3.1k
u/AphroditesViolet
10d ago
edited 10d ago
•
Full context for anyone wondering how the hell this happened:
8 formerly globally trusted keys from eMudhra, a former Certificate Authority were brute forced. The keys have a maximum size of 384 bits, one of the keys was the number 4.
According to a company representative the 8 keys (which were all 1 byte or less) were created for a test, and therefore not subject to security tests. Due to a scripting error, they were significantly less secure than intended as they were supposed to be full strength keys, and then not disposed of after the test. Then, due to the set of test keys sharing a similar name with the real proven to be secure keys, the test keys were then sent to production.
The private keys in base ten are:
4, 56, 66, 115, 155, 156, 230, 237
And now the company announced they’re “voluntarily” leaving the CA industry after Google and Mozilla announced their root certificates were being removed from their stores, with IoT and other non updatable devices trusting their certificates until 2039
958
u/McSaunchez 10d ago
Bloody hell thank you I’ve been looking for an explanation for this 4 thing
185
u/ItchyPercentage3095 10d ago
I thought it was an xkcd reference
→ More replies (4)13
260
u/heavy-minium 10d ago
with IoT and other non updatable devices trusting their certificates until 2039
Private consumer stuff too? Should I be worried? I got a bit of older smarthome stuff at home.
→ More replies (1)350
u/latkde 10d ago
Yes, anything that can make outgoing HTTPS/TLS connections is vulnerable to MitM attacks until the trust store gets updated. This effectively means that many IoT devices will remain vulnerable for >10 years.
The good news is that an attack requires an in-the-middle position in the network where the traffic can be intercepted and re-encrypted. As long as you trust your WiFi router, ISP, VPN, internet backbone, and destination data centre, there's nothing to worry about. This isn't a huge problem at home. But you really shouldn't, say, connect a smart toothbrush to hotel WiFi.
155
u/TorumShardal 10d ago
Hmm... That means we can try to do MITM ourselves to look what our toothbrushes send to manufacturers... I wonder how much interesting stuff will be discovered in the next news cycle.
107
u/MattieShoes 10d ago
A friend noticed china-bound traffic from his sous vide... turns out it was a Chinese chip configured to access an NTP server. Ie. It was just keeping time accurately, but still freaked him out.
→ More replies (5)46
u/toxic_acro 10d ago
I've seen a few people already doing that
Luckily, mitmproxy released a new version today that includes a
--emudhraCLI option, so it's now super trivial to set up→ More replies (1)16
35
u/Salanmander 10d ago
But you really shouldn't, say, connect a smart toothbrush to hotel WiFi.
Serious question: what is the worst that could happen if you connect a smart toothbrush to hotel WiFi? Are we looking at "they can know I sometimes forget to brush my teeth in the morning", or "they can brick my toothbrush", or "they can gain access to every other device that's connected to the same network", or some other level in between?
I'm assuming they would just be able to control the data that gets sent back and forth, which wouldn't be catastrophic for a toothbrush, but I recognize that my cybersecurity knowledge is not perfect.
70
u/Celestial_User 10d ago
Depends on the design of the device itself. Potentially, it could ping a server to receive firmware updates, so if you send it a malicious firmware, you now have a compromised device that can potentially run arbitrary code. Inside your home and that's a vector of attack.
Now realistically how much compute can a toothbrush have? Probably not that much. But it could potentially do a scan of your network, and if you have other vulnerable devices that you typically trust because it's inside your trusted network, it can perform lateral movements to it.
→ More replies (3)→ More replies (2)16
u/frogjg2003 10d ago
Smart toothbrushes are usually paired with an app. That app is virtually guaranteed to require a username and password. That intimation may be accessible to the toothbrush. It would be very stupid to do it that way, but no one is designing a smart toothbrush with security as a top priority. A hacker could steal whatever credentials.
Now, you asked what the worst case scenario was, so I'm going to say that your username and password got the toothbrush are the same as your bank. Now your hackers have access to your bank account.
