| 00:00.47 | DocScrutinizer05 | OMG kermit, even more options to use wrong than minicom |
| 00:01.44 | DocScrutinizer05 | how could I hope that kermit was anything else than that old filetransfer from bulletin box times |
| 00:15.13 | *** join/#maemo SpeedEvil (~quassel@tor/regular/SpeedEvil) |
| 00:26.06 | DocScrutinizer05 | freemangordon: http://maemo.cloud-7.de/share-service/20160409_001.jpg http://maemo.cloud-7.de/share-service/20160409_002.jpg |
| 00:30.31 | *** join/#maemo RedW (~redw@89-76-164-87.dynamic.chello.pl) |
| 00:31.14 | DocScrutinizer05 | http://talk.maemo.org/showthread.php?p=1503047#post1503047 |
| 00:39.49 | *** join/#maemo vakkov (~vakkov@s3n104.brunel.ac.uk) |
| 00:49.41 | DocScrutinizer05 | http://paste.opensuse.org/96915526 |
| 00:50.27 | DocScrutinizer05 | freemangordon: not sure how to make kernel log to console, possibly via a flasher flag? |
| 01:05.11 | *** join/#maemo azkay__ (~azkay@14-202-56-178.tpgi.com.au) |
| 01:21.22 | Maxdamantus | The kernel always logs to the console. |
| 01:37.21 | *** join/#maemo eMHa (~mh@p579DBC5F.dip0.t-ipconnect.de) |
| 01:40.08 | DocScrutinizer05 | freemangordon: very interesting: http://paste.opensuse.org/40855152 -- even more interesting: http://paste.opensuse.org/93460606 . A ./flasher-3.5 --set-rd-flags=serial-console did the trick :-) |
| 01:41.39 | *** join/#maemo robotanarchy (~robotanar@x4e328b02.dyn.telefonica.de) |
| 01:50.19 | *** join/#maemo Hurrian (~Hurrian@unaffiliated/rikanee) |
| 01:52.54 | *** join/#maemo Kabouik_ (~quassel@65.76.93.92.rev.sfr.net) |
| 01:54.56 | DocScrutinizer05 | freemangordon: http://wiki.maemo.org/User:Joerg_rw/console-bootlog |
| 01:58.27 | DocScrutinizer05 | or http://neo900.org/stuff/joerg/N900/N900-log-full.txt |
| 02:03.46 | *** join/#maemo azkay__ (~azkay@14-202-56-178.tpgi.com.au) |
| 02:15.39 | *** join/#maemo LauRoman (~LauRoman@5-14-92-160.residential.rdsnet.ro) |
| 02:21.34 | *** join/#maemo Kabouik (~quassel@65.76.93.92.rev.sfr.net) |
| 02:22.43 | *** join/#maemo RedM (~redw@89-76-164-87.dynamic.chello.pl) |
| 03:01.33 | *** join/#maemo lxp (~lxp@unaffiliated/lxp) |
| 03:25.53 | *** join/#maemo pagurus` (~user@pD950FF28.dip0.t-ipconnect.de) |
| 03:26.08 | *** join/#maemo DocScrutinizer05 (~saturn@openmoko/engineers/joerg) |
| 03:28.14 | *** join/#maemo Kabouik_ (~quassel@65.76.93.92.rev.sfr.net) |
| 03:56.56 | *** join/#maemo liujian0012hn (~liu@42.49.144.223) |
| 04:09.10 | *** join/#maemo liujian0012hn (~liu@42.49.144.223) |
| 04:21.08 | *** join/#maemo vahe1 (~funtoo@130.193.124.135) |
| 04:27.48 | *** join/#maemo lobito (~lobito@190.177.215.153) |
| 04:34.53 | *** join/#maemo RedW (~redw@89-76-164-87.dynamic.chello.pl) |
| 04:39.08 | *** join/#maemo azkay (~azkay@203.17.70.53) |
| 05:11.21 | azkay | Can someone explain why every site uses OAuth instead of just the usual username/password? I mean, I understand why it works and all, but it adds sooooo many steps to anything that actually wants to use the site |
| 05:12.21 | azkay | eg; To login to a site its one http request, and you're in. To get the OAuth bearer token its 5 http requests |
| 05:13.25 | DocScrutinizer05 | never looked into it |
| 05:13.53 | azkay | I recommend you don't :P |
| 05:14.23 | DocScrutinizer05 | seems like currently there's a general trend to complicate internet in hope of spoiling NSA's day a 5 minutes |
| 05:14.43 | DocScrutinizer05 | futile efforts |
| 05:16.03 | DocScrutinizer05 | particularly HTTPS encryption on every cheesy public website doesn't make much sense to me |
| 05:18.26 | DocScrutinizer05 | I mean, everybody sees you connect to that IP. Does anybody really think some TLAs feel pissed when they need to decrypt SSL to know which particular page on that site you read? (if they even need to do that and can't simply tell from size and sequence of the packets which page you requested and downloaded) |
| 05:20.11 | azkay | The best are the sites that don't even have a login |
| 05:20.29 | azkay | Then they get all happy and post news on the site "We've updated to HTTPS guys!" |
| 05:20.31 | DocScrutinizer05 | but sure, we suffered heartbleed and fixed the vuln in SSL for a reason, we don't want to let this brilliant piece of software bitrot now. Harrr, use it wherever you can!! |
| 05:20.55 | DocScrutinizer05 | azkay: exactly what I'm speaking about |
| 05:22.53 | azkay | It's the same sort of thinking that goes behind software/games today |
| 05:23.05 | azkay | "No need to have small files, or optimise the game. We have hardware!" |
| 05:23.39 | azkay | Instead of having something small and quick, they rather have something bloated and terrible, just because todays hardware is good enough to bruteforce through the code |
| 05:25.32 | Maxdamantus | I suspect it's because they don't see the economic benefit to making it small and quick. |
| 05:28.22 | DocScrutinizer05 | look, I just edited a wiki page on wmo, now even when I did all this via HTTPS, I still downloaded a certain number of chars of content, then uploaded a different particular number of chars. Does anybody really believe it would be any difficult to find the page I edited, when you got a complete mirror of the site before and after my edit? |
| 05:29.02 | Maxdamantus | You wouldn't need the sizes. The history has dates in it. |
| 05:31.05 | DocScrutinizer05 | you don't even need a complete mirror from after edit, the usage pattern alone would tell a sniffer of my traffic which wikipage I edited |
| 05:32.09 | Maxdamantus | I think HTTPS is probably better at preventing MitM attacks than preventing authorities from reading your data afterwards. |
| 05:32.38 | DocScrutinizer05 | let's_encrypt... the higher rationale completely eludes me |
| 05:34.37 | Maxdamantus | but I don't think even the latter thing is particularly easy. |
| 05:35.24 | Maxdamantus | as for heartbleed, lots of software at a similar level has similarly destructive bugs. |
| 05:35.52 | Maxdamantus | the OpenSSL-related attacks would be things like the Dual EC DRBG thing. |
| 05:36.28 | Maxdamantus | and even with that, people had been publishing that it was potentially insecure before it was standardised. |
| 05:37.10 | Maxdamantus | the reason it was popularised was probably political, not technical. |
| 05:38.23 | Maxdamantus | the NSA paid some guys that implemented SSL some money to make it their default DRBG .. how did it get standardised in the first place, even when people were pointing out that it was flawed? |
