●● IRC: #techbytes @ Techrights IRC Network: Tuesday, May 24, 2022 ●● ● May 24 [00:01] *psydroid2 has quit (Ping timeout: 2m30s) ● May 24 [03:32] *MinceR has quit (Ping timeout: 2m30s) [03:33] *MinceR (~mincer@bringer.of.light) has joined #techbytes [03:33] *irc.techrights.org sets mode +a #techbytes MinceR [03:46] schestowitz >>>> i believe the answer is in the question. debian is based on distributed trust. i did the analysis (took 3 weeks): it is literally the only distro in the world with an inviolate chain of trust from a large keyring dating back 20 years that is itself GPG-signed as a package, with a package distribution chain from source where all components within the chain up to release are unbroken and inviolate. [03:46] schestowitz >>> This is not an answer to the question though, OP was asking how we prevent abuse of that trust. [03:46] schestowitz >> reputation, and potentially criminal and civil proceedings. [03:46] schestowitz >> [03:46] schestowitz >> all identities are known, and inviolate-known [through the [03:46] schestowitz >> above-described chain]. [03:46] schestowitz >> anyone stupid enough to abuse their position may only do so once, at which [03:46] schestowitz >> point their GPG key is revoked. [03:46] schestowitz >> [03:47] schestowitz >> given that GPG key-signing parties require people's real-world identities [03:47] schestowitz >> to be known, it is easy to track down who signed whose key (it's right [03:47] schestowitz >> there in the keyring-archive], and request that the signer provide assistance [03:47] schestowitz >> to the relevant authorities in proving that real-world identity. [03:47] schestowitz >> [03:47] schestowitz >> this will sufficiently piss off those people that trusted them that they will [03:47] schestowitz >> be unlikely to work with them ever again [reputation] [03:47] schestowitz >> [03:47] schestowitz >> in addition there is the Debian Trademark which if brought into disrepute [03:47] schestowitz >> through abuse could be utilised to seek damages against the perpetrator. [03:47] schestowitz >> [03:47] schestowitz >> bottom line is that it would be a spectacularly stupid thing to do to violate [03:47] schestowitz >> the trust and responsibility of being a Debian Maintainer, and the really [03:47] schestowitz >> interesting bit to me is that this all works in an entirely distributed manner [03:47] schestowitz >> and can all entirely be done entirely without a single centralised authority, [03:47] schestowitz >> i.e. *not* having to trust f*****g google or f*****g github with anyone's [03:47] *psydruid has quit (Ping timeout: 2m30s) [03:47] schestowitz >> real-world identity in any way shape or form. [03:47] schestowitz >> [03:47] schestowitz >> l. [03:47] schestowitz >> [03:47] schestowitz > Luke Kenneth Casson Leighton's explanations have two fundamental flaws [03:47] schestowitz > and one clue of wrongdoing [03:47] schestowitz > [03:47] schestowitz > The clue of wrongdoing is the manner in which he replied to my email and [03:47] schestowitz > completely cut all my own comments out of his response. This means he [03:47] schestowitz > either meant to insult me or obscure something. [03:47] *MinceR has quit (Ping timeout: 2m30s) [03:47] schestowitz > [03:47] schestowitz > Everything he wrote is generally good except for the two flaws: [03:47] schestowitz > [03:47] schestowitz > On the question of PGP IDs, people often use passports to verify ID and [03:47] schestowitz > this turns out to be quite bad. Look at the Mossad passport forgery [03:47] schestowitz > scandals, forging the passports of citizens from countries that are [03:47] schestowitz > typically sympathetic to Israel. Then there was the FOSDEM 2016 fake [03:47] schestowitz > passport scandal. Mark Kennedy had no trouble using fake identities. [03:47] schestowitz > [03:47] schestowitz > The other flaw in LKCL's reasoning is the question of plausible [03:47] schestowitz > deniability. If an intelligence agency wants to put some back door in [03:47] schestowitz > the software they will find an obscure way to weaken the software. They [03:47] schestowitz > already got burnt by the Windows NSA key string and they won't be so [03:47] schestowitz > obvious in future. The people who do this stuff are not necessarily [03:48] schestowitz > going to lose their reputation with one bad commit and they may not be [03:48] schestowitz > detected for a long time anyway. ● May 24 [04:00] *techrights_guest|83 (~519aa9f9@54n9xgft8g6u2.irc) has joined #techbytes [04:05] *MinceR (~mincer@bringer.of.light) has joined #techbytes [04:05] *irc.techrights.org sets mode +a #techbytes MinceR [04:06] *techrights_guest|83 has quit (Quit: Connection closed) ● May 24 [06:46] *psydruid (~psydruid@jevhxkzmtrbww.irc) has joined #techbytes ● May 24 [07:42] *psydruid (~psydruid@jevhxkzmtrbww.irc) has left #techbytes [07:42] *psydruid (~psydruid@jevhxkzmtrbww.irc) has joined #techbytes [07:54] schestowitz
  • [07:54] schestowitz
    How To Turn Ubuntu 22.04 Into Kubuntu
    [07:54] -TechBytesBot/#techbytes-www.ubuntubuzz.com | How To Turn Ubuntu 22.04 into Kubuntu [07:54] schestowitz
    [07:54] schestowitz

