Search
1000 results for “lunic”
-
SAGA 2025 tanca la millor edició amb més de 9.000 visitants
Per quart any consecutiu, el SAGA: Saló del Gaming se supera en assistència de públic i estands.
https://ludica.cat/saga-2025-cronica/
#Catalunya #Crnica #Actualitat #Barcelona #Catalunya #esdeveniments #eSports #indstria #SAGA
-
IndieDevDay 2023: La màgia de l’indie
Una crònica de la 6a edició de la fira dedicada al videojoc independent ubicada a la Farga de l’Hospitalet
https://ludica.cat/indiedevday-2023-la-magia-de-lindie/
#Catalunya #Crnica #2AwesomeStudio #Catalunya #Chibig #DIYGames #esdeveniments #IndieDevDay #indstria #TeamUgly
-
Justinas Leveika’s domination at this year’s #DalesDivide is ludicrous. #dotWatching #cycling https://trackleaders.com/dalesdivide23f
-
Justinas Leveika’s domination at this year’s #DalesDivide is ludicrous. #dotWatching #cycling https://trackleaders.com/dalesdivide23f
-
Justinas Leveika’s domination at this year’s #DalesDivide is ludicrous. #dotWatching #cycling https://trackleaders.com/dalesdivide23f
-
Justinas Leveika’s domination at this year’s #DalesDivide is ludicrous. #dotWatching #cycling https://trackleaders.com/dalesdivide23f
-
Justinas Leveika’s domination at this year’s #DalesDivide is ludicrous. #dotWatching #cycling https://trackleaders.com/dalesdivide23f
-
Vile is backpeddalling like mad after the lawyers pointed out how much it's gonna cost to sue. Any money the co want out of their ludicrous contract.
https://www.theguardian.com/media/2026/mar/10/kyle-sandilands-jackie-o-dispute-apology
-
This week's edition of AI helps me to write a #FakeAbstract in response to ludicrous #conference invites has #ChatGPT 3.5 meet " #Nanomaterials #Conference 2024 "
If interested in the work they "contacted" me about:
https://www.medrxiv.org/content/10.1101/2024.01.29.24301589v1 -
Great article from #geekwire on the research I did with #foundry10 in partnership with #GameToGrow!
Great timing with the #DnDMovie!
We explored how #SEL (#socialemotionallearning) can be supported by #TTRPG / #DnD / #DungeonsandDragons using skilled facilitation and the ludic space.
#InformalEd #informalLearning #education #EduTooters #RPG #gametogrow #Seattle
-
CW: Long thread/32
It's not just doctors; the professions do love their wordplay. especially *lawyers*. This week on #LoweringTheBar, I learned about "a completely ludicrous court fight that involved nine law firms that combined for 66 pages of briefing, declarations, and exhibits, all inflicted on a federal court":
https://www.loweringthebar.net/2023/11/federal-court-ends-double-spacing-fight.html
The dispute was over the definition of "double spaced."
32/
-
It “appears as if” the world is ending
Remember that the year began with mass animal deaths? It continued with revolution in the Middle East. And, poor Australia was hit with the wrath of the gods. (What did you guys do? Just kidding.) Now, we have catastrophic earthquakes – one after another – and a wicked tsunami. With all the political turmoil and natural disasters this year, it would appear as if the world is being ripped apart, socially and physically.
“Appear as if” are the important words to consider. It depends on the perspective you take.
People mostly get their news from the media. The media gives attention to unique things, stories that affect certain groups of people or important people. They don’t always cover events that affect A LOT of people if those people aren’t considered important (remote, poor, unknown).
Once a story is in the news, the topic becomes important. I’m calling this the Google Alert effect.
If you set a Google news alert for “political unrest” or “earthquake” with regards to a particular location, you will see results from other locations because of the association with topic. Thus, it appears that there is a sudden increase in this kind of event. It’s because you are looking for it that you see it. That’s what I think happened with the flood of mass animal death stories earlier this year. A mass animal death in one part of the world suddenly becomes news if a similar event has just occurred somewhere else. We find more events when we are sensitized to them and specifically looking for them. It’s also behind the celebrity deaths in threes idea. When we notice two celebrity deaths, we wait for the third and then stop counting. We’ve fulfilled our expectation.
It’s happening in the news today. Japan has experienced an enormous, unique and horrific earthquake. It’s a megaquake that triggered an even more destructive tsunami. Years ago, we would not have been able to see the dramatic first hand home videos. But now mobile video devices are all over, transmitting immediately. I get Breaking News alerts about all the details of the event – from explosions and fires to aftershocks and the ever mounting death toll. It looks… dare I say it, apocalyptic.
Earlier this week, I noticed people with signs in the public square announcing “Judgement Day May 21, 2011”. Fresh in my mind is the instability in the Middle East, the destruction from the New Zealand quake and the billions of sardines (“carpet of death”) left floating in a California harbor. Related?
Only in the human mind.
That’s not to say there is not a legitimate correlation or domino effect occurring here. First, political action in one area certainly prompts action in another. Spurred on by what is seen in the media, we get a copycat effect. We already have a precarious economic condition so natural disasters cause world markets to react shakily to such events, prompting more worry and possible panic. The mass animal deaths were correlated to bad weather conditions around the world at the time. When someone reports a UFO, lots of people suddenly start looking up and notice unusual things. No surprises here.
It’s hard to watch world turmoil and not get frightened and attempt to make sense out of it. Chaos is disconcerting. So, people try to tie it all together somehow. They say it’s related to some outside natural force like magnetic pole shifts or supermoons *. Or, they say supernatural events are heralded such as the coming of Christ or that God is mad at whatever “immoral” thing the local populations did.