| 05:38.38 | DocScrutinizer05 | the first two bullets alone make me wonder what's the purpose of such paradox thing >> * Free: Anyone who owns a domain name can use Letâs Encrypt to obtain a trusted certificate at zero cost. * Automatic: Software running on a web server can interact with Letâs Encrypt to painlessly obtain a certificate, securely configure it for use, and automatically take care of renewal.<< I don't think a certificate that can get by anybody free |
| 05:38.39 | DocScrutinizer05 | of cost and without any decent checks other than "yes that's actually my site, I can place a ascii file there" makes for a particularly *trustworthy* cert |
| 05:38.47 | DocScrutinizer05 | https://letsencrypt.org/about/ |
| 05:40.08 | Maxdamantus | I haven't looked too much into letsencrypt, but it just seems like a thing to give slight (time-dependent) assurance over who you're talking to. |
| 05:40.16 | ds3 | SSL is a crock design to give people a false sense of security |
| 05:40.23 | Maxdamantus | but it doesn't deride the security provided by people using something else. |
| 05:40.38 | Maxdamantus | Google isn't going to start using something like letsencrypt. |
| 05:40.40 | DocScrutinizer05 | ds3: absolutely |
| 05:41.23 | Maxdamantus | You can say that about anything. Many things, including SSL, ssh, etc provide legitimate security. |
| 05:41.37 | Maxdamantus | Neiher of those things magically fix security issues. |
| 05:42.23 | Maxdamantus | You need to consider what they do to understand what security they provide. |
| 05:43.33 | Maxdamantus | You can potentially use SSL like you do ssh (where you normally store a fingerprint you're meant to have read and manually verified at some point). |
| 05:44.01 | Maxdamantus | If you don't do that, you're delegating that check to root certificates and naming authorities. |
| 05:45.52 | Maxdamantus | In the absense of software bugs (which are not specific to SSL), you can still be fairly sure that the guy you're talking to is the one with the private key for the public one you found at the beginning of your session. |
| 05:46.07 | Maxdamantus | unless that guy has accidentally released his private key. |
| 05:49.27 | Maxdamantus | Why lock your door when someone can just your window? |
| 05:49.33 | Maxdamantus | s/just/just break/ |
| 06:09.22 | DocScrutinizer05 | https://botbot.me/freenode/devuan/2016-04-03/?msg=63441021&page=2 |
| 06:13.35 | DocScrutinizer05 | https://botbot.me/freenode/devuan/2016-04-03/?msg=63441323&page=3 |
| 07:04.02 | kerio | DocScrutinizer05: if you want some harder security, you can do certificate pinning in various forms for https at this point |
| 07:04.09 | kerio | well ok, two forms |
| 07:04.24 | kerio | pin on your own end-entity key, or pin on the CAs that you trust |
| 07:05.34 | kerio | Maxdamantus: more like "why lock your door when SWAT can still get in" |
| 07:08.46 | kerio | that's not the threat https protects you from |
| 07:09.00 | kerio | i mean, don't get me wrong, with proper pinning and very conservative settings it can actually help |
| 07:09.16 | kerio | but confidentiality is not necessarily the main thing |
| 07:09.31 | kerio | integrity is also a huge deal |
| 07:11.22 | *** join/#maemo keithzg_ (~quassel@198-48-129-100.cpe.pppoe.ca) |
| 07:13.02 | ceene | guys |
| 07:13.17 | ceene | maybe some of you can help, at least philosophically :) |
| 07:14.39 | ceene | on one hand i've got yappari, which implements whatsapp protocol in an module that i want to replace with coderus' library |
| 07:14.59 | ceene | the api of my module and his library don't match |
| 07:15.12 | ceene | so it's not simply a matter of changing one thing with the other |
| 07:15.42 | ceene | so the question is... how should I proceed? |
| 07:16.07 | ceene | ditch my module once and for all and start porting my code to use the new api all at once |
| 07:16.44 | ceene | or should i try to make my module's api match that of coderus, little by little, while updating the rest of thecode to the this new api? |
| 07:18.28 | Maxdamantus | or make a module that provides your API but just interacts with coderus. |
| 07:19.10 | Maxdamantus | a "façade" or something. |
| 07:19.21 | ceene | uhm, didn't thought about that |
| 07:21.32 | ceene | which would you go for? |
| 07:27.07 | Maxdamantus | Depends. |
| 07:27.20 | Maxdamantus | All of them seem sensible in different circumstances. |
| 07:28.02 | Maxdamantus | unless it's particularly large an API, I'd probably either go for the first one (ditch it) or the last one (emulate it). |
| 07:28.27 | Maxdamantus | afk |
| 07:44.09 | robotanarchy | DocScrutinizer05: using HTTPS on all websites is important. who said that is has to be openssl? there are plenty of alternatives (libressl, mbedtls, ...) |
| 07:44.47 | robotanarchy | even better, on the state of the onion talk at CCC it was suggested that the next step would be for every site to be a tor hidden service |
| 07:45.33 | DocScrutinizer05 | yeah sure¡ that scales excellent ;-P |
| 07:45.47 | robotanarchy | looks like it does |
| 07:45.54 | robotanarchy | if the tor developers suggest it? |
| 07:45.57 | DocScrutinizer05 | prolly been suggested by server manufacturers |
| 07:46.30 | robotanarchy | the developers of tor actually suggested it. |
| 07:47.15 | DocScrutinizer05 | I don't care who suggests to put double the number of ricecorns on each next square of the checkerboard |
| 07:48.48 | robotanarchy | what do you mean? the additional code running on the server (tor) or the additional network bandwith? |
| 07:50.14 | kerio | fwiw, *google* said that when they forcibly enabled TLS for gmail they barely felt the increased load |
| 07:50.23 | kerio | and they have a fuckton of connections |
| 07:51.06 | *** join/#maemo futpib (~futpib@37.113.239.183) |
| 07:51.15 | Maxdamantus | thought SSL was making the `curl` command really slow for a while. |
| 07:51.38 | Maxdamantus | turned out it was actually the fact that it spent so much time mmapping certificate files. |
| 07:52.42 | Maxdamantus | Even with -k |
| 07:54.43 | kerio | Maxdamantus: which curl? |
| 07:54.45 | kerio | on the n900? |
| 07:54.50 | kerio | our openssl is shit |
| 07:54.56 | Maxdamantus | No. Just whatever's in Debian. |
| 07:55.26 | Maxdamantus | it wasn't on the N900. On some Xeon machine. |
| 07:55.44 | Maxdamantus | always spends something like 100 ms mmapping certificates. |
| 07:56.35 | Maxdamantus | Will probably just start automating things using wget if it involves SSL. |
| 08:05.23 | *** join/#maemo florian (~fuchs@Maemo/community/contributor/florian) |
| 08:30.11 | DocScrutinizer05 | wants to hear one sound argument _why_ >>using HTTPS on all websites is important<< |
