IRC: #techbytes @ Techrights IRC Network: Sunday, July 04, 2021

-TechBytesBot/#techbytes-@crystalshen6: "As the first load of prisoners arrived at the new military prison camp at Guantanamo, Cuba, on January 11, 2002, h… https://t.co/2NnHArk7v4

-TechBytesBot/#techbytes-@crystalshen6: "As the first load of prisoners arrived at the new military prison camp at Guantanamo, Cuba, on January 11, 2002, h… https://t.co/2NnHArk7v4

schestowitz

""As the first load of prisoners arrived at the new military prison camp at Guantanamo, Cuba, on January 11, 2002, he declared them “unlawful combatants” who “do not have any rights under the Geneva Convention.”"

https://twitter.com/jrbrtson/status/1411457673011269634

schestowitz

-TechBytesBot/#techbytes-@jrbrtson: @schestowitz Who replaces Microsoft Windows? Microsoft has a strong cult following of tinkerers who don't touch the command line.

https://twitter.com/csolisr/status/1411379761658707969

schestowitz

-TechBytesBot/#techbytes-@csolisr: @schestowitz As somebody who programmed his phone to automatically upload all pictures to his NextCloud home server… https://t.co/uzzJUnO7Wk

-TechBytesBot/#techbytes-@csolisr: @schestowitz As somebody who programmed his phone to automatically upload all pictures to his NextCloud home server… https://t.co/uzzJUnO7Wk

schestowitz

"As somebody who programmed his phone to automatically upload all pictures to his NextCloud home server, it's a very viable alternative"

https://twitter.com/Rex_Aletheia/status/1411353712656781319

schestowitz

-TechBytesBot/#techbytes-@Rex_Aletheia: @schestowitz fear campaign doesn't work. Unvaccinated people know what's up and stop listening to the hype. The mor… https://t.co/7jKRRdYF8Y

-TechBytesBot/#techbytes-@Rex_Aletheia: @schestowitz fear campaign doesn't work. Unvaccinated people know what's up and stop listening to the hype. The mor… https://t.co/7jKRRdYF8Y

schestowitz

"fear campaign doesn't work. Unvaccinated people know what's up and stop listening to the hype. The more variants we have the more we know its bullshit."

https://twitter.com/glynmoody/status/1411330192644218885

schestowitz

-TechBytesBot/#techbytes-@glynmoody: what a callous, evil person he is https://t.co/SQkp1EzS2i

-TechBytesBot/#techbytes-@schestowitz: ● NEWS ● #TruthOut ☞ #McConnell Wields a Cruelly Narrow Definition of Infrastructure Like a Bludgeon https://t.co/8GtGHxmElV

https://twitter.com/jvantill/status/1411324040581681152

schestowitz

-TechBytesBot/#techbytes-@jvantill: @schestowitz Just like in NL !

https://twitter.com/ianrobo1/status/1411298110832365568

schestowitz

-TechBytesBot/#techbytes-@ianrobo1: How can this be right other than allows certain companies (yes you Apple) to seek rip off service contracts https://t.co/aY4yPdQXvP

-TechBytesBot/#techbytes-@schestowitz: ● NEWS ● #9to5Mac #Hardware ☞ British right to repair law comes into force today, but excludes smartphones and comp… https://t.co/qL8asnF6h6

schestowitz

"How can this be right other than allows certain companies (yes you Apple) to seek rip off service contracts"

https://twitter.com/xolve/status/1411266292124815361

schestowitz

Jul 04 13:52

-TechBytesBot/#techbytes-@xolve: Should be all governement software all around the world. https://t.co/EjMmJJpVUk

Jul 04 13:52

-TechBytesBot/#techbytes-@schestowitz: ● NEWS ● #Joinup #Licensing ☞ New Estonian law requires administration to make state-owned software publicly availa… https://t.co/PTDfTcfEFo

Jul 04 13:52

*liberty_box has quit (Ping timeout: 2m30s)

Jul 04 14:28

*rianne_ has quit (Ping timeout: 2m30s)

Jul 04 14:28

*rianne_ (~rianne@22e8m8t4gqjin.irc) has joined #techbytes

Jul 04 14:30

*liberty_box (~liberty@22e8m8t4gqjin.irc) has joined #techbytes

Jul 04 14:32

schestowitz

http://ipkitten.blogspot.com/2021/07/when-movie-is-derived-from-literary.html?showComment=1625235399706#c2244879325842589574

-TechBytesBot/#techbytes-ipkitten.blogspot.com | When the movie is derived from a literary classic—are you an “All-In”, or a “Well, Maybe”, viewer? - The IPKat

schestowitz

"As a member of the All-In" class, it was not my cup of "Emma tea". But as a form of movie take-off, I thought it was quite clever."

http://ipkitten.blogspot.com/2021/07/when-movie-is-derived-from-literary.html?showComment=1625233449857#c976518856166256952

schestowitz

-TechBytesBot/#techbytes-ipkitten.blogspot.com | When the movie is derived from a literary classic—are you an “All-In”, or a “Well, Maybe”, viewer? - The IPKat

schestowitz

"Where do Mr. & Mrs. Kat stand on the 1995 film "Clueless", which some pundits have argued is the best Emma adaptation of them all?"

http://ipkitten.blogspot.com/2021/07/russia-adopts-law-that-shakes-cognac.html?showComment=1625387429079#c1125721314044172895

schestowitz

-TechBytesBot/#techbytes-ipkitten.blogspot.com | Russia adopts law that shakes Cognac and Champagne importers - The IPKat

schestowitz

schestowitz

if the West was not so dependent on Russia for its energy, it would certainly be easier to boycott Russian products.

