evenwicht

joined 1 year ago
[–] evenwicht@lemmy.sdf.org 1 points 1 week ago* (last edited 1 week ago) (1 children)

There are different narratives. What I believe I heard on BBC radio was that the sender intended to just send a few records to the recipient but accidentally sent the full dataset of 18,000 (or 19,000) records.

Other sources, like the one I linked, say the error was that the wrong recipient was emailed.

It’s surprising that as big as the story is, reporting of the tech details is lousy. A couple sources say the data was a spreadsheet, which seems to support what the Guardian says.

 

cross-posted from: https://lemmy.sdf.org/post/38677119

Indeed it was stupid for someone to send a large sensitive dataset over email. But what I find annoying is the lack of chatter about which email servers were compromised.

Was it Microsoft, considering probably 90+% of all gov agencies use it?

[–] evenwicht@lemmy.sdf.org 1 points 1 month ago* (last edited 1 month ago)

Does the “Buy European” community disregard software?

Nokia briefly had a couple devices with an apparently FOSS platform: Maemo, IIRC. Then they ditched that to align with Microsoft. And their recent smartphones are apparently based on Google’s Android. That’s not European.

If you must have an Android for some strange reason, then I suppose Nokia or Wiko would be as close as you can get to European. But fuck Android. It’s proprietary and designed for obsolescence.

 

There is some chatter here about who to use a custom script to use stealth mode with wireguard:

https://forum.gl-inet.com/t/how-use-wireguard-over-tcp-or-stealth-protocol-from-protonvpn/26797

Is it possible to do the same with openvpn?

[–] evenwicht@lemmy.sdf.org 1 points 2 months ago

I have not tried much of anything yet. I just got a cheap laptop with a BD which came with Windows and VLC. I popped in a blu-ray disc from the library and it could not handle it.. something about not having a aacs decoder or something like that. I didn’t spend any time on it yet but ultimately in principle I would install debian and try to liberate the drive to read BDs.

[–] evenwicht@lemmy.sdf.org 1 points 2 months ago* (last edited 2 months ago) (2 children)

thanks!

Though I should mention my original motivation with makemkv was to rip blu-ray discs, which has complications that go beyond DVD. But the DVD guide will still be quite useful.

[–] evenwicht@lemmy.sdf.org 1 points 3 months ago

Well it’s still the same problem. I mean, it’s likely piracy to copy the public lib’s disc to begin with, even if just for a moment. From there, if I want to share it w/others I still need to be able to exit the library with the data before they close. So it’d still be a matter of transcoding as a distinctly separate step.

[–] evenwicht@lemmy.sdf.org 1 points 3 months ago* (last edited 3 months ago) (2 children)

What’s the point of spending a day compressing something that I only need to watch once?

If I pop into the public library and start a ripping process using Handbrake, the library will close for the day before the job is complete for a single title. I could check-out the media, but there are trade-offs:

  • no one else can access the disc while you have it out
  • some libraries charge a fee for media check-outs
  • privacy (I avoid netflix & the like to prevent making a record in a DB of everything I do; checking out a movie still gets into a DB)
  • libraries tend to have limits on the number of media discs you can have out at a given moment
  • checking out a dozen DVDs will take a dozen days to transcode, which becomes a race condition with the due date
  • probably a notable cost in electricity, at least on my old hardware
[–] evenwicht@lemmy.sdf.org 2 points 3 months ago

Wow, thanks for the research and effort! I will be taking your approach for sure.

[–] evenwicht@lemmy.sdf.org 10 points 3 months ago (6 children)

I’ll have a brief look but I doubt ffmpeg would know about DVD CSS encryption.

 

Translating the Debian install instructions to tor network use, we have:

  torsocks wget https://apt.benthetechguy.net/benthetechguy-archive-keyring.gpg -O /usr/share/keyrings/benthetechguy-archive-keyring.gpg
  echo "deb [signed-by=/usr/share/keyrings/benthetechguy-archive-keyring.gpg] tor://apt.benthetechguy.net/debian bookworm non-free" > /etc/apt/sources.list.d/benthetechguy.list
  apt update
  apt install makemkv

apt update yields:

Ign:9 tor+https://apt.benthetechguy.net/debian bookworm InRelease
Ign:9 tor+https://apt.benthetechguy.net/debian bookworm InRelease
Ign:9 tor+https://apt.benthetechguy.net/debian bookworm InRelease
Err:9 tor+https://apt.benthetechguy.net/debian bookworm InRelease
  Connection failed [IP: 127.0.0.1 9050]

Turns out apt.benthetechguy.net is jailed in Cloudflare. And apparently the code is not developed out in the open -- there is no public code repo or even a bug tracker. Even the forums are a bit exclusive (registration on a particular host is required and disposable email addresses are refused). There is no makemkv IRC channel (according to netsplit.de).

