-up with laundry. It’s been a tiring week, and I’m really and truly ready for ''shabbat'' and so are Esther and Sarah!

This ''shabbat'' it’s just the three of us. We’ll have:
<br>
homemade ''ḥalla'',
red lentil soup,
spice-rubbed baked chicken,
veggie [https://en.wikipedia.org/wiki/Chow_mein chow-mein],
roasted cauliflower,
roasted potatoes,
veggie ''cholent'',
various [http://www.joyofkosher.com/recipes/collection/recipe-terms-salatim/ ''salatim''],
fruit,
and [https://en.wikipedia.org/wiki/Blackcurrant blackcurrant] muffins.

Until next time,<br>
''shabbat shalom''!

{{nav|Blog|Blog|Blog/February 2017/Feb 17th|Feb 17th||}}

← Older revision		Revision as of 07:13, 3 March 2017
Line 47:		Line 47:


−	{{nav\|Blog\|Blog\|Blog/February 2017/Feb 17th\|Feb 17th\|\|}}	+	{{nav\|Blog\|Blog\|Blog/February 2017/Feb 17th\|Feb 17th\|Blog/March 2017/Mar 3rd\|Mar 3rd}}

@@ Line 17: / Line 17: @@
 What does it mean for you?  Not too much in the near-term.  However, in practical terms it means that it is now possible (if not truly feasible) for someone to create a fake electronic document which is “identical with” some other document — “identical” as far as its [https://en.wikipedia.org/wiki/SHA-1#SHA-0 SHA-1 hash] is concerned.  This matters because quite a few software products rely on using SHA-1 to determine the authenticity of a document.  For example, the [https://git-scm.com/book/en/v2/Git-Internals-Git-Objects git software-control system] as well as  [https://www.fossil-scm.org/index.html/doc/trunk/www/index.wiki fossil], which hundreds of thousands of developers use to store their code, use SHA-1 hashes to validate that code has or hasn’t been modified.  A determined attacker could possibly create virus-laden code which produces the same SHA-1 hash as “good” code, and thereby subvert the source-code of some product used by millions.  For instance: the Linux kernel.  That’s not a good thing.
-''Update'': 6500 years of CPU is 56,940,000 hours.  The Amazon EC2 service offers CPUs for rent at a current price of $1.591 per hour for a 36-CPU machine (or $ 0.04419 per CPU-hour).  Thus, one could purchase the computing power needed for a mere $2,516,178 in current US dollars.  Round to $5 million to include overhead costs such as software development and personnel.  Forget what I said about governments; you could fund it with a Kickstarter campaign…
+''Update'': 6500 years of CPU is 56,940,000 hours.  The [https://aws.amazon.com/ec2/pricing/on-demand/ Amazon EC2] service offers CPUs for rent at a current price of $1.591 per hour for a 36-CPU machine (or $ 0.04419 per CPU-hour).  Thus, one could purchase the computing power needed for a mere $2,516,178 in current US dollars.  Round to $5 million to include overhead costs such as software development and personnel.  Forget what I said about governments; you could fund it with a Kickstarter campaign…
 ''Jew Haiku'':<blockquote>

← Older revision		Revision as of 09:10, 24 February 2017
Line 16:		Line 16:

	What does it mean for you? Not too much in the near-term. However, in practical terms it means that it is now possible (if not truly feasible) for someone to create a fake electronic document which is “identical with” some other document — “identical” as far as its [https://en.wikipedia.org/wiki/SHA-1#SHA-0 SHA-1 hash] is concerned. This matters because quite a few software products rely on using SHA-1 to determine the authenticity of a document. For example, the [https://git-scm.com/book/en/v2/Git-Internals-Git-Objects git software-control system] as well as [https://www.fossil-scm.org/index.html/doc/trunk/www/index.wiki fossil], which hundreds of thousands of developers use to store their code, use SHA-1 hashes to validate that code has or hasn’t been modified. A determined attacker could possibly create virus-laden code which produces the same SHA-1 hash as “good” code, and thereby subvert the source-code of some product used by millions. For instance: the Linux kernel. That’s not a good thing.		What does it mean for you? Not too much in the near-term. However, in practical terms it means that it is now possible (if not truly feasible) for someone to create a fake electronic document which is “identical with” some other document — “identical” as far as its [https://en.wikipedia.org/wiki/SHA-1#SHA-0 SHA-1 hash] is concerned. This matters because quite a few software products rely on using SHA-1 to determine the authenticity of a document. For example, the [https://git-scm.com/book/en/v2/Git-Internals-Git-Objects git software-control system] as well as [https://www.fossil-scm.org/index.html/doc/trunk/www/index.wiki fossil], which hundreds of thousands of developers use to store their code, use SHA-1 hashes to validate that code has or hasn’t been modified. A determined attacker could possibly create virus-laden code which produces the same SHA-1 hash as “good” code, and thereby subvert the source-code of some product used by millions. For instance: the Linux kernel. That’s not a good thing.
		+
		+	''Update'': 6500 years of CPU is 56,940,000 hours. The Amazon EC2 service offers CPUs for rent at a current price of $1.591 per hour for a 36-CPU machine (or $ 0.04419 per CPU-hour). Thus, one could purchase the computing power needed for a mere $2,516,178 in current US dollars. Round to $5 million to include overhead costs such as software development and personnel. Forget what I said about governments; you could fund it with a Kickstarter campaign…

	''Jew Haiku'':<blockquote>		''Jew Haiku'':<blockquote>