Dr. Hax

Signet maintainer. Self-custody your passwords... in hardware! https://hax0rbana.org/signet

Cypherpunk. Infosec veteran of about 15 years (vulnerability research, exploit development and cryptography). Cypherpunks write code.

Want to see wider adoption so Bitcoin can be used as digital cash and not just an investment vehicle.

XMR: 44RDkTFmTeSetwAprJXnfpRBNEJWKvA5dBH5ZVXA4DofgoZ9AgjyZdSa2fo7pMD3Qe3pdKga8X22y3Lyn1xYde5kPQPzVUu

Public Key

npub16v82nr4xt62nlydtj0mtxr49r6enc5r0sl2f7cq2zwdw7q92j5gs8meqha

NIP-05 Address

Dr.Hax@hax0rbana.org

NIP-57 Address

twilightglitter4099@getalby.com

Profile Code

nprofile1qqsdxr4f36n9a9fljx4e8a4np6j3aveu2phc04ylvq9p8xh0qz4f2ygpzfmhxue69uhhqmmnw3jhytnsd3skxegpr4mhxue69uhkummnw3ez6ur4vgh8wetvd3hhyer9wghxuet5tngcd4

Publishing to

poster.place

nostr-pub.wellorder.net

nos.lol

Author Public Key

npub16v82nr4xt62nlydtj0mtxr49r6enc5r0sl2f7cq2zwdw7q92j5gs8meqha

Show more details

Last Notes

2024-11-15 23:42:42

- reply

Oh, it gets better, they won't let you withdraw all your money. They are keeping 1% of everyone's money who tries to withdraw and 100% of everyone's money who doesn't (and they'll get a coupon in return)
https://image.nostr.build/dc1803caa55211a781d572669204682832652b26ae5adcf4258c897360baebf8.jpg

2024-11-15 23:07:55

I see #Alby is trying to force people into paying for hosting for Ably Hub by cutting off their hosted wallet service.
Understandable. They have nothing to lose by throwing everyone under the bus. It's not like they'll lose any money over it (their hosted service was free).
I mean, what are the users going to do? Get mad that they can't use a free service anymore? Complain about it on social media? Doesn't matter to Alby's bottom line.

2024-11-09 21:27:32

What are good uses for a food vacuum sealer?
What should I vacuum seal instead of dehydrating and putting it in a canning jar?
#AskNostr #homesteading #gardening #garden #homestead #perpper #prepping

2024-11-01 06:11:38

- reply

Just generated a fresh invoice and tried sending: payment timed out.
After the timeout error, I always get a "payment is in transition" error. Is this a bug? If a transaction times out, shouldn't I be able to re-transmit the same transaction in hopes that it will get through?
I can pay with on-chain funds, but I'd like to use this opportunity to make my lightning software work better and provide feedback so maybe the error messages can be improved, if nothing else.

2024-11-01 06:03:51

- reply

Sure thing
https://image.nostr.build/2e9719b4c3ee286d751901f5c7aff30cedff5eda3006ef4a1476eae76ed0416e.jpg

2024-10-31 20:53:40

- reply

The fact that you have to study nostr and understand all these different types of relays, and NIPS and learn how set all these things up is a much bigger barrier than most people on here are willing to admit. Huge survivor's bias.
When there's an app/website where new users can just open it up and have it walk them through the absolute minimum setup and help with the optional things, when we'll see substancial adoption. No more having to ask for help or get a bunch of unsolicited advice.

2024-10-31 17:44:59

- reply

Not sure, whatever BitRefill uses

2024-10-31 17:38:15

- reply

That helped, and it attempted to send this time, but the payment failed. When I try to re-send, Zeus gives me a "payment is in transition" error (whatever that means 🤷).
I'll have the recipient generate another invoice in a bit and try again. Third time is a charm, right?

2024-10-31 07:19:55

- reply

Ah, the channels pane of the app says they are offline. Guess I'll try again later.

2024-10-31 02:41:07

I found https://www.heywhatsthat.com/ and now I'm going to be distracted for countless hours. Don't click the link.

2024-10-30 18:12:44

I think it is a mistake to upload your private keys to other people (e.g. Google, Apple) in the way passkeys do.
I understand the convience factors, and the concern about backups, and I stand by my statement
FIDO2 got that right. Passkeys got that wrong.
#ZeroTrust #hardware #security #cryptography #infosec #cybersecurity

2024-10-27 02:10:52

Would you pay extra for coins theat were mined and have no transaction history attached?
If so, how much more?

