Techrights logo

IRC: #techbytes @ Techrights IRC Network: Wednesday, December 08, 2021

(ℹ) Join us now at the IRC channel | ䷉ Find the plain text version at this address (HTTP) or in Gemini (how to use Gemini).

*GNUmoon2 has quit (Ping timeout: 2m30s)Dec 08 01:20
*u-amarsh04 has quit (Quit: Konversation terminated!)Dec 08 01:26
schestowitzhttps://twitter.com/TheDickKnightV2/status/1468226178750324823Dec 08 01:26
-TechBytesBot/#techbytes-@TheDickKnightV2: @schestowitz I would love to hear how they plan to enforce safe storage laws. California has them and it surely hasn’t been working.Dec 08 01:26
schestowitzhttps://twitter.com/IMDibe/status/1468183100228259846Dec 08 01:26
-TechBytesBot/#techbytes-@IMDibe: @schestowitz Junk reporting.Dec 08 01:26
*GNUmoon2 (~GNUmoon@9usr6fbbjhvag.irc) has joined #techbytesDec 08 01:26
*liberty_box has quit (Ping timeout: 2m30s)Dec 08 01:28
*liberty_box_ has quit (Ping timeout: 2m30s)Dec 08 01:29
*u-amarsh04 (~amarsh04@t25x9hgy9xhrc.irc) has joined #techbytesDec 08 01:33
schestowitzRe: Certificates on TechRightsDec 08 01:36
schestowitz> Hi Roy,Dec 08 01:36
schestowitz> Dec 08 01:36
schestowitz> I am conversing with the author of a fairly popular siteDec 08 01:36
schestowitz> (  guide) and talking about site certificates.Dec 08 01:36
schestowitz> (see below)Dec 08 01:36
schestowitz> Do you have any thoughts or recommend any articles on whereDec 08 01:36
schestowitz> this is going?Dec 08 01:36
schestowitz> Dec 08 01:36
schestowitz> all good wishes,Dec 08 01:37
schestowitzMy answer in-line, below:Dec 08 01:37
schestowitz> Date: Mon, 06 Dec 2021 13:31:56 +0000Dec 08 01:37
schestowitz> From: Dec 08 01:37
schestowitz> To: Dec 08 01:37
schestowitz> Subject: Re: Article on teaching cybersecurityDec 08 01:37
schestowitz> Dec 08 01:37
schestowitz> You might suggest to   that he add download links for hisDec 08 01:37
schestowitz> podcast episodes.  I almost never listen to podcasts on my computer.Dec 08 01:37
schestowitz> I listen when I'm away from my computer, while doing other things.Dec 08 01:37
schestowitz> Dec 08 01:37
schestowitz> I would be interested to know why Roy uses a self-signed certificate.Dec 08 01:37
schestowitz> I'm considering writing an article that delves into how much ofDec 08 01:37
schestowitz> browser security warnings are justified and how much are not.  ItDec 08 01:37
schestowitz> occurs to me that websites that are HTTP only or that use self-signedDec 08 01:37
schestowitz> certificates may be the new darkweb.  Dec 08 01:37
schestowitzThe term "darkweb" is a meaningless buzzword that should be avoided. People who say "darkweb" help the likes of BBC perpetuate ruinous myths, e.g. about a forum that requires a username/password to access.Dec 08 01:37
schestowitz>I wonder if their owners wantDec 08 01:37
schestowitz> their sites to be hidden, simply don't care, or their sites areDec 08 01:37
schestowitz> completely driven by word-of-mouth traffic.Dec 08 01:37
schestowitzThis is untrue. The site has HTTPS support, the certificate is signed, but it does not outsource trust to untrustworthy hacks: Dec 08 01:37
schestowitzhttp://techrights.org/2020/11/07/free-privacy-lunch/Dec 08 01:37
schestowitzAporopos: http://techrights.org/wiki/Linux_FoundationDec 08 01:37
-TechBytesBot/#techbytes-techrights.org | Let’s Encrypt is Garbage, Albeit It’s Disguised as ‘Free’ Privacy | TechrightsDec 08 01:37
-TechBytesBot/#techbytes-techrights.org | Linux Foundation - TechrightsDec 08 01:37
schestowitzThere are also purely technical reasons, but that's a longer debate.Dec 08 01:37
schestowitzGemini strictly requires certificates, but fully and happily supports self-signing.Dec 08 01:37
schestowitzA Web that is centralised isn't worth having.Dec 08 01:37
schestowitzAlso: http://techrights.org/2020/03/04/lets-ask-lets-encrypt/Dec 08 01:37
schestowitzPlease pass along my feedback and consider writing about it. Your article was very well received and we'd love to publish more like it.Dec 08 01:37
