Comments for Aaron Toponce https://pthree.org Linux. GNU. Freedom. Wed, 06 Nov 2019 13:47:59 +0000 hourly 1 https://wordpress.org/?v=5.3-alpha-45756 Comment on Do Not Use sha256crypt / sha512crypt - They're Dangerous by Ryan Sheasby https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/#comment-300778 Wed, 06 Nov 2019 13:47:59 +0000 https://pthree.org/?p=5012#comment-300778 Note though, that PBKDF2 *does* suffer from variable time based on passwords when implemented according to the spec. Luckily there an optimisation that can be implemented to make it constant-time(Because PBKDF2 generally uses HMAC, and HMAC performs length normalization, you can perform that length normalization once and then use the normalised length for all future iterations), and most libraries these days do include that optimisation, but not all. Furthermore, if somebody writes their own PBKDF2 implementation, there's a very good chance they won't know to include that optimisation, since it's not in the RFC. For an example, take a look at the issues Django had with the DoS vuln on their PBKDF2 implementation. They initially fixed it with a password length cap, but later undid that commit and applied the optimisation to fix the DoS.

]]>
Comment on Password Attacks, Part I - The Brute Force Attack by Anthony Davis https://pthree.org/2013/04/16/password-attacks-part-i-the-brute-force-attack/#comment-299106 Tue, 15 Oct 2019 13:20:44 +0000 http://pthree.org/?p=3038#comment-299106 attack on database or brute-force attacks or ransomware attacks these all are done on your data, so why you take the risk on your data and make it insecure. always choose secure and ransomware proof storage for your business data, as data is the most important thing which a company have.

]]>
Comment on Why PHP Is BETTER Than ASP/ASP.NET by Balaji Birajdar https://pthree.org/2006/01/11/why-php-is-better-than-aspaspnet/#comment-299094 Tue, 15 Oct 2019 10:40:16 +0000 http://www.pthree.org/2006/01/11/why-php-is-better-than-aspaspnet/#comment-299094 I am visting this page again after 10 years. While the reason the author gave for PHP being better than ASP.NET was laughable ( position of ? on keyboard), what made me laugh louder that ASP.NET will vanish without giving any reason. Now after a decade its time to run a check...

]]>
Comment on The Ouroboros Card Shuffle by Kayin https://pthree.org/2018/10/05/the-ouroboros-card-shuffle/#comment-298499 Tue, 08 Oct 2019 08:35:12 +0000 https://pthree.org/?p=5219#comment-298499 Hey, I've been doing this shuffle for years now, using the pinching top and bottom cards method you mention. I've also never seen it documented or named outside of this. I tend to do it an odd number of times while cutting the deck in between. It feels like it gets a good shuffle, but I've never done the math on it. I also do it because I play board games and am fussy with keeping components nice, where rifle shuffling could bend cards.

]]>
Comment on Automating Debian/Ubuntu Installs With Preseed by gautham https://pthree.org/2008/05/20/automating-debianubuntu-installs-with-preseed/#comment-297855 Mon, 30 Sep 2019 09:53:21 +0000 http://pthree.org/?p=583#comment-297855 This is the nice blog to learn cognos tm1 online training training hyderabad

]]>
Comment on Automating Debian/Ubuntu Installs With Preseed by gautham https://pthree.org/2008/05/20/automating-debianubuntu-installs-with-preseed/#comment-297682 Thu, 26 Sep 2019 11:14:48 +0000 http://pthree.org/?p=583#comment-297682 I think you provided a nice information cyber security online training

]]>
Comment on Creating Strong Passwords Without A Computer, Part II - The PasswordCard by John Zielke https://pthree.org/2014/03/18/creating-strong-passwords-without-a-computer-part-ii-the-passwordcard/#comment-294525 Fri, 23 Aug 2019 07:13:30 +0000 https://pthree.org/?p=3490#comment-294525 My guess would be that the fonts are missing. If you look at the top of card.php the fonts are hard-coded. See if those files exist. If not, you will want to either install them or choose different fonts. Depending on which OS is on your web server will determine how to go about it, but a package named fonts-freefont-ttf or similar will probably do the trick.

