Avatar
Dr. Hax
d30ea98ea65e953f91ab93f6b30ea51eb33c506f87d49f600a139aef00aa9511
Cypherpunk. Infosec veteran of about 15 years (vulnerability research, exploit development and cryptography). Cypherpunks write code. :-) Signet maintainer. Self-custody your passwords... in hardware! https://hax0rbana.org/signet Want to see wider adoption so Bitcoin can be used as digital cash and not just an investment vehicle. XMR: 44RDkTFmTeSetwAprJXnfpRBNEJWKvA5dBH5ZVXA4DofgoZ9AgjyZdSa2fo7pMD3Qe3pdKga8X22y3Lyn1xYde5kPQPzVUu

If GDP were going to decrese by 12% in the next couple decades, could you imagine how much quantative easing would be needed to avoid a recession?

https://phys.org/news/2024-08-climate-yields-larger-previous.html

#ClimateChange #collapse #economics

Bid on old technology oened by the late Paul Allen.

Anyone who has seen #AmericanPsycho knows exactly who Paul Allen is. 😆

?v=1613769526

https://onlineonly.christies.com/s/firsts-history-computing-paul-g-allen-collection/lots/3726

Replying to Avatar Jonathan

I think my accuracy is over 90% at this point on https://www.whichfaceisreal.com/

The obvious giveaways for the AI image generator they used are the weird swirls, fuzzy teeth, simple or kaleidoscope backgrounds, messed up people in the background, and inability to show shiny skin.

I kind of want to remake this now with a better image generator.

They missed a real opportunity to call this site "bot or not"

Could you imagine how fast the web would be if modern sites were designed like the PizzaHut page from 1995?

https://www.pizzahut.com/assets/pizzanet/home.html

And just think if you cut out the cloudflare, too! It'd go even faster yet without all those extra connections, JS and redirects!

Nevermind, I found another MQTT topic that publishes the data in JSON! I was subscribed to the topic that gives out the raw data and didn't realize that the "publish in JSON format" option published in both formats; I thought it just wasn't working right since I was still getting the raw packets.

I'm still curious about how to convert the raw data, but it's no longer in my critical path.

❤️

#Meshtastic folks, I need your help! How do I take the bytes off the wire and decode it into a Python class?

I'm reading in "raw protobufs" (according to the docs) from MQTT, which gives me a byte string. The ParseFromString methods don't take a bytes object, they take a String.

I see that if I can get the bytes converted into a google._upb._message.Message object, there's a meshtastic.util.message_to_json() that will probably guve me what I'm looking for.

#AskNostr #GrowNostr #programming #development

Started reading a new book today.

If you are about to respond to this post praising or bashing the book without ever having read it, just stop.

96°F today. Getting to be a bit uncomfortable.

Yeah, I'll have to do some more packet dumps at some point to see what is really going on

It was all very much hacked together, so it's entirely possible there are inefficiencies like this in there. 😆

Why haven't I seen any relay implementations that leech off corporate services? Let them unknowingly pay the cost of operating a relay.

Post your note to X, LinkedIn, Reddit, and GDocs. Fetch from the same.

Sure some will get squashed, but #nostr is designed to handle that.

I'm guessing there's some technical reason for this not existing, like nostr clients expect a certain API. And if that's the case, it'd be great to see a client with a built in proxy or scraper or something to bridge between the API the nostr client expects and the API for each of these corpo services. #cypherpunk

I think that's right. I was able to get the mesh working with B.A.T.M.A.N. pretty easily so I never dug into the details.

Yup, agreed, they should be safe from sniffing.

Might have a problem with being compelled to use it, depending on your country & threat model.

I like the randomized pin pad on the Trezor. That's ideal in my book.

I believe it is per controller, but I haven't personally verified that.

For Qubes in particular, I already have USB isolation from dom0, which can control anything, but without a PS/2 keyboard, an exception needs to be made to give the USB device access to dom0. Having a USB -> pS/2 adapter solves that. This provides some protection against a compromised sys-usb VM.

The risk of sniffing a FIDO2 device which is unlocked by entering a pin directly to the device (e.g. Trezor) is pretty minimal. The challenge is sent to the FIDO2 device, it gets back a signed transaction. At most, a malicious USB device that nabbed that could use the one session to each system that you log into.

The risk for a Yubikey, Nitrokey or Signet is a little higher. The attacker could get your device unlock password, but unless they have physical access, they won't be able to use the device or dump the entire database. If an onlykey requires a physical button press to get each password, the same would be true there.

For the password managers, the attacker would also be able to get each password that you actually use, and if you used the device to also provide the URL and username, they'd have everything they need to get persistent access to that account (assuming you don't have any 2FA set up). In contrast the FIDO2 devices only leak tokens that can be used to get a single session, so they're safer than password managers.

Back to the question at hand: should you isolate these devices to their own controller (assuming that works as expected)? That depends on your threat model and risk tolerance.

If you're trying to protect against someone with physical access to all your stuff, then yes. If not, then it depends on how much effort you want to put into it. A $40 USB card for a desktop is pretty reasonable. Trying to do this on a laptop would probably be a huge amount of trouble. For example, many models of the Microsoft Surface only have one USB port and no real room for expansion. So good luck with that one. Only plug one USB device in at a time, I guess?

In any case, you now have the information you need to make an informed decision. 🤓

ChatGPT has really put a hurting on Clippy. He's got a real 💩 job now. Poor guy.