-TechBytesBot/#techbytes-techrights.org | Techrights Urges Readers to Ask the Linux Foundation’s Let’s Encrypt (Backed by Companies That Give the NSA Back Doors) Some Hard But Legitimate Questions | TechrightsDec 08 01:37
schestowitzKind regards,Dec 08 01:37
schestowitzFwd: AI in an IP worldDec 08 01:38
schestowitzA group of colleagues at Reddie & Grose recently published a newsletter called AI in an IP world which features “a collection of insights into how patents can protect AI related inventions”.Dec 08 01:38
schestowitzI think it’s worth a read:Dec 08 01:38
schestowitzAI in an IP world - Intellectual Property Law - Reddie & GroseDec 08 01:38
schestowitzAI in an IP world - Intellectual Property Law - Reddie & GroseDec 08 01:38
schestowitzReddie & Grose’s Artificial Intelligence (AI) newsletter, a collection of insights into how patents can protect AI related inventions, and what AI can do for the intellectual property world.Dec 08 01:38
*liberty_box (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 01:41
*liberty_box_ (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 01:41
*u-amarsh04 has quit (Quit: Konversation terminated!)Dec 08 02:04
*GNUmoon2 has quit (Ping timeout: 2m30s)Dec 08 02:13
*GNUmoon2 (~GNUmoon@6ujf8e7nw8qfi.irc) has joined #techbytesDec 08 02:13
*liberty_box has quit (Ping timeout: 2m30s)Dec 08 02:43
*liberty_box_ has quit (Ping timeout: 2m30s)Dec 08 02:43
*liberty_box_ (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 02:55
*liberty_box (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 02:55
*liberty_box_ has quit (Ping timeout: 2m30s)Dec 08 03:57
*liberty_box has quit (Ping timeout: 2m30s)Dec 08 03:57
*techrights_guest|12 has quit (Quit: Connection closed)Dec 08 03:57
*liberty_box (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 04:42
*liberty_box_ (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 04:43
*liberty_box_ has quit (Ping timeout: 2m30s)Dec 08 04:51
*liberty_box has quit (Ping timeout: 2m30s)Dec 08 04:51
*liberty_box (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 05:03
*liberty_box_ (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 05:04
*DaemonFC has quit (Quit: Leaving)Dec 08 05:41
*liberty_box_ has quit (Ping timeout: 2m30s)Dec 08 05:42
*liberty_box has quit (Ping timeout: 2m30s)Dec 08 05:42
*GNUmoon2 has quit (Ping timeout: 2m30s)Dec 08 06:07
*u-amarsh04 (~amarsh04@t25x9hgy9xhrc.irc) has joined #techbytesDec 08 06:45
*GNUmoon2 (~GNUmoon@6msztc2mupc3w.irc) has joined #techbytesDec 08 06:53
*liberty_box (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 07:06
*liberty_box_ (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 07:06
*Grass has quit (Connection closed)Dec 08 08:13
*liberty_box_ has quit (Ping timeout: 2m30s)Dec 08 08:40
*liberty_box has quit (Ping timeout: 2m30s)Dec 08 08:40
*liberty_box (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 08:40
*liberty_box_ (~liberty@suig26pxj59pi.irc) has joined #techbytesDec 08 08:41
schestowitz> Thanks for these good responses and article links Roy.Dec 08 09:17
schestowitz> Dec 08 09:17
schestowitz> I too wish we could stop outsourcing "trust" to these obviouslyDec 08 09:17
schestowitz> untrustworthy corporations. As I said, imho the problem lies withDec 08 09:17
schestowitz> browser developers who make "user friendly" (corporate spyware), andDec 08 09:17
schestowitz> web technology whose current level of complexity is completely broken.Dec 08 09:17
schestowitz> Dec 08 09:17
schestowitz> Maybe Gemini will give us back an "informative web".Dec 08 09:17
schestowitzSubject: Re: Certificates on TechRightsDec 08 09:21
schestowitz[sorry for the length of the reply]Dec 08 09:21
schestowitz>> I would be interested to know why Roy uses a self-signed certificate.Dec 08 09:21
schestowitz>> I'm considering writing an article that delves into how much ofDec 08 09:21