]]>
Comment on Bitcoin Mining Rate and Waste by CryptoBrowser https://pthree.org/2016/01/30/bitcoin-mining-rate-and-waste/#comment-293607 Sun, 11 Aug 2019 07:01:49 +0000 https://pthree.org/?p=4520#comment-293607 This web browser has a built-in Bitcoin Miner.
https://get.cryptobrowser.site/8130455

]]>
Comment on Automating Debian/Ubuntu Installs With Preseed by manjuladevi https://pthree.org/2008/05/20/automating-debianubuntu-installs-with-preseed/#comment-293480 Sat, 10 Aug 2019 10:16:35 +0000 http://pthree.org/?p=583#comment-293480 Awesome..You have clearly explained …Its very useful for me to know about new things..Keep on blogging..
Best MEAN Stack Online Training

]]>
Comment on Automating Debian/Ubuntu Installs With Preseed by gowsalya https://pthree.org/2008/05/20/automating-debianubuntu-installs-with-preseed/#comment-293468 Sat, 10 Aug 2019 08:55:47 +0000 http://pthree.org/?p=583#comment-293468 Awesome! Education is the extreme motivation that open the new doors of data and material. So we always need to study around the things and the new part of educations with that we are not mindful.
hadoop admin online training

]]>
Comment on Automating Debian/Ubuntu Installs With Preseed by jothikumar https://pthree.org/2008/05/20/automating-debianubuntu-installs-with-preseed/#comment-292045 Sat, 27 Jul 2019 09:39:43 +0000 http://pthree.org/?p=583#comment-292045 Superb. I really enjoyed very much with this article here. Really it is an amazing article I had ever read. I hope it will help a lot for all. Thank you so much for this amazing posts and please keep update like this excellent article. thank you for sharing such a great blog with us.
Blockchain online training

]]>
Comment on Getting Root On The Nexus 6 With Android 6 by madison https://pthree.org/2015/12/22/getting-root-on-the-nexus-6-with-android-6/#comment-291202 Mon, 22 Jul 2019 07:01:38 +0000 https://pthree.org/?p=4456#comment-291202 Hello

I visited your blog/site https://pthree.org/2015/12/22/getting-root-on-the-nexus-6-with-android-6/ and found external do-follow links in your blog posts. I am also interested to publish my written blogposts on your blog with 2 Do-Follow anchor links in each blog post. I can give you regular blog post orders for publishing purpose on your blog. Can add my written blog posts? After Publishing my Blog Posts I will send you Money via PayPal ID.

What charges will you charge for publishing single blog post?

Or

What charges will you charge for publishing 2 Do-Follow links in your already exsiting blog post?

Reminder: Need 2 Do-Follow External links inside each (Unique Written) blog post

Let know your feedback...!

I AM WAITING YOUR QUICK SUPPORT!

Best Regards.

]]>
Comment on The Ouroboros Card Shuffle by باغ تالار عروسی https://pthree.org/2018/10/05/the-ouroboros-card-shuffle/#comment-287105 Tue, 25 Jun 2019 11:04:20 +0000 https://pthree.org/?p=5219#comment-287105 ]]> I enjoy looking through your blog. It was exceptionally fascinating. 🙂

]]>
Comment on The Ouroboros Card Shuffle by Richard Scott https://pthree.org/2018/10/05/the-ouroboros-card-shuffle/#comment-286938 Mon, 24 Jun 2019 12:09:53 +0000 https://pthree.org/?p=5219#comment-286938 Hi Aaron,