schestowitz

It might be difficult to export those Russian beverages in countries accepting DOP.

schestowitz

*rianne_ has quit (Ping timeout: 2m30s)

Jul 04 15:26

*liberty_box has quit (Ping timeout: 2m30s)

Jul 04 15:26

*liberty_box (~liberty@22e8m8t4gqjin.irc) has joined #techbytes

Jul 04 15:27

*rianne_ (~rianne@22e8m8t4gqjin.irc) has joined #techbytes

Jul 04 15:27

*rianne_ has quit (Ping timeout: 2m30s)

Jul 04 16:35

*liberty_box has quit (Ping timeout: 2m30s)

Jul 04 16:35

*rianne_ (~rianne@22e8m8t4gqjin.irc) has joined #techbytes

Jul 04 16:40

*liberty_box (~liberty@22e8m8t4gqjin.irc) has joined #techbytes

Jul 04 16:41

*DaemonFC (~daemonfc@c3u36vcnrkska.irc) has joined #techbytes

Jul 04 19:33

schestowitz

> Hi Roy,

schestowitz

schestowitz

> I know it's been quite a while since you published the piece on the

schestowitz

> vulnerability I disclosed in 2019

> (http://techrights.org/2019/12/07/fake-linux-news-and-clickbait/), I

schestowitz

-TechBytesBot/#techbytes-techrights.org | From Moderate Advice to FUD and Misinformation: The Case of a VPN Vulnerability (CVE-2019-14899) | Techrights

schestowitz

> just wanted to follow up with you since I enjoy the site and our

schestowitz

> development has continued since then.

schestowitz

schestowitz

> I appreciate that you acknowledged our disclosure was "calm and

schestowitz

> rational" - many other bloggers and podcasters called us "alarmists" and

schestowitz

> "so-called researchers" (Steve Gibson), likely because they reported on

schestowitz

> the reporting of our disclosure and didn't bother to read it. The

schestowitz

> discovery of the vulnerability was in no way an attack on Linux and

schestowitz

> Unix, quite the opposite. The reasons we didn't examine was 1. because

schestowitz

> we didn't care about Windows enough to bother with it at the time, and

schestowitz

> 2. it isn't open source. Nevertheless, it seems that our report was used

schestowitz

> as ammunition against Linux by a great number of tech boomers on the

schestowitz

> internet.

schestowitz

schestowitz

> Since our disclosure, we have created a way to exploit the vulnerability

schestowitz

> server-side, i.e. from any router in-path between the user and the VPN

schestowitz

> server. This attack, we can confirm, does affect Windows, as well as

schestowitz

> Android, Apple, and every Linux and BSD we tested.

schestowitz

schestowitz

> We produced a paper on this vulnerability, which will appear in Usenix

schestowitz

> '21, and included an artifact with demos, PCAPs, and a virtual

schestowitz

> environment to test the attack, if you are interested:

schestowitz

> https://breakpointingbad.com/papers/Blind-in-path-attacks-VPN-USENIX21.pdf

schestowitz

schestowitz

> https://git.breakpointingbad.com/Breakpointing-Bad-Public/vpn-attacks

schestowitz

-TechBytesBot/#techbytes-git.breakpointingbad.com | Breakpointing-Bad-Public/vpn-attacks - vpn-attacks - Gitea: Git with a cup of tea

schestowitz

schestowitz

> I think in your initial analysis, you may have been too quick to shrug

schestowitz

> this off as a small issue and hope that I can convince you otherwise.

schestowitz

schestowitz

> The main point is that while this was an easy fix for Linux and BSD

schestowitz

> users, this was not a fix that Android or Apple users could make to

schestowitz

> their devices, leaving them to wait until a patch was released. This

schestowitz

> took Apple until July 2020 to patch

schestowitz

> (https://support.apple.com/en-us/HT211288), while it was reported in

-TechBytesBot/#techbytes-support.apple.com | About the security content of iOS 13.6 and iPadOS 13.6 - Apple Support

schestowitz

> November 2018. Android was reported on the same day, and issued a patch

schestowitz

> earlier, yet after testing last night, it appears they haven't fixed it.

schestowitz

> I haven't tested iOS again, but I'm not optimistic.

schestowitz

schestowitz

> To the severity of the attack, there are a few things to consider. For

schestowitz

> your average person in the West using a VPN to hide their torrenting and

schestowitz

> pornography habits, the risks are minimal, but for the vulnerable

schestowitz

> populations we are concerned about for our research and outreach

schestowitz

> projects, it can be devastating. Testing to see if a user has an active

schestowitz

> connection to an entire list of banned websites takes seconds and can be

schestowitz

> performed in parellel, and in some nations with especially egregious

schestowitz

> surveillance and censorship information controls, this alone is a crime.

schestowitz

schestowitz

> The initial attack required the attack to control a malicious access

schestowitz

> point, such as a coffee shop or perhaps an ISP with control of your

schestowitz

> modem/router. The server-side attack attack covers any hop after this.

schestowitz

> The key difference in the new attack is that the packets are

schestowitz

> indistinguishable from legitimate traffic, so there is no apparent

schestowitz

> mitigation.

schestowitz

schestowitz

> Thanks again for acknowledging the FUD created by all those bullshit

schestowitz

> websites. This was my first disclosure and really did not anticipate the

schestowitz

> response we got to what people thought we said. What a mess.

schestowitz

schestowitz

> Take care,

schestowitz

schestowitz

> Wm.

schestowitz

Thanks, I shall take a look.