What can logical people do to quell this End Times wailing? I could tell nervous Twitterers that there is no logical basis to connect all these frightening world events because…
- there are on average 50 recorded earthquakes a day – some WILL be huge;
- we are having an unusual cold weather spell that caused animal deaths, or
- it’s just human nature to connect the dots and make something from nothing.
Sadly, that’s not going to help. They will still nervously tweet others and spread the fear. My facts and probabilities won’t change how these pieces fit into their entrenched worldview. It sucks but it’s the truth. Don’t think of these people as stupid. They are just human. There are many, even skeptically minded people, who JUST can’t help but wonder whether this pattern means something. It’s how our brains work.
However, being the calm voice of reason also doesn’t hurt. There are those who look to sources of rationality to be soothed. They want to be told it’s not a big deal. You could tell them, “Nah, I don’t think its the end of the world. It’s not all related; we are just attuned to noticing catastrophes around the world at the moment and tying them together with a good story.”
Be a small comfort in the face of the throngs of doomsayers! If panic is contagious, so is calmness. We just have to be out there promoting it. See you on May 22. 2011…
———–
* The Supermoon idea is ludicrous. Stop getting science from astrologers and promoting wacky nonsense, you pathetic media outlets!!!
#apocalypse #birdDeaths #earthquake #science #skeptical #supermoon #voiceOfReason
https://sharonahill.com/?p=655
-
It “appears as if” the world is ending
Remember that the year began with mass animal deaths? It continued with revolution in the Middle East. And, poor Australia was hit with the wrath of the gods. (What did you guys do? Just kidding.) Now, we have catastrophic earthquakes – one after another – and a wicked tsunami. With all the political turmoil and natural disasters this year, it would appear as if the world is being ripped apart, socially and physically.
“Appear as if” are the important words to consider. It depends on the perspective you take.
People mostly get their news from the media. The media gives attention to unique things, stories that affect certain groups of people or important people. They don’t always cover events that affect A LOT of people if those people aren’t considered important (remote, poor, unknown).
Once a story is in the news, the topic becomes important. I’m calling this the Google Alert effect.
If you set a Google news alert for “political unrest” or “earthquake” with regards to a particular location, you will see results from other locations because of the association with topic. Thus, it appears that there is a sudden increase in this kind of event. It’s because you are looking for it that you see it. That’s what I think happened with the flood of mass animal death stories earlier this year. A mass animal death in one part of the world suddenly becomes news if a similar event has just occurred somewhere else. We find more events when we are sensitized to them and specifically looking for them. It’s also behind the celebrity deaths in threes idea. When we notice two celebrity deaths, we wait for the third and then stop counting. We’ve fulfilled our expectation.
It’s happening in the news today. Japan has experienced an enormous, unique and horrific earthquake. It’s a megaquake that triggered an even more destructive tsunami. Years ago, we would not have been able to see the dramatic first hand home videos. But now mobile video devices are all over, transmitting immediately. I get Breaking News alerts about all the details of the event – from explosions and fires to aftershocks and the ever mounting death toll. It looks… dare I say it, apocalyptic.
Earlier this week, I noticed people with signs in the public square announcing “Judgement Day May 21, 2011”. Fresh in my mind is the instability in the Middle East, the destruction from the New Zealand quake and the billions of sardines (“carpet of death”) left floating in a California harbor. Related?
Only in the human mind.
That’s not to say there is not a legitimate correlation or domino effect occurring here. First, political action in one area certainly prompts action in another. Spurred on by what is seen in the media, we get a copycat effect. We already have a precarious economic condition so natural disasters cause world markets to react shakily to such events, prompting more worry and possible panic. The mass animal deaths were correlated to bad weather conditions around the world at the time. When someone reports a UFO, lots of people suddenly start looking up and notice unusual things. No surprises here.
It’s hard to watch world turmoil and not get frightened and attempt to make sense out of it. Chaos is disconcerting. So, people try to tie it all together somehow. They say it’s related to some outside natural force like magnetic pole shifts or supermoons *. Or, they say supernatural events are heralded such as the coming of Christ or that God is mad at whatever “immoral” thing the local populations did.
What can logical people do to quell this End Times wailing? I could tell nervous Twitterers that there is no logical basis to connect all these frightening world events because…
- there are on average 50 recorded earthquakes a day – some WILL be huge;
- we are having an unusual cold weather spell that caused animal deaths, or
- it’s just human nature to connect the dots and make something from nothing.
Sadly, that’s not going to help. They will still nervously tweet others and spread the fear. My facts and probabilities won’t change how these pieces fit into their entrenched worldview. It sucks but it’s the truth. Don’t think of these people as stupid. They are just human. There are many, even skeptically minded people, who JUST can’t help but wonder whether this pattern means something. It’s how our brains work.
However, being the calm voice of reason also doesn’t hurt. There are those who look to sources of rationality to be soothed. They want to be told it’s not a big deal. You could tell them, “Nah, I don’t think its the end of the world. It’s not all related; we are just attuned to noticing catastrophes around the world at the moment and tying them together with a good story.”
Be a small comfort in the face of the throngs of doomsayers! If panic is contagious, so is calmness. We just have to be out there promoting it. See you on May 22. 2011…
———–
* The Supermoon idea is ludicrous. Stop getting science from astrologers and promoting wacky nonsense, you pathetic media outlets!!!
#apocalypse #birdDeaths #earthquake #science #skeptical #supermoon #voiceOfReason
https://sharonahill.com/?p=655
-
More silly, stat.
Maybe find the right #hashtags
#pineapple of course
I like #ludicrous
#pointless #preposterous #ridiculous might help
The silly community needs hashtags.