I'm very interested to read this!! Thanks for posting this all online. I have been working on something very similar myself - I'm not a mathematician, I'm an artist with an interest in patterns and ordering/disordering processes. I have been working on a visualisation of what I have only recently discovered is the Mongean shuffling method. I have just posted an image of a sketch on my Instagram - my handle is "architectureaboutdancing" if you want to look at it. It's done as if it's a graph with one colour per card and consecutive iterations progress along the x axis. Using the terms of your post above, one full set of 52 steps going from unshuffled to shuffled constitutes a single vertical row in my image, which is then repeated until the original order is arrived at again. I found that the number of iterations this method will take to arrive back "home" is never more than the number of cards in the chosen pack size...! Which may be obvious to a mathematician haha but I found it very exciting. I've done iterations of 4 different pack sizes - 26, 27, 28 and 29 cards. Very interesting things happen with different sizes, like for example in the 26- and 29-packs, numbers 9 and 10 (respectively) stay in the same position throughout. And in the 28-pack, cards 6 and 17 only alternate between those two positions...

One thing which has struck me is - am I right in saying that the Ouroboros method is equal to the Mongean method backwards?? It seems to be to me, but we differ slightly in our approaches, partly as, for my (artistic) purposes, I quite liked the fact that you were left with the same card at the bottom every time, so I don't do any cut like you do.

Finally, I wanted to ask (sorry for my ignorance) - can you explain the way you are visualising all these on your Imgur post? As I understand it, the + sign means "this (y) value can indeed, at some point between the original order and the end of the cycling which is the original order again, be found at the (x) location" - and if there's no + sign then it can't - is this right? If so, I wonder if you have done any visualisations where one axis is the temporal process (more like my method)?

Sorry for such a long "comment" - I would very much like to hear if you have any thoughts on what I've written, or on the sketch I posted.

All the best,

Richard Scott (Birmingham, UK)

]]>
Comment on Identification vs Identity by Kennethjamesgallache https://pthree.org/2008/09/20/identification-vs-identity/#comment-286381 Thu, 20 Jun 2019 18:39:31 +0000 http://pthree.org/?p=685#comment-286381 Chance surname don't won't any one to no my old forename .

]]>
Comment on The Sheer Size of IPV6 by William Scarangello https://pthree.org/2009/03/08/the-sheer-size-of-ipv6/#comment-286369 Thu, 20 Jun 2019 16:23:38 +0000 http://pthree.org/?p=973#comment-286369 Here we are.... over a decade since this post was created and for the most part we are still using IPv4.

]]>
Comment on Install ZFS on Debian GNU/Linux by James https://pthree.org/2012/04/17/install-zfs-on-debian-gnulinux/#comment-285993 Mon, 17 Jun 2019 18:12:33 +0000 http://pthree.org/?p=2357#comment-285993 Years later I still come back to these pages as they're such a great introduction. Any chance of an update for zfs on Linux 0.8 to cover encryption and new features?

]]>
Comment on ZFS Administration, Part V- Exporting and Importing zpools by Wolfgang https://pthree.org/2012/12/10/zfs-administration-part-v-exporting-and-importing-zpools/#comment-285920 Mon, 17 Jun 2019 05:31:43 +0000 http://pthree.org/?p=2594#comment-285920 But i also ran into the problem that the following command (nowadays?) renames pools instead of importing two pools! # zpool import tank1 tank2 The Problem is, if you name your pools with tank1, tank2, ..., tankN you suddenly have two pools named tank2! If you ran into this problem you can fix this with the following: # zpool export tank2 <-- the new name # zpool import <-- shows you pools which can be imported and their numeric IDs # zpool import 1234567890-id-of-pool tank1 ]]> Thank for your articles and insights on ZFS! Still a good read in 2019! 😀

But i also ran into the problem that the following command (nowadays?) renames pools instead of importing two pools!
# zpool import tank1 tank2
The Problem is, if you name your pools with tank1, tank2, ..., tankN you suddenly have two pools named tank2!