| 08:30.54 | Maxdamantus | Because it effectively prevents attacks across LANs. |
| 08:31.16 | Maxdamantus | that's one. |
| 08:31.25 | Maxdamantus | ever used a LAN? |
| 08:31.43 | Maxdamantus | all your packets are belong to me. |
| 08:34.59 | freemangordon | DocScrutinizer05: great! (serial console) |
| 08:35.07 | DocScrutinizer05 | :-) |
| 08:35.20 | freemangordon | what was the problem with garbage chars? |
| 08:36.09 | *** join/#maemo Pali (~pali@Maemo/community/contributor/Pali) |
| 08:36.15 | DocScrutinizer05 | minicom |
| 08:36.23 | freemangordon | ah :) |
| 08:37.37 | DocScrutinizer05 | "amazingly" it works with a 1V8 adapter though the N900 indeed has 2.8V LV-RS232 |
| 08:38.12 | *** join/#maemo xorly (~xorly@ip-86-49-15-121.net.upcbroadband.cz) |
| 08:38.19 | DocScrutinizer05 | well, the adapter doesn't mind, at least. didn't check inbound towards N900 |
| 08:38.36 | kerio | DocScrutinizer05: to prevent dragnet surveillance and to prevent content injection |
| 08:38.52 | kerio | and possibly even more importantly, to prevent encryption from becoming a signal of important data |
| 08:39.05 | DocScrutinizer05 | kerio: how would HTTPS protect me against dragnet? |
| 08:39.54 | DocScrutinizer05 | I mean, the sender and destination IPs are inevitably "plaintext" |
| 08:39.57 | kerio | because grepping for "GET" or "Host" is incredibly super ultra duper easier than trying to match sizes with content and relying on SNI |
| 08:40.43 | DocScrutinizer05 | and how ould I care if somebody knows the content I fetch from a public website? |
| 08:41.20 | DocScrutinizer05 | everybody can fetch same content themselves |
| 08:41.26 | Maxdamantus | You're free to publish your browser history if you want. |
| 08:41.50 | Maxdamantus | I'd rather not personally. |
| 08:42.01 | *** join/#maemo arcean (~arcean@nat2-6.finemedia.pl) |
| 08:43.46 | DocScrutinizer05 | I don't need to try and >> match sizes with content and relying on SNI<< I know when you're on porntube simply by your TCP traffic |
| 08:44.14 | kerio | yeah because nobody has been blackmailed because of his preference for trannies before |
| 08:44.22 | DocScrutinizer05 | do you really think I care which video you prefer to watch? |
| 08:44.37 | kerio | do you really think i give a shit about what YOU care about? |
| 08:45.09 | DocScrutinizer05 | btw you'll give that away as soon as you visit a similar site |
| 08:45.20 | kerio | if i were living in a theocracy where homosexuality is punishable by death i would care A WHOLE INSANE AMOUNT about the fact that you don't know which videos i prefer to watch |
| 08:45.20 | ceene | why won't you use something like whatsapp then, DocScrutinizer05? |
| 08:45.38 | DocScrutinizer05 | ok, kerio, you made it on my ignore list again |
| 08:46.09 | Maxdamantus | Be careful ceene, doc is extremely sensitive about his opinions. |
| 08:46.12 | kerio | wew, DocScrutinizer05 doesn't know how to answer and decides to ignore again |
| 08:47.10 | DocScrutinizer05 | ds3: you're so damn right |
| 08:49.02 | DocScrutinizer05 | people think they better use HTTPS when they visit a site that has dangerous and normal content next to each other ;-P |
| 08:49.28 | DocScrutinizer05 | and that should protect them from any evil |
| 08:49.46 | Maxdamantus | I don't think most people actually think that. |
| 08:49.56 | DocScrutinizer05 | wonders how many such sites actually exist at all |
| 08:50.07 | kerio | https at this point is the very bare minimum |
| 08:50.08 | kerio | but ok |
| 08:50.25 | kerio | keep building strawmen and taking them down |
| 08:50.32 | kerio | this is literally the same as anti-vaxxers |
| 08:50.35 | Maxdamantus | Most people won't know what HTTPS is and are probably already pessimistic about computer security. |
| 08:51.16 | DocScrutinizer05 | and my question why that justifies "HTTPS in *everything*" is still unanswered |
| 08:51.38 | Maxdamantus | Why not? |
| 08:51.47 | kerio | thank fuck the browser makers are smarter than this |
| 08:52.28 | ceene | yeah, even if https is not the best thing, it's still better sending letters inside closed envelopes rather than postcards |
| 08:52.55 | DocScrutinizer05 | ahhyes, and I get my newspaper in a closed envelope too |
| 08:53.09 | Maxdamantus | It's not like it's any extra effort on the users' parts. |
| 08:53.14 | kerio | ceene: except that instead of "closed envelope" it's more like "titanium safe with biometric locks and stamps" |
| 08:53.51 | DocScrutinizer05 | and I don't even know who's the one who closed the envelope |
| 08:54.07 | ceene | i concur with Maxdamantus, most of the time the answer to "why?" is "why not?" |
| 08:54.21 | kerio | yes you do, authentication and integrity is part of the protocol |
| 08:54.43 | DocScrutinizer05 | because people think it's a security that it actually isn't |
| 08:54.51 | Maxdamantus | Like locking your doors? |
| 08:55.21 | Maxdamantus | Do you not lock them? |
| 08:55.39 | Maxdamantus | or if you do? Why? People can probably get in anyway. |
| 08:55.40 | DocScrutinizer05 | letsencrypt rendered HTTPS even more useless than it been before |
| 08:55.55 | kerio | holy shit that's a new low |
| 08:56.15 | DocScrutinizer05 | since now you must asume a cert has no meaning at all anymore |
| 08:56.38 | Maxdamantus | No. Only letsencrypt certs, which are easily identifiable. |
| 08:57.06 | kerio | Maxdamantus: LE does the same domain verification that's in the baseline requirements |
| 08:57.08 | kerio | that literally every CA does |
| 08:57.40 | DocScrutinizer05 | https://botbot.me/freenode/devuan/2016-04-03/?msg=63441587&page=3 |
| 08:58.28 | Maxdamantus | kerio: well, there's another group to trust. |
| 08:58.33 | kerio | yeah, let's base our authentication on pinnings that rely on 1024 bit rsa |
| 08:58.45 | DocScrutinizer05 | you know your data is encryped but you stuill don't know who's the server |
| 08:59.16 | ceene | that's still better than nothing, isn't it? |
| 08:59.28 | kerio | Maxdamantus: they're FAR from being the most untrustworthy group in the CA business |
| 08:59.37 | ceene | at least only one data robber at a time |
| 08:59.40 | Maxdamantus | ceene: arguably, no. But what he said isn't really true. |
| 08:59.59 | kerio | it's ok, he can keep building more and more strawmen |
| 09:00.24 | DocScrutinizer05 | let's face it: when a rougue software injects a /etc/hosts to point my online banking to another IP, no friggin SSL will warn or help me, unless I do cert pinning |
| 09:00.29 | ceene | i know, but just for the sake of the argument, i'd rather only one non authorized person has access to my data |
