| 00:00.21 | *** join/#maemo atk (Arch-TK@fsf/member/Arch-TK) |
| 00:20.14 | *** join/#maemo ashneo76 (~ashneo76@204.14.154.168) |
| 00:46.04 | *** join/#maemo sunshavi (~user@181.64.192.238) |
| 01:12.37 | *** join/#maemo eMHa__ (~mh@p54B0FF47.dip0.t-ipconnect.de) |
| 02:33.48 | *** join/#maemo yosafbridge (~yosafbrid@68.ip-149-56-14.net) |
| 03:41.34 | DocScrutinizer05 | ~usbfix |
| 03:41.34 | infobot | from memory, usbfix is http://talk.maemo.org/showthread.php?t=75920 - and **NEVER** use epoxy (unless you want to seal your device for underwater), or https://www.youtube.com/watch?v=fYz5nIHH0iY#t=1866, you will basically need two irons: a small good one (or better hot-air reflow) and a 60+ Watt |
| 03:42.49 | DocScrutinizer05 | >>Fixing USB port, **before** and after it is to late.<< |
| 03:47.34 | DocScrutinizer05 | honestly, ruggedizing a non-broken N900 USB port is for 9 year old who want to learn soldering. You don't even need flux for it, when you got proper high quality electronics solder wire |
| 03:49.02 | *** join/#maemo lobito (~lobito@unaffiliated/lobito) |
| 04:03.14 | *** join/#maemo DocScrutinizer05 (~saturn@openmoko/engineers/joerg) |
| 04:58.42 | *** join/#maemo klydrar (~jam@73.109.61.113) |
| 05:12.04 | *** join/#maemo auenfx4 (David@DC-24-199.bpb.bigpond.com) |
| 05:14.34 | *** join/#maemo Mek_ (~quassel@kde/mkruisselbrink) |
| 05:14.53 | *** join/#maemo BitEvil (~quassel@tor/regular/SpeedEvil) |
| 05:15.20 | *** join/#maemo useretai- (useretail_@gateway/shell/elitebnc/x-yzztbzorjjnsjkmz) |
| 05:16.03 | *** join/#maemo XDS2010_ (sid1218@gateway/web/irccloud.com/x-oxthsjkxopwkbwbb) |
| 05:16.07 | *** join/#maemo frals_ (~frals@c83-251-147-241.bredband.comhem.se) |
| 05:16.35 | *** join/#maemo fk_lx_ (~fk_lx@152.ip-37-187-81.eu) |
| 05:16.56 | *** join/#maemo Vajb_ (~Vajb@85-76-98-35-nat.elisa-mobile.fi) |
| 05:17.16 | *** join/#maemo Ariadeno (~Ariadeno@199.175.50.37) |
| 05:18.01 | *** join/#maemo robink_ (~quassel@unaffilated/robink) |
| 05:19.03 | *** join/#maemo DrCode_ (~DrCode@5.28.134.3) |
| 05:20.02 | *** join/#maemo totalizator_ (~totalizat@degu.pl) |
| 05:20.07 | *** join/#maemo netkat_ (~me@80.79.126.176) |
| 05:21.16 | *** join/#maemo CatButts (~c@188.173.53.45) |
| 05:21.22 | *** join/#maemo mavhc (~mavhc@cpc77319-basf12-2-0-cust433.12-3.cable.virginm.net) |
| 05:21.22 | *** join/#maemo grinsekatze (~andreas@5.189.188.187) |
| 05:26.04 | *** join/#maemo povbot (~supybot@office.pov.lt) |
| 05:27.41 | *** join/#maemo Guest64392 (~Milhouse@host81-154-9-248.range81-154.btcentralplus.com) |
| 05:28.24 | *** join/#maemo Tenhi_0 (~tenhi@static.177.80.201.138.clients.your-server.de) |
| 05:28.29 | *** join/#maemo timeless (sid4015@firefox/developer/timeless) |
| 05:32.03 | Maxdamantus | ruggedised two N900 USB ports in the weekend. |
| 05:34.07 | *** join/#maemo radekp (~radek@82.113.39.213) |
| 05:35.06 | *** join/#maemo ruskie (ruskie@sourcemage/mage/ruskie) |
| 05:35.33 | klydrar | so i'm getting an n900 on wednesday, should i strengthen the solder on it immediately? |
