JoeyJoeJoeJr

@JoeyJoeJoeJr@lemmy.ml

• ⁨Comment⁩ on ⁨‘Joker: Folie à Deux’ Makes $7M In Thursday Night Previews, Receives 36% Rotten Tomatoes Audience Score – Box Office⁩ ⁨⁨4⁩ ⁨weeks⁩ ago⁩:

  Saw the movie today. I concur with this astute review.

  I would say there were maybe (maybe) 4 spots where it made sense to put music, and maybe 1 or 2 of those where the scene and music were done well (graded on a favorable curve). Then about 20-25 places they jammed bad music for what felt like no reason other than to slow down a movie that already wasn’t going anywhere.

• ⁨Comment⁩ on ⁨I definitely never unsubscribed from a YouTube channel just for that...⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  In a scientific context, a hypothesis is a guess, based on current knowledge, including existing laws and theories. It explicitly leaves room to be wrong, and is intended to be tested to determine correctness (to be a valid hypothesis, it must be testable). The results of testing the hypothesis (i.e. running an experiment) may support or disprove existing laws/theories.

  A theorem is something that is/can be proven from axioms (accepted/known truths). These are pretty well relegated to math and similar disciplines (e.g. computer science), that aren’t dealing with “reality,” so much as “ideas.” In the real world, a perfect right triangle can’t exist, so there’s no way to look at the representation of a triangle and prove anything about the lengths of its sides and their relations to each other, and certainly no way to extract truth that applies to all other right triangles. But in the conceptual world of math, it’s trivial to describe a perfect right triangle, and prove from simple axioms that the length of the hypotenuse is equal to the square root of the sum of the squares of the remaining two sides (the Pythagorean Theorem).

  Note that while theorems are generally accepted as truth, they are still sometimes disproved - errors in proofs are possible, and even axioms can be found to be false, shaking up any theorems that were built from them.

• ⁨Comment⁩ on ⁨I definitely never unsubscribed from a YouTube channel just for that...⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  A law describes what happens, a theory explains why. The law of gravity says that if you drop an item, it will fall to the ground. The theory of relativity explains that the “fall” occurs due to the curvature of space time.

• ⁨Comment⁩ on ⁨A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  You are conflating the concept and the implementation. PFS is a feature of network protocols, and they are a frequently cited example, but they are not part of the definition. From your second link, the definition is:

  Perfect forward secrecy (PFS for short) refers to the property of key-exchange protocols (Key Exchange) by which the exposure of long-term keying material, used in the protocol to authenticate and negotiate session keys, does not compromise the secrecy of session keys established before the exposure.

  And your third link:

  Forward secrecy (FS): a key management scheme ensures forward secrecy if an adversary that corrupts (by a node compromise) a set of keys at some generations j and prior to generation i, where 1 ≤ j < i, is not able to use these keys to compute a usable key at a generation k where k ≥ i.

  Neither of these mention networks, only protocols/schemes, which are concepts. Cryptography exists outside networks, and outside computer science (even if that is where it finds the most use).

  Funnily enough, these two definitions (which I’ll remind you, come from the links you provided) are directly contradictory. The first describes protecting information “before the exposure” (i.e. past messages), while the second says a compromise at j cannot be used to compromise k, where k is strictly greater than j (i.e. a future message). So much for the hard and fast definition from “professional cryptographers.”

  Now, what you’ve described with matrix sounds like it is having a client send old messages to the server, which are then sent to another client. The fact the content is old is irrelevant - the content is sent in new messages, using new sessions, with new keys. This is different from what I described, about a new client downloading old messages (encrypted with the original key) from the server. In any case, both of these scenarios create an attack vector through which an adversary can get all of your old messages, which, whether you believe violates PFS by your chosen definition or not, does defeat its purpose (perhaps you prefer this phrasing to “break” or “breach”).

  This seems to align with what you said in your first response, that Signal’s goal is to “limit privacy leaks,” which I agree with. I’m not sure why we’ve gotten so hung up on semantics.