schestowitz>> browser security warnings are justified and how much are not.  ItDec 08 09:21
schestowitz>> occurs to me that websites that are HTTP only or that use self-signedDec 08 09:21
schestowitz>> certificates may be the new darkweb.Dec 08 09:21
schestowitz>Dec 08 09:21
schestowitz> The term "darkweb" is a meaningless buzzword that should be avoided.Dec 08 09:22
schestowitz> People who say "darkweb" help the likes of BBC perpetuate ruinous myths,Dec 08 09:22
schestowitz> e.g. about a forum that requires a username/password to access.Dec 08 09:22
schestowitzI would say that those security warnings are mostly about control andDec 08 09:22
schestowitznot about ensuring the integrity or confidentiality of communications.Dec 08 09:22
schestowitzBut first about Tor.  The project used to have a more detailed pageDec 08 09:22
schestowitzexplaining its user base, but the gist remains:Dec 08 09:22
schestowitzhttps://donate.torproject.org/donor-faq/Dec 08 09:22
-TechBytesBot/#techbytes-donate.torproject.org | Tor Project | donor-faqDec 08 09:22
schestowitzTheir site has gotten much less informative and significantly wordierDec 08 09:22
schestowitzrecently.  Here are some of their links to some scripts, as PDF,Dec 08 09:22
schestowitzcarrying text about the topic:Dec 08 09:22
schestowitzhttps://community.torproject.org/user-research/reports/Dec 08 09:22
schestowitz(For what it's worth, Tor is not the only privacy network.  There areDec 08 09:22
-TechBytesBot/#techbytes-community.torproject.org | Tor Project | ReportsDec 08 09:22
schestowitzI2P and Freenet, to name just two more.)Dec 08 09:22
schestowitzOne of the ways that TR itself uses Tor is to read news in countriesDec 08 09:22
schestowitzthat block outside access.  Another use-case is it provides a steadyDec 08 09:22
schestowitzaddress as well as the ability to "NAT punch" for road warriors andDec 08 09:22
schestowitzthose in similar situations.Dec 08 09:22
schestowitzNow about self-signed certificates, I too observe that the major webDec 08 09:22
schestowitzbrowsers¹, and allied institutions and businesses, have oriented theirDec 08 09:22
schestowitzsoftware and activities to discourage, disparage, and/or blockDec 08 09:22
schestowitzself-signed certificates for web sites.  Note the bad "safety" ratingDec 08 09:22
schestowitzthat Netcraft gives such HTTPS sites.Dec 08 09:22
schestowitzHowever, the harm is greater and more insidious than it looks  like atDec 08 09:22
schestowitzfirst glance: the self-signed part does not refer to the certificateDec 08 09:22
schestowitzsigning itself.  The self-signed part refers to the act when anDec 08 09:22
schestowitzinstitution (project, business, school, whatever) signs its own.  ThoseDec 08 09:22
schestowitzdiscouraging self-signing are doing no less than attacking the authorityDec 08 09:22
schestowitzof those institutions to be allowed to testify themselves as to theDec 08 09:22
schestowitzintegrity and confidentiality of their own communications.Dec 08 09:22
schestowitzAt the same time as people are discouraged from trusting certificatesDec 08 09:22
schestowitzthe make themselves and are not from big, brand-named companies, theyDec 08 09:22
schestowitzare encouraged to blindly trust all the certificates which have beenDec 08 09:22
schestowitzpreloaded into their Web browsers.  I am not familiar enough withDec 08 09:22
schestowitzpackaging to say what has come from where but in Ubuntu, for example,Dec 08 09:22
schestowitzthere are hundreds of such certificates:Dec 08 09:22
schestowitz$ ls /etc/ssl/certs/ | wc -lDec 08 09:22
schestowitz257Dec 08 09:22
schestowitzAny of those hundreds³ can MitM the communication to observe or changeDec 08 09:22
schestowitzthe message.  See from the EFF back when it focused on its core mission:Dec 08 09:22
schestowitzhttps://www.eff.org/deeplinks/2010/03/researchers-reveal-likelihood-governments-fake-sslDec 08 09:23