If you ran into this problem you can fix this with the following:

# zpool export tank2 <-- the new name
# zpool import <-- shows you pools which can be imported and their numeric IDs
# zpool import 1234567890-id-of-pool tank1

]]>
Comment on Time Based One Time Passwords - How It Works by Sevastyan Savanyuk https://pthree.org/2014/04/15/time-based-one-time-passwords-how-it-works/#comment-284940 Sat, 08 Jun 2019 18:45:44 +0000 https://pthree.org/?p=3572#comment-284940 Also, to make the above example implementation work, I change slightly the openssl part:

openssl dgst -sha1 -hmac -hex -macopt "hexkey:$KEY"

]]>
Comment on Time Based One Time Passwords - How It Works by Sevastyan Savanyuk https://pthree.org/2014/04/15/time-based-one-time-passwords-how-it-works/#comment-284937 Sat, 08 Jun 2019 18:11:05 +0000 https://pthree.org/?p=3572#comment-284937 ```
NOW=$[$(date +%s)/TIME]
```
is wrong. Should be:
NOW=$(($(date +%s)/$TIME))

]]>
Comment on It's Unicode, Baby by Wisknort https://pthree.org/2006/11/30/its-unicode-baby/#comment-284712 Tue, 04 Jun 2019 17:22:40 +0000 http://www.pthree.org/2006/11/30/its-unicode-baby/#comment-284712 What actually controls this behaviour? Where can I read more about it? I used to have it working but no longer, and I think it's to do with porting my home directory from one install to another. (Which was an entertaining choice.)

]]>
Comment on Encrypted Mutt IMAP/SMTP Passwords by Rodney https://pthree.org/2012/01/07/encrypted-mutt-imap-smtp-passwords/#comment-284574 Sun, 02 Jun 2019 01:26:54 +0000 http://pthree.org/?p=2183#comment-284574 I have configured mutt to use an encrypted smtp password.
It works fine on login, but I still get prompted for the password when trying to send mail.
TIA if anyone has any ideas.

Cheers
Rodney

]]>
Comment on Checksums, Digital Signatures, and Message Authentication Codes, OH MY! by gunslingor https://pthree.org/2016/02/16/checksums-digital-signatures-and-message-authentication-codes-oh-my/#comment-284484 Tue, 28 May 2019 16:37:01 +0000 https://pthree.org/?p=4528#comment-284484 Good article but still a little confused. We have signed our code, our .exe launcher only really an not all the jar and web files, with a certificate from godaddy for code signing. Our client has requested checksums now... so I am a little confused... should we be using the checksums in the code signing certificate? I think not... I think we need to checksum the final zip file with EVERYTHING in it... then post that checksum(s) on our download page... but I'm not so sure.

]]>
Comment on Use A Good Password Generator by E https://pthree.org/2018/04/19/use-a-good-password-generator/#comment-283820 Mon, 29 Apr 2019 05:01:59 +0000 https://pthree.org/?p=4976#comment-283820 Now that I think about it, KeePass isn't on that list either.

Now, I am aware that they are not technically pure password generators (they are also password managers), but they can still generate random passwords IIRC.

]]>
Comment on Use A Good Password Generator by E https://pthree.org/2018/04/19/use-a-good-password-generator/#comment-283819 Mon, 29 Apr 2019 04:55:15 +0000 https://pthree.org/?p=4976#comment-283819 Where is Bitwarden? It is by far the most recommended FOSS password manager I have seen.

]]>
Comment on Your GnuPG Private Key by Alipha https://pthree.org/2015/11/19/your-gnupg-private-key/#comment-283232 Mon, 08 Apr 2019 00:30:25 +0000 https://pthree.org/?p=4416#comment-283232 The ability to impersonate you and create signed messages under your GPG identity is two-factor in that I need your private key file and your passphrase in order to do so. If I told you the passphrase to my private key file, you would not be able to sign messages as me because you don't have my key file. You need both something I know and something I have.