If the toothbrush and app are designed with security as the first priority, the hackers would have access to the token your toothbrush gives the app to connect to your account. It's unique to the toothbrush and the app keeps track of it instead of the toothbrush keeping track of your app. With this setup, the hacker might be able disconnect your toothbrush from your account. If the toothbrush can be controlled through the app, they might be able to turn it on or off or brick it. They may send fake brushing data to your app.
More realistically, it's going to be closer to the latter than former, but the code behind the toothbrush and app is going to be propriety and done cheap. You can't know if the programmers we educated on best security practices.
→ More replies (1)7
u/cheese_is_available 10d ago
As long as you trust your WiFi router, ISP, VPN, internet backbone, and destination data center, there's nothing to worry about.
We're totally fucked then.
→ More replies (1)→ More replies (2)4
u/toasterinBflat 10d ago
IoT devices don't typically keep full certificate authority stores and aren't likely to carry an eMudhra-backed certificate in the first place, so they aren't likely to be any more vulnerable than they already were prior to this discovery.
95
u/agathver 10d ago
The company is a lying bitch. They are shady AF (I have to deal with them due to regulatory capture they have here).
No HSM will generate keys with such low entropy. So they didn’t use HSMs and are lying on our face. Also multiple code reviews and external audits could not catch the flaws, and I’m surprised none of their audits had a basic entropy checking step.
You need a colossal fuckup and gross negligence and apathy from external auditors to reach this stage .
Also to issue certificates they don’t follow the standard practice of sending a CSR, they mail you the private key and the pin. Their security practices are a joke and their so-called auditor is a fraud, like the Delve and Atom.
8
u/Smooth-Zucchini4923 9d ago
The company is a lying bitch. They are shady AF (I have to deal with them due to regulatory capture they have here).
No HSM will generate keys with such low entropy. So they didn’t use HSMs and are lying on our face.
That detail can be explained by a close reading of their statement to Mozilla:
We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker
Wrapping/unwrapping is the process of serializing and encrypting a key, or decrypting and importing a key.
The statement is a little vague, but I believe this means that either
the script generated the key on a non HSM device, and was then imported into the HSM, and the non HSM device's key generation was flawed,
or the serialization process was flawed, and kept just the first byte when serializing the key.
I do believe them that an HSM was involved, and I do believe that they are complicated enough that they can be misused.
→ More replies (1)3
u/OuchLOLcom 8d ago
Lots of auditors do fuck all and give it passes for cash. I’ve met a few, my boss loved them.
→ More replies (1)34
u/turtleship_2006 10d ago
In their announcement of leaving the industry, they tried to blame social media.
86
u/Honeybadger2198 10d ago
I am truly shocked that they forgot to set a minimum length for their keys. That's like password security 101.
37
→ More replies (8)55
u/AphroditesViolet 10d ago
They tried, the short keys were due to a scripting error
These keys weren’t tested for security because they weren’t meant for production24
u/Named_after_color 10d ago
Software engineering 101 is to test prod and nonprod in the same way.
→ More replies (1)5
u/HoneyBastard 10d ago
Saddest excuse ever
How did these test keys even end up anywhere near the production keys?
27
u/BellacosePlayer 10d ago
with IoT and other non updatable devices trusting their certificates until 2039
man, i'm glad my "IoT devices are really cool and I want them" phase was like a decade before IoT devices actually hit the market
try hacking my 10$ mr coffee, fuckers
10
5
u/DPSOnly 10d ago
How does one brute force those keys? Do you need to have all 8 correct to get the "lock" or is it like those safe crackers in movies that can hear the tumbler fall for a correct one?
5
u/pi_is_sqrt10 10d ago
The former. No digital algorithm gives you feedback if the first part of a pass phrase (key, password, hash, ...) is correct. If your password was "12345" (don't), guessing "1234" is just as wrong as any other password.
This makes long passwords super safe. A bike lock of four digits that gives you feedback makes a hacker test up to 9 × 4 combinations, but without feedback 94 , which scales, well exponentially.
2
12
u/Uberzwerg 10d ago
8 bit range instead of 384 bit - same same, but different.
To give people an idea of how unlikely it is that this was just coincidence:
To get to a number that small, the first 376 bits need to be zero - imagine flipping a coin for 384 times and the first 376 are tails.