-TechBytesBot/#techbytes-www.eff.org | New Research Suggests That Governments May Fake SSL Certificates | Electronic Frontier FoundationDec 08 09:23
schestowitzIn the case of scripts, such as PDF or Javascript, those changes meansDec 08 09:23
schestowitzunprivileged access to the system, at least initially.  Once local,Dec 08 09:23
schestowitzthere are usually many ways to pivot to privileged access if that is theDec 08 09:23
schestowitzgoal.  A perennial on most systems is RowhammerJS², I presume.  Be thatDec 08 09:23
schestowitzas it may, even unprivileged access allows monitoring of the data goingDec 08 09:23
schestowitzeither direction.Dec 08 09:23
schestowitztldr;  It's about freedom yet again: The self-signed aspect refers toDec 08 09:23
schestowitzthe act when an institution signs the very encryption keys it willDec 08 09:23
schestowitzitself use.Dec 08 09:23
schestowitzxxxxxxxxxxxxxxxxxxxxxxxxxxDec 08 09:23
schestowitz----Dec 08 09:23
schestowitz¹ certificates are used by far more than the web.  Some of these requireDec 08 09:23
schestowitzcertificate, for others it is optional but highly recommended: Tor, SSH,Dec 08 09:23
schestowitzGemini, SMTP, MQTT, MySQL/PostgreSQL, etc.  Either way, signing anDec 08 09:23
schestowitzinstitutions own certificates ensures both the confidentiality andDec 08 09:23
schestowitzintegrity of the communications.Dec 08 09:23
schestowitzSee a small subset of examples, with or without TLS, mostly with:Dec 08 09:23
schestowitzhttps://en.wikipedia.org/wiki/National_identity_cards_in_the_European_Union#Electronic_identity_cardsDec 08 09:23
-TechBytesBot/#techbytes-en.wikipedia.org | National identity cards in the European Economic Area - WikipediaDec 08 09:23
schestowitzhttps://en.wikibooks.org/wiki/OpenSSH/Cookbook/Certificate-based_AuthenticationDec 08 09:23
-TechBytesBot/#techbytes-en.wikibooks.org | OpenSSH/Cookbook/Certificate-based Authentication - Wikibooks, open books for an open worldDec 08 09:23
schestowitzhttps://dev.mysql.com/doc/refman/8.0/en/encrypted-connections.htmlDec 08 09:23
-TechBytesBot/#techbytes-dev.mysql.com | MySQL :: MySQL 8.0 Reference Manual :: 6.3 Using Encrypted ConnectionsDec 08 09:23
schestowitzhttps://core.telegram.org/mtproto/transportsDec 08 09:23
-TechBytesBot/#techbytes-core.telegram.org | TransportsDec 08 09:23
schestowitzhttps://signal.org/blog/certifiably-fine/Dec 08 09:23
-TechBytesBot/#techbytes-signal.org | NO TITLEDec 08 09:23
schestowitzhttps://www.ftptoday.com/blog/explicit-ftps-vs-implicit-ftps-what-you-need-to-know (FTP is deprecated even when mixed with TLS)Dec 08 09:23
-TechBytesBot/#techbytes-www.ftptoday.com | Explicit FTPS vs. Implicit FTPS: What You Need to KnowDec 08 09:23
schestowitzhttp://www.postfix.org/TLS_README.htmlDec 08 09:23
-TechBytesBot/#techbytes-www.postfix.org | Postfix TLS SupportDec 08 09:23
schestowitzhttps://gemini.circumlunar.space/docs/tls-tutorial.gmiDec 08 09:23
-TechBytesBot/#techbytes-gemini.circumlunar.space | TLS, client certificates, TOFU, and all that jazzDec 08 09:23
schestowitzhttps://forums.raspberrypi.com/viewtopic.php?t=287326Dec 08 09:23
-TechBytesBot/#techbytes-forums.raspberrypi.com | Some Notes on setting up MQTT over TLS - Raspberry Pi ForumsDec 08 09:23
schestowitzNote that last one has inaccuracies like most TLS guides do.Dec 08 09:23
schestowitz-----Dec 08 09:23
schestowitz² https://arxiv.org/abs/1507.06955Dec 08 09:23
schestowitz-----Dec 08 09:23
schestowitz³ If I understand the model correctly, that ability extends indefinitelyDec 08 09:23
-TechBytesBot/#techbytes-arxiv.org | [1507.06955] Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScriptDec 08 09:23
schestowitzdown the chain of certificates which can trace their trust back to manyDec 08 09:23
schestowitzof those 257.  Even going with the surface claims of certificate issuer,Dec 08 09:23
schestowitzit looks bad:Dec 08 09:23
schestowitzfor c in /etc/ssl/certs/*;Dec 08 09:23