-
More silly, stat.
Maybe find the right #hashtags
#pineapple of course
I like #ludicrous
#pointless #preposterous #ridiculous might help
The silly community needs hashtags.
-
More silly, stat.
Maybe find the right #hashtags
#pineapple of course
I like #ludicrous
#pointless #preposterous #ridiculous might help
The silly community needs hashtags.
-
More silly, stat.
Maybe find the right #hashtags
#pineapple of course
I like #ludicrous
#pointless #preposterous #ridiculous might help
The silly community needs hashtags.
-
TZTZ TALK LOUD
COLA TAXI OKAY, Sunday, February 8 at 02:00 PM GMT+1
TZTZ TALK LOUD – Spielerisch sprechen
Beim TZTZ TALK LOUD treffen sich Menschen mit ganz
unterschiedlichen Sprachkenntnissen und Sprechweisen.
Denn jede*r spricht anders – mal schnell, mal langsam, mal
leise, mal laut. Und das ist gut so! Mit spielerischen
Übungen üben wir das Sprechen, stärken unser
Selbstvertrauen und verbessern Aussprache, Ausdruck und
Präsenz. Menschen mit Migrations- oder Fluchtgeschichte
können ihre Deutschkenntnisse erweitern, und DeutschMuttersprachler*innen entdecken ihre Sprache neu und
kreativ. Das Angebot ist offen für alle und unabhängig vom
Sprachniveau. Es geht um Austausch, Spaß und
Experimentieren mit Sprache und Stimme. Scheu ist ganz
normal – Mut wächst beim Üben und Sprechen. Komm
vorbei und mach mit! Wir freuen uns auf Dich.
TZTZ TALK LOUD – Speaking playfully
At TZTZ TALK LOUD people with very different language
skills and ways of speaking come together. Because
everyone speaks differently – sometimes fast, sometimes
slow, sometimes quiet, sometimes loud. And that’s a good
thing! With playful exercises we practise speaking, build our
confidence, and improve pronunciation, expression and
presence. People with a migration or refugee background
can develop their German skills, and native German
speakers discover their language anew and creatively.
The offer is open to everyone regardless of language level.
It’s about exchange, fun and experimenting with language
and voice. Being shy is completely normal – courage grows
by practising and speaking. Come by and join in! We look
forward to seeing you.
TZTZ TALK LOUD – Parler de façon ludique
Chez TZTZ TALK LOUD, des personnes aux compétences
linguistiques et usages de parole très variés se réunissent.
Parce que chacun·e parle différemment – parfois vite,
parfois lentement, parfois doucement, parfois fort. Et c’est
bien ainsi ! À travers des exercices ludiques, nous
pratiquons le parler, renforçons notre confiance, et
améliorons la prononciation, l’expression et la présence.
TZTZ TALK LOUD – Hablar de forma juguetona
En TZTZ TALK LOUD se reúnen personas con
conocimientos lingüísticos y formas de hablar muy
diversas. Porque cada uno/a habla de forma distinta – a
veces rápido, a veces lento, a veces en voz baja, a veces
en voz alta. ¡Y eso está bien! Con ejercicios lúdicos
practicamos el habla, fortalecemos nuestra confianza y
mejoramos la pronunciación, la expresión y la presencia.
Las personas con historia de migración o de refugio pueden
ampliar sus conocimientos de alemán, y quienes son
hablantes nativos de alemán descubren su idioma de un
modo nuevo y creativo. La oferta está abierta a todas las
personas, sin importar el nivel de idioma. Aquí se trata de
intercambio, diversión y experimentar con el idioma y la
voz. La timidez es algo perfectamente normal – la valentía
crece al practicar y al hablar. ¡Pasa y participa! Nos
alegramos de verte.
TZTZ TALK LOUD – Игровое говорение
На встречах TZTZ TALK LOUD собираются люди с
совершенно разными языковыми навыками и
способами говорить. Ведь каждый говорит по-своему –
иногда быстро, иногда медленно, иногда тихо, иногда
громко. И это прекрасно! С помощью игровых
упражнений мы практикуем речь, укрепляем
уверенность в себе и улучшаем произношение,
выразительность и присутствие. Люди с миграцией или
беженским прошлым могут развивать свои знания
немецкого языка, а носители немецкого языка
открывают свой язык заново и творчески. Это
предложение открыто для всех, независимо от уровня
языка. Речь идёт об обмене, веселье и
экспериментировании с языком и голосом.
Скромность — это нормально, — смелость растёт через
практику и говорение. Приходи и присоединяйся! Мы
рады тебя видеть.
TZTZ TALK LOUD – Oyunla konuşma
TZTZ TALK LOUD’da çok farklı dil düzeylerine ve konuşma
biçimlerine sahip insanlar bir araya geliyor. Çünkü herkes
farklı konuşur – bazen hızlı, bazen yavaş, bazen alçak
sesle, bazen yüksek sesle. Ve bu gayet güzel! Oyuncu
egzersizlerle konuşma pratiği yapıyoruz, özgüvenimizi
güçlendiriyoruz ve telaffuz, ifade ve sahnede olma hâlimizi
geliştiriyoruz. Göç veya mülteci geçmişi olan kişiler Alman
dilini geliştirebilir, Almanca ana dil olan katılımcılar da
dillerini yeni ve yaratıcı bir şekilde keşfeder. Bu etkinlik dil
seviyesinden bağımsız olarak herkese açıktır. Amaç dil ve
sesle değişim, eğlence ve deneme yapmaktır.
Çekingenlik tamamen normal — cesaret pratikle ve
konuşmayla büyür. Gel ve katıl! Seni aramızda görmekten
mutluluk duyarız.