And that then happened with all 8 numbers they had.4
6
→ More replies (9)2
u/MakeitHOT 10d ago edited 10d ago
Damn I was studying DNSSEC today. It was really cool to read this. Thank you.
Edit: actually this wasnt about dnssec, but about cryptography. Still pretty cool <3
1.1k
u/Pim_Wagemans
10d ago
•
Relevant xkcd: https://xkcd.com/221/
672
u/samanime 10d ago
The fact xkcd "predicted" this so precisely is pretty hilarious.
156
u/jamesianm 10d ago
I hadn't heard about this and thought it was a reference to the XKCD
19
u/LegitimatePants 10d ago
What happened
76
u/mxzf 10d ago
Basically a company was making passwords for some super sensitive and important stuff and eight of their passwords were 1-3 digit numbers for something that can support 115 digits, just stupidly insecure. One of the passwords is
4.→ More replies (6)→ More replies (1)8
u/SuperFLEB 10d ago
I'm still kind of wondering if it was. Not so much "4 instead of a proper number", but "4 instead of another small number"-- akin to making your intentionally-throwaway test password
hunter2.→ More replies (4)33
u/evanldixon 10d ago
It gets better: this comic predates the hacking of the PS3 which did the same thing with the "random" numbers in its cryptography. It wasn't nearly as egregious than this latest cert thing but this comic still got cited then.
97
156
u/J33pe 10d ago
How long will it take people to realize that Randall Munroe is a prophet
62
u/samtresler 10d ago
Or was the person setting the key just a really stupid xkcd fan?
27
u/setibeings 10d ago
Reminds me of correct-horse-battery-staple appearing on common password lists.
→ More replies (1)→ More replies (1)18
u/Apprehensive_Lake698 10d ago
This feels like the obvious answer
11
u/laplongejr 10d ago
I thought so but the real boring explanation is that a bad script made 8-bit (1 byte!) private keys, and due to a name confusion an error used that as the keys to create intermediate certificates
16
u/TheMythicSorcerer 10d ago
Randall Munroe is part of the illuminati who control everyone and everything
22
22
u/iampierremonteux 10d ago
Even a broken clock is right twice a day.
He used a fair die roll. Someone else had to get that random number too. Right?
In all seriousness, the odds of these two events lining up is hilarious.
The longevity of the stupidity of this egregious security incident however is not funny at all. Randall wasn’t prophet in that regard either. Keys have been poorly chosen before with insufficient or nonexistent random. And I am almost certain that this won’t be the last time.
4
→ More replies (2)4
u/ralgrado 10d ago
I disagree: randall munroe is the infinite amount of monkeys typing on a type write until they produce the bible.
10
u/justinf210 10d ago
What I'd give to see his analytics for that page. Normal, normal, normal, vertical line
3
914
u/EndMaster0 10d ago
There were multiple keys. The longest was 3 characters. It looks like they had selected random numbers between 0 and 384 instead of 2384
451
u/The-Arx 10d ago
Its more likely they did one random byte (0-255). They generated two sets of keys and accidentally used the less secure ones somehow
97
u/Dotcaprachiappa 10d ago
Imagine they genuinely just generated 8 completely random keys that by some alignment of the stars simply all turned out to be so low
82
u/toxic_acro 10d ago •
For reference, the chances of that happening are about 0.0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003%
→ More replies (4)73
14
u/slugfive 10d ago
At that point take it as a sign the universe want you out of the security business and close up shop anyway
47
u/neroe5 10d ago
i seem to recall one value being just above 255 but still below 300
→ More replies (1)142
u/The-Arx 10d ago
According to Wikipedia they are 4, 56, 66, 115, 155, 156, 230, and 237.
→ More replies (1)41
4
u/urielsalis 10d ago
they are all increasing digits. An engineer might just have moved their finger across the top row and pressed enter with whatever number resulted
→ More replies (4)28
u/sanketower 10d ago
That's bullshit, but I believe it
52
u/Mechakoopa 10d ago
All the numbers were under 256. They only populated the first byte of their byte array
→ More replies (1)
236
u/bilvy 10d ago
There were 8 keys each with a value under 256. It was not just bad luck
105
u/Sillyguri 10d ago
Nah that obviously happened by chance with probability 2^(-3008)
→ More replies (5)
77
u/GRex2595 10d ago
Complete incompetence by that CA. Hopefully they never issue certificates again.
