xashor

The abuse is often just different.

If you eat meat, eggs, drink milk, you are supporting the things shown in the video.

    (a -> b) -> T a -> T b
  T (a -> b) -> T a -> T b
  (a -> T b) -> T a -> T b

    echo@> (2{ARGV) -.&([: <;._1 LF, 1!:1) (3{ARGV)
    NB.    2nd arg                          3rd arg
    NB.              g&f execute f for each, then g on both
    NB.                              1!:1 read file
    NB.                          LF, prepend newline
    NB.                 [: <;._1 split based on first char
    NB.             -.  remove right elements from left array
    NB. echo@> echo each line
    exit 0

    $ time j9 -c ./pseudo_grep.ijs test_b test_a
    …
    real   0m0.064s
    user   0m0.032s
    sys    0m0.017s
    $ time grep -vf test_b test_a
    …
    real   0m5.815s
    user   0m5.234s
    sys    0m0.576s

  // p={(x0,y0),(x1,y1),...} and v={(vx0,vy0),(vx1,vy1),...}
  for(int j=0;j<2*SIZE;j++)p[j]+=v[j];

  // pv={(x0,y0,vx0,vy0),(x1,y1,vx1,vy1),...}
  for(int j=0;j<4*SIZE;j+=4)
    pv[i+0]+=pv[i+2],pv[i+1]+=pv[i+3];

  LABEL = sys._getframe().f_lineno
  print(1)
  j(LABEL)

- Score

- Link

- Upvotes

- Comments

Only nuisance is that SUPPORT_BUSY_WAIT_LOOP is defined in the defaults, so I can't use the package from my distribution but have to compile it myself – as I don't want 100% CPU usage when prototyping (where I can happily live with inaccuracies of the timers). I considered opening an issue and forgot about it. But you, Ray, seem to be reading this thread anyway. :-) Thanks, by the way!

>If it's not secure, then surely people would be cashing in on that sweet money. So, why is it that we constantly see articles talking about how insecure Telegram encryption is, but nobody is showing a proof of concept attack or collecting the prize?

regulary != 2 times with limited time. Also, E2EE is not only about decrypting a message. E.g. signing messages as someone else isn't awarded. Also, you might need a lot of computation power. SHA-1 used in MTProto 1.0 for example is practically pretty secure, but not against a well funded attack.

But that aside, Telegram's encryption is probably good enough. But we already have standards that are good enough. Why risk it?

For example, from On the CCA (in)Security of MTProto[0]:

>Telegram is a popular messaging app which supports end-to-end encrypted communication. In Spring 2015 we performed an audit of Telegram's Android source code. This short paper summarizes our findings. Our main discovery is that the symmetric encryption scheme used in Telegram -- known as MTProto -- is not IND-CCA secure, since it is possible to turn any ciphertext into a different ciphertext that decrypts to the same message.

>We stress that this is a theoretical attack on the definition of security and we do not see any way of turning the attack into a full plaintext-recovery attack. At the same time, we see no reason why one should use a less secure encryption scheme when more secure (and at least as efficient) solutions exist.

>The take-home message (once again) is that well-studied, provably secure encryption schemes that achieve strong definitions of security (e.g., authenticated-encryption) are to be preferred to home-brewed encryption schemes.

And that aside, E2EE is not default and neither E2E group chats or E2E video calls are supported. This is the biggest security problem.

[0] https://dl.acm.org/citation.cfm?id=2994468

Also, Telegram isn't that open source either: server side is closed source and the client side seems to be still an undocumented, mirrored mess.

So for me at least, as I don't want anyone that easily to read my messages: many other solutions > WhatsApp > Telegram.

For a similar approach, see e.g. Interactive Programming in C [3], which relies on re-loading a shared (recompiled) library. But this step could also be done by recompiling via tcc. There the persistent data lives just in the heap and pointers to it get passed to the next version of the library.

[0] https://github.com/cnlohr/noeuclid/blob/0831b9ce21620704257a... [1] https://github.com/cnlohr/noeuclid/blob/0831b9ce21620704257a... [2] https://github.com/cnlohr/noeuclid/blob/a8e1e038829686f39d48... [3] https://nullprogram.com/blog/2014/12/23/

Some examples from the last year:

http://www.spiegel.de/panorama/justiz/g20-polizei-soll-recht...

https://www.hessenschau.de/panorama/durchsuchung-des-asta-st...