Subnostr

Dr. Hax

d30ea98ea65e953f91ab93f6b30ea51eb33c506f87d49f600a139aef00aa9511

Cypherpunk. Infosec veteran of about 15 years (vulnerability research, exploit development and cryptography). Cypherpunks write code. :-) Signet maintainer. Self-custody your passwords... in hardware! https://hax0rbana.org/signet Want to see wider adoption so Bitcoin can be used as digital cash and not just an investment vehicle. XMR: 44RDkTFmTeSetwAprJXnfpRBNEJWKvA5dBH5ZVXA4DofgoZ9AgjyZdSa2fo7pMD3Qe3pdKga8X22y3Lyn1xYde5kPQPzVUu

Last night I bought enough parts to build a second computer which should be able to run Qubes (at least v4.2).

Hopefully this will let me get to the bottom of this bizarre issue where hidraw devices were fully functional in Qubes 4.1 and seem to have certain packets filtered in #Qubes 4.2.

That is... IF I can get Qubes 4.1 to install on my current machine so I can do a side by side comparison. Hopfully I will be able to work on this on Saturday. #signet

Do you think it's important to protect people's sovereignty? Don't approve of ferderal surveillance of protests? You may have a lot in common with the protestors of Standing Rock than you realized.

https://grist.org/indigenous/fbi-informant-standing-rock-protest-court-documents-surveillance/

Can you believe that CrimethInc posted a bunch of tools and tactics to let people get away with #protests and stand up against #government sanctioned violence against it's own citizens?

https://crimethinc.com/2020/08/03/tools-and-tactics-in-the-portland-protests-from-leaf-blowers-and-umbrellas-to-lasers-bubbles-and-balloons

This is exactly the kind of material #FreeSpeech advocates would say is fine and promotes #freedom from #oppression

Dr. Hax, why haven't you posted on #nostr much today?

Well, let me tell you! I was moving about 4 cubic yards of dirt out of my raised garden bed, putting in a subterranean watering system, and then putting about 3.5 cubic yards of that dirt back into the bed.

It was exhausting, and I'm very glad to have had the help that I did. 🙏🫂 I didn't at all expect that we would get it completed in a single day.

The last one that we put in took about a week of working at least a couple hours each day. Granted, there were half the people working on it, but still considerably fewer person-hours.

#gardening #GrowNostr #vegetable #prepper

Hard manual labor is very good exercise. #gardening #TheMoreYouKnow

/me rolls up sleeves

Welp, time to dig into USB packet sniffing...

https://docs.kernel.org/5.10/usb/usbmon.html

nostr:nevent1qqszlpg5wavc8k3f7ruex77t5x8jfhljnvatq7k4af0f3jfavahluygpz3mhxue69uhhyetvv9ujumn0wd68ytnzvupzp5cw4x82vh5487g6hylkkv82284n83gxlp75nasq5yu6auq249g3qvzqqqqqqymj2wtk

OK, sniffing USB packets is pretty cool, albeit noisy AF!

Found an amazon box on my porch and honestly thought "now WTF did I buy?"

Well... what was it?

Mike Dilger ☑️

I suspect the ideas of "insulin resistance" (and it's inverse "insulin sensitivity") are entirely explained by muscle mass and muscle glycogen (and liver glycogen).

I may be wrong; this is my current opinion; I'm not an expert; But this is informed by experts, in particular Roy Taylor, a prominent diabetes researcher from Newcastle University.

If you have a lot of muscle mass and it is depleted of glycogen (generally your liver is also depleted) you are very insulin sensitive. Your muscles will suck up sugar greedily. This happens after fasting, after exercise, and when on the keto diet (essentially a sugar fast). On the other hand, if your muscle and liver glycogen is full then you are insulin resistant. They have no room to suck up any more sugar. You can change your insulin sensitivity quickly, within hours, by eating or fasting. There is a longer-term component and a genetic component, which I presume has to do with how much glycogen your liver and muscles can hold. If you train a lot, they can hold more. But this is also partially genetically determined where some people even after training don't hold much glycogen in their muscles and are thus genetically at least somewhat "insulin resistant" all the time.

People trying to work on their "insulin sensitivity" to avoid type-2 diabetes are IMHO probably misguided. They should just try to be a healthy weight, to not overeat, and to do some exercise to keep their glycogen from filling up and spilling over into body fat.... and ignore this new mysterious thought-to-be-independent factor.