| 09:00.46 | Maxdamantus | So how does it verify things? By doing DNS lookups and requests from lots of places or something? |
| 09:00.47 | kerio | rogue software can alter your pins |
| 09:01.01 | Maxdamantus | (letsencrypt, that is) |
| 09:01.03 | kerio | nice try |
| 09:01.46 | kerio | Maxdamantus: they rely on their own recursive resolver for dns verification, and i think that at this point they only check from one of a handful of servers for http/sni verification |
| 09:02.31 | DocScrutinizer05 | >>one robber at a time<< ? You a) lost me and b) that doesn't sound like any known approach to security |
| 09:03.08 | ceene | you may be talking to a server you're not sure is the one you intended |
| 09:03.16 | ceene | but at least the data is encrypted |
| 09:03.21 | DocScrutinizer05 | wow |
| 09:03.25 | ceene | :P |
| 09:03.39 | ceene | so you're only given your data to one bad guy at a time |
| 09:03.51 | DocScrutinizer05 | exactly my point, no use at all, and many people fall for a flase sense of security from it |
| 09:03.56 | ceene | not that it's very good, but is still better than announcing it all in the paper |
| 09:03.56 | kerio | ceene: please stop enabling his echo chamber |
| 09:04.51 | ceene | nah, i should get going with this whatsapp thing, but even the registrartion api is so much different |
| 09:04.52 | DocScrutinizer05 | brainless hype |
| 09:05.08 | ceene | i hate it all |
| 09:07.27 | DocScrutinizer05 | so far I had maybe 3 or 4 sites where I knew I need to have an eye on the certs. Now they start to shit my roof with certs and managing them in a reasonable way becomes absolutely impossible |
| 09:07.54 | kerio | if only there was a way to automate that |
| 09:09.46 | DocScrutinizer05 | >>Privacy and anonymity depend in the same way on common sense and experience as other elements of life. If you want to protect yourself you need to educate yourself. << https://www.ipredator.se/page/about |
| 09:11.08 | DocScrutinizer05 | try to convey this message to a HTTPS fanboy who got no clue but "hey, every site I visit is encrypted now!" |
| 09:14.19 | DocScrutinizer05 | before letsencrypt you hardly found a site URL like www.DeutscheBank.bla.service.894374179651785610786.roguehacker.com with a valid cert |
| 09:14.54 | kerio | oh god he's even believing the shit that namecheap posted |
| 09:15.09 | freemangordon | ceene: what was that FOSS library for whatsapp ecryption? |
| 09:15.51 | DocScrutinizer05 | since no decent certification instance would have accepted the obviously fake part DeutscheBank, and a wildcard cert is expensive and not THAT easy to get |
| 09:15.56 | freemangordon | ceene: isn't it implement the protocol as well? |
| 09:16.04 | freemangordon | *implementing |
| 09:16.44 | kerio | a wildcard cert costs 45$, you get one by answering a single email, and it doesn't work with multiple . parts anyway |
| 09:17.09 | DocScrutinizer05 | btw cert instances usually don't accept bitcoins |
| 09:19.56 | DocScrutinizer05 | so yeah, automated SSL certs for everybody sure are a huuuuge step ahead for global internet security |
| 09:20.13 | kerio | they are, yes |
| 09:21.30 | freemangordon | DocScrutinizer05: re n900 serial console - could you reconsider your stance about europa and remote access to the device? |
| 09:21.41 | DocScrutinizer05 | as a side effect decent certs will become more expensive |
| 09:21.51 | freemangordon | or you still think it is better to send it to me? |
| 09:21.53 | DocScrutinizer05 | sure |
| 09:22.01 | *** join/#maemo hashcore (~hashcore@unaffiliated/hashcore) |
| 09:22.20 | DocScrutinizer05 | I can install Europa again and connect it there |
| 09:22.22 | DocScrutinizer05 | np |
| 09:22.43 | freemangordon | great, that way Pali could have be given access as well |
| 09:22.51 | DocScrutinizer05 | you'll have access a 2 to 5 days earlier this way, even |
| 09:22.57 | freemangordon | needs moar coffee |
| 09:22.59 | DocScrutinizer05 | yep, also np |
| 09:23.04 | freemangordon | yes |
| 09:23.50 | freemangordon | DocScrutinizer05: but we shall discuss it before doing so, as there might be some problems we didn;t think of |
| 09:24.09 | DocScrutinizer05 | and I'll install a LE on Europa.... wait, I don't run a webserver on it at all |
| 09:24.15 | freemangordon | like - how to flash it remotely without pesering you every time |
| 09:24.29 | freemangordon | how to choose which kernel to boot |
| 09:24.37 | freemangordon | hmm... |
| 09:24.39 | DocScrutinizer05 | umm, I guess I can manage that |
| 09:24.40 | drathir | whatsapp have own encryption implementation if good heared... |
| 09:24.52 | DocScrutinizer05 | drathir: yep |
| 09:25.44 | DocScrutinizer05 | freemangordon: using my proven relaycard for battery should do, no? |
| 09:25.44 | freemangordon | Pali: is nfsboot the only sane option for booting n900 without having physical access to it? |
| 09:26.08 | Pali | freemangordon: probably yes |
| 09:26.21 | drathir | btw nice ovh gettin new 100G line us-uk ^^ |
| 09:26.26 | freemangordon | DocScrutinizer05: it should when it comes to reset, but I can't imagine how we can choose options in u-boot menu remotely |
| 09:26.38 | DocScrutinizer05 | you can set up device in a way so it powers up always |
| 09:27.00 | DocScrutinizer05 | oooh, that might be a tad harder to solve, yes |
| 09:27.04 | freemangordon | yeah |
| 09:27.12 | freemangordon | or even impossible |
| 09:27.19 | DocScrutinizer05 | you'd need a special uboot hack for that |
| 09:27.39 | DocScrutinizer05 | one that simply uses USB instead touchscreen, or whatever |
| 09:27.55 | freemangordon | and that'll may things way more complicated than simply sending the device to me :( |
| 09:28.18 | DocScrutinizer05 | then otoh why do you need uBoot? |
| 09:28.24 | freemangordon | well, lets proceed as planned initially, if Pali needs something done I will do it for him |
| 09:28.28 | drathir | and remember to get rid of that start screen in case power cut... |
| 09:29.03 | DocScrutinizer05 | drathir: at that point the interesting stuff already happened ;-) |
| 09:29.10 | drathir | that one where language date time typing... |
| 09:29.15 | freemangordon | DocScrutinizer05: because if mainline gets unbootable, it is way easier to boot stock (or KP) and fix whatever needs to be fixed |
| 09:29.36 | DocScrutinizer05 | rescueOS? |
| 09:30.01 | freemangordon | see, all this is possible, but very complicated |
| 09:30.10 | DocScrutinizer05 | possibly, yes |
| 09:30.32 | freemangordon | so instead of focusing on bugfixing we'll have to waste time solving boot issues |