2024-10-24 23:56:39

- reply

Apparently not.
I was careful to put the peppers on the bottom so I didn't get any hot pepper seeds mixed in with my strawberries or tomatoes.
It wasn't until they had been going for a few hours that it occurred to me that there might be a problem. Yay for unintentional science experiments! 🎉

2024-10-23 00:50:08

Am I doing it right?
https://image.nostr.build/db2464688f9da167339eacdd6c66bd68d35a309cdf2717411a6649132d59388b.jpg
#dehydrating #dehydrator #garden #gardening #homestead #homesteading #food #foodstr

2024-10-17 23:30:57

- reply

Is Strike closed source?

2024-10-16 00:34:37

#Heltec v3 #meshtastic users, where you at? I'm trying to figure out why the amber light keeps coming on with one of my two units. I am having some message delivery problems, but I am not sure if they are related.
It's plugged in via USB-C and there's no battery connected to the back, so it's certainly not charging a battery, despite what some reddit users report the amber light meaning.
My other unit has a blinking white LED and it is being powered by a lithium-ion rechargable battery (NOT via USB-C). This one is working as expected.
Answers that cite some documentation that I can't seem to find will get a healthy zap. ⚡

2024-10-15 17:47:43

- reply

Still waiting for my BTC node to sync. ETA is about another 10 days.
Why it's taking so long is bith a long story and a sore subject. Don't ask.

2024-10-14 17:17:24

- reply

That sounds like a lot of work. How about you post 'em and if they sell, you get 10%? 😎

2024-10-13 23:20:13

- reply

Yes, well mostly. Zoneminder handles nearly everything. Technically there is some code inside the cameras to be IP cams, so it's not 100% FOSS, but using different cameras could solve that.

2024-10-12 04:22:17

You may have heard of the "slippery slope"
First, you discover #nostr, then #LoRa and #Meshtastic, then things built on top of these like #reticulum and #nomadnet
After that, you decide to stick it to the closed source software. You purge Windows and macOS, switch to #GrapheneOS and #Linux.
Then you start purging the simple closed source #hardware starting with all those IoT devices. #Nest ain't hoovering up your data anymore. You tell #Ring to GFY. #OpenSource everything.
Next thing you know, you're driving around with your #phone in airplane mode. Good luck tracking your every move now, overlords.
Then you're biking & walking with your phone in airplane mode instead of driving. High gas prices, drivers licenses, car insurance, #ALPR systems... they ain't gonna stop you.
Then you start your own #garden and learning how to preserve food. 50% inflation on food? Not a huge deal. You got this.
Later your leaving all #electronics at home and paying for everything in cash. You know the routes that minimize exposure to security cameras. You're nearly a ghost.
I'm not sure what comes after that, but I'll let you know when I get there.
These may happen in a slightly different order. Each person has their own path. But once you start going down the "STOP FUCKING EXPLOITING ME" path, and stop paying the people who are doing it, it's extremely hard to stop. It feels so good to be free from all that nonsense. You want to keep going and never look back. #cypherpunk
Take the plunge. Start with just some small things. You won't regret it. And if I'm wrong, you can always turn back anytime.

2024-10-12 03:49:49

- reply

I like the idea, but there are serious problems with leaking metadata with #nostr DMs. Not sure people care, but having the ciphertext available to everyone is a risk.
It can be mitigated by having a unique relay for each group, but requiring people to do advanced relay management is not a recipe for success.
This could be fixed at the protocol level. E.g.
Client: give me the encrypted notes for key ID 0xabc123
Server: Sign this nonce with that key and they're yours
Client: here's the sig
Server: here's the encrypted DMs
It still lets the relay see who is messaging whom, when and how often, but that is very much like Signal. But unlike Signal, nostr could pick a different subset of relays for each message so no single relay has all the information. As long as everyone in the group is using the same set of relays, that should be reliable.

2024-10-11 03:12:52

- reply

#cbase is amazing. I had the pleasure of getting a tour when I was in town for a hacker con years ago.

2024-10-10 23:30:53

Fun fact: #BitBox is NOT #OpenSource #hardware. Take a look at their git repos. You'll only find the firmware and apps. No electronics schematics there.
https://github.com/BitBoxSwiss/
Prove me wrong. Reply with a link to a .kicad file that lets you build your own hardware.

2024-10-10 00:37:35

Age verification check:
Pound for found, it costs more than gold.
What is it?

2024-10-10 00:15:16

Alby has been making some pretty bold claims about making it easy to self-custody with lightning in a manmer where you don't have to manually launch your wallet app every 24 hours (like Zeus).
I'm going to put those to the test after my full node gets done syncing. We'll see if it meets the hype (without paying them to run your node). Stay tuned.