People wearing continuous glucose monitors who aren't diabetic, and even people trying to avoid "blood sugar spikes" by avoiding fruit like bananas, are IMHO also probably misguided. Blood sugar is supposed to spike - that is what insulin is for. Blood sugar spikes don't cause diabetes... it is only high blood sugar that remains high that *signals* diabetes (high blood sugar is an effect of diabetes, not a cause). We evolved to eat fruit and honey for god sake. Epidemiological research shows people that eat a lot of complex carbs live the longest. Gut bacteria need fiber (a carbohydrate) to produce the chemicals that our health seems to depend on.

Diabetes is caused by (based on Roy Taylor's research):

1. Your propensity to store fat viscerally (mostly genetically determined, and widely ranging)

2. Your beta cell tolerance to visceral fat (this also ranges widely and is apparently genetically determined),

3. Based on 1 & 2, if you are over your personal weight threshold such that enough viseral fat has entered your pancreas to cause those beta cells to stop functioning.

Diabetes can be reliably reversed by losing weight... and eating sugar if you want, as long as you lose weight. Roy Taylor reversed diabetes in people by feeding them a complete nutritional supplement (these tend to be 60% carbohydrate) that wasn't enough to meet daily caloric needs, so they lost weight.

There was some clear research based on MRI scans of pancreatic fat that determined that yes, thin people with type-2 diabetes have fat pancreases, even though they don't appear to be fat. And fat people without diabetes don't have fat pancreases. So the connection is pretty clear.

#DontFearTheCarbohydrate

At least some of this lines up with what I've been watching here: https://nourishedbyscience.com/start-here/

The idea the glucose spikes are to be avoided is questionable, and that is even stronger when calling something under 140ml/dl a "spike". It is a rise, but it's not at all the same as a spike of 200 or 300ml/dl that takes more than 2 hours to go down.

I don't know enough about the topic to be able to agree or disagree with the idea that it's entirely muscle mass. I'll keep it in mind as I continue to learn more.

Linux kernel seems to be the common thread, however, another Linux machine that I have still works fine with Signet, even though it's running a very recent kernel.

This makes me think that the problem is some kernel configuration option that is only enabled in security hardened systems. So this is the lead I will follow.

/me rolls up sleeves

Welp, time to dig into USB packet sniffing...

https://docs.kernel.org/5.10/usb/usbmon.html

nostr:nevent1qqszlpg5wavc8k3f7ruex77t5x8jfhljnvatq7k4af0f3jfavahluygpz3mhxue69uhhyetvv9ujumn0wd68ytnzvupzp5cw4x82vh5487g6hylkkv82284n83gxlp75nasq5yu6auq249g3qvzqqqqqqymj2wtk

#Signet Saturday is off to a start, and I'm confirming parts of my hypothesis. Just confirmed that #Tails 5.17.1 has the same issue as #Qubes 4.2 with hidraw devices on my newest motherboard.

This is the second motherboard to have this issue, and they were different makes and models, so this seems to point to a software issue. The good news is that this is something for which I'm more likely to be able to find a fix or workaround.

Linux kernel seems to be the common thread, however, another Linux machine that I have still works fine with Signet, even though it's running a very recent kernel.

This makes me think that the problem is some kernel configuration option that is only enabled in security hardened systems. So this is the lead I will follow.

#Signet Saturday is off to a start, and I'm confirming parts of my hypothesis. Just confirmed that #Tails 5.17.1 has the same issue as #Qubes 4.2 with hidraw devices on my newest motherboard.

This is the second motherboard to have this issue, and they were different makes and models, so this seems to point to a software issue. The good news is that this is something for which I'm more likely to be able to find a fix or workaround.

Replying to Change this if you want

Good

Night

Sylish picture!

Late Night Blog

Are we watching the internet die

https://www.wheresyoured.at/are-we-watching-the-internet-die/

#tech #blog #privacy

A group of people who create handmade art and crafts that broke away from #etsy and formed their own coop. They now run an "actually handmade" marketplace at artisans.coop

So there are some places where the people are fighting back.

Time will tell if people really care if things are handmade and the profits go to the creators, or if they just want cheap arty/craftsy type things. If not, it's another data point to add to your thesis. I hope people do care.

Yeah reproducable builds are good at making sure the code matches the executable, but it says nothing about the quality of the code.

That's where reviews come in. It doesn't even have to be human review, although the automated review systems are frequently abled to be gamed.

