| 06:27 |
whaack |
diana_coman: EOD Report: I only completed my revised article for TheFleet. I distracted myself for part of the day by responding to the concerns that arose from a meatwot friend having seen a comment from mp on ztkfg + then reading trilema |
| |
~ 3 hours 55 minutes ~ |
| 10:22 |
diana_coman |
whaack: lol, did you put their concerns to sleep at least? |
| 10:23 |
diana_coman |
jfw: that photo article made a lovely start to my day. |
| 10:37 |
diana_coman |
dorion: hardcore classicist this Chad friend of yours I gather; all downhill from beethoven, heh. |
| |
~ 4 hours 12 minutes ~ |
| 14:49 |
feedbot |
http://ossasepia.com/2020/02/07/thinkpad-in-gales/ << Ossa Sepia -- Thinkpad in Gales |
| |
~ 47 minutes ~ |
| 15:37 |
whaack |
diana_coman: maybe slightly but i don't think so. the politics are a 180 |
| 15:37 |
whaack |
180 degree turn* |
| 15:47 |
diana_coman |
whaack: well, the gain usually is simply to get them to engage (in this case to get them to comment on your blog first, on trilema then etc) rather than attempt the sort of turning on the spot anyway; unless you really want to apply that ever useful advice to "use a bigger hammer" to put ~everything to sleep, ofc. |
| 15:48 |
whaack |
diana_coman: what do you mean by "'use a bigger hammer' to put ~everything to sleep"? |
| 15:51 |
diana_coman |
whaack: lol, it's the "rule of (non)engineering" - if it doesn't work/fit/start/stop, you can *always* use a ...bigger hammer; literally! |
| 15:52 |
diana_coman |
in the case of other people's concerns, it usually goes along the lines of giving them worse to be concerned about. |
| 15:53 |
whaack |
aha |
| |
~ 4 hours 11 minutes ~ |
| 20:05 |
whaack |
jfw: do you use znc with yrc / have instructions anywhere for setting that up? |
| 20:08 |
dorion |
http://logs.ossasepia.com/log/ossasepia/2020-02-07#1017693 - for sure. though he's also been known to indulge Tool and Jimi Hendrix since I suppose Bach and Mozart didn't express every emotion. |
| 20:08 |
ossabot |
Logged on 2020-02-07 06:49:25 diana_coman: dorion: hardcore classicist this Chad friend of yours I gather; all downhill from beethoven, heh. |
| 20:08 |
dorion |
whaack nah. we run yrc on a server in a tmux. |
| 20:12 |
jfw |
diana_coman: http://logs.ossasepia.com/log/ossasepia/2020-02-07#1017692 - glad to hear it and the thinkpadingales one made a lovely start to mine. |
| 20:12 |
ossabot |
Logged on 2020-02-07 06:35:39 diana_coman: jfw: that photo article made a lovely start to my day. |
| 20:13 |
jfw |
whaack: I have not used bouncers and don't know how they do their thing; if they're supposed to be compatible with a normal irc server then I expect it should work |
| 20:14 |
whaack |
jfw: There's a property "login name" separate from "nick" on my current client, and I believe that needs to be set appropriately for znc. The other property that gets used is 'server password' |
| 20:16 |
whaack |
jfw: But I think I will use your tmux method. |
| 20:16 |
jfw |
normal irc has a username separate from nick as well, and yrc can give a password on login |
| 20:18 |
jfw |
It doesn't look like I've made it possible to set the username differently from the nick though. Some clients implicitly grab it from your OS username which I always thought kinda rude. |
| 20:20 |
d41r |
how do you guys import all the wot keys into your gpg client? |
| 20:23 |
jfw |
d41r: typically one only imports those in one's own WoT or that one is otherwise interested in |
| 20:24 |
d41r |
that sounds like mining bitcoin with a pencil and a leaf of paper |
| 20:24 |
jfw |
lol, do you expect to have meaningful & important conversations with everyone in there or what? |
| 20:26 |
d41r |
what is the purpose of the WOT if you can't use it? |
| 20:26 |
d41r |
(unless doing a lot of manual stuff) |
| 20:29 |
d41r |
btw, something's broken, my nick still does not appear on the "D" page |
| 20:31 |
dorion |
d41r join #trinque and ping raise it with trinque there. note that http://wot.deedbot.org/5092C1145245B67517A6CC1C8FE0D8F9352472FC.html exists. |
| 20:32 |
d41r |
dorion: thanks, i guess you need rating before appearing on the list, or something like that |
| 20:34 |
jfw |
d41r, again with not answering the question. What do you suppose automation would achieve there? Why would I care about the set of all alleged identities that've been announced somewhere, except perhaps for research projects? |
| 20:36 |
billymg |
