20

anonymous@undisclosed.example.com (Anonymous) — Tue, 15 Jun 2021 20:08:58 +0000

2010.08.20 - feeding the fiords

few days ago i got back from Norway. Norway is an incredible mix of mountains and the sea/lake landscapes. in fact you usually see both of them at once. since i'm in love with both mountains and the water, they did impressed me a lot!

this is not a coincidence however that Norway is all-green – it is raining nearly every year. ok, we were told that this summer was especially rainy, though according to statistics it is raining there (in august) on average every third day. in practice it was very wet in the morning, some minor rain about the noon and nice weather until sun set. the temperature was typically about 20-25 degrees C, so for me – just perfect!

and did we see the fiords? well - fiords were eating string from our hands! ;) in case someone doubt about this, on the right there is a picture proving it actually took place (click it to enlarge the image). :)

another interesting thing are prices. they were quite astronomical, for most of the things, for Polish people. most noticeable were prices of casual things like bread, water or cheese. bread was for example about 10 times (!) more expensive than the one in Poland and quality did not make price up. the same goes for water – i actually felt a bit like in Arabic country, since water was almost the same price as the fuel! it's very strange for a country that have so pure water, it can be drunk directly from tap.

since it was very rainy, we had just one “bigger” mountain trip. it looked like it was raining faster than it could evaporate thus the best shoes there would be gumboots i guess. ;)

we were, as one can see, during the summer time. between Oslo and Åndalsnes night lasted for about 4-5 hours. at 10pm i was still able to read book inside the tent. i wouldn't want to check it during winter time though… ;)

because of the sights, most of our time we spent far from towns and any bigger civilization - with tents, cooking on Coleman Multi-Fuel stove and (in the beginning) Rusian Trzmiel 4 stove. they both used gasoline so it was cheap, convenient and easy-refuelable way to cook dinner or even a coffee/tea. in fact old Russian stove cooked the same amount of water twice that fast, but we had unpleasant accident with it about 3rd or 4th day, when pomp started to leak the burnable mixture and we had to extinguish it by external means and since that time we stopped using it. we'll have to fix pump when it will be back (i returned after two weeks, but others stayed there for one more week).

below are some of the pictures from the trip. for now i have only the ones from my camera, but there are plenty of them to fill this whole page. ;) here they go (you can click them to enlarge)…

25

anonymous@undisclosed.example.com (Anonymous) — Tue, 15 Jun 2021 20:08:58 +0000

2010.08.25 - security and web applications

few days ago i found out that filmweb, well-known Polish web site about the movies, has been hacked and about 700 thousands users' credentials have been stolen. about year ago other, well-known Polish site (namely wykop.pl) got similar problem. it's described in more details along with good-practices set on Piotr Konieczny's blog. what does connect both of them? well - interesting thing is that they both shown shame low security level: wykop.pl had test infrastructure that could be easily accessed from anywhere, as long as you knew where it was (which turned out to be quite simple to find out), filmweb.pl on the other hand uses MD5 for passwords… without any salt! this makes them extremely vulnerable to rainbow table attacks, and since you have so many of them – it gets even simpler!

another interesting issue is MD5 itself. since it has high rate of collisions, only ~half of output set is ever used it is common, but weak algorithm to use nowadays. if you still use MD5 you should shift to SHA* ASAP! see the complexity comparison of SHA* algorithms for details (for non-Polish readers: see the table – “kolizja” means “collision”). it shows that SHA1 is now below the bare minimum in commonly accepted cryptographical “security” definition (which is, according to the article, 80-bits).

there is one exception, however – MD5 is very fast, thus it can be used for very short-term data signing, like sessions. it is in fact one of the options for SSL/TLS encryption and it is still secure, since it's temporary keys usage in HMAC mode.

BaSzErr - blog:2010:08

20

2010.08.20 - feeding the fiords

25

2010.08.25 - security and web applications