The DMZ

There are a number of people who did post their private keys on SE though, but in most cases it was intentional (i.e. "example" private keys that they made only for this purpose).

Journeyman Geek

Oh that's fine

If it was a real private key - the 'smart' thing would be to temporary delete, resolve the issue (and a smart OP would generate a new one!) then undelete

or any PII really

forest

There was someone who posted a private PGP key accidentally and allegedly I modified it to be acceptable by keyserves and uploaded it for the lulz. :^)

Journeyman Geek

(since redaction needs 2 mods and is slightly tricky)

lol

Or a standard fake key, used akin to RFC 5737 IPs or RFC 6761 Domains

(no I don't memorise these. I know they exist :D )

forest

The fun thing is when people accidentally post a Tor hidden service private key.

Although I've never seen anyone do it on Stack Exchange.

But it allows you to totally take over the domain.

Journeyman Geek

2:40 AM

And that's a situation when you'd want to flag and make it super clear this is very bad.

I mean that or point the domain at the rickroll

@forest pre tags on that key make it one loooooooong line

so that's a no, we're not doing that :D

forest

@JourneymanGeek Not before using the key, of course!

brb

Journeyman Geek

> I mean that or point the domain at the rickroll

:D

Anonymous

7:36 AM

Hey :)

forest

hey

Anonymous

I am super tired but I have so much to do.

forest

Sleep, and dream about what you have to do. :P

Anonymous

Going to drown myself in caffeine. Saw an article this morning, not that I am surprised by this but Amazon had a sales income of 44 billion in Europe in 2020 and they paid precisely 0% corporation tax on it.

Anonymous

And then you have these clowns that tell me: "you should pay 40% tax its good for everyone!"

Anonymous

7:41 AM

It's not good for me...

forest

yup

I refuse to willingly pay taxes until the megacorporations pay their share.

Anonymous

You know what's so hilarious?

forest

That's why I preferentially accept money through cryptocurrencies.

Anonymous

An Amazon spokesperson said this: "We’ve invested well over €78bn in Europe since 2010, and much of that investment is in infrastructure that creates many thousands of new jobs, generates significant local tax revenue, and supports small European firms."

forest

The whole Amazon claim that they "support small businesses" is complete, utter bullshit.

Anonymous

7:43 AM

That translates to: "we've invested 78 billion, so we don't think we need to pay more" except they fail to mention that they only invested that 78 billion so they could make hundreds of billions more.

Anonymous

Acting as if they did it for the good of Europe, lmfao.

forest

mhm

Amazon is... a truly repulsive company.

Even Google is, in many ways, better.

Anonymous

Yes, I agree.

Anonymous

I very much disagree with the idea of a world government, but the idea of a world corporation tax.. I can get behind that.

forest

World government is one of those things that only works if governments work.

Anonymous

7:44 AM

It's a utopian ideal though, it will never happen, even if it did it wouldn't work how we'd like it to work.

forest

Not until we live in a post-scarcity society akin to that of Star Trek.

Anonymous

Heh.

Anonymous

Isn't your current president a world tax promoter?

Anonymous

Ours isn't... He gives contracts to his friends and then they fuck them up.

Anonymous

Like how we spent 200 million on an excel spreadsheet...

Anonymous

7:49 AM

Yes, really...

forest

He's not my president.

He's just some asshole saying he's in charge.

Anonymous

Yes, my apologies :D

Anonymous

Oh, forest.

Anonymous

I meant to ask you: what do you think of Mullvad? (Not for opsec just in general)

forest

VPNs in general are not ideal if you want anonymity.

Mullvad doesn't seem to be really scammy, though. Good if you want to torrent.

Anonymous

7:54 AM

@forest Yeah, I'm aware.

forest

But it's not trash like PIA or HMA.

Anonymous

I hear a lot of things about Mullvad, they seem actually like a decent company.

forest

I think they've grown in the past 5-10 years.

It used to be that they had like... 2 different servers.

I used it once to shitpost on 4chan back when none of their IPs were banned.

But then I got them all banned and had to buy a VPS.

Anonymous

Hahahahah :D

Anonymous

Hmm, someone just sent me this: getsession.org

forest

7:58 AM

Some E2E messager?

Anonymous

Seems like Signal but without needing a mobile number... Interesting.

Anonymous

Yeah, it's a fork of Signal.

forest

Eh, I wouldn't trust it. I'd be careful.