    This tutorial will explain how you can turn Ubuntu 22.04 with GNOME Desktop into Kubuntu with KDE Plasma Desktop. This will not remove the original GNOME, but we simply install Plasma Desktop on top of the system so we will have two different desktop environments as the result. Follow it carefully and have a friendly computing with Kubuntu!

    [07:54] schestowitz
    [07:54] schestowitz
    • ● May 24 [08:04] schestowitz
  • [08:04] schestowitz
    Hijacking webcams with Screencastify
    [08:04] -TechBytesBot/#techbytes-palant.info | Hijacking webcams with Screencastify | Almost Secure [08:04] schestowitz
    [08:04] schestowitz

    Everyone has received the mails trying to extort money by claiming to have hacked a persons webcam and recorded a video of them watching porn. These are a bluff of course, but the popular Screencastify browser extension actually provides all the infrastructure necessary for someone to pull this off. A website that a user visited could trick the extension into starting a webcam recording among [08:04] schestowitz other things, without any indications other than the webcams LED lighting up if present. The website could then steal the video from the users Google Drive account that it was uploaded to, along with anything else that account might hold.

    [08:04] schestowitz
    [08:04] schestowitz
    • [08:12] schestowitz
  • [08:12] schestowitz
    Install ROS 2 Humble in Ubuntu 20.04 or 18.04 using LXD containers
    [08:12] -TechBytesBot/#techbytes-Install ROS 2 Humble in Ubuntu 20.04 or 18.04 using LXD containers | Ubuntu [08:12] schestowitz
    [08:12] schestowitz

    We welcome the new release of ROS 2 Humble which targets the recently released Ubuntu 22.04. If you want to install it now, please visit the ROS 2 Humble documentation.

    [08:12] schestowitz

    But if you want to install ROS 2 Humble and test compatibility, keeping your current Ubuntu (20.04, 18.04,) environment stable until you know you are ready to upgrade, you can dive into LXD containers.

    [08:12] schestowitz
    [08:12] schestowitz
    • [08:12] schestowitz
  • [08:12] schestowitz
    Canonical at HPE Discover 2022
    [08:12] -TechBytesBot/#techbytes-Canonical at HPE Discover 2022 | Ubuntu [08:12] schestowitz
    [08:12] schestowitz

    HPE and Canonical have a long-standing relationship, certifying Ubuntu on HPE hardware. Now, you can go beyond the operating system and engage with us on hybrid cloud, AI/ML, and open source support projects.

    [08:12] schestowitz

    Now were excited to share that well be at the HPE Discover 2022 in Las Vegas on June 28-30 showcasing our solution in the expo.

    [08:12] schestowitz

    Join Canonical and Ubuntu at HPE Discover in Las Vegas.

    [08:12] schestowitz

    Meet with one of our experts and get a demo of our opens source solutions.