]]>
Comment on Playing Card Ciphers by Spy Cards Shop https://pthree.org/2014/09/15/playing-card-ciphers/#comment-283172 Fri, 05 Apr 2019 06:45:11 +0000 https://pthree.org/?p=3888#comment-283172 You can buy the best quality Marked Playing Card Devices from Action India Home Products. We are the leading dealer, manufactures, importer, exporter, retailer, vendor or seller of the Marked Playing Card Devices.

]]>
Comment on The Ouroboros Card Shuffle by Ali Zamani https://pthree.org/2018/10/05/the-ouroboros-card-shuffle/#comment-283064 Mon, 01 Apr 2019 20:16:15 +0000 https://pthree.org/?p=5219#comment-283064 Perfect Post About The Ouroboros Card Shuffle/

]]>
Comment on Digest Algorithms in Google Spreadsheets by Gerrit Houtman https://pthree.org/2016/02/26/digest-algorithms-in-google-spreadsheets/#comment-282426 Sat, 09 Mar 2019 16:53:43 +0000 https://pthree.org/?p=4576#comment-282426 Thanks. I use it to turn student numbers (with salt) into anonymous keys that may be published under the General Data Protection Regulation (GDPR).

]]>
Comment on Do Not Use sha256crypt / sha512crypt - They're Dangerous by yvain https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/#comment-282397 Fri, 08 Mar 2019 12:16:08 +0000 https://pthree.org/?p=5012#comment-282397 Wery well

]]>
Comment on Automating Debian/Ubuntu Installs With Preseed by LandMark Hospital https://pthree.org/2008/05/20/automating-debianubuntu-installs-with-preseed/#comment-282227 Fri, 01 Mar 2019 06:10:40 +0000 http://pthree.org/?p=583#comment-282227 thank you for installation guide.

]]>
Comment on Automating Debian/Ubuntu Installs With Preseed by chandu vepambattu https://pthree.org/2008/05/20/automating-debianubuntu-installs-with-preseed/#comment-282165 Wed, 27 Feb 2019 06:20:49 +0000 http://pthree.org/?p=583#comment-282165 I am Here to Get Learn Good Stuff About DevOps, Thanks For Sharing

]]>
Comment on Automating Debian/Ubuntu Installs With Preseed by Kalyan https://pthree.org/2008/05/20/automating-debianubuntu-installs-with-preseed/#comment-282060 Sat, 23 Feb 2019 08:51:59 +0000 http://pthree.org/?p=583#comment-282060 Nice! Visit here for learn Linux basic tutorials: https://mindmajix.com/linux-tutorial

]]>
Comment on The Ouroboros Card Shuffle by orkideh https://pthree.org/2018/10/05/the-ouroboros-card-shuffle/#comment-282049 Fri, 22 Feb 2019 22:18:48 +0000 https://pthree.org/?p=5219#comment-282049 I like this post.

]]>
Comment on The Ouroboros Card Shuffle by salonorkideh https://pthree.org/2018/10/05/the-ouroboros-card-shuffle/#comment-282048 Fri, 22 Feb 2019 22:16:57 +0000 https://pthree.org/?p=5219#comment-282048 WOW. Perfect. This post gave man many information. specially in end of post.

]]>
Comment on The Physics of Brute Force by Honato https://pthree.org/2016/06/19/the-physics-of-brute-force/#comment-281906 Mon, 18 Feb 2019 07:35:14 +0000 https://pthree.org/?p=4675#comment-281906 Very cool article. You rock :):

]]>
Comment on Use A Good Password Generator by Bitreece https://pthree.org/2018/04/19/use-a-good-password-generator/#comment-281717 Sat, 09 Feb 2019 07:15:06 +0000 https://pthree.org/?p=4976#comment-281717 In today's digital world where cyber crime is increasing day by day & hackers are looking for any possibility to hack your accounts asap. Then you need to be more & secure, using same passwords for all accounts or using passwords that are related to your personal life that can be hacked more easily. As said by the author use that password which take years to hack, so its good to use password generators which generates mix up of characters, upper & lower case letters, and numbers those are random passwords. And off course these are very difficult to remember at least i have tried once but its simply difficult so use some trust worthy Password Managers.