There is a blurb somewhere that the author is looking to get MakeMKV into the official Debian repos and is looking for a sponsor (someone with a Debian account). But I wonder if this project would even qualify for the non-free category. Debian does not just take any non-free s/w.. it's more for drivers and the like.

Alternatives?


The reason I looked into #makemkv was that Handbrake essentially forces users into a long CPU-intensive transcoding process. It cannot simply rip the bits as they are. MakeMKV relieves us of transcoding at the same time as ripping. But getting it is a shit show.

 

My current rig:

  • old android phone with GPS disabled
  • external GPS device (NMEA over bluetooth)
  • OSMand from f-droid for offline maps and navigation
  • BlueGPS to connect to the bluetooth GPS device, grab the NMEA signal, and feed it as a mock location
  • developer options » mock locations enabled

The idea is to save on phone battery so I can navigate more than an hour. The phone’s internal GPS is energy intensive because of all the GPS calculations. By offloading the GPS work to an external bluetooth GPS, the phone’s battery can be somewhat devoted to the screen because bluetooth uses much less energy than GPS. And NMEA carries lat/long so the phone need not do the calculations.

Not sure it actually works though.. been waiting for satellites for a while now. Anyway, I would like to know if this config can work on any FOSS platforms, like pmOS. Can OSMand run on pmOS or is there a better option? IIUC, Android apps are a huge CPU hog on pmOS because of emulation.

Ideally I would like to buy something 2nd-hand like a BQ Aquaris X5 and put pmOS on it. I’ll need a quite lean mapping and nav app that runs on pmOS, and also has the ability to use an external GPS.

For the first 15 minutes when satellites are taking forever to appear, I would like to use something like WiGLE WiFi Wardriving which makes use of wifi APs and cell towers the same way Google location does, but without feeding Google. Is there anything like that on pmOS, or any other FOSS phone platform?

Updates

Every mobile FOSS platform listed by the OSM project have been abandoned as far as I can tell. But perhaps OSM is just poorly tracking this because osmin and pure maps apparently both run on Postmarket OS:

There is a network-dependent nav app called Mepo, but that would not interest me.

There is also Organic Maps which comes as a flatpak for aarch64. It requires the whole KDE framework which is fat in terms of size but probably not relying on emulation so it could perform well enough.

[–] evenwicht@lemmy.sdf.org 2 points 8 months ago* (last edited 8 months ago)

Does pdfinfo give any indication of the application used to create the document?

Oracle Documaker PDF Driver
PDF version: 1.3

If it chokes on the Java bit up front, can you extract just the PDF from the file and look at that?

Not sure how to do that but I did just try pdfimages -all which was not useful since it’s a vector PDF. pdfdetach -list shows 0 attachments. It just occurred to me that pdftocairo could be useful as far as a CLI way to neuter the doc and make it useable, but that’s a kind of a lossy meat-grinder option that doesn’t help with analysis.

You might also dig through the PDF a bit using Dider Stevens 's Tools,

Thanks for the tip. I might have to look into that. No readme.. I guess this is a /use the source, Luke/ scenario. (edit: found this).

I appreciate all the tips. I might be tempted to dig into some of those options.

[–] evenwicht@lemmy.sdf.org 3 points 8 months ago* (last edited 8 months ago)

Your assertion that the document is malicious without any evidence is what I’m concerned about.

I did not assert malice. I asked questions. I’m open to evidence proving or disproving malice.

At some point you have to decide to trust someone. The comment above gave you reason to trust that the document was in a standard, non-malicious format. But you outright rejected their advice in a hostile tone. You base your hostility on a youtube video.

There was too much uncertainty there to inspire trust. Getoffmylan had no idea why the data was organised as serialised java.

You should read the essay “on trusting trust” and then make a decision on whether you are going to participate in digital society or live under a bridge with a tinfoil hat.

I’ll need a more direct reference because that phrase gives copious references. Do you mean this study? Judging from the abstract:

To what extent should one trust a statement that a program is free of Trojan horses? Perhaps it is more important to trust the people who wrote the software.