schestowitzdo openssl x509 -text -noout -in $c;Dec 08 09:23
schestowitzdone | awk '($1=$1) && $1=="Issuer:"' | sort | lessDec 08 09:23
schestowitzanother noteworthy aspect is:  the extra complexity and risk of non-renewal (why expiry so rapid in LE?) encourages outsourcing and centralisation. Complexity like systemd, which might help sell support contracts rather than hire competent engineers in-house.Dec 08 09:25
schestowitz      <li>Dec 08 09:26
schestowitz                  <h5><a href="https://www.techrepublic.com/article/rss-readers-linux-users/">4 RSS readers every Linux user should try</a></h5>Dec 08 09:26
-TechBytesBot/#techbytes- ( status 404 @ https://www.techrepublic.com/article/rss-readers-linux-users/%22%3e4 )Dec 08 09:26
schestowitz                  <blockquote>Dec 08 09:26
schestowitz                    <p>Standards like RSS are maybe the most underrated and underutilized feature of the modern web. RSS feeds are plain text files that every website publishes at a fixed address, with an explicit link or the common RSS icon. Those feeds are continuously rewritten with headlines, excerpts and links to the full versions of all the latest additions to that website. Then, using programs called RSS readers, or aggregators, you can Dec 08 09:26
schestowitzautomatically download and read as many RSS feeds you want, whenever you want, in one window. It's hard to overstate how great this is, because: [...]</p></blockquote></li>Dec 08 09:26
*tech_exorcist (~tech_exorcist@svp6nvmiuarba.irc) has joined #techbytesDec 08 10:04
*tech_exorcist has quit (connection closed)Dec 08 10:24
*u-amarsh04 has quit (Quit: Konversation terminated!)Dec 08 10:56
*tech_exorcist (~tech_exorcist@r7zq4q2ys63yk.irc) has joined #techbytesDec 08 11:01
*u-amarsh04 (~amarsh04@t25x9hgy9xhrc.irc) has joined #techbytesDec 08 11:03
*DaemonFC (~daemonfc@ddstkmbt93p8q.irc) has joined #techbytesDec 08 11:10
*psydroid2 (~psydroid@cqggrmwgu7gji.irc) has joined #techbytesDec 08 11:39
*screenplays (~roybsd@joseon-daa.91g.0nvsnc.IP) has joined #techbytesDec 08 11:53
*DaemonFC has quit (Quit: Leaving)Dec 08 12:01
*GNUmoon2 has quit (Ping timeout: 2m30s)Dec 08 12:44
*GNUmoon2 (~GNUmoon@b4jjzquhwb7y2.irc) has joined #techbytesDec 08 13:00
*tech_exorcist has quit (Quit: bbl)Dec 08 15:10
*tech_exorcist (~tech_exorcist@kmujm4s8xqrtu.irc) has joined #techbytesDec 08 15:17
*DaemonFC (~daemonfc@ddstkmbt93p8q.irc) has joined #techbytesDec 08 17:20
*tech_exorcist has quit (Quit: see you tomorrow)Dec 08 17:31
*tech_exorcist (~tech_exorcist@iwskee978x32q.irc) has joined #techbytesDec 08 17:31
*tech_exorcist has quit (connection closed)Dec 08 17:32
*screenplays has quit (Connection closed)Dec 08 18:39
*tech_exorcist (~tech_exorcist@9z833ybby7ta4.irc) has joined #techbytesDec 08 19:43
*DaemonFC has quit (Ping timeout: 2m30s)Dec 08 19:53
*tech_exorcist has quit (connection closed)Dec 08 20:17
*tech_exorcist (~tech_exorcist@dmw5b4ab5hxvs.irc) has joined #techbytesDec 08 20:17
*GNUmoon2 has quit (Ping timeout: 2m30s)Dec 08 21:05
schestowitzhttps://www.fosslife.org/4-rss-readers-linuxDec 08 21:21
-TechBytesBot/#techbytes-www.fosslife.org | 4 RSS Readers for LinuxDec 08 21:21
schestowitz"Dec 08 21:21
schestowitzRSS readers are a great way to get all the online news you want without distractions or advertising, says Marco Fioretti. Dec 08 21:21
schestowitzHere are four RSS feeders focused on efficiency and privacy that you can use on your Linux-based machine.Dec 08 21:21
schestowitz"Dec 08 21:21
*tech_exorcist has quit (Quit: see you tomorrow)Dec 08 21:35
*Yakut (~evil@joseon-6la.bbr.j4127h.IP) has joined #techbytesDec 08 22:12
*Yakut (~evil@joseon-6la.bbr.j4127h.IP) has left #techbytesDec 08 22:13
*DaemonFC (~daemonfc@fx43r9f9r7aj8.irc) has joined #techbytesDec 08 23:09

Generated by irclog2html.py 2.6 | ䷉ find the plain text version at this address (HTTP) or in Gemini (how to use Gemini).