http://logs.ossasepia.com/log/ossasepia/2020-02-05#1017311 << very productive, including a meeting about the fiber optic line with the technician you put me in touch with (thanks again) |
| 20:36 |
ossabot |
Logged on 2020-02-05 13:10:30 whaack: travel_billy: how has the rest of your trip turned out? |
| 20:37 |
whaack |
billymg: nice. |
| 20:37 |
billymg |
back in tx now, with a multipage todo list in my notebook to chew through before the move date |
| 20:38 |
billymg |
yeah, turns out the only fiber service they can offer me is enterprise tier, not residential (which he explained is split between 5 businesses vs. residential which is split between 25 homes) |
| 20:39 |
billymg |
cost for 10/10 is about $380/mo |
| 20:39 |
billymg |
3 month buildout to lay the cable, need to first fill out an RFP to get a detailed proposal from them |
| 20:40 |
billymg |
going to do that and also research to see if there are other ISPs serving that area |
| 20:41 |
billymg |
(perhaps BingoBoingo can weigh on whether this all sounds legit or not based on his experience with latam internet service) |
| 20:41 |
whaack |
billymg: does your place have dsl in the meantime? |
| 20:41 |
d41r |
jfw: "Obtaining the PGP/GPG key of an author (or developer, publisher, etc.) from a public key server also presents risks, since the key server is a third-party middle-man, itself vulnerable to abuse or attacks. To avoid this risk, an author can instead choose to publish their public key on their own key server (i.e., a web server accessible through a domain name owned by them, and securely located in |
| 20:41 |
d41r |
their private office or home) and require the use of HKPS-encrypted connections for the transmission of their public key. For details, see WOT Assisting Solutions below." from https://en.wikipedia.org/wiki/Web_of_trust#Problems |
| 20:42 |
billymg |
whaack: previous owners had _something_, will have to look into that as temp measure as well |
| 20:42 |
d41r |
just a reminder that wot.deedbot.org is totally unencrypted |
| 20:43 |
whaack |
lol @ wikipedia article explaining how something else is 'vulnerable to abuse or attacks' |
| 20:43 |
billymg |
but i think best option might be one of those cellular hotspots and a data plan, provided i can find one that has LTE coverage where i am (which i know exists because some people visiting the property were getting it on their phones) |
| 20:43 |
whaack |
billymg: yes, you're going to want the cellular hotspot + data plan anyways |
| 20:43 |
d41r |
in the case of mitm or any other attack on wot.deedbot.org we're basically... fucked |
| 20:44 |
d41r |
it's 100% unencrypted and centralized |
| 20:44 |
jfw |
d41r, how would you authenticate someone's dns private home hkps etc without already having their key? |
| 20:45 |
d41r |
is that the case of wot.deedbot.org? |
| 20:47 |
jfw |
not sure what you mean there really. |
| 20:48 |
d41r |
deedbot's wot is 100% unencrypted and centralized |
| 20:48 |
jfw |
is it possible deedbot serves a malicious key? sure, as it's possible someone registers "d4lr" to try some social engineering, or my name isn't really jfw. Building trust starts from human relationships, the tools follow |
| 20:49 |
jfw |
what would encryption accomplish anyway? public keys necessarily are... public |
| 20:50 |
BingoBoingo |
billymg: This doesn't sound too abnormal. You probably want to ask everyone in the country, if everyone needs to build to get to you... You're essentially working as a small rural ISP yourself. |
| 20:51 |
BingoBoingo |
And if they are calling the service "enterprise" all of the 10/10 should be yours. |
| 20:52 |
billymg |
BingoBoingo: that was the only part that sounded funny to me too, "enterprise" being split between 5 |
| 20:52 |
dorion |
d41r it's always best to meet in person and exchange keys, which many people have already done, which means someone will probably notice if someone tries to mitm and they'll speak up ;) |
| 20:52 |
BingoBoingo |
d41r: jfw any myself met, exchanged key fingerprints, ate very cheesy pizza, good times to be had breaking out of the 'anon' bubble |
| 20:53 |
billymg |
and yes, when he told me this i started thinking about using this for my personal hosting needs, although i'm not sure if it's a good idea to mix blog/bouncer hosting with what will also be my home internet |
| 20:53 |
dorion |
d41r then jfw brought me one of BingoBoingo's business cards with fingerprint and voila. |
| 20:54 |
whaack |
d41r: And I have BingoBoingo's fingerprint through meeting jfw |
| 20:54 |
BingoBoingo |