I seem to have received software pretending to be a document. Trust would naturally not be a sensible reaction to that. In the infosec discipline we would be incompetent fools to loosely trust whatever comes at us. We make it a point to avoid trust and when trust cannot be avoided we seek justfiication for trust. We have a zero-trust principle. We also have the rule of leaste privilige which means not to extend trust/permissions where it’s not necessary for the mission. Why would I trust a PDF when I can take steps to access the PDF in a way that does not need excessive trust?

The masses (security naive folks) operate in the reverse-- they trust by default and look for reasons to distrust. That’s not wise.

In Canada, and elsewhere, insurance companies know everything about you before you even apply, and it’s likely true elsewhere too.

When you move, how do they find out if you don’t tell them? Tracking would be one way.

Privacy is about control. When you call it paranoia, the concept of agency has escaped you. If you have privacy, you can choose what you disclose. What would be good rationale for giving up control?

Even if they don’t have personally identifiable information, you’ll be in a data bucket with your neighbours, with risk profiles based on neighbourhood, items being insuring, claim rates for people with similar profiles, etc. Very likely every interaction you have with them has been going into a LLM even prior to the advent of ChatGPT, and they will have scored those interactions against a model.

If we assume that’s true, what do you gain by giving them more solid data to reinforce surreptitious snooping? You can’t control everything but It’s not in your interest to sacrifice control for nothing.

But what you will end up doing instead is triggering fraudulent behaviour flags. There’s something called “address fraud”, where people go out of their way to disguise their location, because some lower risk address has better rates or whatever.

Indeed for some types of insurance policies the insurer has a legitimate need to know where you reside. But that’s the insurer’s problem. This does not rationalize a consumer who recklessly feeds surreptitious surveillance. Street wise consumers protect themselves of surveillance. Of course they can (and should) disclose their new address if they move via proper channels.

Why? Because someone might take a vacation somewhere and interact from another state. How long is a vacation? It’s for the consumer to declare where they intend to live, e.g. via “declaration of domicile”. Insurance companies will harrass people if their intel has an inconsistency. Where is that trust you were talking about? There is no reciprocity here.

When you do everything you can to scrub your location, this itself is a signal that you are operating as a highly paranoid individual and that might put you in a bucket.

Sure, you could end up in that bucket if you are in a strong minority of street wise consumers. If the insurer wants to waste their time chasing false positives, the time waste is on them. I would rather laugh at that than join the street unwise club that makes the street wise consumers stand out more.

[–] evenwicht@lemmy.sdf.org 6 points 8 months ago* (last edited 8 months ago) (3 children)

Don’t Canadian insurance companies want to know where their customers are? Or are the Canadian privacy safeguards good on this?

In the US, Europe (despite the GDPR), and other places, banks and insurance companies snoop on their customers to track their whereabouts as a normal common way of doing business. They insert surreptitious tracker pixels in email to not only track the fact that you read their msg but also when you read the msg and your IP (which gives whereabouts). If they suspect you are not where they expect you to be, they take action. They modify your policy. It’s perfectly legal in the US to use sneaky underhanded tracking techniques rather than the transparent mechanism described in RFC 2298. If your suppliers are using RFC 2298 and not involuntary tracking mechanisms, lucky you.

[–] evenwicht@lemmy.sdf.org 14 points 8 months ago* (last edited 8 months ago) (6 children)

You’re kind of freaking out about nothing.

I highly recommend Youtube video l6eaiBIQH8k, if you can track it down. You seem to have no general idea about PDF security problems.

And I’m not sure why an application would output a pdf this way. But there’s nothing harmful going on.

If you can’t explain it, then you don’t understand it. Thus you don’t have answers.

It’s a bad practice to just open a PDF you did not produce without safeguards. Shame on me for doing it.. I got sloppy but it won’t happen again.

 

cross-posted from: https://lemmy.sdf.org/post/24645301

They emailed me a PDF. It opened fine with evince and looked like a simple doc at first. Then I clicked on a field in the form. Strangely, instead of simply populating the field with my text, a PDF note window popped up so my text entry went into a PDF note, which many viewers present as a sticky note icon.