| 05:38.47 | *** join/#maemo juiceme (~juice@Maemo/community/council/juiceme) |
| 05:38.50 | Maxdamantus | I think that's still the current advice. |
| 05:39.44 | Maxdamantus | Well, I'd at least make sure it's charged first, so you don't have to test it afterwards with a flat battery. |
| 05:42.03 | klydrar | looks easy enough to take apart, i'll give it a shot then |
| 06:08.55 | *** join/#maemo arcean (~arcean@62.159.77.164) |
| 06:27.08 | *** join/#maemo KotCzarny (ariel@31.135.195.151) |
| 06:36.07 | *** join/#maemo povbot (~supybot@office.pov.lt) |
| 07:14.39 | *** join/#maemo jskarvad (~jskarvad@ip4-83-240-109-43.cust.nbox.cz) |
| 07:14.39 | *** join/#maemo jskarvad (~jskarvad@redhat/jskarvad) |
| 07:27.28 | *** join/#maemo florian_kc (~fuchs@Maemo/community/contributor/florian) |
| 07:42.42 | *** join/#maemo mhlavink_afk (quassel@nat/redhat/x-baayexrwcbwlnvlf) |
| 07:44.15 | *** join/#maemo geaaru (~geaaru@host170-152-static.43-88-b.business.telecomitalia.it) |
| 08:54.32 | bencoh | yay, gnuboy works fine on n900 .... I wonder how people could stick with laggy closed-source vgb :/ |
| 08:55.09 | KotCzarny | make a tmo entry about it? |
| 08:55.44 | bencoh | yeah, I haven't finished packaging it yet, it and has no GUI either, but ... |
| 08:56.07 | KotCzarny | writing gui shouldnt be hard in pygtk |
| 08:56.44 | bencoh | I can't stand python, and writing GUIs is exactly the part I hate/suck at anyway |
| 08:56.57 | bencoh | so ... feel free :) |
| 08:57.21 | bencoh | actually the main reason it would need a GUI is to set key bindings |
| 08:58.10 | bencoh | (although I patched it to print unmapped keysyms to stdout so discovering needed keycodes wouldn't be too hard) |
| 08:58.28 | KotCzarny | python is easy |
| 08:58.41 | KotCzarny | much easier than perl anyway ;) |
| 08:59.08 | bencoh | I personally think it's braindead, but that's beyond the scope of this chan |
| 08:59.46 | KotCzarny | why so? its a scripting language with beautyfying feat built in |
| 09:00.21 | KotCzarny | and makes writing apps from scratch easy |
| 09:01.16 | KotCzarny | though i agree, on resource limited system (n900) its not useful for anything else than configuration editors/launchers |
| 09:06.47 | *** join/#maemo eMHa__ (~mh@185.36.21.2) |
| 09:12.49 | *** join/#maemo troulouliou_div2 (~troulouli@unaffiliated/troulouliou-div2/x-0271439) |
| 09:14.09 | *** join/#maemo zGrr (~Grr@185.13.106.222) |
| 09:36.24 | *** join/#maemo dreamer (~henk@melange.soleus.nu) |
| 09:37.16 | Xxaxx | or spy device with webcam/mic, wifi proxy to local network etc |
| 09:37.22 | Sicelo | bencoh: yay! |
| 09:45.05 | *** join/#maemo troulouliou_div2 (~troulouli@unaffiliated/troulouliou-div2/x-0271439) |
| 10:48.56 | *** join/#maemo N-Mi (~nicolas@calvix/staff/N-Mi) |
| 10:49.14 | *** join/#maemo eMHa (~mh@185.36.21.1) |
| 11:44.45 | *** join/#maemo LauRoman (~LauRoman@5-14-40-48.residential.rdsnet.ro) |
| 11:45.40 | *** join/#maemo dreamer (~henk@unaffiliated/dreamer) |
| 13:09.41 | *** join/#maemo xorly| (~xorly@193.85.203.185) |
| 13:16.18 | *** join/#maemo RST38h (~marat@tissa.komkon.org) |