TZTZ TALK LOUD – Vorbim jucăuș
La TZTZ TALK LOUD se întâlnesc oameni cu cunoștințe de
limbă și moduri de vorbire foarte diferite. Pentru că fiecare
vorbește altfel – uneori rapid, uneori lent, uneori în șoaptă,
uneori tare. Și asta e bine! Prin exerciții jucăușe practicăm
vorbirea, ne întărim încrederea în noi și ne îmbunătățim
pronunția, expresivitatea și prezența. Persoanele cu istoric
de migrație sau refugiu își pot dezvolta cunoștințele de
germană, iar vorbitorii nativi de germană își redescoperă
limba în mod nou și creativ.Oferta este deschisă pentru toți,
indiferent de nivelul de limbă. Este despre schimb,
distracție și experimentare cu limba și vocea. Timiditatea e
complet normală – curajul crește prin exercițiu și vorbire.
Vino și participă! Te așteptăm cu drag.
TZTZ TALK LOUD – Kuongea kwa kucheza
Katika TZTZ TALK LOUD watu wenye ujuzi na mitindo ya
kuongea sana tofauti wanaonana. Kwa sababu kila mtu
anaongea kwa njia yake – wakati mwingine haraka, wakati
mwingine polepole, wakati mwingine kwa sauti ya chini,
wakati mwingine kwa sauti ya juu. Na hiyo ni nzuri!
Kwa mazoezi ya mchezo tunaongea, tunajenga kujiamini
na kuboresha lafudhi, maelezo na uwepo wetu.
Watu wenye historia ya uhamiaji au uhamiaji wa kimbari
wanaweza kukuza ujuzi wao wa Kijerumani, na
wazungumzaji wa asili wa Kijerumani wanagundua lugha
yao upya na kwa ubunifu. Ombi hili lipo wazi kwa wote, bila
kujali kiwango cha lugha. Ni kuhusu kubadilishana,
burudani na kujaribu na lugha na sauti. Kuogopa ni kawaida
kabisa – ujasiri unakua kwa mazoezi na kuongea. Njoo na
jiunge nasi! Tunafurahi kukutana na wewe.
TZTZ TALK LOUD – Ukuthetha ngokudlala
Kwi-TZTZ TALK LOUD kudibana abantu abanezakhono
zolwimi kunye neendlela ezahlukeneyo zokuthetha. Kuba
wonke umntu ukuthetha ngendlela yakhe – ngamanye
amaxesha ngokuqhuma, ngamanye amaxesha kancinci,
ngelizwi eliphantsi, ngelizwi eliphezulu. Kwaye oko
kulungile! Ngezemidlalo zokuzonwabisa sizilolonga
ukuthetha, siyomeleza ukuzithemba kwethu, kwaye
siphucula ukucacisa amagama, ukuveza izinto kunye
nobukho bethu. Abantu abanembali yokufika okanye
bazalelwe kwamanye amazwe banokuba namandla
okulolonga ulwimi lwesiJamani, kwaye abo baneJamani
njengolwimi lwendalo banokufumanisa ulwimi lwabo
ngendlela entsha nephefumlelweyo.
Isibonelelo sivulekile kuwo onke abantu, nokuba ulwimi
lwakho kwilevel eyiphi na. Kukho malunga
notshintshiselwano, uvuyo kunye nokuvavanya ulwimi
kunye nelizwi. Ukuthoba isantya kukulungile
ngokupheleleyo – ubungqina burhweba ngokuzilolonga
nokuthetha. Woza ujoyine! Sijonge phambili ukukubona.
TZTZ TALK LOUD
افرادی با مهارتها و شيوههای بسيار متفاوت صحبت TZTZ TALK LOUDدر
گرد هم میآيند. زيرا هر کس به نحوی متفاوت صحبت میکند – گاهی سريع،
!گاهی آهسته، گاهی با صدای پايين، گاهی با صدای بلند. و اين چيز خوبی است
با تمرينهای بازيگوشانه ما به مکالمه میپردازيم، اعتمادبهنفسمان را تقويت
.میکنيم و تلفظ، بيان و حضورمان را بهبود میبخشيم
افرادی با پيشينه مهاجرت يا پناهندگی میتوانند مهارتهای زبان آلمانی خود را
گس
-
„Rocznica” Jana Komasy. Amerykańska elita toczy wojnę domową przy rodzinnym stole
Jan Komasa, po międzynarodowym sukcesie „Bożego Ciała”, prezentuje swój pierwszy w pełni anglojęzyczny film. Jeżeli spodobał wam się „Civil War” Alexa Garlanda, to i dzieło Komasy ma szansę znaleźć waszą akceptację, choć jest filmem stawiającym na zupełnie odmienną formę prezentacji rozkładu społeczeństwa.
„Rocznica” (Anniversary) to thriller polityczny, zręcznie ukryty pod płaszczem kameralnego dramatu rodzinnego. To już pierwsze wyraźne rozróżnienie w stosunku do wspomnianego filmu Alexa Garlanda. Tam planem był w zasadzie cały kraj (Stany Zjednoczone), tutaj mamy spojrzenie na podstawową komórkę społeczną: rodzinę.
Jan Komasa wie co robi. Reżyser, znany jest z prześwietlania polskich wyższych sfer, tym razem bierze na warsztat zamożne elity Waszyngtonu. Obserwujemy spotkanie z okazji 25. rocznicy ślubu, które staje się katalizatorem ideologicznego i osobistego konfliktu, odzwierciedlającego pęknięcia współczesnej Ameryki. Brzmi to może zbyt górnolotnie, ale absolutnie takie nie jest podczas seansu i duża w tym zasługa maestrii aktorskiej.