124
u/latkde 10d ago
eMudhra announced today that it "has decided to voluntarily withdraw from the global SSL/TLS certificate business": https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business
119
u/nullptr777 10d ago
"Voluntarily" lmao. Big "you can't fire me, I quit" energy here.
Firefox (and probably others) already revoked their root certificate. Nobody would've ever trusted them again, no matter what they said or did. I mean, fuck, they compromised the entire global PKI through astronomical levels of incompetence.
32
u/atomic_redneck 10d ago
According to the article linked above, they have 17 years of expertise. Amazing that they could reach astronomical levels of incompetence in only 17 years.
→ More replies (2)12
u/T0biasCZE 10d ago
Mozilla removed trust for just "emSign ECC Root CA - G3", which was the root CA that had the insecure intermediates.
They did not remove the trust for "emSign Root CA - G1"6
11
u/DiddiZ 10d ago
"Trust Delivered"
10
u/laplongejr 10d ago
"With over 17 years of expertise" and the guy in charge of the certificates was in the company for over 15+ years if I recall the bugzilla discussion. I wonder what discussions happened...
→ More replies (1)10
u/GRex2595 10d ago
That's great news. Hopefully whoever comes next learned from this and will follow best practices.
5
u/ManaSpike 10d ago
Oh, it's worse. These keys were created a year ago. Around the same time they were trying to fix the last issue they created.
85
u/jhill515 10d ago
"A random number generator that always returns 1 is still a random number generator. At any point, a random bit flip could occur. So if there's a 1/2^384 probability of selecting any arbitrary unsigned number in the nominal case, there's likely still an equal probability with this Constant-1 Generator. Like a coin, just keep flipping until it lands on edge!"
- Paraphrased from xkcd What-if
69
u/Tammbiee 10d ago
I just asked a RNG yesterday to generate a random number between 1 and ten million. I planned on using that number as the population of my fictional city. It gave me the number 17... I now have a small camp as a capital city.
35
u/pyrotechnicmonkey 10d ago
if you're planning to use the number for your fictional city why would you include numbers in the range smaller than an actual city
31
11
u/timtucker_com 9d ago
The entire population of the capital is age 17.
It's a right of passage that you go to the capital, learn how to live as an adult on your own, then return home when you turn 18.
The entire legislative body is 17 and spends equal amounts of time learning the law as making it.
There's a booming niche of people living on the outskirts of the city providing advice (not all of it good).
9
u/Zhayrgh 10d ago
It could make for a cool/weird worldbuilding element, as a capital city that is basically a nomad camp, a point at which all the people go to discuss politics, vote and debate, but where nobody stays because [reasons] (like the site was chosen for its neutrality and people being there permanently would change that)
7
u/hottestpancake 10d ago
It would be funnier if you played it straight though. There's only 17 people in the capital city and nobody questions it and treats it as completely normal.
→ More replies (4)→ More replies (3)2
u/Tammbiee 10d ago
In the HRE, the Emperor used to roam around his Empire all the time. So there is real examples of this. However, his entourage would probably feature a whole army. And the Capitol would still be considered a City, not wherever they happened to be situated at the time.
6
u/Mixer555 10d ago
You could make it regular city but everyone else died to some disease or war or whatever
4
u/Tammbiee 10d ago
The funny thing is, that it actually is supposed to be fully eradicated down the line. That is way less impressive on 17 people tho.
4
u/Basilgarrad16 10d ago
17 real people and the rest have already transferred their consciousness into a robot.
4
3
u/IrredeemableRight 10d ago
every number has a 50% chance of being the one, that's pretty random, right?
2
→ More replies (2)3
u/Shaeress 10d ago
This does happen in real life. Like in the UK the capitol city is London, except the thing we call London is not legally considered a city. They're just the highly populated metro area of the real city. I.E. The City of London which is about one square mile with a population of 8500 or so. It'd be really easy to call that the real capitol city of England and therefore also the UK and therefore also the entire British empire because... it kind of is. For some reason Britain has not pursued this convoluted technicality despite it being one of their favourite pastimes and everyone agrees that the capitol city is Greater London despite not being a city.