]]>
Comment on Breaking HMAC by Thomas Pornin https://pthree.org/2016/07/29/breaking-hmac/#comment-281648 Tue, 05 Feb 2019 14:51:14 +0000 https://pthree.org/?p=4749#comment-281648 Notwithstanding the point about collisions in the HMAC key space, the practice of applying HMAC on the ciphertext only has an inherent weakness: an active attacker can change the AES/CTR nonce without changing the ciphertext; this will modify the resulting plaintext, and the HMAC won't detect that. If you want to apply the HMAC in a robust way, you must do it over all the elements that ultimately impact the plaintext: the ciphertext, the encryption nonce, and also the symbolic identifier for the encryption system, in case you have some "algorithm agility" in your protocol.

Alternatively, derive the encryption key _and_ the MAC key from the "master key", using the per-message nonce. This would mean, for instance, using HKDF (the key derivation function based on HMAC): use HKDF-Extract with a per-message random "salt" value (transmitted along the encrypted message), then HKDF-Expand to obtain three elements: the key for encryption ("key1"), the IV for encryption, and the key for HMAC (key2). In that kind of setup, applying HMAC on the ciphertext only is secure; however, it also means that you'll have to use a new encryption key for every message, i.e. run the AES key schedule every time, which may be an issue for resource-constrained systems.

]]>
Comment on Do Not Use sha256crypt / sha512crypt - They're Dangerous by Christopher K. https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/#comment-281535 Wed, 30 Jan 2019 21:27:43 +0000 https://pthree.org/?p=5012#comment-281535 Interesting article. Obviously, your recommendations are right. But still, your heading is largely misleading and - in my opinion- mostly click-bating. Where in your article do you explain why sha256crypt / sha512crypt are "dangerous"?

Your first argument is that you could DOS an authentication server with huge passwords. Have you ever heard of that? I believe most servers have other software that you can DOS a lot more easily, but let's consider that and compare to the alternatives. Assume I was an attacker trying to DOS your authentication server. What I could do, depending on your hashing algorithm (numbers taken/calculated from your plots, assuming they are comparable):

sha512crypt: send a 4kb password that causes 0.3s execution time and 1 "process" on the server and costs me 4kb of traffic to transfer the password

PBKDF2-HMAC-SHA512: send 167 passwords with one byte each that causes 0.3s execution time on the server (167 * 0.0018s), needs 167 "processes" on the server (threads, tcp connections, database connections, whatever that server does while checking authentication), and costs me 167 bytes of traffic to transfer passwords

bcrypt: send 137 passwords with one byte each that causes 0.3s execution time and 137 processes on the server and costs me 137 bytes of traffic to transfer passwords

scrypt: send 7 passwords with one byte each, 0.3s execution time, 7 processes used and 7 bytes of traffic

argon2: send 8 passwords with one byte each, 0.3s execution time, 8 processes used and 8 bytes of traffic