billymg: At the very least see what every ISP in Costa Rica can offer your place. I suspect that the monthly price per bps can drop quite a bit if you get more speed. |
| 20:54 |
jfw |
I'm patient 0 of the dreaded uruguayo identivirus! |
| 20:55 |
d41r |
jfw: an attacker could substitute a considerable amount of public keys with his own public keys, at any moment, and intercept private communication channels (irc, email, etc.) |
| 20:56 |
BingoBoingo |
d41r: One advantage of blog keeping is being able to publish your own keys for folks to compare. |
| 20:56 |
d41r |
...on unencrypted web servers |
| 20:56 |
BingoBoingo |
"An attacker can" many things. |
| 20:56 |
dorion |
d41r there's no substitute for getting to know people. |
| 20:56 |
d41r |
then yet again... what is the purpose of having wot.deedbot.org? |
| 20:56 |
BingoBoingo |
d41r: What's your understanding of the "Heartbleed" episode |
| 20:56 |
billymg |
BingoBoingo: makes sense |
| 20:57 |
BingoBoingo |
<d41r> then yet again... what is the purpose of having wot.deedbot.org? << Repository for ratings. |
| 20:57 |
d41r |
BingoBoingo: a lot of work updating stuff, I remember |
| 20:57 |
BingoBoingo |
d41r: It allowed reading arbitrary bits of memory while creating no loglines on the victim machine. |
| 20:57 |
d41r |
BingoBoingo: great, that you need to manually verify and manually replicate on your own personal WoT |
| 20:58 |
d41r |
I mean, this is not a new problem, Keybase exists for a reason. |
| 20:58 |
BingoBoingo |
d41r: This is actually something a bit of scripting can assist, but yes. It is my WoT and keybase doesn't exist for it. |
| 20:59 |
whaack |
jfw or anyone else: does your normal work flow involve being in an x session? if so, do you use a tool to hotkey the movement of windows? |
| 21:01 |
jfw |
whaack, I sometimes use tiling window managers and otherwise might use alt-click to drag them around, not sure what movement you have in mind though |
| 21:01 |
BingoBoingo |
d41r: I didn't acquire all the public keys in my keyring all in one gulp if that's what you are asking. |
| 21:01 |
BingoBoingo |
It happened 2012/2013 through present and it is ongoing |
| 21:03 |
whaack |
jfw: i'm looking for a way to hotkey "move + resize active window to left/right half of screen" (and top/bottom left/right corner) |
| 21:05 |
whaack |
looks like yes, the term for what i'm looking for is a 'tiling window manager' |
| 21:05 |
jfw |
whaack: I don't know a thing that does specifically that other than it's what the tiling ones do full-time, though many have hotkeys for vertical or horizontal maximize |
| |
~ 1 hours 51 minutes ~ |
| 22:57 |
dorion |
d41r how does PKI protect you from CAs diddling the WoT ? |
| 22:59 |
d41r |
it doesn't |
| 23:00 |
dorion |
good. so why do you want it ? |
| 23:00 |
d41r |
when I said I wanted it? |
| 23:01 |
d41r |
pki is shit, bro, it's literally technological shit |
| 23:02 |
d41r |
the epitome of centralization |
| 23:03 |
d41r |
what I did say is that we don't even have that level of shitty protection, we're totally unprotected right now, we only got the centralization and no protection, not even a shitty one |
| 23:04 |
d41r |
I think I'll work on solving that. |
| 23:06 |
dorion |
d41r hm, perhaps I inferred incorrectly, apologies. |
| 23:07 |
d41r |
no worries |
| 23:08 |
dorion |
I disagree that there's no protection though. e.g. I put the probability of me having an incorrect key for jfw at ~0%. |
| 23:10 |
d41r |
well, yeah, maybe next time I aqcuire teleportation powers I'll meet each one of you while wearing a mask (muh anonymity) so that we can exchange keys, jokes, and drink beer together |
| 23:10 |
dorion |
and , e.g. if he did end up issuing a new key signed by the one I now have, I'd not allocate the same level of trust until I verified it in person. |
| 23:12 |
d41r |
meanwhile, as I don't have many teleportation powers (or money for plane tickets, for that matter), I'll go with a more remote approach, like keybase.io, just decentralized |
| 23:16 |
d41r |
for now, if anyone wants to pm me, you can use this script I wrote: http://dpaste.com/32P2SSB , and a lot of trust on this link: http://wot.deedbot.org/5092C1145245B67517A6CC1C8FE0D8F9352472FC.html |
| 23:23 |
dorion |
d41r don't take it personal, but I wouldn't hold my breath for that if I were you. I'm open to be corrected, but I think it's safe to say the logs are a big reason people are here. |
| 23:28 |
d41r |
I'll put it this other way: don't pm me unless you encrypt your messages. |