u/atoponce

Coinspect recently disclosed Ill Bloom, a vulnerability affecting recovery phrases generated using the historical CryptoJS.lib.WordArray.random() implementation.

The affected CryptoJS 3.x code used a Multiply-With-Carry construction seeded with values derived from Math.random()

The technical disclosure, including the PRNG reconstruction and affected-version analysis, is here:

https://illbloom.org/

Drawn with diagrams.net, I used the following sources to put this together:

• https://github.com/torvalds/linux/blob/master/drivers/char/random.c
• https://www.zx2c4.com/projects/linux-rng-5.17-5.18/
• https://www.zx2c4.com/projects/linux-rng-5.17-5.18/inside-linux-kernel-rng-presentation-sept-13-2022.pdf

I believe this is an accurate view without getting too deep into the weeds. There are probably still some minor wrinkles that need ironing out, but this illustrates how RDSEED, SipHash, BLAKE2s, and ChaCha20 all fit together in random.c to generate cryptographically secure random numbers.

My first distro was Red Hat Linux 6.0 in August 1999. I purchased a boxed copy off the shelf for $40 at a local electronics store, took it home, and accidentally wiped my Windows 98 desktop.

I fought with Red Hat Linux more than I care to admit. This before they had dependency resolution with yum(8), so "RPM hell" was a very real thing.

But nothing pissed me off more than Slackware. I tried to like it, because everyone in the computer science department at my university would rave about it. But Patrick Volkerding seems to resist change strictly for the reason of resisting change, and it shows in Slackware.

I jumped ship off Linux entirely for a brief time and installed NetBSD on an old Sun Ultra workstation. Even though NetBSD is not a Linux distribution, but a BSD one, I personally know a couple of the developers and follow its development. It lags behind FreeBSD in many areas, but if I were to install BSD again, it would be NetBSD.

I've been on Debian since ~2003, with a brief 2 year stint on Ubuntu from 04.10 through 07.04, then went back on Debian and have been here since. It just works.

At one point in my life, I joined a startup as employee #3. After we had purchased all our hardware, we wanted to try Gentoo on our workstations. We spent 3-4 days compiling and installing everything, following the then Gentoo handbook and wiki before the Arch wiki became the new source of all Linux knowledge.

However, we kept running into compilation errors and snags and after 4 days of downtime, decided enough was enough, and installed Debian. I'd still like to give Gentoo an honest go one of these days though. It's always intrigued me. Back in my Linux User Group days, there was a subtle turf war between Debian and Gentoo that always made me chuckle.

At each new switchback, go back to the trailhead. Continue until you reach the peak. 2,523 meters across 29.75 km in 6:20 elapsed.

Training for The Rut 50K in September. The mileage is a little light but the vert is on point.

Link to activity here: https://www.strava.com/activities/19463811371

Our local running club has a runner who has OCD about not only their own runs ending on .00 miles, but other's as well. They're the type of person who will run circles in a parking lot. Anyway, their 40th birthday is tomorrow, so a friend and I decided to have a bit of fun with their OCD.