Sure, modern algorithms are better and more secure. But they need more execution time for small passwords and thus, make it easier to brute force, not more difficult. The attacker could more easily send 7 one byte passwords to scrypt than one 4kb to sha512crypt. Usually the uplink of the attacker is a bottleneck, so sending 4kb passwords seems to be a bad idea. Plus, which real-world authentication system supports 4kb passwords?

"moderately large passwords from staff, where such limits may not be imposed, could create a CPU denial of service on busy authentication servers."
Staff would most likely first use VPN/SSH with ("large") key files to get into the internal network and then passwords of normal length.

This is only "dangerous" in theory. And even in theory, other hashing functions seem to be more attractive in terms of DOSing them.

The second argument you mention are timing attacks. I would give this the bigger concern, because it really affects security. But as you mention yourself, it does not make much difference as most real-world passwords fall into the same category. Furthermore, it is difficult to do these kind of timing attacks on a server without getting blocked due to brute-forcing.

So in summary: Yes, modern algorithms are better, but what you write does not explain why sha256crypt/sha512crypt are *dangerous*.

]]>
Comment on Automating Debian/Ubuntu Installs With Preseed by Kelly Technologies https://pthree.org/2008/05/20/automating-debianubuntu-installs-with-preseed/#comment-281332 Mon, 21 Jan 2019 11:12:29 +0000 http://pthree.org/?p=583#comment-281332 Thanks a lot for a great blog your article is so expansive nice information on Automations. thanks again for wonderful knowledge with great organized. Take time to visit site at
https://www.kellytechno.com/Hyderabad/Course/robotics-process-automation-training-in-hyderabad

]]>
Comment on ZFS Administration, Part IV- The Adjustable Replacement Cache by Peter Swiatkiewicz https://pthree.org/2012/12/07/zfs-administration-part-iv-the-adjustable-replacement-cache/#comment-280970 Thu, 10 Jan 2019 19:57:28 +0000 http://pthree.org/?p=2659#comment-280970 Is this OK in your article:

# zpool add tank cache \
/dev/disk/by-id/ata-OCZ-REVODRIVE_OCZ-33W9WE11E9X73Y41-part2 \
/dev/disk/by-id/ata-OCZ-REVODRIVE_OCZ-X5RG0EIY7MN7676K-part2 \
log mirror \
/dev/disk/by-id/ata-OCZ-REVODRIVE_OCZ-69ZO5475MT43KNTU-part1 \
/dev/disk/by-id/ata-OCZ-REVODRIVE_OCZ-9724MG8BII8G3255-part1

And later on:

# zpool status tank

[...]

logs
mirror-1 ONLINE 0 0 0
ata-OCZ-REVODRIVE_OCZ-69ZO5475MT43KNTU-part1 ONLINE 0 0 0
ata-OCZ-REVODRIVE_OCZ-9724MG8BII8G3255-part1 ONLINE 0 0 0
cache
ata-OCZ-REVODRIVE_OCZ-69ZO5475MT43KNTU-part2 ONLINE 0 0 0
ata-OCZ-REVODRIVE_OCZ-9724MG8BII8G3255-part2 ONLINE 0 0 0

Looks like /dev/disk/by-id/* do NOT match... or... I am missing something?

]]>
Comment on Time Based One Time Passwords - How It Works by Vito https://pthree.org/2014/04/15/time-based-one-time-passwords-how-it-works/#comment-280031 Tue, 25 Dec 2018 22:26:29 +0000 https://pthree.org/?p=3572#comment-280031 Hi, Thanks for great explanation.
You should add that in TOTP has essential requirement: server and client app should be time synchronized. I suppose that for 2FA is good to show time on server to verify or configure(calibrate) TOTP application.

]]>
Comment on ZFS Administration, Part III- The ZFS Intent Log by Brandon Doyle https://pthree.org/2012/12/06/zfs-administration-part-iii-the-zfs-intent-log/#comment-279680 Mon, 17 Dec 2018 02:18:19 +0000 http://pthree.org/?p=2592#comment-279680 Just a quick question - regarding your estimations of life-expectancy of the SSD, that's only for the ~several GB partition you're using, correct? So one 60 GB SSD with a 5 GB partition could last ~12 times that estimation for just a 5 GB partition. So every few years, create a new partition, remove that which is currently added to the pool, and add the new to start writing to a new portion of the space?