2024-10-09 21:36:36

- reply

It's deeply disturbing

2024-10-09 02:53:56

- reply

Yes!

2024-10-07 14:27:09

- reply

Yeah, I've heard that too, but I've done bandwidth testing on that network and it has about 900-950Mb of bandwidth to spare.
I'm not trying to get 1Tb/second or anything crazy like that. I'm just frustrated at getting less than 1MB/second.

2024-10-07 14:20:52

If someone wants to modify the #Signet firmware, it already stores keys/passwords/secrets in hardware. It's all #OpenSource. No permission needed to make the change.
#nevent1q…u29d

2024-10-07 03:32:53

- reply

I did it for the live migration capabilities. Probably overbuilt, but live and learn. It wasn't fast enough without the SSD DB devices. But then again, I feel that it's still ot fast enough, so 🤷
Separate 1Gb net for ceph backend
No RDMA. I have too many security concerns to enable that.

2024-10-06 20:52:41

- reply

4 hosts, 21 OSDs, a bit over 100TB total raw capacity.
OSDs are a mix of big expensive SSDs and "HDDs with an SSD as a DB device" (and thus it also serves as a WAL device). There are no HDDs without an SSD in front of them.
Workload is about 40 VMs which vary greatly in disk activity. DNS, basic web services are super lightweight, but heavier hitters like the InfluxDB server, GitLab, and Mastodon.

2024-10-06 19:56:25

Yesterday was a rough day for me as a #sysadmin, but #ceph still maintained its perfect record of no data loss, even though I don't 💯 understand all the inner workings.
At this point, I'd say it is battle tested. I've had concurrent drive failures, and this latest issue where it couldn't find the DB device fors of 17 of the 21 drives!
I'm not sure I'd go with ceph again if I had to start over. It allows live migrating running VMs to anither host, which is a huge win for avoiding downtime and saving disk writes for migrating an entire hard drive (as opposed to just migrating the confents of memory). But having standalone disks would be way more performent in terms of both I/O and memory usage.
If I could get equal disk I/O performance, I'd choose ceph for any #SelfHosting. Maybe not for a #homelab, where nobody relies on any of the services, but certainly if you're using it in your daily life.
I still have a #bounty out of 300K sats for anyone who can get me 100MB/s random read inside a VM and 100 IOPS for the rados write benchmark.
What I actually want is for VMs to run at least as well as if they were on a standalone consumer grade hard drive, but I'm trying to provide concrete metrics so there's an objective metric of whether it goes "fast enough".

2024-10-02 20:40:37

Another empty #bitcoin block. :-) https://mempool.space/block/000000000000000000002d06a5825f1e2478682049ef9df7fcc0c5019516b6c1

2024-10-02 20:02:39

I just submitted #Signet to be certified as #OpenSource #hardware by @oshwassociation@mastodon.social (ActivityPub) and I'm going to join as a member.
I was inspired by today's membership drive. Thank you for everything you do, crew.

2024-10-02 19:24:15

- reply

Yes, I sell encrypted hardware password managers. 100% Open Source. Significant discount for paying in bitcoin.

2024-10-02 19:21:40

- reply

Does your book comment on the story of Lot and his daughters?

2024-09-28 18:35:00

- reply

TorBrowser, DuckDuckGo browser or Mull are all good choices.

2024-09-28 18:26:16

- reply

What does that "...chippen + pinnen" sign translate to in English?
Like, I can guess that last part is about paying with credit cards (chip + PIN), but what does that first part say?