If I were to fax this PDF, the PDF comments would just get lost. So to fill out the form I fed it to LaTeX and used the overpic pkg to write text wherever I choose. LaTeX rejected the file.. could not handle this PDF. Then I used the file command to see what I am dealing with:

$ file signature_page.pdf
signature_page.pdf: Java serialization data, version 5

WTF is that? I know PDF supports JavaScript (shitty indeed). Is that what this is? “Java” is not JavaScript, so I’m baffled. Why is java in a PDF? (edit: explainer on java serialization, and some analysis)

My workaround was to use evince to print the PDF to PDF (using a PDF-building printer driver or whatever evince uses), then feed that into LaTeX. That worked.

My question is, how common is this? Is it going to become a mechanism to embed a tracking pixel like corporate assholes do with HTML email?

I probably need to change my habits. I know PDF docs can serve as carriers of copious malware anyway. Some people go to the extreme of creating a one-time use virtual machine with PDF viewer which then prints a PDF to a PDF before destroying the VM which is assumed to be compromised.

My temptation is to take a less tedious approach. E.g. something like:

$ firejail --net=none evince untrusted.pdf

I should be able to improve on that by doing something non-interactive. My first guess:

$ firejail --net=none gs -sDEVICE=pdfwrite -q -dFIXEDMEDIA -dSCALE=1 -o is_this_output_safe.pdf -- /usr/share/ghostscript/*/lib/viewpbm.ps untrusted_input.pdf

output:

Error: /invalidfileaccess in --file--
Operand stack:
   (untrusted_input.pdf)   (r)
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1990   1   3   %oparray_pop   1989   1   3   %oparray_pop   1977   1   3   %oparray_pop   1833   1   3   %oparray_pop   --nostringval--   %errorexec_pop   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   %array_continue   --nostringval--
Dictionary stack:
   --dict:769/1123(ro)(G)--   --dict:0/20(G)--   --dict:87/200(L)--   --dict:0/20(L)--
Current allocation mode is local
Last OS error: Permission denied
Current file position is 10479
GPL Ghostscript 10.00.0: Unrecoverable error, exit code 1

What’s my problem? Better ideas? I would love it if attempts to reach the cloud could be trapped and recorded to a log file in the course of neutering the PDF.

(note: I also wonder what happens when Firefox opens this PDF considering Mozilla is happy to blindly execute whatever code it receives no matter the context.)

 

I’ve noticed this problem on infosec.pub as well. If I edit a post and submit, the form is accepted but then the edits are simply scrapped. When I re-review my msg, the edits did not stick. This is a very old Lemmy bug I think going back over a year, but it’s bizarre how it’s non-reproducable. Some instances never have this problem but sdf and infosec trigger this bug unpredictably.

0.19.3 is currently the best Lemmy version but it still has this bug (just as 0.19.5 does). A good remedy would be to install an alternative front end, like alexandrite.

 

A home insurance policy offers a discount to AAA members. The discount is the same amount as the cost of membership. I so rarely use a car or motorcycle that I would not benefit significantly from a roadside assistence plan. I cycle. But there are other discounts for AAA membership, like restaurant discounts. So my knee-jerk thought was: this is a no-brainer… I’m getting some benefits for free, in effect, so it just makes sense to get the membership.

Then I dug into AAA a bit more. The wiki shows beneficial and harmful things AAA has done. From the wiki, these points stand out to me:

AAA blamed pedestrians for safety problems“As summarized by historian Peter Norton, "[AAA] and other members of motordom were crafting a new kind of traffic safety effort[. ...] It claimed that pedestrians were just as responsible as motorists for injuries and accidents. It ignored claims defending the historic rights of pedestrians to the streets—in the new motor age, historic precedents were obsolete.”

AAA fights gasoline tax“Skyrocketing gas prices led AAA to testify before three Congressional committees regarding increased gasoline prices in 2000, and to lobby to prevent Congress from repealing parts of the federal gasoline tax, which would have reduced Highway Trust Fund revenue without guaranteeing consumers any relief from high gas prices.”

AAA fights mass transit“Despite its work promoting environmental responsibility in the automotive and transportation arenas, AAA's lobbying positions have sometimes been perceived to be hostile to mass transit and environmental interests. In 2006, the Automobile Club of Southern California worked against Prop. 87. The proposition would have established a "$4 billion program to reduce petroleum consumption (in California) by 25 percent, with research and production incentives for alternative energy, alternative energy vehicles, energy efficient technologies, and for education and training."”