| 09:30.38 | DocScrutinizer05 | well, think about it a while, I'll not send it before monday anyway |
| 09:30.58 | freemangordon | Pali: ^^^ |
| 09:31.56 | freemangordon | DocScrutinizer05: will do, but the more I am thinking about it, the more it becomes obvious remote access is not a viable option for complicated stuff |
| 09:32.25 | freemangordon | another example - how one is supposed to understand what happens with kbd leds? |
| 09:32.38 | DocScrutinizer05 | flashing really is a lightweight process, and I guess you could do a simple little hack with kernel cmdline by flasher too, to choose what shall get booted |
| 09:32.55 | freemangordon | how to open or close the keyboard? |
| 09:32.57 | drathir | that all remembered me i need soon setup grub/boot ssh acces to be able remotely unlock home srver ;p |
| 09:33.18 | freemangordon | DocScrutinizer05: keep in mind we have maemo booted, not some simple rootfs |
| 09:33.36 | DocScrutinizer05 | well, when you want to do stuff like that, it's prolly easier to send the device than to build a robot arm here |
| 09:33.43 | freemangordon | exactly |
| 09:34.25 | DocScrutinizer05 | not that I couldn't operate the hall sensors with simple electromagnets instead slider... |
| 09:34.53 | DocScrutinizer05 | but when it comes to touchscreen and LED inspection, I pass |
| 09:35.27 | drathir | DocScrutinizer05: live led stream with camera ;p |
| 09:35.37 | freemangordon | sure, you can, but it doesn't worth it |
| 09:35.40 | DocScrutinizer05 | idly wonders how Nokia implemented their Remote Device Access |
| 09:35.53 | freemangordon | hmm, yeah |
| 09:36.07 | drathir | but rouchscreen is a mystery for me... |
| 09:36.20 | drathir | touchscreen* |
| 09:37.52 | DocScrutinizer05 | drathir: I *could* emulate touchscreen with two potentiometers and a switch for pen-down/up |
| 09:38.28 | DocScrutinizer05 | but I don't feel eager to set up such test rig |
| 09:39.53 | drathir | DocScrutinizer05: oh that interesting... |
| 09:42.58 | DocScrutinizer05 | drathir: one line touchscreen crashcourse: 4wire-ts means it has 4 pins: L, R, U, D. internally that 4wire-ts is L--resistor-A-resistor--R and U--resistor-B-resistor--D, A and B connect on pen-down and the 4 resistors depend in size upon the point on screen you touch |
| 09:44.02 | DocScrutinizer05 | very very simple |
| 09:46.47 | DocScrutinizer05 | to give more detail: the 2 resistors between L and R are actually just one long resistor and the only thing that changes is the position of the touchpoint A. Same for Up and Down |
| 09:48.37 | ceene | freemangordon: encryption is based on libaxolotl (recently renamed to libsignal). Coderus wrote libwa which implements whatsapp protocol using libaxolotl |
| 09:48.40 | DocScrutinizer05 | so you have two long (and wide) transparent resistor films and when you push the upper film down then the two touch in A-B |
| 09:48.48 | ceene | so the work to be done is making yappari use this library |
| 09:49.29 | DocScrutinizer05 | drathir: tell me when you find a shorter easier explanation of a resistive 4wire touchscreen :-) |
| 09:50.51 | Sicelo | ceene: is the library still working fine? asking because the N9/SFOS guys seem to be stuck if tmo is anything to go by |
| 09:53.39 | *** join/#maemo M4rtinK (~M4rtinK@ip-78-102-146-111.net.upcbroadband.cz) |
| 09:55.16 | Sicelo | DocScrutinizer05: remote device access: it may have worked through or same way as in SB |
| 09:55.23 | DocScrutinizer05 | freemangordon: how hard would it be to patch uBoot so it takes kernel cmdline options and acts accordingly? We can alter cmdline by flasher |
| 09:55.39 | ceene | the thing is coderus has decided not to continue anymore |
| 09:55.47 | ceene | if anything changes, his app won't follow |
| 09:55.54 | DocScrutinizer05 | Sicelo: yep, good point indeed |
| 09:55.58 | ceene | the library, at the moment, should work just fine |
| 09:56.44 | *** join/#maemo arossdotme (~zxy@host-92-20-221-214.as13285.net) |
| 09:57.33 | Sicelo | i think i read problems with registration for example |
| 09:58.14 | freemangordon | DocScrutinizer05: no ide, it is Pali that should answer that question |
| 09:59.51 | ceene | registrartion doesn't work? |
| 10:00.00 | ceene | bah, i just dont know if it is all worth the effort |
| 10:00.06 | Sicelo | i seem to have read so. ..let me check |
| 10:00.49 | ceene | once no more s40 versions are released it will be much harder to RE the protocol |
| 10:01.43 | DocScrutinizer05 | I wonder why they don't support FOSS implemetations, that's insane |
| 10:02.49 | Sicelo | ceene: http://talk.maemo.org/showthread.php?t=94689&page=95 .. or that application not using coderus lib? |
| 10:02.53 | DocScrutinizer05 | I mean, the whole watsabi thing is server based anyway, so they wouldn't lose control |
| 10:04.20 | Maxdamantus | I don't think you'd need to modify u-boot. |
| 10:05.20 | Maxdamantus | They should be in RAM, right? u-boot should have commands to read RAM into variables. |
| 10:05.35 | ceene | whatsup for jolla is from cepiperez |
| 10:05.43 | ceene | i think his codebase differs from that of coderus |
| 10:05.47 | Sicelo | ah :) |
| 10:06.07 | ceene | i think it's more similar to mine, in fact |
| 10:06.24 | ceene | i don't quite get why they don't make devlopment public, as I do |
| 10:06.29 | ceene | it'd help us all |
| 10:06.53 | DocScrutinizer05 | Jolla? |
| 10:07.05 | DocScrutinizer05 | or watsup |
| 10:07.18 | ceene | whatsup |
| 10:07.23 | ceene | well, jolla too |
| 10:09.49 | DocScrutinizer05 | ooooh there's *one* thing and that's their insane coupling to smartphone number for PC client which would get rendered hackable with open source implementation |
| 10:10.44 | DocScrutinizer05 | so far you need a phoennumber (no matter how little sense that makes) |
| 10:11.45 | Sicelo | it makes sense if you think about who it was created for :) |
| 10:11.50 | ceene | even if they'd allow open clients they could still enforce that |
| 10:12.16 | DocScrutinizer05 | hardly, unless they send SMS with auth code |
| 10:12.28 | ceene | and that's exactly what they do |
| 10:12.34 | DocScrutinizer05 | o.O |
| 10:12.51 | DocScrutinizer05 | hehe |
| 10:12.51 | Sicelo | whatsapp is organized in such a way that a person never had to add contacts/friends. phone number is the easiest way to do that |
| 10:12.56 | ceene | to register you tell them your phone number and they send an sms to that phone number |
| 10:13.26 | DocScrutinizer05 | ok |
| 10:14.29 | DocScrutinizer05 | cya |
| 10:14.32 | DocScrutinizer05 | o/ |