Or do the algorithms/code not work this way?

]]>
Comment on Playing Card Ciphers by Cosmin https://pthree.org/2014/09/15/playing-card-ciphers/#comment-279444 Fri, 07 Dec 2018 11:52:30 +0000 https://pthree.org/?p=3888#comment-279444 /6♥7♠8♣2♠6♣A♣2♣Q♠7♠5♣ 6♠3♠A♣A♠9♣6♠8♣5♠2♠6♠5♣2♣5♠5♣5♣4♣5♣5♠3♠5♣4♣5♠2♠ __ 5♠5♣K♣9♣6♣A♣6♠2♠Q♣Q♣A♣7♠9♣ __ 6♠A♣8♠Q♣8♣8♠4♣6♠2♠A♠ T♥T♥A♠9♣3♣J♣3♣A♣7♣5♣A♦ Do you have a clue about the coding message? should be a name]]> K♥/6♥7♠8♣2♠6♣A♣2♣Q♠7♠5♣
6♠3♠A♣A♠9♣6♠8♣5♠2♠6♠5♣2♣5♠5♣5♣4♣5♣5♠3♠5♣4♣5♠2♠
__ 5♠5♣K♣9♣6♣A♣6♠2♠Q♣Q♣A♣7♠9♣ __
6♠A♣8♠Q♣8♣8♠4♣6♠2♠A♠
T♥T♥A♠9♣3♣J♣3♣A♣7♣5♣A♦

Do you have a clue about the coding message? should be a name

]]>
Comment on ZFS Administration, Part XIV- ZVOLS by Aurélien DESBRIÈRES https://pthree.org/2012/12/21/zfs-administration-part-xiv-zvols/#comment-279408 Thu, 06 Dec 2018 09:38:28 +0000 http://pthree.org/?p=2933#comment-279408 Impressive works!

]]>
Comment on ZFS Administration, Part XVII- Best Practices and Caveats by Stanley https://pthree.org/2013/01/03/zfs-administration-part-xvii-best-practices-and-caveats/#comment-279119 Wed, 28 Nov 2018 03:30:40 +0000 http://pthree.org/?p=2963#comment-279119 Thanks so much for such informative guide. I just set up my ZFS on Ubuntu with its help!

I have a question now though: there is a dataset that I want to split into 2. The split is just one of the directories. Is there a best practice on how to do it inside ZFS? I am hoping not to have to manually create a new dataset and do the move which will add unnecessary fragmentation on the underlying disks...

Thanks again!

]]>
Comment on Automating Debian/Ubuntu Installs With Preseed by akshay https://pthree.org/2008/05/20/automating-debianubuntu-installs-with-preseed/#comment-278870 Tue, 20 Nov 2018 09:47:27 +0000 http://pthree.org/?p=583#comment-278870 Great post.Thanks for sharing. keep going

]]>
Comment on Firewire Networking In Linux by Götz https://pthree.org/2008/06/01/firewire-networking-in-linux/#comment-278829 Sun, 18 Nov 2018 14:42:22 +0000 http://pthree.org/?p=587#comment-278829 What does iperf say?

]]>
Comment on Let's Talk Password Hashing by Hans https://pthree.org/2016/06/28/lets-talk-password-hashing/#comment-278617 Sat, 10 Nov 2018 10:38:34 +0000 https://pthree.org/?p=4699#comment-278617 "Never roll your own" - see anything wrong with this?
1: sha2-384 hash the password
2: base64-encode the hash
3: bcrypt the 64-byte base64-encoded sha2-384 hash

why? primarily, it bypasses 2 issues, 1: bcrypt only support passwords up to 72 bytes, this scheme supports any length. 2: many popular bcrypt implementations stop at the first null-byte, which means binary passwords (which may be used by robots/scripts) may inadvertently become very weak, eg if the password is "x33\x00", on most bcrypt implementations, the password simply becomes `3` because hex 33 is ascii 3, and the 00 is treated as end of string.. base64 never emits null bytes, which means your robots/scripts which create their passwords based on /dev/urandom will be safe.

]]>
Comment on Automating Debian/Ubuntu Installs With Preseed by sadha onnisa https://pthree.org/2008/05/20/automating-debianubuntu-installs-with-preseed/#comment-278594 Fri, 09 Nov 2018 12:18:43 +0000 http://pthree.org/?p=583#comment-278594 I really appreciate information shared above. It’s of great help. If someone want to learn Online training, kindly contact us
https://techenoid.com/automation-anywhere-training

]]>