<pie__>
actually hold on, this looks like it predicates on already having a collision?
<pie__>
" In particular, we have a chosen-prefix collision attack againstSHA-1with complexity between 266.9and 269.4(depending on assump-tions about the cost of finding near-collision blocks), while the best-known attack has complexity 277.1. This is within a small factor of thecomplexity of the classical collision attack onSHA-1(estimated as 264.7).This represents yet another warning that industries and users have
<pie__>
tomove away from usingSHA-1as soon as possible"
<pie__>
thats to be read as 2^66.9 and etc
<pie__>
not sure what implications this had for git
<pie__>
didnt know this "Why do collisions matter for Git’s security?
<pie__>
If a Git fetch or push tries to send a colliding object to a repository that already contains the other half of the collision, the receiver can compare the bytes of each object, notice the problem, and reject the new object. Git has implemented this detection since its inception."
<gchristensen>
git's store is content addressed, so why bother sending (or receiving) an object you already have
<pie__>
well yeah
<pie__>
so does that mean when you push you retrieve an list of remote hashes?
<pie__>
or..hm
<pie__>
i guess you wouldnt need to since you have a remote pointer and a local pointer and can just send whats in between
<pie__>
well, i should look up how git syncing works if i want to know
<pie__>
that mitigation seems to be specific to SHAttered though
erictapen has joined #nixos-security
<pie__>
"The Git project is also developing a plan to transition away from SHA-1 to another, more secure hash algorithm, while minimizing the disruption to existing repository data. As that work matures, we plan to support it on GitHub." seems encouraging
<gchristensen>
it is a bit complicated because all the old hashes will still exist
justanotheruser has joined #nixos-security
erictapen has quit [Ping timeout: 258 seconds]
erictapen has joined #nixos-security
erictapen has quit [Ping timeout: 244 seconds]
erictapen has joined #nixos-security
pie___ has joined #nixos-security
pie__ has quit [Ping timeout: 255 seconds]
pie__ has joined #nixos-security
pie___ has quit [Ping timeout: 246 seconds]
andi- has quit [Remote host closed the connection]
<samueldr>
To protect users, Chrome OS 74 disables Hyper-Threading by default. For the majority of our users, whose workflows are primarily interactive, this mitigates the security risk of MDS without a noticeable loss of responsiveness. Chrome OS 75 will contain additional mitigations.
<samueldr>
turns out google does :)
<samueldr>
(for now)
<pie_>
yeah so how do we :p
<pie_>
or how do i i mean
<pie_>
im kind of lazy / preoccupied to start googlign thart
<samueldr>
AFAIUI the bios setting is the right one
<pie_>
the blacklisted kernel modules thing was a throwback to the RDS thing yesterday
<pie_>
<ggreer> The following packages will be upgraded:
<pie_>
<ggreer> ... intel-microcode ...
<pie_>
<ggreer> oh shit. what happened now?
<pie_>
looks like debians got updates
<pie_>
not surprising given the embargoed distro list i suppose