Tytułowa „Rocznica” jest tu spoiwem narracyjnym. Film zaczyna się rocznicą małżeństwa cenionej wykładowczyni uniwersyteckiej Ellen (Diane Lane) i restauratora Paula (Kyle Chandler). Również ostatnie sceny to rocznica, ale o jakże odmienna w formie i charakterze. Nie chcę zdradzać fabuły, niemniej kameralność inscenizacyjna nie odbiera temu tytułowi splendoru. Wręcz przeciwnie, fakt, że niemal wszystkie sceny rozgrywają się w jednym miejscu pozwala zabłysnąć aktorsko i moim zdaniem afisz nie zawodzi, a amerykańskie gwiazdy stają na wysokości zadania, serwując widzom emocjonalny rollercoaster.
Co jednak ma wspólnego rodzina z politycznym thrillerem? Sztampowy film z tego gatunku najczęściej epatuje gabinetowymi naradami, przebitkami z miejsc typu Biały Dom, Kongres, etc. Komasa podszedł do tego zupełnie inaczej. Faktycznych polityków widzimy dosłownie przez sekundy, czy to w scenie w restauracji Paula, czy na przebitkach z transmisji telewizyjnych.
Komasa umiejętnie gra na symbolach, choćby flaga. Niby to tylko flaga państwowa, ale właśnie ona jest tu symbolem o większym ciężarze gatunkowym i wymowie, niż jakiekolwiek inscenizowane przemowy polityków, który tu na szczęście widzom oszczędzono.
Siłą „Rocznicy” jest przede wszystkim gra aktorska. Dodać trzeba że artystyczne skrzydła pozwolił im rozwinąć udany scenariusz Lori Rosene-Gambino. Błyskotliwe słowne starcia tu wystarczają, by powietrze gęstniało od emocji. Nie trzeba kul i efektów specjalnych, choć zrozumiem, że fani „Johna Wicka” mogliby być tym filmem rozczarowani.
Jeżeli jednak umiejętna, precyzyjna, oparta na wiarygodnym sztafażu emocji, gra aktorska to coś co w kinie lubicie, amerykańskie dzieło Komasy nie powinno was rozczarować. I jakkolwiek znalazłoby się kilka rzeczy, do których na siłę mogłabym się przyczepić, to wynikają głównie z osobistego podejścia widza do poruszanej tematyki. Zupełnie inaczej ten film odbiorą zwolennicy każdej z dwóch stron amerykańskiej sceny politycznej, która – choć amerykańska – siłą rzeczy rezonuje globalnie.
#Anniversary #DianeLane #dramat #film #JanKomasa #news #PhoebeDynevor #recenzja #rocznica #thrillerPolityczny
-
@papapep
Tranquil, no ets l'únic.
Jo en tinc uns 2100 a la llista de desitjos i uns 110 a l'estanteria de casa, encara per #llegir.
Lluito, amb dificultat, contra l'angoixa i evito la presumpció de creure que puc fer o saber-ho tot Sobretot no deixis de prendre la medicació 😂
Utilizo #librarything -
Dneska jsem poprosil Lenku, jestli mi naproti nehodí prcky rovnou na stezku i s bruslema.
#Brusle už převážně drží na asfaltu a jsem schopnej se rozjet. Zastavování je takový trochu problematický...
Malá Lenička to má zatím spíš jako koloběžku - jednu nohu veze a druhou se odráží 😀
-
Beyond Bcrypt
In 2010, Coda Hale wrote How To Safely Store A Password which began with the repeated phrase, “Use bcrypt”, where the word bcrypt was linked to a different implementation for various programming languages.
This had two effects on the technology blogosphere at the time:
- It convinced a lot of people that bcrypt was the right answer for storing a password.
- It created a meme for how technology bloggers recommend specific cryptographic algorithms when they want attention from Hacker News.
At the time, it was great advice!
Credit: CMYKatIn 2010, bcrypt was the only clearly good answer for password hashing in most programming languages.
In the intervening almost fifteen years, we’ve learned a lot more about passwords, password cracking, authentication mechanism beyond passwords, and password-based cryptography.
If you haven’t already read my previous post about password-based cryptography, you may want to give that one a once-over before you continue.
But we’ve also learned a lot more about bcrypt, its limitations, the various footguns involved with using it in practice, and even some cool shit you can build with it.
In light of a recent discussion about switching WordPress’s password hashing algorithm from PHPass (which is based on MD5) to bcrypt, I feel now is the perfect time to dive into this algorithm and its implications on real-world cryptography.
Understanding Bcrypt in 2024
Bcrypt is a password hashing function, but not a password KDF or general-purpose cryptographic hash function.
If you’re using a sane password storage API, such as PHP’s password API, you don’t even need to think about salting your passwords, securely verifying passwords, or handling weird error conditions. Instead, you only need concern yourself with the “cost” factor, which exponentially increases the runtime of the algorithm.
There’s just one problem: bcrypt silently truncates after 72 characters (or rather, bytes, if you’re pedantic and assume non-ASCII passwords, such as emoji).
Here’s a quick script you can run yourself to test this:
<?php$example1 = str_repeat('A', 72);$example2 = $example1 . 'B';$hash = password_hash($example1, PASSWORD_BCRYPT);var_dump(password_verify($example2, $hash));This may sound ludicrous (“who uses 72 character passwords anyway?”) until you see security advisories like this recent one from Okta.
The Bcrypt algorithm was used to generate the cache key where we hash a combined string of userId + username + password. Under a specific set of conditions, listed below, this could allow users to authenticate by providing the username with the stored cache key of a previous successful authentication.