  I wasn’t going to address this, but since you brought it up twice, running a forum is not much of a credential. Anyone can start a forum. There are forums for vaxxers and forums for antivaxxers, forums for atheists and forums for believers, forums for vegans and forums for carnivores. Not everyone running these forums is an expert, and necessarily, not all of them are “right.” This isn’t to say you don’t have any knowledge of the subject matter, only that running a forum isn’t proof you do.

  If you’d like to reply, you may have the last word.

• ⁨Comment⁩ on ⁨A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  I would argue that it is not limited to network traffic, it is the general concept that historical information is not compromised, even if current (including long-term) secrets are compromised.

  From my comment earlier:

  There is no sharing of messages between linked devices - that would break forward secrecy

  This describes devices linked to an account, where each is retrieving messages from the server - not a point-to-point transfer, which is how data is transferred from one Android device to another. If a new device could retrieve and decrypt old messages on the server, that would be a breach of the forward security concept.

• ⁨Comment⁩ on ⁨A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  From …signal.org/…/360007059752-Backup-and-Restore-Mes…:

  Signal Desktop does not support transferring message history to or from any device.

• ⁨Comment⁩ on ⁨A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  You’re describing something very different - you already have the messages, and you already have them decrypted. You can transfer them without the keys. If someone gets your device, they have them, too.

  Whether Signal keeps the encrypted the messages or not, a new device has no way of getting the old messages from the server.

• ⁨Comment⁩ on ⁨A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  “They” is the browser/browser maker. The browser, acting as the client, would have access to the keys and data. The browser maker could do whatever they want with it.

  To be clear, I’m not saying they would, only that it defeats the purpose of an E2E chat, where your goal to to minimize/eliminate the possibility of snooping.

• ⁨Comment⁩ on ⁨A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  Using an E2E chat app in your browser necessarily makes the keys and decrypted messages available to your browser. They would have the ability to read messages, impersonate users, alter messages, etc. It would defeat the purpose of a secure messaging platform.

• ⁨Comment⁩ on ⁨A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  There is no sharing of messages between linked devices - that would break forward secrecy, which prevents a successful attacker from getting historical messages. See the first bullet of: support.signal.org/…/360007320551-Linked-Devices

  Messages are encrypted per device, not per user (signal.org/docs/specifications/sesame/), and forward secrecy is preserved (en.m.wikipedia.org/wiki/Forward_secrecy, for the concept in general, and signal.org/docs/specifications/doubleratchet/ for Signal’s specific approach).

• ⁨Comment⁩ on ⁨A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  Yes, as long as you set up the desktop client before sending the message.

  Messages sent with Signal are encrypted per device, not per user, so if your desktop client doesn’t exist when the message is sent, it is never encrypted and sent for that device.

  When you set up a new client, you will only see new messages.

  See signal.org/docs/specifications/sesame/ for details.

• ⁨Comment⁩ on ⁨A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  This is not entirely correct. Messages are stored on their servers temporarily (last I saw, for up to 30 days), so that even if your device is offline for a while, you still get all your messages.

  In theory, you could have messages waiting in your queue for device A, when you add device B, but device B will still not get the messages, even though the encrypted message is still on their servers.

  This is because messages are encrypted per device, rather than per user. So if you have a friend who uses a phone and computer, and you also use a phone and computer, the client sending the message encrypts it three times, and sends each encrypted copy to the server. Each client then pulls its copy, and decrypts it. If a device does not exist when the message is encrypted and sent, it is never encrypted for that device, so that new device cannot pull the message down and decrypt it.

  For more details: signal.org/docs/specifications/sesame/

• ⁨Comment⁩ on ⁨How do I "ls -R | cat | grep print" ?⁩ ⁨⁨9⁩ ⁨months⁩ ago⁩:

  grep -r string .

  The flag should go before the pattern.

  -r to search recursively, . refers to the current directory.

  Why use . instead of *? Because on it’s own, * will (typically) not match hidden files. See the last paragraph of the ‘Origin’ section of: en.m.wikipedia.org/wiki/Glob_(programming). Technically your ls command (lacking the -a) flag would also skip hidden files, but since your comment mentions finding the string in ‘any files,’ I figured hidden files should also be covered (the find commands listed would also find the hidden files).