| 10:17.15 | ceene | best course of action would be helping with kernel upgrade, i guess |
| 10:17.26 | ceene | there are several alternatives that require a modern glibc |
| 10:39.47 | *** join/#maemo Pali (~pali@Maemo/community/contributor/Pali) |
| 10:42.48 | drathir | DocScrutinizer05: im sre im dont find that one ^^ |
| 10:45.38 | drathir | DocScrutinizer05: but yea its sounds even trivially easy in theory but in practice why thats probably of one from the most expensive parts in phone...? |
| 10:59.03 | ceene | i may end up buying a cheap android |
| 10:59.12 | ceene | not only because of whatsapp |
| 10:59.21 | ceene | the lack of applications, nice browser, etc |
| 11:01.43 | Maxdamantus | Let's all sell our souls and work for Satan because it's more convenient that way. |
| 11:09.15 | ceene | i could also live in a cave or in the forest |
| 11:09.38 | ceene | but it's a hell of a lot more inconvenient |
| 11:36.38 | *** join/#maemo azkay (~azkay@c110-23-4-9.rochd7.qld.optusnet.com.au) |
| 11:43.17 | enyc | DocScrutinizer05: hrrrm that numer copulping gets worse... |
| 11:43.34 | enyc | DocScrutinizer05: with a sip2sim attached toan aasip number, you can have a geographic number working on mobile no problems |
| 11:43.39 | enyc | DocScrutinizer05: sms both ways etc. |
| 11:52.45 | enyc | DocScrutinizer05: but the silly whatsapp etc refuse to accept the number |
| 11:53.59 | *** join/#maemo Kabouik (~quassel@65.76.93.92.rev.sfr.net) |
| 12:02.53 | *** join/#maemo troulouliou_div2 (~troulouli@unaffiliated/troulouliou-div2/x-0271439) |
| 12:28.25 | *** join/#maemo krnlyng (~liar@178.112.244.66.wireless.dyn.drei.com) |
| 13:06.59 | Pali | Hi! Do not forget: today is qualification round for Code Jam! https://code.google.com/codejam |
| 13:36.18 | *** join/#maemo vahe (~funtoo@130.193.124.135) |
| 13:40.00 | *** join/#maemo M4rtinK (~M4rtinK@ip-89-102-34-183.net.upcbroadband.cz) |
| 13:57.02 | *** join/#maemo deepy (deepy@wrongplanet/deepa) |
| 13:58.35 | *** join/#maemo kerio (kerio@bad.memes.vs.dank.ninja) |
| 14:02.34 | *** join/#maemo jon_y (~enforcer@115.134.69.198) |
| 14:55.55 | *** join/#maemo troulouliou_div2 (~troulouli@unaffiliated/troulouliou-div2/x-0271439) |
| 15:27.03 | *** join/#maemo sunshavi (~user@190.235.18.236) |
| 15:39.53 | *** join/#maemo pcfe (~pcfe@2a02:8109:8080:fa4:beee:7bff:fed9:8f1b) |
| 15:39.59 | *** join/#maemo pcfe (~pcfe@redhat/pcfe) |
| 15:45.28 | *** join/#maemo dos1 (~dos1@unaffiliated/dos1) |
| 16:36.06 | *** join/#maemo gregoa (~gregoa@colleen.colgarra.priv.at) |
| 17:24.54 | *** join/#maemo andril (~andril@c-66-229-28-40.hsd1.fl.comcast.net) |
| 17:40.57 | bencoh | freemangordon: ah ... well, I guess I'm a bit late :/ |
| 17:53.35 | freemangordon | well, yeah :) |
| 17:56.01 | *** join/#maemo sunshavi (~user@190.235.18.236) |
| 18:02.58 | *** join/#maemo troulouliou_div2 (~troulouli@unaffiliated/troulouliou-div2/x-0271439) |
| 18:26.58 | *** join/#maemo lxp (~lxp@unaffiliated/lxp) |
| 18:41.52 | DocScrutinizer05 | completely unrelated ranting: since 2 or 3 years or more, I suffer from randomly appearing - for weeks - massive delay when opening konqueror in local filebrowser mode (cwd: ~). Now it suddenly occurs to me that's caused by gvfs |
| 18:42.21 | DocScrutinizer05 | massive delay = upto 120s until window opens |
| 18:42.45 | DocScrutinizer05 | another useless g* piece of software |
| 18:59.15 | DocScrutinizer05 | enyc: yep, of course. A SIP client is not 'real phone' |
| 19:00.47 | DocScrutinizer05 | I guess not even on Android apps are built in a way so the accept arbitrary IM as GSM SMS text message (SMS via SIP is basically IM) |
| 19:02.03 | *** join/#maemo pagurus (~user@pD950FF28.dip0.t-ipconnect.de) |
| 19:02.04 | DocScrutinizer05 | also any possible API for query of own number will fail epically when that number is not SIM based but SIP |
| 19:11.29 | enyc | DocScrutinizer05: no, this is not a sip client, it is acutal mobile sim card getting actual mobile calls on the sip2sim phone number |
| 19:11.56 | DocScrutinizer05 | ooh |
| 19:12.02 | enyc | DocScrutinizer05: if you have both a sip2sim and a mobile from aaisp they will bind them together natively/internally |
| 19:12.25 | enyc | DocScrutinizer05: though you _can_ have the sip2sim service register on an 'external' sip account if you wish |
| 19:12.31 | DocScrutinizer05 | now is aaisp aka aasip a N900 typo or meant like that? |
| 19:12.33 | enyc | DocScrutinizer05: but its' not done by sip client on the phone |
| 19:12.55 | enyc | DocScrutinizer05: aaisp is a company Andrews & Arnold ISP |
| 19:13.08 | DocScrutinizer05 | aaah ok |
| 19:13.11 | enyc | DocScrutinizer05: AASIP -- Andrews and Arnold SIP phone number, i think i meant |
| 19:13.22 | enyc | DocScrutinizer05: i.e. aaisp run aasip service ;p |
| 19:13.49 | enyc | DocScrutinizer05: their irc.z.je #a&a channel is a good community / place to find interesting/technical people |
| 19:14.36 | DocScrutinizer05 | thanks for this new (to me) info :-) |
| 19:15.30 | enyc | DocScrutinizer05: they provide sim-cards for data-only service, static ipv4 address + ipv6 over 6in4 tunnel |
| 19:16.13 | enyc | DocScrutinizer05: also, 'sip2sim' roaming mobile voice sim, that connects either directly to an aasip number, OR, to a sip account of your choice, but NOT using sip client built into phone, it uses the GSM voice. |
| 19:16.22 | enyc | DocScrutinizer05: or 3g voice or whatever but you get the idea |
| 19:17.06 | DocScrutinizer05 | unified-services has many funny options and variants :-) |
| 19:17.21 | enyc | anyway, it does work with SMS to/from geographic number of the phone |
| 19:17.29 | enyc | but apparently whatsapp don't like that |
| 19:17.34 | DocScrutinizer05 | the differences between connection classes vanish more and more |
| 19:17.58 | DocScrutinizer05 | I wonder if my mobile SMS dispatch would like it |
| 19:18.28 | DocScrutinizer05 | I always wondered how they decide to either send ascii SMS or voice SMS |
| 19:18.59 | enyc | orange/ee seem to voice-dispatch, wheresa three, vodafone, at least deliver normally/fine |
| 19:19.17 | DocScrutinizer05 | odds are for anything that looks to them like a landline geo-phonenumber they will send text2speech voice SMS anyway |
| 19:19.34 | enyc | i never saw the need for mobile to 'voice dispatch' -- seemingly at least bt openreach landlines, have their own locally generated text2speech |
| 19:19.47 | enyc | i.e. its' not needed at the sending provider network at all |
| 19:20.33 | DocScrutinizer05 | well, that's what you get when there's no globbaly accepted standard and no unambiguous 'right way' to implement a service |