2024-09-28 17:46:33

If you've never seen the movie "Network" (1976), it's worth a watch. Here's a scene and quote from it (note: the video is a bit of a spoiler since you can see which characters are speaking with each other):
https://www.americanrhetoric.com/MovieSpeeches/moviespeechnetwork4.html
You are an old man who thinks in terms of nations and peoples. There are no nations. There are no peoples. There are no Russians. There are no Arabs. There are no third worlds. There is no West. There is only one holistic system of systems, one vast and immane, interwoven, interacting, multivariate, multinational dominion of dollars. Petro-dollars, electro-dollars, multi-dollars, reichmarks, rins, rubles, pounds, and shekels.
It is the international system of currency which determines the totality of life on this planet. That is the natural order of things today. That is the atomic and subatomic and galactic structure of things today! And YOU have meddled with the primal forces of nature, and YOU WILL ATONE!
Am I getting through to you, Mr. Beale?
You get up on your little twenty-one inch screen and howl about America and democracy. There is no America. There is no democracy. There is only IBM and ITT and AT&T and DuPont, Dow, Union Carbide, and Exxon. Those are the nations of the world today.
What do you think the Russians talk about in their councils of state -- Karl Marx? They get out their linear programming charts, statistical decision theories, minimax solutions, and compute the price-cost probabilities of their transactions and investments, just like we do.
We no longer live in a world of nations and ideologies, Mr. Beale. The world is a college of corporations, inexorably determined by the immutable bylaws of business. The world is a business, Mr. Beale. It has been since man crawled out of the slime. And our children will live, Mr. Beale, to see that perfect world in which there's no war or famine, oppression or brutality -- one vast and ecumenical holding company, for whom all men will work to serve a common profit, in which all men will hold a share of stock, all necessities provided, all anxieties tranquilized, all boredom amused.

2024-09-26 00:30:09

- reply

I've been considering starting one for a while now. These are really helpful tips for getting started.
Do you have a suggestion for a CHEAP, battery powered node that one would take with their mobile device and pair with via bluetooth in order to chat? Doesn't have to be pretty, or easy to use, or even open source (though that last one is highly desirable).

2024-09-25 06:39:46

- reply

Because Ceasar's face was on the coins

2024-09-23 21:19:58

- reply

I concede that he dodged the question of whether it was right/lawful, but he did very clearly instruct people pay the tax though.
Funnily enough, if the coins don't have the tax man's name on them (Ceasar, in this case), he made no statement on whether people should pay the tax or not.
So an interesting parallel could be drawn there if paying via bartering.

2024-09-23 05:32:46

- reply

The part surrounded by "BEGIN PGP PUBLIC KEY BLOCK" is the key. That should always work.
If you are configured to use keyservers, and the person uploaded their key to those servers, you can find it with the fingerprint. E.g. A13806B1FA2A676B

2024-09-22 23:10:54

This is the first functional prototype of a custom #RaspberryPi Pico hat that will convert any USB keyboard and/or mouse to PS/2.
https://image.nostr.build/ff7ee1f37abf670c5f08308ad1b5acc9307490015301873c6505e8cc9522097f.jpg
The reason I want one is so I can use modern keyboards with #QubesOS and not have to expose dom0 to any USB devices, ever! This is a #security feature shich I've wrote about previously and #Qubes has documented well.
As the picture implies, the PBC design was missing a trace, which I've patched with that red wire. I also had to cut the PS/2 cable apart and make it into a "crossover" cable to compensate for my having the pins reversed on the Mini-DIN-6 connector (I had it wired like a cable instead of a jack).
I've updated the PCB design to fix all these things (and some more minor issues) in case anyone else is interested in buying or building one of these little gems.
I am an #infosec #electronics #maker, hear me roar.

2024-09-21 02:35:45

Saw this at the grocery store the other day, thought #bitcoin #nostr would get a kick out of it.
https://image.nostr.build/d52da5b6a0f4afcf7622e17deabfda892ffc88faf48630e34bd1464f90b4483b.jpg
The fine print not apassword, it is about how to enter people's ID. It just highlights that while it doesn't work, if it did, it'd only work if you give them ID.

2024-09-21 01:58:12

Do hosting companies like AWS/GCP still have a free tier? If so do they require a credit card?
This may possibly be related to #nevent1q…k0nf

2024-09-21 01:37:16

Need some hacking/programming tunes? I got you covered:
https://invidious.privacyredirect.com/watch?v=Y91C2yTq8BQ

2024-09-19 16:17:06

- reply

Yes.
A. F-Droid only allows completely open souce stuff and informs you about things like whether it has privacy concerning features like trackers, relies on connecting to a closed source server, etc.
B. Obtainium doesn't give you any of those guarantees, but you can pull from a lot of different locations including .APKs from Microsoft GitHub releases, and
C. Aurora only allows you to get things listed on Google's play store (same backend)

2024-09-19 15:32:34

- reply

Ah so it's in the note of the lightning transaction. That wouldn't work very well on me since the only notification I get when someone zaps me is in Amethyst, which doesn't display the lightning note.

2024-09-19 14:42:56

I'm imagining a Capture The Flag (CTF) game where the #challenge is to bypass some network control (aka #censorship) that is used in the real world.
Maybe you'd #VPN into an environment where the gateway has some annoying restriction and your mission was to #circumvent them.
The point wouldn't be the specific #tactic used to bypass a particular #control, but rather to get people thinking about how to bypass controls in general. That way when some new one comes along, you'll be able to probe, adapt and overcome!
At the same time, the group running it could learn more about what controls there are out there, especially ones that aren't commonly used in their country.