Anonymous

Oh I'm not going to use it.

forest

Use OTR or whatever if you want numberless E2E.

Anonymous

7:58 AM

I'm just interested.

forest

There was something like that before that was bad. Cryptocat or something.

Anonymous

I do wonder why Signal themselves will not allow sign up without a phone number.

Anonymous

I think the whole phone number association thing is absolutely retarded.

Anonymous

"we can't read your data! but we can give your phone number to LE"

forest

No idea. Maybe they want to ensure that people don't mistake them as an anonymous service?

Anonymous

8:00 AM

That seems plausible, yeah.

Anonymous

I wouldn't use Signal for that, though.

Anonymous

I just use it in the same way a "normal" person uses WhatsApp. There's better ways to communicate for other purposes than Signal.

forest

I don't own a phone anyway so I've never needed to use it.

I dislike the idea of having a portable GPS tracker that I pay for.

Anonymous

I'd love to get rid of mine...

Anonymous

Hah, yes. Me as well.

Anonymous

8:02 AM

I don't like it at all.

forest

Throw it away. Buy a dumb phone.

Anonymous

Well, I just bought that Pixel to run Graphene.

Anonymous

It's not perfect but, it's an okay solution for now.

forest

GrapheneOS is probably more secure than most desktop OSes, ironically.

Anonymous

Yeah, from what I can see it really doesn't have many competitors either...

Anonymous

8:05 AM

There's Lineage but that looked like it had way less security features.

forest

Lineage is kinda trash.

@J-- Because it's being developed for the sake of security, not profit.

I know the guy who made it. He's a good guy.

Anonymous

Yeah, it didn't seem that great at all. (Lineage)

Anonymous

@forest That's exactly what I want :D

forest

The most important part of the OS though I believe is the hardened malloc.

(Well, and the hardened bionic in general, but that's not as applicable outside of Android)

Anonymous

Oh yeah, I meant to read that link, I'll read that today.

Anonymous

8:08 AM

The hardened malloc section.

forest

Since you're doing vuln research, I think you'll like it.

Best part is you can compile it for any *nix and put it in /etc/ld.so.preload!

Anonymous

Yeah I'll like it for sure :D

Anonymous

I have two more ROP challenges to complete.

Anonymous

And I can absolutely see why people use ROP compilers :d

forest

:P

Anonymous

8:24 AM

I should really start my day.

Anonymous

But I really don't want to start my day.

forest

And I need to end my day.

In a few days I'm going to have to get up really early for work and I don't like that. :(

Anonymous

Heh.

Anonymous

Yeah, it must be super late for you...

Anonymous

It's nearly 10am here.

forest

8:39 AM

:D

@J-- lwn.net/Articles/853798/#Comments

> Cellebrite makes software to automate physically extracting and indexing data from mobile devices. They exist within the grey – where enterprise branding joins together with the larcenous to be called “digital intelligence.” Their customer list has included authoritarian regimes in Belarus, Russia, Venezuela, and China; death squads in Bangladesh; military juntas in Myanmar; and those seeking to abuse and oppress in Turkey, UAE, and elsewhere. [...]

Given the number of opportunities present, we found that it’s possible to execute arbitrary code on a Cellebrite machine simply by includin…

Anonymous

Ugh, Cellebrite.

Anonymous

One of the most morally bankrupt companies on planet Earth.

forest

Oh there are worse ones out there.

Cellebrite is fairly low-level, used by the dumbest of the dumb (cops and the like).

Anonymous

Oh, this is from a while ago, a few weeks, I think.

Anonymous

I saw this before. Cellebrite poked the bear.

Anonymous

8:44 AM

They got what they deserved, frankly.

forest

Yeah it's not new, but it's hilarious.

Anonymous

Yeah, it is :D

forest

But I love "Files will only be returned for accounts that have been active installs for some time already, and only probabilistically in low percentages based on phone number sharding." :D

Anonymous

The police use Cellebrite here quite a lot, they really like it.

forest

They've gotta be shitting their pants.

Well it just shows people... don't use a fucking cell phone.

I mean yeah, you can do JTAG attacks against desktops, but still...

Anonymous

8:45 AM

:)

Anonymous

I'll never hold a different view for anyone who works at a company like this.

Anonymous

Hahahahahahahhahaah.

Anonymous

+1

forest

:P

Anonymous

I will genuinely never hold an ounce of sympathy for anyone who works at place like this.