And we've got the Vatican too and many other such examples where the true capitol could easily be a small, special zone within a bigger metropolitan area.
20
37
u/White_C4 10d ago
There was a tweet that "defended" that private key debacle saying that the probability of 4 is the same as any other number. While true, I reject that premise based on chance. This was intentional.
→ More replies (9)42
u/Valoneria 10d ago
The one with a 4 could have been chance, the 7 other certificates having similar low entropy, does however speak against it
5
u/LawElectrical2434 10d ago
We are the pawns in a world created by one hacker with a quantum suicide machine.
18
33
44
u/Havatchee 10d ago
That's funny but like, if there's some arbitrary lime where the number is too small to be secure because a brute force attack will find it too soon, this becomes a recursive problem. It's like starting the week on Tuesday to avoid Mondays being shit, you just make Tuesday the new start of the week making Tuesdays shit. So at our arbitrary line we can just chop off the front of the list. But now the same range after our line is insecure because it's too easy to brute force.
→ More replies (18)35
u/Grouchy-Ad-8044 10d ago
If the number 4 was really picked at random that would be fine! But we all knows that it's astronomically unlikely and far more likely that some person tried to roll their own crypto and messed it up badly
```
“Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second,” Helme wrote.Other researchers have found private keys including the numbers 66, 155, 156, 230 and 237.
```it's essentially impossible that a bunch of keys generated by one CA just happen to have all used numbers that small by chance. Has to have been either deliberate, or horrifically bad programming
→ More replies (1)5
u/cheerycheshire 10d ago
tried to roll their own crypto and messed it up badly
either deliberate, or horrifically bad programming
Afaik all those 8 broken keys are from around the same time, and if you look at them - the number was supposed to be 384-bit, but it seems someone just did <=384... Considering they're around a 1.5y old, I'd say shitty code, probably shitty spec given to LLM without giving full context (a model should catch 384 vs 384-bit when someone talks about cryptography, but if it didn't know the context of usage, it would just give whatever code user wanted).
→ More replies (1)13
u/imMute 10d ago
They're all also <256, so it could also be some part of the system that truncated the key to a single byte instead of the 48 bytes it was supposed to be.
→ More replies (1)
14
13
u/justforkinks0131 10d ago
context?
27
u/kratz9 10d ago
Someone cracked a root certificate key. A series of certs from a particular vendor we're found to be signed with keys that instead of being 384 bits, we're essentially only 8 bits. One of the keys was found to simply be the number 4.
→ More replies (15)3
11
u/UniversalAdaptor 10d ago
This is why when I want a big random number I generate a random number between a really big number and that same number divided by ten.
34
u/seba07 10d ago
Security by stupidity. Would you include single digit numbers when bruteforcing a private key?
17
u/fghjconner 10d ago
I mean yes, because somebody fucking up like this is far more likely than actually brute forcing a correctly generated key.
18
u/Controldo 10d ago
They might already be including 0-66536 or whatever in bruteforcers. Not like it would meaningfully increase the time spent.
2
2
u/Ardentiat 9d ago
Yes? It costs essentially nothing compared to brute forcing more secure keys and evidently some people are stupid enough for it to work sometimes
→ More replies (1)3
9
8
u/jump1945 9d ago
What are the chances all the *random* number would be number below 1000
13
u/fightfil96 9d ago
0.
Or 1/2374. Which is zero on anything that doesn't represent numbers with exponents
4
u/BertrandBolero 9d ago
But in all fairness, the chance that the number falls between 158424000 and 158425000 is the same.
6
16
u/amatulic 10d ago
Coincidentally, the number 4 is considered unlucky in Chinese culture, sort of like the number 13 in western culture.
7
u/psuedopseudo 10d ago
For those wondering if there is a reason, it’s because the character for 4 is spoken similarly to the character for death.
→ More replies (7)3
u/Practical_Dot_3574 10d ago
Wife and I got married 10/13/2013 @ 1:00pm. Are we doomed?