2024-09-19 14:18:13

- reply

The relays no longer show up below the authors picture. Here's a screenshot from v0.91.0-fdroid
https://image.nostr.build/b05f49726e04e8c297de1e7eddfb8d638d6303e8fee82fc72aca5aa466ab9625.jpg

2024-09-19 14:10:04

Does anyone here know how to get SpamAssassin to only look at the last hop instead of looking at every MTA that a message has gone through?
Failing that, do you know how to configure it to not punish Tor users?
I can find lots of guides on configuring rules, but nothing that answers these specific questions.

2024-09-19 14:03:22

- reply

How exactly does that work?
They zap you and hope you see it and think "who is this account? Let me look at their profile..."?

2024-09-19 01:58:39

- reply

There is also I2P, which has been around longer, is battle tested, has a bigger community, and is basically the same thing.
I asked the developers why they made #Veilid instead of contributing to #I2P and they said they didn't know much about I2P.
#privacy

2024-09-18 15:51:13

- reply

And they already have radios for remote detination. Pretty crafty, and as long as you don't care about killing nearby civilians and bombing funerals, I mean, why not go down this road, right?

2024-09-18 15:46:25

For anyone who is seeing out of context references to pagers, walkie talkies, and explosions, here's what they've referring to: https://www.axios.com/2024/09/18/israel-detonates-hezbollah-walkie-talkies-second-wave-after-pager-attack

2024-09-17 18:48:49

Fun fact: if AWS and Google banned running #lightning nodes it'd take out more than half of the lightning network.
Source: https://mempool.space/lightning

2024-09-17 17:47:24

What's going on with the #bitcoin chain? A block was mined 11 minutes ago that builds on one mined 6 minutes ago? How does that work?
https://image.nostr.build/5fb8713dafb2149adf6629f44cebae87ecfe89ac09979c8410c8a19193cc1977.jpg

2024-09-17 06:45:11

- reply

How do you get anything you buy online shipped to you? Do you have a PO box or UPS box or something that you drive by from time to time? I'll ship it anywhere in the USA. Can be a friend or relative's home, their employer, or whatever. Doesn't matter to me.

2024-09-17 06:04:44

- reply

I've only seen it in passing, not looked at the hardware or software or tried to verify any of their claims. But here are my quick thoughts:
- Good design to not have any wireless hardware
- Open source hardware allows people to verify that fact
- CPU is actually the same make as is used in the Signet, but theirs looks much more complex model (based on the picture)
- Form factor is pretty cool, but if customs asks you to turn on your "phone" to prove it works, things might get awkward
The first thing I'd want to know is what secrets are stored on the device, if any. Since it has a secure element, I'm guessing the secret is on the device. The next question is about the ability to make a backup, and how is the secret protected?
I prefer simplicity in design to banking on a secure element that I can't fully audit.
I've poked around in the codebase for SeedSigner and I can say that it's legit. It doesn't store your secrets at all. You enter it each time you boot. Requires you securely store your seed phrase, but that's not a problem for me. 😎

2024-09-17 05:43:31

- reply

The hardware scematics are public, as is the firmware and the client. The electronics are very simple (only one IC). So we're doing our best to earn people's trust, not just expecting it like closed source hardware.
It doesn't do signing. It coukd with some additional firmware code, but I'm reluctant to put a bunch of extras in there because it'll increase attack surface and make it harder to audit.
Having an alternate firmware that runs on the same hardware would be cool though. No reason it couldn't handle it.

2024-09-17 05:32:43

We've been prepping #vegetables from the #garden for over 4 hours now. Not even going to be able to #cook them all tonight. Going to have to punt some #recipes to Wednesday night.
It's a good haul, but it's a lot of work.
#gardening #homesteading

2024-09-16 17:48:07

- reply

Cool. There's a v1.4 branch in the cad repo that I would recommend. It's functionally the same as the default branch, but I flipped all the components to the same side of the board to make assembly easier. It's a royal pain to try to solder on SMT parts when other SMT parts are trying to fall off the back.
LMK how it goes. If you run into any issues, I'd be happy to help (and improve the documentation).

2024-09-15 16:14:55

- reply

No, but I'm looking for distributors/resellers to handle shipping to various regions.
I want to try to help people who aren't able to build their own (due to not having the equipment, skills, etc.) But having people pay $30 in shipping on a $45 item feels wrong.