| 13:19.48 | *** join/#maemo sunshavi (~user@181.64.192.238) |
| 13:45.56 | *** join/#maemo xorly| (~xorly@193.85.203.185) |
| 14:03.08 | *** part/#maemo L29Ah (~L29Ah@cl-154.led-01.ru.sixxs.net) |
| 14:20.47 | *** join/#maemo japa-fi (~jani@mobile-access-5d6a67-158.dhcp.inet.fi) |
| 14:28.26 | *** join/#maemo xorly| (~xorly@193.85.203.185) |
| 14:30.28 | *** join/#maemo L29Ah (~L29Ah@cl-154.led-01.ru.sixxs.net) |
| 14:41.00 | *** join/#maemo capitanocrunch (~capitanoc@host85-245-dynamic.18-79-r.retail.telecomitalia.it) |
| 15:07.14 | *** join/#maemo eMHa (~mh@p54B0FF47.dip0.t-ipconnect.de) |
| 15:20.13 | *** join/#maemo freemangordon_ (~ivo@213.222.56.174) |
| 15:33.28 | L29Ah | slaps Wizzup with a portage tree |
| 15:43.48 | *** join/#maemo xorly| (~xorly@193.85.203.185) |
| 15:49.22 | *** join/#maemo Pali (~pali@Maemo/community/contributor/Pali) |
| 15:55.36 | *** join/#maemo ds3 (~ds2@rehut.com) |
| 16:00.08 | *** join/#maemo xorly| (~xorly@193.85.203.185) |
| 16:19.01 | *** join/#maemo Sui_dorimu (~wdwrwf@wikipedia/Antonio-Lopez) |
| 16:29.48 | dkbrz | hmm.. is u-boot capable booting off kernel found on encrypted LUKS partition on SD card (like GRUB does), or do I need unencrypted /boot for kernel and initrd on a separate partition? |
| 16:46.29 | Pali | dkbrz: u-boot in maemo extras does not support LUKS |
| 16:46.52 | Pali | but I have no idea if new version of u-boot has support for LUKS or not |
| 16:47.07 | Pali | dkbrz: better ask on #u-boot channel |
| 16:47.46 | dkbrz | Pali: thanks |
| 16:48.29 | Pali | maybe look at this: https://packages.debian.org/sid/grub-uboot-bin |
| 16:48.52 | Pali | it has some luks support: https://packages.debian.org/sid/armel/grub-uboot-bin/filelist |
| 16:49.23 | Pali | looks like this acts as grub for third stage bootloader |
| 16:49.34 | Pali | but still something needs to be unencrypted... |
| 16:49.43 | Pali | probably overkill and useless... |
| 16:50.29 | Pali | dkbrz: anyway, if you found something, let me know, luks + uboot sounds very interesting |
| 16:51.36 | dkbrz | Pali: sure. |
| 16:52.55 | dkbrz | 19:51 < Marex> dkbrz: no, but you can use grub-efi on top of u-boot, which supports that |
| 16:53.11 | dkbrz | so, that's the standard approach I guess |
| 16:54.17 | Pali | it is useless for n900 |
| 16:54.25 | *** join/#maemo stejae (~betelgeus@85.183.206.154) |
| 16:54.43 | Pali | you can boot directly unencrypted kernel |
| 16:54.50 | *** join/#maemo florian (~fuchs@Maemo/community/contributor/florian) |
| 16:54.59 | Pali | or boot unecrypted grub which boot encrypted kernel |
| 16:55.24 | *** join/#maemo stejae (~betelgeus@unaffiliated/stejae) |
| 16:56.03 | Pali | both options are probably same secure... |
| 16:56.48 | Pali | man with physical access to SD card can change boot code easily (e.g. switching SD card) |
| 16:57.04 | dkbrz | yes, but grub option reveals less, so maybe better from privacy perspective |
| 16:57.54 | Pali | attacker will either see your unecrypted grub or unencrypted kernel image |
