Top all-time · #852
Aaron Toponce
Personal blog · pthree.org · on HN as atoponcesecuritysystems
Aaron Toponce's personal blog at pthree.org covers security and systems. Since 2009, 79 different Hacker News readers have linked it 93 times, most often “ZFS on linux guide”. No feed was found, so read it on the site itself.
Most-linked posts?
- ZFS on linux guide6 people · 6 mentions · first linked 2013-10-09
- /2013/12/10/zfs-administration-appendix-c-why-you-should-use-ecc-ram/5 people · 7 mentions · first linked 2014-09-09
- The Physics of Brute Force (2016)4 people · 5 mentions · first linked 2019-08-19
- ECB vs CBC Encryption4 people · 4 mentions · first linked 2012-02-17
- /2014/07/21/the-linux-random-number-generator/3 people · 3 mentions · first linked 2014-08-13
- Bitcoin Mining Rate and Waste3 people · 3 mentions · first linked 2016-02-03
- OpenSSH Keys and The Drunken Bishop3 people · 3 mentions · first linked 2013-05-30
- Why I think using sha256crypt or sha512crypt is dangerous3 people · 3 mentions · first linked 2018-05-23
- A browser-based password generator audit2 people · 2 mentions · first linked 2018-04-23
- Convert text to Base64 by hand2 people · 2 mentions · first linked 2015-06-16
What Hacker News says?
Unless some crazy physics breakthrough happens, bruteforcing even 128 bits is physically impossible: https://pthree.org/2016/06/19/the-physics-of-brute-force/
Comment linking /2016/06/19/the-physics-of-brute-force/
on “Memories – 256 bytes demo winner of Revision 2020”Submitted The Meaning of 'su' as a story · 141 points
HN discussionYou can create a zvol for your dropbox folder and format it in ext4 and it'll work: https://pthree.org/2012/12/21/zfs-administration-part-xiv-zv...
Comment linking /2012/12/21/zfs-administration-part-xiv-zvols/
on “My one-liner Linux Dropbox client”Submitted Why I think using sha256crypt or sha512crypt is dangerous as a story · 71 points
HN discussion> Dropping support for file systems outside ext4. One of my machines uses Linux on ZFS Well if you're using ZFS you can create a zvol for your dropbox folder and format it in ext4 and it'll work: https://pthree.org/2012/12/21/zfs-administration-part-xiv-zv...
Comment linking /2012/12/21/zfs-administration-part-xiv-zvols/
on “The new Dropbox”Submitted The Physics of Brute Force (2016) as a story · 34 points
HN discussionGoogle Authenticator implements TOTP, which is actually a very simple standard: https://pthree.org/2014/04/15/time-based-one-time-passwords-... If you can extract the private key, you can transfer it to another phone or device. On Android, AndOTP is open source (available on F-Droid) and allows encrypted backups. As for Google Authenticator, I don't think you can create backups.
Comment linking /2014/04/15/time-based-one-time-passwords-how-it-works/
on “OnlyKey: Open-Source Alternative to YubiKey”Submitted The Sheer Size of IPV6 as a story · 29 points
HN discussion"As alluded to above, this does introduce a separate challenge with multi-file consistency. The team took an interesting approach here. The index file points to the location of the root of the page graph and free space map in each page cache file. When persisting a multi-file transaction, all page cache files are flushed to disk before the index file." That sounds familiar: https://pthree.org/2012/12/14/zfs-administ…
Comment linking /2012/12/14/zfs-administration-part-ix-copy-on-write/
on “Never Write Your Own Database (2017)”Submitted Deckware – A 224-bit entropy extractor (2021) as a story · 22 points
HN discussionUnless he is talking about scrubbing and self-healing? In which case, the same thing still applies -- all releases do this as far as I know. See: https://pthree.org/2012/12/11/zfs-administration-part-vi-scr...