2024-09-15 06:38:18

OK, price drop as promised for #bitcoin users
https://hax0rbana.org/signet/store.html?pubkey=028fe8dff97df9480d37bd7fbdd300c7aab1e77e3f77647f41ae27fa69d401da26&relays=%5B%22wss://relay.damus.io%22,%22wss://nostr-pub.wellorder.net%22,%22wss://nostr.bolt.fun%22%5D
This is as low as I can go. It's the cost of the components and the average shipping price.
No compensation for the hour I spend building, testing and reworking each board or the hundreds of hours working of the software or firmware. But if it helps encourage more people to pay and accept bitcoin, it'll be worth it. Besides, if bitcoin goes up by 50%, I'll have made minimum wage. 🤣 It's all good, it's a labor of love. 🫂
#nevent1q…jlt9

2024-09-15 05:56:44

- reply

A yubikey can only store one password, so you can't use it to log into accounts that take passwords, enter passwords to decrypt files and so forth. It does second factor auth, FIDO2 auth and things of that nature.
#Signet does store passwords (and other secrets like seed phrases, answers to security questions, and so forth).
The current firmware doesn't have the ability to sign nostr notes, but that could be added. Plus, it's open source so you don't need my permission to patch that feature in. 🙂
#Signet is an open source project, so we don't have a well funded marketing department. We have me, posting notes on nostr, trying to spread the good word that there are non-corporate, non-centralized, hardware based solutions to password management. ✊

2024-09-15 05:10:29

- reply

It's just a password manager (although, with some firmware and client tweaks, it could be a signing device), and only $45.
I've never heard on moolti-pass before but it looks legit! The whole knocking on wood thing is weird, but they seem legit about being open source, as opposed to being like most companies that claim to be open source because one component is open source. I saw mooltipass has published kicad files.

2024-09-15 04:36:42

- reply

I see the OnlyKey has software that runs on the computer, is that optional? How would you choose which password you want to have it type in without any software?

2024-09-14 21:59:41

For people who have NOT joined the #Signet project, nor bought a device. I want to hear from you.
Too expensive ($45)?
Don't feel it's more secure than pure software?
Don't feel you can trust it?
Don't use a password database?
Not enough time to help (provide feedback, report bugs, contribute code, etc.)?
What's holding you back and how can we fix it?
#nevent1q…jlt9

2024-09-14 21:55:43

Was able to flash it successfully on the first try.
Had to rework it once to address a short with the button, but my guide on what component to look at for the specific problem (button doesn't work) made the rework 10x less frustrating, and faster too.
Now if there were more interest in the #Signet project, I think I'd be able to better keep up with demand.
#nevent1q…9ulp

2024-09-14 20:57:33

Working on another prototype for #Signet #Saturday
Pro tip: don't proactively add a droplet of flux to surface mount soldering. While it seems like a good idea, it will boil off and cause resistors and capacitors to go flying. Even a switch got misaligned and the CPU was jumping up and down in my case!

2024-09-14 17:26:10

- reply

If you believe MasterCard, it's Recorded Future.
Personally, I feel like that's asking who has the best lead balloon. It's not that it's completely impossible to get value there, but it's misguided.
I feel it'd be better to look at the processes that cause vulnerabilities, the vulnerabilities themselves and defenses to immediately detect and resond to problems.
As compared to CTI, which focuses on the payload that was used to exploit them, at best, or at worst: surfing message boards looking for people bragging about hacks or selling information obtained.

2024-09-14 04:28:29

- reply

It works by storing your passwords and any other data you put in there encrypted (aes256-cbc) on the persistent storage. The device does not contain the secret key and there is no secure element, by design.
The device password is used to generate the key to decrypt the storage. https://gitlab.hax0rbana.org/signet/signet-base/-/blob/trunk/firmware/commands.c#L411
The password is hashed by scrypt to generate the key. https://gitlab.hax0rbana.org/signet/signet-client/-/blob/trunk/client/signetapplication.cpp#L213
As for has it been audited, well, yes and no. If your definition of an audit is that someone who did not write the code reviewed it for security, and this reviewer was experienced in cryptographic audits, then yes. If you mean, were they paid for their work, and did they write up a report, then no.
Also, I am the person who did the audit, because I wasn't going to trust the device without doing a code review first. So there's some bias here in me saying it's audited, but I didn't design or implement the code. I'm merely the maintainer of all software and firmware and the builder of hardware.
By not having a secure element that stores some secret, it means there's no secure element that needs to be audited (which is good because they're difficult to audit and nearly impossible to get access to in order to do the audit). It also makes it easier to backup & restore the device. The trade off here is that it means offline attacks are possible. If you chose a weak password, it'd be possible to brute force if someone got a backup of your device. So, yeah, a 6 digit PIN isn't going to cut it here.