Anonymous

8:46 AM

If you're an accountant you're just as complicit as an engineer.

forest

But in all seriousness, there are worse companies. Cellebrite is a baby.

Anonymous

Oh for sure!

forest

Raytheon and their ilk are much more dangerous.

Anonymous

:)

Anonymous

Oh yeah, Raytheon... I'm aware of them.

forest

8:48 AM

The thing is, most people who work for those companies are easy pray for getting pwnt and having something not-so-legal placed on their computer. Now, most of them are bright guys, but not flawless. Not saying I've done this, but... vae victis

Anonymous

They are absolutely vile.

Anonymous

@forest Heh :D

Anonymous

I just don't understand how someone can go to work knowing they are contributing to the murder of journalists and innocent people just for $50,000 a year.

Anonymous

I mean, what is wrong with you?

forest

Eh, they make more than that.

Or at least, people who sell to them.

Anonymous

8:49 AM

I mean, the tech people do, yes.

Anonymous

But imagine you're just a clerk.

forest

ah

Anonymous

You're making $50,000 a year to be complicit in murder.

forest

mhm

Anonymous

I mean, the tech people, I understand it a bit more.

Anonymous

8:49 AM

They make a damn lot for sure.

forest

I'd rather sell 0days and security services to pedophiles than these fuckers.

Anonymous

But it's still fucking morally bankrupt.

Anonymous

It makes me sick, honestly.

forest

Thing is, if you have the knowledge required to work at a place like that, you can get work nearly anywhere.

Anonymous

Yes, exactly.

Anonymous

8:50 AM

This what makes my piss boil so much.

Anonymous

They could work anywhere, go work at Google, ffs. Even that is more ethical than this shit.

Anonymous

But for some unknown fucking reason they choose to work at a place that sparks genocides. Imprisons innocent people. Risks the lives of millions to catch the few.

Anonymous

I don't get it. I'll never get it.

forest

On the upside, it's certainly possible to defend from an adversary with those kinds of resources.

But it requires very solid opsec and a very strong understanding of privilege boundaries.

Anonymous

Do you know what frustrates me the most?

Anonymous

8:53 AM

It's the security people that work at those companies.

Anonymous

Let's forget the developers a moment, they are often not that bright when it comes to security. But actual security engineers that work there, they should know better.

forest

You'll get to know a lot of them if you start working in exploit dev. :/

Anonymous

There has been a war on privacy for the last 15 years, for you to work in security and not defend that right is absolutely fucking vile.

Anonymous

It's like these people who work in infosec that promote crypto backdoors. If you do that, I genuinely hope you lose everything in your life of value.

Anonymous

@forest Heh, yes, unfortunately so.

Anonymous

8:55 AM

The thing is, I will absolutely make sure I choose to work at a place that I believe is as moral as it can be.

forest

You don't even need to do that. Just don't go with the least moral.

Keep the hacker spirit.

Anonymous

As much as I hate tech companies, I would have no problems working there because even though they do unethical shit, at least I know my exploits aren't being used for starting wars.

forest

Well... Look at Facebook :/

Anonymous

But, you know, it just takes research.

forest

vice.com/en/article/v7gd9b/…

Selling exploits to the feds.

Anonymous

8:57 AM

Oh, I'd never work at Facebook though.

Anonymous

I am already very aware of how morally bankrupt they are.

Anonymous

Ew.

Anonymous

Look at the title of this article.

forest

Yeah it's dumb, but it ends on a good note (critical of FB).

Anonymous

That's gross. The way they have written it makes it hard to disagree... I don't like that.

Anonymous

8:59 AM

Disgusting.

Anonymous

Facebook has long been off my list for a place I'd work, anyways.

Anonymous

Never liked it, never will.

forest

Thing is, trying to hack pedophiles is a very dangerous game. Most of them are dumb, but every once in a while you have one that can take that 0day you handed to them.

An exploit that can hack a pervert's Firefox can just as easily hack a child's.

So people should be careful giving pedophiles the very tools they need to create a botnet of kids.

> debug1: rekey after 420696969 blocks

hehehe

Anonymous

Yeah, the thing is, the cause here is good, I am not going to suggest it wasn't. The problem is that the cause does not outweigh the risk involved in creating a 0day like this.

Anonymous

First things first being, they will use it again.

forest

9:02 AM

Well, in this particular case they selected a 1day.

One which Tails was going to fix in an upcoming update (or rather, a component of Tails).

Anonymous

Even still...

forest

Right. It's still dangerous.