Comment linking /2012/12/11/zfs-administration-part-vi-scrub-and-resilver/
on “Bcachefs – A general purpose COW filesystem”Submitted Debian – The Universal Operating System as a story · 20 points
HN discussionzsh can do that. eg. http://pthree.org/2009/03/28/add-vim-editing-mode-to-your-zs... that was the first link on a ddg search. there were other articles. https://duckduckgo.com/?q=zsh+vi+mode+prompt
Comment linking /2009/03/28/add-vim-editing-mode-to-your-zsh-prompt/
on “Vim and Vi Tips: Essential Vim and Vi Editor Skills, free on Amazon today only”Submitted Do Not Use Sha256crypt / Sha512crypt – They're Dangerous as a story · 8 points
HN discussionI did the math myself at one point, but I lost the link. However, here's a reference for the same kind of thing: https://pthree.org/2016/06/19/the-physics-of-brute-force/ The total energy output of a supernova is enough to count up to 2^220, making a lot of generous (invalid) assumptions. You'd need 2^36 supernovas to just count up to 2^256, never mind actually running SHA256. At minimum. There are circa 2^38 stars…
Comment linking /2016/06/19/the-physics-of-brute-force/
on “BitTorrent v2 (2020)”Submitted ZFS on linux guide as a story · 5 points
HN discussion34 bytes is equivalent to bruteforcing a 272-bit key. It's already physically impossible to do that for a 256-bit key even if you ignore everything other than incrementing the key counter itself: https://pthree.org/2016/06/19/the-physics-of-brute-force/
Comment linking /2016/06/19/the-physics-of-brute-force/
on “Dirty tricks 6502 programmers use”Submitted Good Advice For Computer Science Students as a story · 5 points
HN discussionI mean, leaking an SRP verifier into the logs is analogous to leaking a salted password hash. (Same story if a client key is leaked, since replay attacks are not possible.) That is still 1000x better than a plaintext password leak. Which happens... how often again? All it takes is one oversight by one developer and one rushed code review. Addressing arguably the most common way passwords are stolen nowadays is not w…
Comment linking /2014/07/21/the-linux-random-number-generator/
on “Lesspass – open-source stateless password manager”Submitted Do Not Use Sha256crypt / Sha512crypt – They're Dangerous (2018) as a story · 4 points
HN discussionOkay. I read the whole thread (ugh). Arguments for using the kernelspace CSPRNG basically boils down to this: 1. Kernelspace CSPRNGs generally don't change, are well audited, and are generally accepted to be secure. 2. Userspace CSPRNGs don't provide any additional security benefit. 3. OpenSSL is a questionable security product with it's history of vulnerabilities. So, with that said, let's look at each of them. For…
Comment linking /2016/03/08/linux-kernel-csprng-performance/
on “A Taste of JavaScript's New Parallel Primitives”Submitted ZFS Administration as a story · 4 points
HN discussion> But you seem to claim that it isn't sound, which also isn't possible without an audit. That's not quite true, right? If encryption was successfully broken, then you wouldn't need an audit. Even if it wasn't broken, there's still things like this: http://pthree.org/2012/02/17/ecb-vs-cbc-encryption/
Comment linking /2012/02/17/ecb-vs-cbc-encryption/
on “Apple's iMessage encryption trips up feds' surveillance”Submitted Two OCB Block Cipher Mode Patents Expired Due to Nonpayment as a story · 4 points
HN discussionraidz1 is not raid5. From https://pthree.org/2012/12/05/zfs-administration-part-ii-rai... : > ather than the stripe width be statically set at creation, the stripe width is dynamic. Every block transactionally flushed to disk is its own stripe width. Every RAIDZ write is a full stripe write. Further, the parity bit is flushed with the stripe simultaneously, completely eliminating the RAID-5 write hole. So, in the ev…
Comment linking /2012/12/05/zfs-administration-part-ii-raidz
on “Five Years of Btrfs”Submitted A browser-based password generator audit as a story · 3 points
HN discussionI'd very much like an invite, too. Especially after reading a bit about the background, and stumbling on this link on the front page:) http://pthree.org/2013/05/30/openssh-keys-and-the-drunken-bi...
Comment linking /2013/05/30/openssh-keys-and-the-drunken-bishop/
on “Ask HN: Alternatives to HN”Submitted Let's Talk Password Hashing as a story · 3 points
HN discussionFor a great primer on ZFS (on Linux) in general there's this website[1] by Aaron Toponce that is very well laid out. Specifically see the section on snapshots & clones, as well as sending/receiving. Also don't forget that you can make a ZFS pool out of any block device, this includes normal files mounted as a loop device! So a great way to experiment w/ learning how to manage a ZFS pool is to just create a few spars…
Comment linking /2012/04/17/install-zfs-on-debian-gnulinux/
on “Windows 10 October 2018 Update no longer deletes your data”Submitted Say Allo to Insecurity as a story · 3 points
HN discussion