2024-09-14 01:06:18

"People who hate negative numbers will stop at nothing to avoid them."
Via: https://infosec.exchange/@catsalad/110983599919373020

2024-09-13 23:24:34

I'm about to put #Signet devices on #sale. Actually no, not sale, I'm just going to lower the price on my store, where people pay in #bitcoin. #Fiat prices will remain the same.
https://image.nostr.build/e9dfe3b3b9c39a3afde78b2094828006c5bfc625834d6768c6472116e2291346.jpg
https://image.nostr.build/54dbac04f8e413699358a5b8dba84cb53da7e739d78d576dcdfb34e1ee25a784.jpg
https://hax0rbana.org/signet to buy, but might as well wait until tomorrow when the price drops.
#security #infosec #cyber #cybersec #cybersecurity #OpenSource #hardware #privacy

2024-09-12 19:39:09

Why isn't Sideband in the default F-Droid repos?
Do they not meet the requirements? I can open a ticket about it (there isn't one), but figured I'd check here to see if someone knew the answer off the top of their head.
https://github.com/markqvist/sideband
#sideband #decentralize #distributed #decentralized #network #LoRa #Meshtastic #privacy #freedom #tech #Fdroid

2024-09-12 14:54:05

MasterCard just paid 2.65 billion dollars for a threat intelligence firm.
It's amazing people will pay so much to learn about the payloads of yesterday and not invest comparable amounts in finding the vulnerabilities of tomorrow.
https://www.reuters.com/markets/deals/mastercard-buy-threat-intelligence-company-recorded-future-265-bln-2024-09-12/
#infosec #security #ThreatIntel #vulnerability #research #tech #IT

2024-09-11 20:51:50

- reply

Would you support the idea of making the requirement physical strength and reject people who don't meet that requirement and accept people that do, regardless of gender?

2024-09-11 17:49:44

Fish, hungarian and jalapeño. They look beautiful.
https://image.nostr.build/d8fd5344bc48995e134f203709857866d0b80ca9ca8a195133a99547c3f96231.jpg
Yes, some of the jalapeños were hiding and managed to ripen before we found them. They may be red, but I assure you they are still jalapeños.
#pepper #prepper #homestead #homesteading #garden #gardening

2024-09-11 17:45:03

The kale is off to the races! Cilantro and celery have yet to sprout.
https://image.nostr.build/767198043e62e283b59cefe00dd7304f7f4365329c10446cde3f5c79c4f83daa.jpg
https://image.nostr.build/7d0ffcd615aaa5060539565ac2805f6fc8d743c3f8d2e094d11d0554d4ea3933.jpg
#hydroponics #gardening #food #foodstr #SelfSufficiency

2024-09-11 17:39:36

- reply

Go on...

2024-09-11 17:37:22

- reply

For those looking for more info:
https://reticulum.network/
https://github.com/markqvist/nomadnet

2024-09-10 04:37:55

I'm #dehydrating another batch of fish, hungarian and jalapeño peppers again.
Last batch of jalapeños (now about half gone):
https://image.nostr.build/c84a4eabfce17efff323915871ac0ac4a8c2fc923882a780e06230b20b1b3ada.jpg
#garden #gardening #dehydrator #food #foodstr #prepper #prepping #homestead #homesteading

2024-09-06 15:01:38

OMG, the Hungarian peppers I have ARE the same genius, species and variatal as is sometimes used to make paprika!
I don't know what the heck they're doing differently than me, but when I dry them and grind them into a powder, it makes spicy pepper powder, not anything like paprika.
Maybe if I took the seeds out and wasn't using the "benign neglect" strategy of watering them?
If I ever get enough of my normal pepper powder, maybe I'll try making paprika. By removing the seeds that is, because remembering to water them the perfect amount every day for months on end is going to take automation.