An example: if I attested that my CI process compiled a library without any warnings using `gcc -Wall`, it means something. Maybe it means the developer put inline compiler warning suppressions all over the place, or maybe they fixed up all the things the compiler was warning about.

Now if that same library also had stats about warning suppressions, that might be interesting too. The same could be done with automated test suites passing, code coverage, operating sysyem compatibility, static and dynamic security tools, and a bunch of other things.

If a person I know reviewed it, that would likely have more influence over me in terms of whether I'd want to use it, as it's harder for developers to undermine a manual review. Humans can frequently spot sketchy heuristic bypasses of the automated checks. And they can find things like logic errors, which scanners can almost never find.

FWIW, I would set up some CI jobs to make these types of attestations if there were a place I could post them and software to search for them and use them.

If someone wanted to write some code, it seems like #nostr could solve this. Post attestations in a specific format (they're already signed), and make sure they are searchable and machine readable. Then write a client that can find such events.

nostr:nevent1qqsd6l5cjkd4p83zcgpclfwzugnvvzwm8gngj4w28wwd77am68rds9cpz3mhxue69uhhyetvv9ujumn0wd68ytnzvupzp5cw4x82vh5487g6hylkkv82284n83gxlp75nasq5yu6auq249g3qvzqqqqqqyvj52cz

Replying to deleted

there should be a client mode where you can roll a proxy npub, dox your location, see if there are other nostr users... nostr:npub1ye5ptcxfyyxl5vjvdjar2ua3f0hynkjzpx552mu5snj3qmx5pzjscpknpr maybe an addition to anon mode in nostrudel?

I like the idea of being able to connect with locals without posting my exact geolocation coordinates, let alone post them to the social media with the least ability to delete posts. #privacy

Nice and Kind Vic

Ive seen bitcoinbinary.org for something like that at least related to people attesting to being able to do reproducible builds. Id be interested in more like that for other domains

Yeah reproducable builds are good at making sure the code matches the executable, but it says nothing about the quality of the code.

That's where reviews come in. It doesn't even have to be human review, although the automated review systems are frequently abled to be gamed.

An example: if I attested that my CI process compiled a library without any warnings using `gcc -Wall`, it means something. Maybe it means the developer put inline compiler warning suppressions all over the place, or maybe they fixed up all the things the compiler was warning about.

Now if that same library also had stats about warning suppressions, that might be interesting too. The same could be done with automated test suites passing, code coverage, operating sysyem compatibility, static and dynamic security tools, and a bunch of other things.

If a person I know reviewed it, that would likely have more influence over me in terms of whether I'd want to use it, as it's harder for developers to undermine a manual review. Humans can frequently spot sketchy heuristic bypasses of the automated checks. And they can find things like logic errors, which scanners can almost never find.

Tips to find #local people on #nostr

1. 🤷‍♂️

#GLHF

I haven't tested contacts. Any open issues on github?

Didn't see anything that looked like a match. And the ol' Simple Mobile Tools still works fine. Maybe it's Graphene specific.

I'll have to put together a bug report when I want to finally ditch SMT

"Fossify apps pick up where Simple Mobile Tools left off"

Installed #Fossify gallery this morning and everything seems back to privacy-respecting gallery goodness 😎🤙

#cybersecgirl #privacytechpro

https://liliputing.com/fossify-apps-pick-up-where-simple-mobile-tools-left-off-free-and-open-source-suite-of-android-apps/

nostr:nevent1qqsw3x580z4mz89ksp9uq4arajf54fweayrf8zvuaacfqda96r3y8fqpvemhxue69uhkv6tvw3jhytnwdaehgu3wwa5kuef0dec82c33vcm82emc09uxk6mwddjhgvmtddjxwaf5dvcxvafhx3mx6umgv9mk2unddd4rsepsxeeh5dn2w3enjap5ddekcct6vd4kz0mzwfhkzerrv9ehg0t5wf6k2q3qf6ugxyxkknket3kkdgu4k0fu74vmshawermkj8d06sz6jts9t4ksxpqqqqqqzgsjl32

Does the Fossify Contacts show any contacts for you? It's empty for me and I literally can't give the app any more permissions.

I use CardDav and dav x5 and found another person who told me they have the same setuo and are having the same issue.

Biden got caught secretly funding Israel as they commit genocide.

He's using the same trick that Trump used to hide his weapon sales: many small shipments that don't require disclosure.

https://jacobin.com/2024/03/biden-weapons-israel-gaza-palestine/

Load More