| 19:21.45 | DocScrutinizer05 | the more creative and innovative your service, the higher the odds you competitor will come up with something even more nifty which is incompatible for sure |
| 19:24.58 | DocScrutinizer05 | in the nineties we had a phone exchane system called EWS here in germany, which had all sorts of nifty functions like wake call setup via DTMF (sort of *42*0715#), Then came SS7 and those nice functions all were gone again |
| 19:27.43 | DocScrutinizer05 | https://de.wikipedia.org/wiki/Signalling_System_7 https://de.wikipedia.org/wiki/EWSD |
| 19:36.25 | DocScrutinizer05 | robotanarchy: ((what do you mean? the additional code running on the server (tor) or the additional network bandwith?)) basically what I mean is the Erlang (Erl) explosion you get from using a randomized routing like in TOR |
| 19:38.45 | bencoh | ? |
| 19:39.24 | DocScrutinizer05 | if *every* (web-)server in the internet was a TOR-only server, you'd not only need twice to three times the amount of router/server hardware to establish the needed TOR network, you also need a probably factor 16 beefed up internet, particularly backbones down to the datacenters of this world |
| 19:42.19 | DocScrutinizer05 | you're aware that even today where TOR is mostly unknown to Joe AverageUser and massively supported for free with TOR nodes run by enthusiasts, it's not possible to watch TV via TOR |
| 19:43.10 | DocScrutinizer05 | TOR simply doesn't scale |
| 19:43.28 | bencoh | that's not really a backbone issue, more a last-mile thing (and people setting bw limits to their TOR servers) |
| 19:43.39 | bencoh | at this scale at least |
| 19:45.23 | DocScrutinizer05 | well, yes, but we still have *A*DSL in post parts of this world as best you can get. So you can't run any sort of P2P-TOR that would faintly get near to what's your downstream bandwidth. You can't even get average upstream bandwidth with your P2P-TOR downstream |
| 19:45.47 | DocScrutinizer05 | s/ post / most / |
| 19:46.17 | bencoh | DocScrutinizer05: that's why I'm saying it's a last-mile issue, not a backbone one ... for now. |
| 19:46.27 | DocScrutinizer05 | for now yes |
| 19:46.42 | DocScrutinizer05 | for a "everything is TOR" wprld this changes |
| 19:47.28 | DocScrutinizer05 | since as I said you need twice the amount of webservers existing on this globe to establish the TOR layer on a semi-commercial level |
| 19:47.46 | bencoh | as for "later", ie the day ISP stop being stupid and eventually move to symetric uplinks (which might never come as it stands ...) ... we'd just get less bw :) |
| 19:48.03 | DocScrutinizer05 | you need twice the amount of TOR than what we got for web servers |
| 19:48.49 | bencoh | I'm pretty the webserver vs users ratio is more than that ;) |
| 19:49.25 | bencoh | (users vs webservers rather) |
| 19:55.32 | DocScrutinizer05 | yes, but also many users can use one TOR server (actually they use several servers then, depending on the number of hops) |
| 19:56.53 | DocScrutinizer05 | the factor 2 was a guestimate tradeoff between lower load for TOR compared to the stuff a webserver does, vs the fact that a TOR connection involves multiple such TOR nodes for one client of a webserver |
| 19:57.10 | bencoh | yeah but you've got the idea |
| 19:57.16 | DocScrutinizer05 | sure |
| 19:57.18 | DocScrutinizer05 | :-) |
| 20:01.10 | DocScrutinizer05 | anyway even when you'd assume *every* user runs a P2P TOR node on their (A)DSL, the available netto bandwidth is bruto DSL min(up,down) bandwith / average number of TOR hops * 1/percentage-nettoload-over-time-per-user-DSL |
| 20:02.13 | DocScrutinizer05 | actually s/average number of TOR hops /(2 * average number of TOR hops) / |
| 20:03.52 | DocScrutinizer05 | with an averahe hop count of 5, and every user running full bandwidth downloads, they all get 1/10 of their up/down bandwith whatever is lower, for both down and up |
| 20:10.13 | DocScrutinizer05 | +-2, my math sucks |
| 20:10.37 | DocScrutinizer05 | 1/8 - 1/12 |
| 20:27.54 | robotanarchy | DocScrutinizer05: I didn't say: everyone should use tor for everything, but I like the idea that every page provides a tor hidden service, if the user requests it. and streaming content over tor is not a good idea at all, unless really necessary |
| 20:29.13 | robotanarchy | also about your argument that you can decode whatever users were doing on a webserver by the download size - consider wikipedia or search engines, reddit, ... you can't easily say from the traffic which site they have visited. and it *does* make a difference whether you're reading about big bang theory or about making explosives |
| 20:29.22 | robotanarchy | just as an example |
| 20:29.45 | DocScrutinizer05 | robotanarchy: (every server *provides*) completely on your page |
| 20:30.56 | DocScrutinizer05 | also agree on content being relevant for some usecases like search engines and huge wikipedias |
| 20:31.14 | DocScrutinizer05 | in such cases encryption makes sense |
| 20:31.52 | robotanarchy | and maybe you do not want to get javascript 0days inserted into your plain HTTP xkcd.com connection when surfing in open hotel wifi ;) |
| 20:33.50 | bencoh | yeah, or let's sign js code :* |
| 20:34.26 | bencoh | just kidding ... but I strongly believe the real issue here is allowing code to run in the browser :) |
| 20:34.48 | robotanarchy | it absolutely is |
| 20:37.22 | DocScrutinizer05 | robotanarchy: what in a hotel WLAN situation would make a fake DNS attack that points xkcd.com to my rogue server to download the 0day via HTTPS less feasible than a MITM that tries to insert the 0day into plain unencrpted HTTP from original xkcd.com? |
| 20:38.16 | kerio | the fact that xkcd.com has HSTS |
| 20:38.18 | DocScrutinizer05 | there we are again - false assumptions about security |
| 20:38.28 | bencoh | DocScrutinizer05: hmm? |
| 20:38.47 | bencoh | DocScrutinizer05: you'd need to be able to sign a cert for xkcd.com |
| 20:39.04 | bencoh | (which might be possible depending on who you are, but's that another story) |
| 20:39.05 | DocScrutinizer05 | bencoh: when I'm in a hotel WLAN I usually get my DNS IPs via DHCP |
| 20:39.31 | bencoh | DocScrutinizer05: still doesn't change the ssl cert thing |
| 20:39.44 | DocScrutinizer05 | so I don't sign a cert for xkcd, I simply use my own |
| 20:39.57 | robotanarchy | as bencoh says, you still need the cert. and if xkcd has used certificate pinning, you can't even use a fake cert (which isn't that easy to get in the first place) |