2024-09-06 04:38:09

People are working on 3d printing pharmaceuticals. Wow
https://infosec.exchange/@tinker/113087807778793836

2024-09-05 19:18:30

- reply

I was asking about receiving, not realizing it was any different than transmitting. I thought a poorly tuned antenna would give a poor SNR for receiving and not transmit as well when transmitting (though I don't know the metric for that).
When I said an FM antenna being a wire, I was thinking of a home stereo and an antenna like this:
https://cdn.shopify.com/s/files/1/0048/5090/9253/products/71dC4VAnqRL._SL1500_1200x1200.jpg?v=1552667011
With those clarifications out of the way, the example was very helpful. I can't say I understand all the theory, but maybe I can take a crack at explaining what I think to be the case and we can iterate?
The waves come in and hit the antenna, inducing a current. In the middle section, it's blocked, but it gets in above and that's the resonant frequency, so the signal will be nice and strong. Below the double shield, the cable is still shielded, so it gets minimal interference on that segment.
I know my terminology is probably wrong here, but is that the gist of it?

2024-09-05 02:48:00

- reply

Ok, same question with a straight stick antenna. Like, for example, an FM antenna is literally just a wire.

2024-09-04 23:03:33

Question for a #radio person, perhaps @nprofile…k5tp?
If a dipole antenna is 59.14 mm in length (tuned for 802.11g, channel 1), and you attach it directly to the wifi card, that's great.
My question is: if you now extend that antenna by attaching it to the wifi card using a wire, like a normal person, would that cause it to no longer be tuned for 2412 MHz?
If so, what's the point of buying the "proper" antenna?
If not, how on Earth does that work?!

2024-09-04 22:51:02

My savings are dried jalapeños, hungarian peppers, fish peppers, apple chips, dried peaches, cherries, blackberries, blueberries, and banana chips.
It's not entirelt fungible. You can't transmit it over the internet. But it is wonderful conversion of my past labor, stored for the future.
https://image.nostr.build/d5e870cf3e6e0a877ce006a206730af1d84e624be27e3bad74d989277c470834.jpg
https://image.nostr.build/3b32c88f3109dcafc644926135997a96362b4db7805b27c3cc89a8a495124fea.jpg
#gardening #homesteading #prepping #foodstr

2024-09-04 22:40:07

- reply

Did you compile the firmware from source?
/s

2024-09-03 04:11:37

Wow, the fediverse was poppin' today
https://image.nostr.build/28e9b55118190e62c1974a84b0148590f481a2b442498f7cd38f37fc91191c39.jpg

2024-09-02 16:00:52

- reply

🤣
https://starecat.com/content/wp-content/uploads/control-of-internet-speech-how-would-you-like-this-wrapped-anti-terrorism-protect-kids.jpg

2024-09-02 04:50:43

Quitting ultra processed foods for one month.
https://mastodon.online/@CurlyParakeet/113050464472110201
If you are in a hurry, the punchline is that it's about 20% cheaper at the grocery store, but about 7-21 hours per week of additional time (and I suspect that is an underestimate) to make everything from scratch.

2024-09-01 22:50:50

1. Use a password manager
2. Use #Matrix
3. Use #Tor
4. Use #privacy email addresses
5. Buy things with #cash, #Monero, #Bitcoin or prepaid credit cards
Pretty much in that order. If you want to dive into #VPNs, #FIDO2 #hardware, #passkeys, #Qubes, firewalls, burner phones, #VoIP lines, freezing your credit reports, and the like, that's cool, but get the basics down first.

2024-09-01 08:47:25

- reply

Matrix. No centralized server that collects everyone's phone numbers in a huge database, true multi-device support, you get to choose your client, and much more popular than XMPP.
Nothing is perfect, but Matrix is good and continuing to get better.
If they get their p2p Matrix support to be reliable and easy to use, that'd be **amazing**!
https://arewep2pyet.com/
https://github.com/matrix-org/pinecone

2024-09-01 06:21:27

- reply

I don't know why I wasn't already following you, but that mistake has now been fixed!

2024-09-01 06:00:47

- reply

It took 7 years before we got our first fruit. If you haven't mulched around them yet, you should. That seemed to speed things up.

2024-09-01 05:59:14

- reply

The best I can say on the flavor is "tropical". I guess somewhere between a cantaloupe and a pineapple maybe?
The texture is soft, similar to a banana. Skin is similar to a pear. I thought it was fine to eat the skin, opinions on that vary.

2024-08-31 21:58:00

I've had my first #pawpaw and because you can't buy them in stores, it's a #homegrown pawpaw.
https://image.nostr.build/6798455e170335c0d9ce9b44ccc8d6be881062801065821ccb5878dfd6b02f45.jpg
They are possibly the best #fruit I've ever tasted.
#foodstr #gardening #homesteading

2024-08-31 02:25:43

Here's the original version:
https://www.webdesignmuseum.org/gallery/pizza-hut-in-1995
#nevent1q…dxk3