(…)
- The username is 52 characters or longer
The other thing to consider is that many people use passphrases, such as those generated from Diceware, which produce longer strings with less entropy per character.
If you use bcrypt as-is, you will inevitably run into this truncation at some point.
“Let’s pre-hash passwords!”
In response to this limitation, many developers will suggest pre-hashing the password with a general purpose cryptographic hash function, such as SHA-256.
And so, in pursuit of a way to avoid one footgun, developers introduced two more.
AJTruncation on NUL Bytes
If you use the raw binary output of a hash function as your password hash, be aware that bcrypt will truncate on NUL (
0x00) bytes.With respect to the WordPress issue linked above, the default for PHP’s hashing API is to output hexadecimal characters.
This is a bit wasteful. Base64 is preferable, although any isomorphism of the raw hash output that doesn’t include a
0x00byte is safe from truncation.Hash Shucking
When a system performs a migration from a cryptographic hash function (e.g., MD5) to bcrypt, they typically choose to re-hash the existing hash with bcrypt.
Because users typically reuse passwords, you can often take the fast, unsalted hashes from another breach and use it as your password dictionary for bcrypt.
If then you succeed in verifying the bcrypt password for a fast hash, you can then plug the fast hash into software like Hashcat, and then crack the actual password at a much faster rate (tens of billions of candidates/second, versus thousands per second).
This technique is called hash shucking (YouTube link).
You can avoid hash shucking by using HMAC with a static key–either universal for all deployments of your software, or unique per application.
It doesn’t really matter which you choose; all you really need from it is domain separation from naked hashes.
I frequently see this referred to as “peppering”, but the term “pepper” isn’t rigidly defined anywhere.
One benefit of using a per-application HMAC secret does make your hashes harder to crack if you don’t know this secret.
For balance, one downside is that your hashes are no longer portable across applications without managing this static key.
Disarming Bcrypt’s Footguns
Altogether, it’s quite straightforward to avoid bcrypt’s footguns, as I had recommended to WordPress last week.
- Pre-hash with HMAC-SHA512.
- Ensure the output of step 1 is base64-encoded.
- Pass the output of step 2 to PHP’s password API.
Easy, straightforward, and uncontroversial. Right?
Objections to Bcrypt Disarmament
The linked discussion was tedious, so I will briefly describe the objections raised to my suggestion.
- This is “rolling our own crypto”.
- Answer: No, it’s a well-understood pattern that’s been discussed in the PHP community for well over a decade.
- Passwords over 72 characters are rare and not worthy of our consideration.
- Answer: No, this has bit people in unexpected ways before (see: Okta).
When you develop a popular CMS, library, or framework, you cannot possibly know all the ways that your software will be used by others. It’s almost always better to be misuse-resistant.
- Answer: No, this has bit people in unexpected ways before (see: Okta).
- Pre-hashing introduces a Denial-of-Service attack risk.
- Answer: No. Bcrypt with a cost factor of 10 is about 100,000 times as expensive as SHA2.
- This introduces a risk of hash shucking.
- As demonstrated above, HMAC doesn’t suffer this problem (assuming the key is reasonably selected).
- Base64 encoding reduces entropy.
- Answer: No, it’s isomorphic.
- Base64 with the 72 character truncation reduces entropy.
- Answer: We’re still truncating SHA-512 to more than 256 bits of its output, so this doesn’t actually matter for any practical security reason.
- This would necessitate a special prefix (e.g.
$2w$) to distinguish disarmed bcrypt from vanilla bcrypt that PHP’s password API wouldn’t know what to do with.- This is a trivial concern, for which the fix is also trivial:
After password_hash(), modify the prefix with a marker to indicate pre-hashing.
Before password_verify(), swap the original prefix back in.
- This is a trivial concern, for which the fix is also trivial:
There were some other weird arguments (such as “Bcrypt is approved by NIST for FIPS”, which is just plain false).
Why Bcrypt Truncating SHA-512 Doesn’t Matter
If you have a random secret key, HMAC-SHA-512 is a secure pseudorandom function that you can treat as a Random Oracle.
Because it’s HMAC, you don’t have to worry about Length Extension Attacks at all. Therefore, the best known attack strategy is to produce a collision.
The raw binary output of SHA-512 is 64 characters, but may contain NUL characters (which would truncate the hash). To avoid this, we base64-encode the output.
When you base64-encode a SHA-512 hash, the output is 88 characters (due to base64 padding). This is longer than the 72 characters supported by bcrypt, so it will truncate silently after 72 characters.
This is still secure, but to prove this, I need to use math.
First, let’s assume you’re working with an extremely secure, high-entropy password, and might be negatively impacted by this truncation. How bad is the damage in this extreme case?
There are 64 possible characters in the base64 alphabet. That’s tautology, after all.
If you have a string of length 72, for which each character can be one of 64 values, you can represent the total probability space of possible strings as .
If you know that , you can do a little bit of arithmetic and discover this quantity equal to .
As I discussed in my deep dive on the birthday bound, you can take the cube root of this number to find what I call the Optimal Birthday Bound.
This works out to samples in order to find a probability of a single collision.
This simply isn’t going to happen in our lifetimes.
2^-144 is about 17 trillion times less likely than 2^-100.The real concern is the entropy of the actual password, not losing a few bits from a truncated hash.
After all, even though the outputs of HMAC-SHA512 are indistinguishable from random when you don’t know the HMAC key, the input selection is entirely based on the (probably relatively easy-to-guess) password.
“Why not just use Argon2 or Scrypt?”
Argon2 and scrypt don’t have the bcrypt footguns. You can hash passwords of arbitrary length and not care about NUL characters. They’re great algorithms.