| 16:57.59 | dkbrz | if device lost/stolen = not you being of interest for some letters ogranisations |
| 16:58.27 | Pali | I think it is widely known that on n900 is running linux kernel |
| 16:58.43 | bencoh | we'd actually need a way to sign/check bootloaders and check the first one in hw, but ..... meh :) |
| 16:59.05 | Pali | X-Loader is signed by nokia key |
| 16:59.13 | Pali | NOLO not (thankfully!) |
| 16:59.28 | Pali | see what happened with N9/N950 and harmattan |
| 16:59.33 | Pali | useless device for hacking |
| 16:59.34 | bencoh | that's what I suspected yeah .... but that means we cant add signature check code to it |
| 16:59.57 | bencoh | thus cant ensure our 2nd-stage bootloader hasn't been modified |
| 17:00.05 | Pali | I think it is better |
| 17:00.24 | Pali | modifying 2nd stage bootloader without active system and equipment is no so easy |
| 17:00.25 | dkbrz | more from #u-boot: |
| 17:00.36 | dkbrz | 19:57 < Marex> dkbrz: if you want to encrypt all things, add small SPI NOR for u-boot, encrypt and checksum that one using the bootrom (make CPU your root of trust) and then store both the u-boot and kernel in that NOR |
| 17:00.40 | dkbrz | 19:58 < Marex> dkbrz: u-boot can decrypt kernel using CPU's crypto engine and boot it, kernel can then decrypt, verify and mount the FS from initramfs |
| 17:00.51 | bencoh | yup, it'd be better than nothing, or than encryption |
| 17:06.42 | *** join/#maemo CatButts (~c@188.173.53.45) |
| 17:11.14 | KotCzarny | dkbrz, just an idea, boot linux then somehow load/kexec encrypted kernel? |
| 17:12.24 | dkbrz | KotCzarny: it sounds even more complex than u-boot + grub. :) |
| 17:12.26 | KotCzarny | or make kernel requiring decryption key avilable via bt dongle |
| 17:12.45 | Pali | what is problem with having kernel image unencrypted? |
| 17:16.29 | dkbrz | Pali: some more privacy only. Actually, for my purposes it's ok. Just Have all other system with full encryptions, maybe a bit lowering expectation and less mental comfort :) |
| 17:21.32 | dkbrz | but chainloading grub sounds interesting, I'll try it just of curiosity |
| 18:36.35 | *** join/#maemo trumee (~trumee@c-73-155-87-64.hsd1.tx.comcast.net) |
| 18:38.21 | DocScrutinizer05 | beats bencoh with a huge wet Aegis |
| 18:48.29 | *** join/#maemo japa-fi (~jani@mobile-access-bcee7f-122.dhcp.inet.fi) |
| 19:03.18 | DocScrutinizer05 | an attacker able to do anything you might try to stop with such encryption (i.e. replacing kernel by an unsigned one) is also able to do basically all the things you might want to forbid via that encrypted kernel |
| 19:03.27 | DocScrutinizer05 | sorry |
| 19:04.00 | DocScrutinizer05 | sorrythat was poorly worded, but actually still to the point |
| 19:05.49 | DocScrutinizer05 | more normal language: what does it help when you can tell an attacker replaced the kernel and your system doesn't boot the non-encrypted/signed new kernel, when the same attacker that sneaked in that new kernel already copied all your protected stuff since he could do that as well when he could replace the kernel |