    [08:12] schestowitz
    [08:12] schestowitz
    • [08:18] schestowitz
  • [08:18] schestowitz
    Multi sensor device packed with Raspberry Pi RP2040 chip
    [08:18] -TechBytesBot/#techbytes- ( status 520 @ https://linuxgizmos.com/multi-sensor-device-packed-with-raspberry-pi-rp2040-chip/ ) [08:18] schestowitz
    [08:18] schestowitz

    Sfera Labs released the Exo Sense RP which is a compact module that combines sensors to monitor air quality, humidity, temperature, light, motion and audio sensing. Unlike the SENSE board by Nexus Electronics and presented by LinuxGizmos a few days ago, the Exo Sense RP integrates a Raspberry Pi RP2040 IC.

    [08:18] schestowitz

    Featuring a dual core ARM Cortex-M0+ processor (up to 133MHz), with 16MB of Flash and 264kB of RAM, the MCU offers more than enough speed and supports several data protocols to interface with various types of sensors efficiently.

    [08:18] schestowitz
    [08:18] schestowitz
    • [08:42] *psydruid (~psydruid@jevhxkzmtrbww.irc) has left #techbytes [08:42] *psydruid (~psydruid@jevhxkzmtrbww.irc) has joined #techbytes ● May 24 [12:04] *psydruid (~psydruid@jevhxkzmtrbww.irc) has left #techbytes [12:05] *psydruid (~psydruid@jevhxkzmtrbww.irc) has joined #techbytes [12:28] *GNUmoon2 has quit (connection closed) [12:57] *GNUmoon2 (~GNUmoon@txkdaiuveepza.irc) has joined #techbytes ● May 24 [13:16] *GNUmoon2 has quit (connection closed) [13:23] *GNUmoon2 (~GNUmoon@vmfsukqv656ba.irc) has joined #techbytes [13:48] *Despatche has quit (Quit: Read error: Connection reset by deer) [13:57] schestowitz [02:52] Hey, you should consider looking into the Stripe mafia bolt thing [13:57] schestowitz [02:52] All comes back to Nat Friedman and the bs I experienced with y combi [13:57] schestowitz [02:53] Alex did yc too [13:57] schestowitz [04:03] I have Nat Friedmans high school https://en.wikipedia.org/wiki/St._Anne%27s-Belfield_School [13:57] -TechBytesBot/#techbytes-en.wikipedia.org | St. Anne's-Belfield School - Wikipedia [13:57] schestowitz [04:03] Boarding school outside of DC [13:57] schestowitz [04:04] I'm not entirely convinced that his father was always a stockbroker [13:57] schestowitz [04:04] Although I have noticed there is a pattern of switching back-and-forth between the intelligence community and finance ● May 24 [16:51] *psydruid (~psydruid@jevhxkzmtrbww.irc) has left #techbytes [16:55] *u-amarsh04 has quit (Quit: Konversation terminated!) ● May 24 [17:01] *u-amarsh04 (~amarsh04@v6xmmrhxmbafc.irc) has joined #techbytes [17:23] *psydruid (~psydruid@jevhxkzmtrbww.irc) has joined #techbytes [17:39] *psydruid (~psydruid@jevhxkzmtrbww.irc) has left #techbytes ● May 24 [18:12] *psydroid2 (~psydroid@memzbmehf99re.irc) has joined #techbytes [18:17] *psydruid (~psydruid@jevhxkzmtrbww.irc) has joined #techbytes ● May 24 [20:31] *Despatche (~desp@u3xy9z2ifjzci.irc) has joined #techbytes ● May 24 [21:53] *psydroid2 has quit (Ping timeout: 2m30s) ● May 24 [22:12] *psydruid (~psydruid@jevhxkzmtrbww.irc) has left #techbytes [22:12] *psydruid (~psydruid@jevhxkzmtrbww.irc) has joined #techbytes ● May 24 [23:30] *Despatche has quit (Quit: Read error: Connection reset by deer) [23:33] *psydruid (~psydruid@jevhxkzmtrbww.irc) has left #techbytes