(edit) AAA fights for more roads and fought against the Clean Air ActDaniel Becker, director of Sierra Club's global warming and energy program, described AAA as "a lobbyist for more roads, more pollution, and more gas guzzling."[86] He observed that among other lobbying activities, AAA issued a press release critical of the Clean Air Act, stating that it would "threaten the personal mobility of millions of Americans and jeopardize needed funds for new highway construction and safety improvements."[86] "AAA spokespeople have criticized open-space measures and opposed U.S. EPA restrictions on smog, soot, and tailpipe emissions."[87] "The club spent years battling stricter vehicle-emissions standards in Maryland, whose air, because of emissions and pollution from states upwind, is among the nation's worst."[88] As of 2017, AAA continues to lobby against public transportation projects.

Even though the roadside assistence is useless to me, the AAA membership comes with 2 more memberships. So I could give memberships to 2 family members and they would benefit from it. But it seems I need to drop this idea. AAA seems overall doing more harm than good.

AAA is a federation:It’s interesting to realize that AAA is not a single org. It is a federation of many clubs. Some states have more than one AAA club. This complicates the decision a bit because who is to say that specific club X in state Y spent money fighting the gas tax or fighting mass transit? Is it fair to say all clubs feed money to the top where federal lobbying happens?

(edit) And doesn’t it seem foolish to oppose mass transit even from the selfish car driver standpoint? If you drive a car, other cars are in your way slowing you down and also increasing your chances of simultaneously occupying the same space (crash). Surely you would benefit from others switching from car to public transport to give you more road space. It seems to me the anti mass transit move is AAA looking after it’s own interest in having more members paying dues.

Will AAA go the direction of the NRA?Most people know the NRA today as an evil anti gun control anti safety right wing org. It was not always that way. The NRA used to be a genuine force of good. It used to truly advocate for gun safety. Then they became hyper politicized and perversely fought for gun owner rights to the extreme extent of opposing gun safety. I wonder if AAA might take the same extreme direction as NRA, as urban planners increasingly come to their senses and start to realize cars are not good for us. Instead of being a force of saftey, AAA will likely evolve into an anti safety org in the face of safer-than-cars means of transport. (Maybe someone should start a counter org called “Safer than Cars Alliance” or “Better than Cars Alliance”)

I also noticed most AAA club’s websites block Tor. So the lack of privacy respect just made my decision to nix them even easier.

 

This is what my fetchmail log looks like today (UIDs and domains obfuscated):

fetchmail: starting fetchmail 6.4.37 daemon
fetchmail: Server certificate verification error: self-signed certificate in certificate chain
fetchmail: Missing trust anchor certificate: /C=US/O=Let's Encrypt/CN=R3
fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page. See README.SSL for details.
fetchmail: OpenSSL reported: error:0A000086:SSL routines::certificate verify failed
fetchmail: server4.com: SSL connection failed.
fetchmail: socket error while fetching from user4@server4.com@server4.com
fetchmail: Query status=2 (SOCKET)
fetchmail: Server certificate verification error: self-signed certificate in certificate chain
fetchmail: Missing trust anchor certificate: /C=US/O=Let's Encrypt/CN=R3
fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page. See README.SSL for details.
fetchmail: OpenSSL reported: error:0A000086:SSL routines::certificate verify failed
fetchmail: server3.com: SSL connection failed.
fetchmail: socket error while fetching from user3@server3.com@server3.com
fetchmail: Server certificate verification error: self-signed certificate in certificate chain
fetchmail: Missing trust anchor certificate: /C=US/O=Let's Encrypt/CN=R3
fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page. See README.SSL for details.
fetchmail: OpenSSL reported: error:0A000086:SSL routines::certificate verify failed
fetchmail: server2.com: SSL connection failed.
fetchmail: socket error while fetching from user2@server2.com@server2.com
fetchmail: Query status=2 (SOCKET)
fetchmail: Server certificate verification error: self-signed certificate in certificate chain
fetchmail: Missing trust anchor certificate: /C=US/O=Let's Encrypt/CN=R3
fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page. See README.SSL for details.
fetchmail: OpenSSL reported: error:0A000086:SSL routines::certificate verify failed
fetchmail: server1.com: SSL connection failed.
fetchmail: socket error while fetching from user1@server1.com@server1.com
fetchmail: Query status=2 (SOCKET)

In principle I should be able to report the exit node somewhere. But I don’t even know how I can determine which exit node is the culprit. Running nyx just shows some of the circuits (guard, middle, exit) but I seem to have no way of associating those circuits with fetchmail’s traffic.

Anyone know how to track which exit node is used for various sessions? I could of course pin an exit node to a domain, then I would know it, but that loses the benefit of random selection.

view more: next ›