| 19:18.38 | DocScrutinizer05 | yes, somebody with physical access could sneak in a kernel that discloses your master password while they only could steal the encrypted partition |
| 19:19.43 | *** join/#maemo krnlyng (~liar@178.114.48.51.wireless.dyn.drei.com) |
| 19:37.46 | *** join/#maemo japa-fi (~jani@mobile-access-5d6af6-160.dhcp.inet.fi) |
| 19:37.54 | *** join/#maemo BCMM (~BCMM@unaffiliated/bcmm) |
| 19:40.51 | *** join/#maemo atk (~Arch-TK@fsf/member/Arch-TK) |
| 19:44.29 | *** join/#maemo xorly| (~xorly@ip-89-176-10-118.net.upcbroadband.cz) |
| 19:55.18 | bencoh | DocScrutinizer05: ? |
| 19:55.50 | *** join/#maemo xorly (~xorly@ip-89-176-10-118.net.upcbroadband.cz) |
| 19:56.36 | bencoh | I only said that the only way to "garantee" "security" would be to keep a chain of signed software, from 1st-stage bootloader (checked by hw) to kernel/initrd |
| 19:58.31 | Pali | and who will have signing keys? |
| 19:58.47 | Pali | how will be distributed (to HW)? |
| 19:58.58 | Pali | and who will be able to change them? |
| 19:59.06 | bencoh | Pali: on n900, we just cant do it :) |
| 19:59.08 | KotCzarny | or just attach some explosives and trigger anything suspicious |
| 19:59.39 | Pali | who is responsible for security audit of that HW signature verification code? |
| 19:59.57 | Pali | and how to replace them if security problem will be found? |
| 20:00.16 | Pali | it is not about n900, those are general questions for any phone |
| 20:00.48 | bencoh | Pali: device vendor |
| 20:01.51 | Pali | I say that if owner of phone does not have all above in his own control, then there is no real security |
| 20:03.48 | bencoh | indeed, and that's exactly what happened with n900 :) |
| 20:04.17 | KotCzarny | its still leaps and bounds better than most of the phones today |
| 20:09.02 | Sicelo | true ... i have taken ownership of my dad's old SGS4 - the hardware is nice (processor, ram, display) - but the OS just leaves a lot to be desired. i feel boxed in :( |
| 20:16.05 | KotCzarny | port maemo to it ;) |
| 20:41.57 | Sicelo | haha .. the Replicant team seems to have had significant problems porting to it .. |
| 20:42.09 | Sicelo | so you can already see the chances for Maemo |
| 20:42.27 | Sicelo | CM works good apparently |
| 21:07.47 | bencoh | but CM is full of blobs |
| 21:08.07 | bencoh | (not that we don't have any in maemo, but ...) |
| 21:16.24 | *** join/#maemo geaaru (~geaaru@host235-147-dynamic.60-82-r.retail.telecomitalia.it) |
| 21:22.21 | *** join/#maemo pagurus (~user@pD950FB4A.dip0.t-ipconnect.de) |
| 21:51.20 | *** join/#maemo N-Mi (~nicolas@calvix/staff/N-Mi) |
| 21:58.14 | *** join/#maemo BitEvil (~quassel@tor/regular/SpeedEvil) |
| 21:59.23 | Sicelo | yes .. hence my disinterest in CM |
| 22:28.49 | *** join/#maemo Antiguan (~arlan@209.59.90.205) |
| 22:28.51 | *** join/#maemo weasel268 (~arlan@209.59.90.205) |
| 23:25.44 | *** join/#maemo arossdotme (~zxy@host-92-26-242-57.as13285.net) |
| 23:52.28 | Maxdamantus | Some Lenovo laptops have some "tamper detection", which might be a reasonable solution if done correctly. |