Anonymous

Yeah, it is.

Anonymous

I am not going to defend pedophilia (obviously) but I am absolutely going to defend arming LE when they routinely break boundaries and get away with it.

Anonymous

It's a sad fact that the child in this situation is of less value than what LE are going to use that exploit for in the future.

forest

9:03 AM

mhm

Anonymous

Privacy and security and freedom come above everything.

forest

Privacy and security and freedom protect people in the long-term.

Anonymous

Yeah.

forest

That's why I'm so happy that there exist tools like Tor and LUKS.

Anonymous

As much as I would love to value the life of that child here, the consequence of that is the situation which ensued, which is that LE got armed with a nasty exploit.

Anonymous

9:05 AM

In a perfect world, the child would be safe and they wouldn't need to make an exploit that they can use later.

Anonymous

But the world isn't perfect.

forest

Maybe if people actually taught children PROPER FUCKING DATA HYGIENE.

Journeyman Geek

@J-- tbh - most computer forensics folks are uh...

halfway technical

so a lot of the things we get taught are pretty much 'tool use' and 'legally hard to discard' evidence collection

forest

Very true.

Journeyman Geek

If you think about these, all these are basically DD with a write blocker, chain of custody and hashes

Nothing that interesting

forest

9:09 AM

@JourneymanGeek Well, Cellebrite actually uses exploits against mobile devices.

The write blocker comes after.

It's a plug-n-play mobile exploitation toolkit with forensics acquisition technology.

Anonymous

^

Journeyman Geek

@forest the end user isn't going to write or understand most of it

forest

@JourneymanGeek Right. Hence it being plug-n-play.

Journeyman Geek

@forest and phones are 'messy' compared to PCs for that since you can't really do offline data acquisition

(and till recentish, the first thing you did was pull the plug)

forest

Well the idea is to use this toolkit to bypass screen locks.

Yeah nowadays, you never pull the plug.

(Sounds like you have some forensics experience :P)

Journeyman Geek

9:11 AM

@forest experience, no

Its what I have a degree in

forest

heh

Journeyman Geek

so I can fairly competently talk out of my ass about it

forest

That's funny, since I do anti-forensics.

Maybe that's why we often clash. :P

Journeyman Geek

heh

Anonymous

:D

Journeyman Geek

9:15 AM

Its either the whole "fundamental personality disgreement" or I'm in "authority" and you're anti authority I suspect :D

forest

haha probably

Anonymous

Yeah.

Anonymous

Well, I don't think all of us are anti authority.

Anonymous

Most of us, for sure.

Anonymous

As I said before, I'm so anti authority I don't even agree with the idea of a sleep schedule :D

Journeyman Geek

9:18 AM

:D

forest

@J-- patched nanosleep() out of all his kernels.

Anonymous

I feel really strange today.

Anonymous

@forest hahahaha :D

Anonymous

Now I just need to patch emotions() out of my kernels.

Anonymous

Or whatever the computer equivalent of emotions is.

Anonymous

9:20 AM

I'm on my way to becoming a total infosec robot.

forest

Maybe personality()

That's a real syscall too.

Anonymous

Hahahahaha :D Yes, that works.

Anonymous

To be fair, I don't have much of a personality anyways. My personality is I hate authority and hate people, it's pretty one dimensional.

Anonymous

Hate being the common theme...

Anonymous

Its more the fact that I am extremely negative.

Anonymous

9:22 AM

I am negative about almost everything.

Anonymous

And, I like it. I often am not disappointed.

Anonymous

Jesus, I am downloading this ISO and its downloading at 140kb/s

Anonymous

im gonna cry.

nobody

@J-- eh, I've downloaded one at 10 kbps. Well actually didn't manage to download it. Had to wait a day for the internet to get better and then download again

Anonymous

oof.

Anonymous

9:30 AM

would anyone be interested in seeding a torrent for me

Anonymous

so i can download it sometime within this decade...

Journeyman Geek

@J-- how big?

Anonymous

5gb.

Journeyman Geek

@J-- I can

link?

assuming its legal

Anonymous

Thank you.

Anonymous

9:32 AM

archive.org/download/…

Anonymous

ill buy a license, yes, yes.

Anonymous

:D

Anonymous

archive.org is really slow.

Anonymous

i guess they dont want peoiple to download over the site

Anonymous

makes sense.

Journeyman Geek

9:33 AM

lol

I have a bunch of disks in case

funny story that...

