Avatar
Dr. Hax
d30ea98ea65e953f91ab93f6b30ea51eb33c506f87d49f600a139aef00aa9511
Cypherpunk. Infosec veteran of about 15 years (vulnerability research, exploit development and cryptography). Cypherpunks write code. :-) Signet maintainer. Self-custody your passwords... in hardware! https://hax0rbana.org/signet Want to see wider adoption so Bitcoin can be used as digital cash and not just an investment vehicle. XMR: 44RDkTFmTeSetwAprJXnfpRBNEJWKvA5dBH5ZVXA4DofgoZ9AgjyZdSa2fo7pMD3Qe3pdKga8X22y3Lyn1xYde5kPQPzVUu

Update: Celery has now also sprouted. I'm still holding out hope for the cilantro. #hydroponics

If these sprout and grow as fast as I have been led to believe they will, this will save me the hassle of watering these plants every other day.

I could imagine going dirtless for the indoor plants. But it has to pass this first basic test before I go whole hog on this.

Understood. I just wanted to make sure others know that this is no less exposure to attacks than if they just forwarded some ports from their router to the server.

What's the point of having a cloud instance if you're relying on an on-prem machine to stay online?

Put another way, why allow untrusted people to reach into your server via wireguard instead of just forwarding those ports?

I guess it's a setup for people who don't want to use i2p or Tor but do want to keep their IP address private.

Plus we don't know that the darknet nodes have a different hosting pattern. 50% or more of those could be on AWS/GCP too.

Replying to Avatar Dr. Hax

A bug in #GitLab that, according to GitLab's write up, "allows an attacker to trigger a pipeline as an arbitrary user".

Does this mean an attacker could create a pipeline job to extract secrets and then run it as another user?

GitLab won't say. They just say the attacker can #exploit this #vulnerability "under certain circumstances". Not much #transparency for something they consider a "critical" vulnerability.

Source: https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/#execute-environment-stop-actions-as-the-owner-of-the-stop-action-job

Before someone tells me thay it's open source and I can just read the source code, just stop. You're missing the point. The point is that people who write up announcements like this should be communitating to other server operators what the actual risk is. Do I need to shut down the CI runner until I can get someone out of bed to patch this? How can I find exploitation in the logs or be completely confident my server wasn't exploited?

#security #infosec #cyber #cybersecurity

Fun fact: if AWS and Google banned running #lightning nodes it'd take out more than half of the lightning network.

Source: https://mempool.space/lightning

What's going on with the #bitcoin chain? A block was mined 11 minutes ago that builds on one mined 6 minutes ago? How does that work?

How do you get anything you buy online shipped to you? Do you have a PO box or UPS box or something that you drive by from time to time? I'll ship it anywhere in the USA. Can be a friend or relative's home, their employer, or whatever. Doesn't matter to me.

I've only seen it in passing, not looked at the hardware or software or tried to verify any of their claims. But here are my quick thoughts:

- Good design to not have any wireless hardware

- Open source hardware allows people to verify that fact

- CPU is actually the same make as is used in the Signet, but theirs looks much more complex model (based on the picture)

- Form factor is pretty cool, but if customs asks you to turn on your "phone" to prove it works, things might get awkward

The first thing I'd want to know is what secrets are stored on the device, if any. Since it has a secure element, I'm guessing the secret is on the device. The next question is about the ability to make a backup, and how is the secret protected?

I prefer simplicity in design to banking on a secure element that I can't fully audit.

I've poked around in the codebase for SeedSigner and I can say that it's legit. It doesn't store your secrets at all. You enter it each time you boot. Requires you securely store your seed phrase, but that's not a problem for me. 😎

The hardware scematics are public, as is the firmware and the client. The electronics are very simple (only one IC). So we're doing our best to earn people's trust, not just expecting it like closed source hardware.

It doesn't do signing. It coukd with some additional firmware code, but I'm reluctant to put a bunch of extras in there because it'll increase attack surface and make it harder to audit.