Several people involved in the Password Hashing Competition (that selected Argon2 as its winner) have since lamented the emphasis on memory-hardness over cache-hardness. Cache-hardness is more important for short run-times (i.e., password-based authentication), while memory-hardness is more important for longer run-times (i.e., key derivation).
As Sc00bz explains in the GitHub readme for his bscrypt project:
Cache hard algorithms are better than memory hard algorithms at shorter run times. Basically cache hard algorithms forces GPUs to use 1/4 to 1/16 of the memory bandwidth because of the large bus width (commonly 256 to 1024 bits). Another way to look at it is memory transactions vs bandwidth. Also the low latency of L2 cache on CPUs and the 8 parallel look ups let’s us make a lot of random reads. With memory hard algorithms, there is a point where doubling the memory quarters a GPU attacker’s speed. There then is a point at which a memory hard algorithm will overtake a cache hard algorithm. Cache hard algorithms don’t care that GPUs will get ~100% utilization of memory transactions because it’s already very limiting.
Ironically, bcrypt is cache-hard, while scrypt and the flavors of Argon2 that most people use are not.
Most of my peers just care that you use a password hashing algorithm at all. They don’t particularly care which. The bigger, and more common, vulnerability is not using one of them in the first place.
I’m mostly in agreement with them, but I would prefer that anyone that chooses bcrypt takes steps to disarm its footguns.
Turning Bcrypt Into a KDF
Earlier, I noted that bcrypt is not a password KDF. That doesn’t mean you can’t make one out of bcrypt. Ryan Castellucci is an amazing hacker; they managed to do just that.
To understand why this is difficult, and why Ryan’s hack works, you need to understand what bcrypt actually is.
Bcrypt is a relatively simple algorithm at its heart:
- Run the Blowfish key schedule, several times, over both the password and salt.
- Encrypt the string
"OrpheanBeholderScryDoubt"64 times in ECB mode using the expanded key from step 1.
Most of the heavy work in bcrypt is actually done in the key schedule; the encryption of three blocks (remember, Blowfish is a 64-bit block cipher) just ensures you need the correct resultant key from the key schedule.
“So how do you get an encryption key out of bcrypt?”
It’s simple: we, uh, hash the S-box.
static void BF_kwk(struct BF_data *data, uint8_t kwk[BLAKE2B_KEYBYTES]) { BF_word *S = (BF_word *)data->ctx.S; BF_htobe(S, 4*256); // it should not be possible for this to fail... int ret = blake2b_simple(kwk, BLAKE2B_KEYBYTES, S, sizeof(BF_word)*4*256); assert(ret == 0); BF_betoh(S, 4*256);}Using BLAKE2b to hash the S-box from the final Blowfish key expansion yields a key-wrapping key that can be used to encrypt whatever data is being protected.
The only feasible way to recover this key is to provide the correct password and salt to arrive at the same key schedule.
Any attack against the selection of S implies a cryptographic weakness in bcrypt, too. (I’ve already recommended domain separation in a GitHub issue.)
CMYKatIt’s worth remembering that Ryan’s design is a proof-of-concept, not a peer-reviewed design ready for production. Still, it’s a cool hack.
It’s also not the first of its kind (thanks, Damien Miller).
If anyone was actually considering using this design, first, they should wait until it’s been adequately studied. Do not pass Go, do not collect $200.
Additionally, the output of the BLAKE2b hash should be used as the input keying material for, e.g., HKDF. This lets you split the password-based key into multiple application-specific sub-keys without running the password KDF again for each derived key.
Wrapping Up
Although bcrypt is still an excellent cache-hard password hashing function suitable for interactive logins, it does have corner cases that sometimes cause vulnerabilities in applications that misuse it.
If you’re going to use bcrypt, make sure you use bcrypt in line with my recommendations to WordPress: HMAC-SHA-512, base64 encode, then bcrypt.
Here’s a quick proof-of-concept for PHP software:
<?phpdeclare(strict_types=1);class SafeBcryptWrapperPoC{ private $staticKey; private $cost = 12; public function __construct( #[\SensitiveParameter] string $staticKey, int $cost = 12 ) { $this->staticKey = $staticKey; $this->cost = $cost; } /** * Generate password hashes here */ public function hash( #[\SensitiveParameter] string $password ): string { return \password_hash( $this->prehash($password), PASSWORD_BCRYPT, ['cost' => $this->cost] ); } /** * Verify password here */ public function verify( #[\SensitiveParameter] string $password, #[\SensitiveParameter] string $hash ): bool { return \password_verify( $this->prehash($password), $hash ); } /** * Pre-hashing with HMAC-SHA-512 here * * Note that this prefers the libsodium base64 code, since * it's implemented in constant-time */ private function prehash( #[\SensitiveParameter] string $password ): string { return \sodium_bin2base64( \hash_hmac('sha512', $password, $this->staticKey, true), \SODIUM_BASE64_VARIANT_ORIGINAL_NO_PADDING ); }}You can see a modified version of this proof-of-concept on 3v4l, which includes the same demo from the top of this blog post to demonstrate the 72-character truncation bug.
If you’re already using bcrypt in production, you should be cautious with adding this pre-hashing alternative. Having vanilla bcrypt and non-vanilla bcrypt side-by-side could introduce problems that need to be thoroughly considered.
I can safely recommend it to WordPress because they weren’t using bcrypt before. Most of the people reading this are probably not working on the WordPress core.
Addendum (2024-11-28)
More of the WordPress team has chimed in to signal support for vanilla bcrypt, rather than disarming the bcrypt footgun.
The reason?
That would result in maximum compatibility for existing WordPress users who use the Password hashes outside of WordPress, while also not introducing yet-another-custom-hash into the web where it’s not overly obviously necessary, but while still gaining the bcrypt advantages for where it’s possible.