| 20:40.10 | robotanarchy | DocScrutinizer05: with a self signed cert, the user would see the big red warning screen |
| 20:40.30 | DocScrutinizer05 | LE doesn't issue self signed certs |
| 20:41.08 | robotanarchy | DocScrutinizer05: how would you make lets encrypt sign *you* a cert for xkcd.com |
| 20:41.10 | robotanarchy | ? |
| 20:41.21 | DocScrutinizer05 | and I'm actually tired of that discussion. It constantly mixes things, encryption is NOT authentication |
| 20:42.06 | DocScrutinizer05 | certs are useless for automated authentication, by design |
| 20:42.17 | DocScrutinizer05 | actually the recently used infra is |
| 20:42.20 | bencoh | DocScrutinizer05: ssl certificate exchange provides server "authentification", client-wise (?) |
| 20:42.57 | bencoh | considering the attacker doesn't have control over a truster cert authority |
| 20:43.58 | bencoh | I don't really get your point here, let's say you do push your DNS IPs to the dhcp client |
| 20:44.11 | kerio | watch out, or he's going to ignore you |
| 20:44.19 | bencoh | then you'd redirect web traffic to your server. ... then which cert would you present? |
| 20:44.46 | DocScrutinizer05 | kerio: what makes you think I he gives a *fuck* about your warnings? |
| 20:45.02 | DocScrutinizer05 | kerio: maybe you got a deja vu |
| 20:46.15 | DocScrutinizer05 | but indeed I don't feel like continuing this discussion, maybe we can agree on you all thinking I'm wrong and I insist on my dislike of this LE thing |
| 20:47.03 | robotanarchy | DocScrutinizer05: I recommend fefe's rant on let's encrypt if you have not already read it. pure gold :D |
| 20:47.25 | *** join/#maemo Sicelo009N (~sicelo@unaffiliated/sicelo) |
| 20:47.34 | DocScrutinizer05 | I never read fefe |
| 20:48.16 | bencoh | DocScrutinizer05: I dislike LE as well but I feel I missed part of the discussion, I didn't gather LE was at stake here actually |
| 20:48.18 | DocScrutinizer05 | got my own brain to build my own notion |
| 20:49.07 | DocScrutinizer05 | bencoh: the discussion was about LE massively improving glovbal internet security |
| 20:49.49 | DocScrutinizer05 | I disagree and think it rather conveys a wrong sense of security to Joe Noob |
| 20:50.23 | DocScrutinizer05 | and massively complicates things that actually would help in my very private security management |
| 20:52.16 | DocScrutinizer05 | everyone is free to have their own idea about that, I'm not even any sort of expert with security |
| 20:53.05 | DocScrutinizer05 | at least not on sw level |
| 20:56.14 | DocScrutinizer05 | I just get angry about sw devels particularly of browsers etc when I read stuff like https://botbot.me/freenode/devuan/2016-04-03/?msg=63439141&page=2 |
| 20:56.56 | DocScrutinizer05 | and https://botbot.me/freenode/devuan/2016-04-03/?msg=63440909&page=2 |
| 20:58.37 | DocScrutinizer05 | doesn't sound like improved security |
| 20:58.46 | DocScrutinizer05 | raher like additional trouble |
| 21:00.40 | DocScrutinizer05 | my take on that particular issue and what's relevant for my perceived security in it: https://botbot.me/freenode/devuan/2016-04-04/?msg=63443153&page=1 |
| 21:09.34 | Maxdamantus | Package lists should definitely be encrypted. Packages themselves should at least have to match hashes from the package list. |
| 21:10.03 | Maxdamantus | Otherwise I could easily do something like make it so people grab my evil package list when they do `apt-get update` on a LAN I happen to also be on. |
| 21:10.27 | Maxdamantus | then when they upgrade any package it will get my modified version that includes something malicious in it. |
| 21:11.18 | Maxdamantus | Well, when I say "encrypted", signed would also suffice, but I don't think Debian normally has an inherent mechanism for that. |
| 21:11.49 | DocScrutinizer05 | yeah sure, as happened thousands of times in maemo's apt-get already, partucularly as long as Nokia had valid *signature* keys on plain text packages.lst |
| 21:11.57 | DocScrutinizer05 | fixes damn ignore list |
| 21:19.09 | *** join/#maemo troulouliou_div2 (~troulouli@unaffiliated/troulouliou-div2/x-0271439) |
| 21:25.56 | DocScrutinizer05 | desparately searches for source of the magical tools that allow at least *snooping* of traffic from other LAN clients in any arbitrary LAN built from switches instead of hubs, and a marginally decent-configured router that doesn't FORWARD ALL ALL |
| 21:26.33 | Maxdamantus | Do you know what ARP is? |
| 21:27.41 | Maxdamantus | ARP requests are normally broadcast to everyone on the .. broadcast domain. |
| 21:27.57 | Maxdamantus | There isn't any way to validate the responses you get back from them. |
| 21:28.19 | Maxdamantus | and that's how you know what addresses to send to at the level you're talking about. |
| 21:29.13 | Maxdamantus | You can also make false responses to DHCP requests. |
| 21:29.42 | Maxdamantus | Using switches instead of hubs doesn't really improve security. |
| 21:31.34 | *** join/#maemo clopez (~tau@neutrino.es) |
| 21:34.28 | Maxdamantus | You can probably also come up with attacks involving STP if that's running on the broadcast domain. |
| 21:35.16 | Maxdamantus | I'm sure there are countless others. |
| 21:38.19 | Maxdamantus | btw, these attacks don't have to be intended by the people using the LAN. |
| 21:38.32 | Maxdamantus | they could be performed by malware already running on other people's computers on the LAN. |
| 21:43.57 | *** join/#maemo Venusaur (~wdwrwf@wikipedia/Antonio-Lopez) |
| 22:09.57 | Maxdamantus | btw, the "magical tools" are just a standard build of dnsmasq and the standard Linux networking tools. |
| 22:11.11 | Maxdamantus | with those you can set up a DHCP server that tells (some) people making DHCP requests to use your IP address as a gateway and as a DNS server. |
| 22:12.47 | Maxdamantus | then you just need to do NAT to forward connections on through the real gateway and everything will appear to be working as normal, it just happens that half of the network users are forwarding all their traffic through your machine. |
| 22:16.02 | *** join/#maemo Luke-Jr (~luke-jr@unaffiliated/luke-jr) |
| 22:36.56 | *** join/#maemo M4rtinK (~M4rtinK@ip-78-102-146-111.net.upcbroadband.cz) |
| 23:25.24 | *** join/#maemo andril (~andril@c-66-229-28-40.hsd1.fl.comcast.net) |
| 23:29.40 | *** join/#maemo luke-jr_ (~luke-jr@unaffiliated/luke-jr) |
| 23:36.07 | *** join/#maemo luke-jr_ (~luke-jr@unaffiliated/luke-jr) |
| 23:45.25 | *** join/#maemo luke-jr_ (~luke-jr@unaffiliated/luke-jr) |
| 23:51.44 | *** join/#maemo robink (~quassel@unaffilated/robink) |
| 23:58.17 | *** join/#maemo krnlyng (~liar@83.175.90.24) |