Having an alternate firmware that runs on the same hardware would be cool though. No reason it couldn't handle it.

We've been prepping #vegetables from the #garden for over 4 hours now. Not even going to be able to #cook them all tonight. Going to have to punt some #recipes to Wednesday night.

It's a good haul, but it's a lot of work.

#gardening #homesteading

Cool. There's a v1.4 branch in the cad repo that I would recommend. It's functionally the same as the default branch, but I flipped all the components to the same side of the board to make assembly easier. It's a royal pain to try to solder on SMT parts when other SMT parts are trying to fall off the back.

LMK how it goes. If you run into any issues, I'd be happy to help (and improve the documentation).

Yeah, you can import keepass files, and this is how I keep things synced personally. I haven't worked on exporting to Keepass format, so I only mske changes in Keepass and then periodically re-import.

No, but I'm looking for distributors/resellers to handle shipping to various regions.

I want to try to help people who aren't able to build their own (due to not having the equipment, skills, etc.) But having people pay $30 in shipping on a $45 item feels wrong.

Replying to Avatar Dr. Hax

I'm about to put #Signet devices on #sale. Actually no, not sale, I'm just going to lower the price on my store, where people pay in #bitcoin. #Fiat prices will remain the same.

https://hax0rbana.org/signet to buy, but might as well wait until tomorrow when the price drops.

#security #infosec #cyber #cybersec #cybersecurity #OpenSource #hardware #privacy

OK, price drop as promised for #bitcoin users

https://hax0rbana.org/signet/store.html?pubkey=028fe8dff97df9480d37bd7fbdd300c7aab1e77e3f77647f41ae27fa69d401da26&relays=%5B%22wss://relay.damus.io%22,%22wss://nostr-pub.wellorder.net%22,%22wss://nostr.bolt.fun%22%5D

This is as low as I can go. It's the cost of the components and the average shipping price.

No compensation for the hour I spend building, testing and reworking each board or the hundreds of hours working of the software or firmware. But if it helps encourage more people to pay and accept bitcoin, it'll be worth it. Besides, if bitcoin goes up by 50%, I'll have made minimum wage. 🤣 It's all good, it's a labor of love. 🫂

nostr:nevent1qqsghrl3tzvevjv0sm443knqaunr4xzxlv0laqm3yxl9mteqvqddxvqpzpmhxue69uhkummnw3ezumt0d5hsygxnp65cafj7j5ler2un76esafg7kv79qmu86j0kqzsnnthsp254zypsgqqqqqqs03jlt9

Replying to Avatar Dr. Hax

I'm about to put #Signet devices on #sale. Actually no, not sale, I'm just going to lower the price on my store, where people pay in #bitcoin. #Fiat prices will remain the same.

https://hax0rbana.org/signet to buy, but might as well wait until tomorrow when the price drops.

#security #infosec #cyber #cybersec #cybersecurity #OpenSource #hardware #privacy

OK, price drop as promised for #bitcoin users

https://hax0rbana.org/signet/store.html?pubkey=028fe8dff97df9480d37bd7fbdd300c7aab1e77e3f77647f41ae27fa69d401da26&relays=%5B%22wss://relay.damus.io%22,%22wss://nostr-pub.wellorder.net%22,%22wss://nostr.bolt.fun%22%5D

This is as low as I can go. It's the cost of the components and the average shipping price.

No compensation for the hour I spend building, testing and reworking each board or the hundreds of hours working of the software or firmware. But if it helps encourage more people to pay and accept bitcoin, it'll be worth it. Besides, if bitcoin goes up by 50%, I'll have made minimum wage. 🤣 It's all good, it's a labor of love. 🫂

nostr:nevent1qqsghrl3tzvevjv0sm443knqaunr4xzxlv0laqm3yxl9mteqvqddxvqpzpmhxue69uhkummnw3ezumt0d5hsygxnp65cafj7j5ler2un76esafg7kv79qmu86j0kqzsnnthsp254zypsgqqqqqqs03jlt9