The hesitance to introduce a custom hash construction is understandable, but the goal I emphasized with bold text is weird and not a reasonable goal for any password storage system.
It’s true that the overwhelming non-WordPress code written in PHP is just using the password hashing API. But that means they aren’t compatible with WordPress today. PHP’s password hashing API doesn’t implement phpass, after all.
In addition to being scope creep for a secure password storage strategy, it’s kind of a bonkers design constraint to expect password hashes be portable. Why are you intentionally exposing hashes unnecessarily?
CMYKatAt this point, it’s overwhelmingly likely that WordPress will choose to not disarm the bcrypt footguns, and will just ship it.
That’s certainly not the worst outcome, but I do object to arriving there for stupid reasons, and that GitHub thread is full of stupid reasons and misinformation.
The most potent source of misinformation also barked orders at me and then tried to dismiss my technical arguments as the concerns of “the hobbyist community”, which was a great addition to my LinkedIn profile.
If WordPress’s choice turns out to be a mistake–that is to say, that their decision for vanilla bcrypt introduces a vulnerability in a plugin or theme that uses their password hashing API for, I dunno, API keys?–at least I can say I tried.
Additionally, WordPress cannot say they didn’t know the risk existed, especially in a courtroom, since me informing them of it is so thoroughly documented (and archived).
CMYKatHere’s to hoping the risk never actually manifests. Saying “I told you so” is more bitter than sweet in security. Happy Thanksgiving.
Header image: Art by Jim and CMYKat; a collage of some DEFCON photos, as well as Creative Commons photos of Bruce Schneier (inventor of the Blowfish block cipher) and Niels Provos (co-designer of bcrypt, which is based on Blowfish).
#bcrypt #cryptography #passwordHashing #passwords #SecurityGuidance
-
Clinical Neuroimaging : Cases and Key Points (2007) by David J. Anschel, MD
Author: David J. Anschel
File Type: PDF
Download at https://unitedvrg.com/2022/08/11/pdf-clinical-neuroimaging-cases-and-key-points-2007-by-david-j-anschel-md/
#CaseMedicine, #DavidJ.Anschel -
@ijk @ColinTheMathmo The website for CGTC changed recently, so I'm jumping in in case anyone is having trouble finding the new site. CGTC 5: https://ludicum.org/cgtc-v/
The next CGT conference I know of is Integers in Georgia (US) in mid-May: https://sites.google.com/view/integersconference2025. Shortly after that there will be a CGT session at CanaDAM in Ottawa: https://canadam.ca/2025schedule#page-u.
There's also the virtual seminar (Zoom) that happens about every month September to April: https://sites.google.com/view/virtual-cgt/seminar
-
‘Lift’ Review: Kevin Hart Ratchets Up His Action Star Cred In Netflix Heist Film That Is Ludicrously Entertaining
#Reviews #FGaryGray #GuguMbathaRaw #Jeanreno #KevinHart #Lift #Netflix #SamWorthington #VincentDOnofriohttps://deadline.com/2024/01/lift-review-kevin-hart-action-star-heist-film-1235720340/
-
Lightspeed is too slow. We'll have to go right to ludicrous speed.
2 million miles per hour (3.21 million kilometers per hour).
The superheated gas from this galaxy, Messier 82 (M82), flows from a region of intense stellar activity at the galaxy's heart. M82 is located around 12 million light-years away from us in the northern constellation Ursa Major and classified as a "starburst galaxy" because it is forming stars 10 times as rapidly as the Milky Way does.
#Galaxy #Messier82 #M82 #CigarGalaxy #Space #Winds #Astronomy
-
Lightspeed is too slow. We'll have to go right to ludicrous speed.
2 million miles per hour (3.21 million kilometers per hour).
The superheated gas from this galaxy, Messier 82 (M82), flows from a region of intense stellar activity at the galaxy's heart. M82 is located around 12 million light-years away from us in the northern constellation Ursa Major and classified as a "starburst galaxy" because it is forming stars 10 times as rapidly as the Milky Way does.
#Galaxy #Messier82 #M82 #CigarGalaxy #Space #Winds #Astronomy
-
Lightspeed is too slow. We'll have to go right to ludicrous speed.
2 million miles per hour (3.21 million kilometers per hour).
The superheated gas from this galaxy, Messier 82 (M82), flows from a region of intense stellar activity at the galaxy's heart. M82 is located around 12 million light-years away from us in the northern constellation Ursa Major and classified as a "starburst galaxy" because it is forming stars 10 times as rapidly as the Milky Way does.
#Galaxy #Messier82 #M82 #CigarGalaxy #Space #Winds #Astronomy
-
Lightspeed is too slow. We'll have to go right to ludicrous speed.
2 million miles per hour (3.21 million kilometers per hour).
The superheated gas from this galaxy, Messier 82 (M82), flows from a region of intense stellar activity at the galaxy's heart. M82 is located around 12 million light-years away from us in the northern constellation Ursa Major and classified as a "starburst galaxy" because it is forming stars 10 times as rapidly as the Milky Way does.
#Galaxy #Messier82 #M82 #CigarGalaxy #Space #Winds #Astronomy
-
Betanews: Mayo Clinic embraces Microsoft 365 Copilot https://betanews.com/2023/09/28/mayo-clinic-embraces-microsoft-365-copilot/ #AutomatedAdministrativeTasks #EnterpriseProductivity #HealthcareInnovation #HealthcareTechnology #Patient-CenteredCare #LargeLanguageModels #Microsoft365Copilot #GenerativeAI #HealthcareIT #MayoClinic #Article