I recently bought a chinese nuc-clone with a ryzen

Their stock installs are dodgy (it had a wierdly long KMS licence) so I decided to do a reinstall off an 'official' windows 10 media

(for some benchmarks)

it validated.

like "legit" digital entitlement

@J-- torrent hasn't started ._.

Anonymous

Really?

Anonymous

Damn.

Anonymous

That's annoying...

Journeyman Geek

there's one peer

Anonymous

Ah yes, I see that.

Anonymous

9:35 AM

drat...

Anonymous

i guess ill find it elsewhere

forest

Giving each other your IPs huh?

Journeyman Geek

@J-- uhh

gimme a sec

I knew this site that was a front end to the offiical windows site and let you download the ISOs

it was slightly dodgy but...

tb.rg-adguard.net/public.php

caveat emptor, it looks dodgy as hell so double check the hash if you don't trust it

Anonymous

This seems fine.

Anonymous

Really dodgy looking but whatever

Journeyman Geek

9:41 AM

Punchline is...

6

Q: Is downloading Windows ISOs from TechBench downloaders safe?

How safe are TechBench downloaders? Is it safe to download an iso from TechBench downloading service for example: https://tb.rg-adguard.net/public.php I have no idea how it works but it supposedly downloads the ISO directly from Microsoft servers. Chrome says the download for Windows 7 Ultimate i...

that's where I found out about it :D

Anonymous

Oh nice, thanks :D

Anonymous

This is much faster.

Journeyman Geek

I've never gotten MS's insistance on the MCT and only having the latest versions available, and hiding older versions

Anonymous

Yeah, it's weird...

Journeyman Geek

On specific configs you're stuck on older versions

and there's situations where the ISO is useful

Anonymous

9:46 AM

Yeah, 100%. Lots of situations...

Journeyman Geek

I do my fresh installs off a IODD disk enclosure that'll load ISOs and VHDs directly

Anonymous

I currently have 7 deskmats waiting to be manufactured and arrive.

Anonymous

Good God...

Anonymous

I have a problem.

Journeyman Geek

so I need ISOs

or a bigger desk

Anonymous

9:47 AM

@JourneymanGeek oh thats a great idea.

Anonymous

i should do something like that...

Journeyman Geek

I have a 2541 - I recommend that or the mini

I bought the enclosure and dropped my own drive in but YMMV

but I also do a lot of reinstalls and support stuff so....

Anonymous

I'd really like to build a server for VMs and stuff. Once I move, I'll probably buy one and spin up eSXI so I can do that.

Journeyman Geek

ah

Anonymous

It would be really useful to stop hosting VMs on my desktop.

Journeyman Geek

9:50 AM

MAKE SURE the NICs are intel

Anonymous

I don't like it.

Journeyman Geek

not realtek

Anonymous

It's messy.

Journeyman Geek

no idea about broadcom

Anonymous

Any specific reason? Not supported with eSXI?

Journeyman Geek

9:50 AM

yup

You can kinda beat it into working but not worth the pain

Anonymous

Right, thanks.

Anonymous

I'll remember that.

Anonymous

To be honest, I saw some decent servers for like £300-400.

Anonymous

I wouldn't need anything too crazy. Just a lot of cores.

Journeyman Geek

also real servers are noisy

Anonymous

9:51 AM

I might just build it in a PC case? :think:

Anonymous

like a big case, obviously.

Journeyman Geek

tbh, I'm debating just setting up a quartet or so of NUCs or an X99 board (old-ex server boxen)

Anonymous

i think uhhh bequiet do a decent one.

Anonymous

To be honest, I probably don't even need eSXI.

Anonymous

Bit overkill.

Journeyman Geek

10:30 AM

lol

KVM is nice

proxmox is an 'easy' distro based off that and craft computing has a ton of good videos on it

Anonymous

10:45 AM

https://www.youtube.com/watch?v=U9MvkI7zfv8
> criticizing rich people for aligning themselves with capitalism
> wearing nike.
good one.

Anonymous

Don't get me wrong, I like this show. I am also by no means a capitalist, far from it.

Anonymous

But you cannot sit there and criticize one for supporting capitalism and simultaneously wear Nike.

Anonymous

If you cannot see the hypocrisy in that, you're an idiot.

Anonymous

"I dislike this person agreeing with capitalism, but I support it by buying Starbucks, wearing Nike".

Anonymous

It's moronic.

Transcript for