hanno / is on Nostr

Freelance Journalist with a focus on Climate, Energy, IT-Security. #searchable

web: https://hboeck.de/
twitter: https://twitter.com/hanno
Newsletter (Climate/Energy/Industry): https://industrydecarbonization.com/

Last Notes

2024-08-14 09:59:24

Falls sich potentiell jemand für gebrauchte Solarmodule "Schüco MPE 90 AL" interessiert: könnte potentiell vermitteln dass die von einer alten Anlage, die abgebaut werden soll, abgeholt werden können. Wenn sie niemand holt werden sie wohl entsorgt. 120 Stück, Standort nordöstlich von Stuttgart.

2024-08-11 20:26:18

Question to cryptographers who are... somewhat older. Was RSA 512 the smallest key size that was ever used widely, or were smaller key sizes ever used in common applications?

2024-08-08 09:39:56

Preparing a talk about industrial emissions, & I like to illustrate things with local examples. The place where I'm presenting is close to a cluster of chemical factories, in the German state of Saxony-Anhalt. In the pic on the left is a large coal power plant, pretty nasty, + the largest emission source in Saxony-Anhalt. But I want to talk about the factory on the right. That's the Dow steam cracker, a major step in the production of plastics. Pic CC by-sa, Foto Fitti, https://commons.wikimedia.org/wiki/File:Merseburg,_Germany_-_panoramio_(55).jpg 🧵
https://files.mastodon.social/media_attachments/files/112/925/734/667/224/316/original/5bd778cd5429fb50.jpg

2024-06-21 18:31:07

- reply

I mean... surely it's difficult (or impossible) to write a tool that will test everything perfectly. But for a start: how about a tool that tests the stuff that is not difficult? (like, e.g. some headers have required and optional attributes, checking that isn't difficult.)

2024-06-21 17:21:15

Is there such a thing as an email valiator software checking compliance of headers and MIME structure with RFCs?

2024-05-12 08:24:26

Today, 16 years ago, Debian published a security advisory announcing CVE-2008-0166, a severe bug in their OpenSSL package that effectively broke the random number generator and limited the key space to a few ten thousand keys. The vulnerability affected Debian+Ubuntu between 2006 and 2008. In 2007, an email signature system called DKIM was introduced. Is it possible that people configured DKIM in 2007, never changed their key, and are still vulnerable to CVE-2008-0166? https://16years.secvuln.info/

2024-04-29 08:13:00

Do I know someone or can anyone recommend someone who is a nerd in the EU emission trading system (ETS)?
For two unrelated stories, I have some extremely specific questions.
I'm looking for the kind of person that will not say "oh, I don't know that, sorry", but rather "I don't know that, but I know how to find out, and I will", or "I don't know that, but I know who does".

2024-04-24 10:21:48

Some proprietary software lobbyists are trying to spin the xz story as an "anti open source" story, and I see demands like "you shall only use opensource software if you have a contract with someone guaranteeing support and security". I'd be curious: Can I see the contract those people have with Microsoft or whatever company you never heard of that wrote the firmware in their wifi card that guarantees the same for the closed source software they're using?

2024-04-16 10:33:11

Diese ganzen Regelungen für Cannabis-Konsum, z.B. nicht in der Nähe von Schulen verkaufen, nicht in Gegenwart von Kindern und Jugendlichen konsumieren etc., können wir das für Zigaretten und Alkohol auch haben?

2024-04-08 13:06:45

- reply

Update: Someone from 1password just commented on the report and it seems they'll take it seriously.

2024-04-08 07:55:18

In case anyone from [@1password](https://1password.social/@1password) is reading this, you may want to get in touch with me. I have reported a security vulnerability via their bugbounty program, and bugcrowd's staff thinks it's "not applicable", in my view clearly misinterpreting the program's rules. I am pretty sure it's something they want to address. I may consider other means of disclosure if this is "not applicable" for their bugbounty program..

2024-03-29 21:21:40

- reply

Pretty much everyone develops code using Git these days, or some other SCM (some don't, there's this mail server, but I disgress). But people distribute code in tarballs. How does a Git repo become a tarball? The answer may disturb you. It's basically "every dev has some process, maybe some script, maybe some commands they remember". Nothing is reproducible, nothing is verifiable.

2024-03-29 21:19:41

- reply

I wanted to disclose this eventually, but then a new version of that library came out and fixed the bug. And plenty of others, and well, people crash parsers for data formats from hell all the time. And I had some concerns that it would sound like I wanted to ridicule the dev, which wasn't my intention at all. But I already thought there's a deeper story here than someone accidentally leaking a PoC for an unfixed vuln. Why can this even happen?

2024-03-29 21:17:15

- reply

I contacted the responsible project, but I never got an answer and never really got to the bottom of this. But here's what I think happened: This was a proof of concept file for a yet unfixed and undisclosed vulnerability. It appears the developer already had a testcase for that bug in his local copy of the source tree. And then created the tarball from that source tree. And by doing that leaked a PoC for a zeroday. FWIW, it was "only" a DoS bug. But still.

2024-03-29 21:15:23

- reply

That file was named similar to the other testcases, but it was not used in any test. And if you fed that file into anything using that library, it would either crash or cause enormous CPU spikes. And most interestingly: This file was nowhere to be found in the project's git repository. It was *only* in the tarball.

2024-03-29 21:13:53

I have a story to tell that is relevant to the xz-utils thing that just happened. I'll probably write this up properly later, but I'm in pre-vacation mode so it may take a while . We have a problem with the way we develop and then distribute FOSS software, and both stories show that. A while ago I looked at the testcases of a widely used library implementing a widely used data format. There was one file that was... strange. 🧵