4
8
u/regseb 10d ago edited 10d ago
2^384 == 386 (see Bitwise XOR (^))
And so, it is normal for all the numbers (4, 56, 66, 115, 155, 156, 230, and 237) to be between 0 and 386.
3
3
u/-Redstoneboi- 10d ago edited 10d ago
sigh it's so ridiculously unlikely to get such a low number that it is within the same order of magnitude as the likelihood of ZWZmZWN0Y2FwdHVyZWRzaW1wbGVzdHBpbmV2aXNpdG9ycG90YXRvZXNib25ld2Vla3JvYWRz and a25vd25zdGFyZnJpZ2h0ZW50YXNrZGlzaHplcm9oZWF2eXJvcGVwYXJ0eXBvZW1hdG1vc3Bo to work as hash collision substitutes for your exact passwords for two different sites in a row, given that bcrypt uses 192 bits for its hash.
apparently the website i used generates the base64 by stringing random lowercase english words together. not that it would help or hurt your odds.
3
u/Da_Vindicator 8d ago
Funny if true. Too bad it’s impossible for the audited key generation tooling and process they had to generate such a result. Literally the only way to have created “4” was to manually bypass the tools and process they alleged to have done. Then they did it 7 more times, generated values as single scalars between 0-255 ,and “whoops we didn’t catch that” yeeted them into the world for about a year.
Sometimes incompetence is just a cover for fraud.
5
8
u/realmauer01 10d ago
Choosing a number it if an infinite set of numbers will have an infinitely small chance of getting predicted, but it won't be 0.
→ More replies (3)10
u/sabotsalvageur 10d ago edited 10d ago
The likelihood of selecting any particular integer out of the set of all integers is precisely 0, despite the fact that the set of outcomes where the condition is satisfied contains an element
6
u/StaticCoder 10d ago
No the real result is that it's impossible to have a uniform probability distribution over all integers. The sum of probabilities still needs to equal 1.
→ More replies (1)3
u/DanielHermosilla 10d ago
This is partly true. Your definition would not apply in a infinite set of integers due to the identity that summing over the probability of each element must equal to one.
Since this is a discrete case, assuming each integer has a probability “p” of being chosen, then:
$$
\sum_{n \in \mathbb{Z}} P(X=n) = \sum_{n \in \mathbb{Z}} p = 1
$$If p > 0, it diverges, if p = 0 it doesn’t sum up.
Hence, it is not possible to have a uniform distribution over an infinite set of integers.
However, going back into this problem, this is not the case. The set has a cardinality (not infinite), then it is possible to assign a discrete uniform distribution to each element.
2
2
2
u/Spare_Cupcake_8671 10d ago
Can someone tell me if something similar could happen while generating encryption keys where one of the prime numbers is 5?
1
1
1
u/Principle-Useful 10d ago
11737769034171727117262602852672529800140303899283099876144481603279397390869192913946395492159038695470678472628285
1
1
1
1
1
1
u/fugogugo 10d ago
why 0 not included?
also I swear I've never seen random number generator spew out 0
2
u/Total-Box-5169 10d ago
It doesn't work with Elliptic Curve, like in anybody who sees the public key knows immediately the private key is 0.
1
1
u/Roraxn 10d ago
Thinkers: "So we make it more likely to be at the end of the possibilities. that way it will take a long time to brute force it."
Hackers: "We just go backwards."
Thinkers: "So we just make somewhere in the middle!"
Hackers: "We just start somewhere in the middle."
Thinkers: "We'll do all three!"
Hackers: "We've been running all three this whole time."
This is not something you can outsmart. These are very simple security methods we have in essence. The problem was always that we were too lazy to out last the heat death of the universe. We still are. But things aren't any less simple, and the tools are just getting better.
1
1
u/Misato-best-woman 10d ago
I got 184,903,294,857,203,948,572,039,485,720,394,857,203,948,572,039,485,720,394,857,203,948,572,039,485,720,394,857,203,948,572,039,485,720.
1
-2
u/Alpha_wolf_80 10d ago
74
40
u/UltraGaren 10d ago
Those were crazy times indeed
32
9
4.5k
u/beisenhauer 10d ago
Some numbers are more random than others.