General September 2014

general@lists.hackerspace.pl

46 participants
34 discussions

Start a nNew thread

Simply Secure
by viq 23 Sep '14

23 Sep '14

https://simplysecure.org/ -- viq

11 36

WebGL? oraz inne portable 3d formats
by spin＠hackerspace.pl 22 Sep '14

22 Sep '14

Witaj Generale Bounces (general-bounces(a)lists.hackerspace.pl) Zczaiłem że freecad ma exporter do WebGLa, i jaram się że on wypluwa plik htmlowy w którym zawiera wszystkie dane na temat modelu. Jest to dosyć wyjebane w kosmos, i jaram się tym jak sprzęgło forda mondeo w tatrach. W sensie jest jeden plik htmlowy który się wyświetla w przeglądarce, można to też dowolnie copypastować, etc. Truly portable 3d format i jebaj się flashu solonym sznurem konopnym. Czy to ma jakieś wady? w sensie kompatybilność, hulanie pod luniksem, ograniczenia szejderów, takie tam? Z tego co widzę to freecadowy eksporter posysa jeszcze jakiegoś JSa z cloudflare'a. Natomiast moim marzeniem jest mieć format 3d który odpalam sobie w przeglądarce do obrazków i on pikny oteksturowany śmiga i hula, ew. ma jakąśtam funkcjonalność (wciśnij przycisk żeby cośtam).

3 3

Fwd: [Cryptography] Shaming sites that send sensitive information over HTTP
by rysiek 22 Sep '14

22 Sep '14

Dobry tumblr jest dobry. ---------- Forwarded message ---------- From: Jerry Leichter Date: Fri, Sep 19, 2014 at 12:03 PM To: Cryptography My favorite: The NSA's web site *redirects HTTPS to HTTP*. Some kind of back-handed acknowledgement of what they do? http://httpshaming.tumblr.com ----------------------------------------- -- Pozdr rysiek

1 0

TOR users become FBI's No.1 hacking target after legal power grab • The Register
by viq 22 Sep '14

22 Sep '14

http://www.theregister.co.uk/2014/09/19/fbi_overseas_hacking_powers -- viq

3 2

MTM Little John: MIT's 3DP+CNC
by spin＠hackerspace.pl 21 Sep '14

21 Sep '14

http://mtm.cba.mit.edu/machines/mtm_lj/Site/MTM_Little_John.html MIT takie cudo zrobił jakiś czas temu. Me gusta tak trochie.

1 0

Middle-School Dropout Codes Clever Chat Program That Foils NSA Spying | WIRED
by viq 18 Sep '14

18 Sep '14

http://www.wired.com/2014/09/new-encrypted-chat-program-thwarts-nsa-elimina… -- viq

2 1

2xNibyarduino za koszt przesyłki
by Wiktor Przybylski 17 Sep '14

17 Sep '14

First things first: https://www.wish.com/c/53eed183a4b6b068a82f0f0d - Version Board ATmega328P UNO R3 CH340T Instead 16U2 & Free USB Cable for Arduino za 13 zł. Na wish.com jest akcja promocyjna z reflinkami - za zarejestrowanie sie z reflinka dostaje się $10 na zakup czegoś. Gdy rejestrujący się coś kupi, wówczas osoba która reflinka wysłała dostaje również $10. W przypadku zakupu powyższych płytek jedyny koszt jaki ponosisz to 4zł per towar (2 płytki to 8zł) Mój reflink to https://www.wish.com/s/4fmbpL - za każdy giftcode które dostanę jeśli ktoś z was się skusi i skorzysta kupuję 2 takie płytki dla Hackerspace Kraków. Po rejestracji wish zachęca do instalacji swojej apki która ma cholernie dzikie uprawnienia których wymaga do instalacji - nie trzeba jej zasysać, zarejestrowane konto zasila się i bez tego. Miłych zakupów. -- Pozdrawiam. Wiktor Przybylski

1 1

Fwd: RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4
by rysiek 16 Sep '14

16 Sep '14

Also relevant. ---------- Treść przekazywanej wiadomości ---------- Temat: RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4 Data: poniedziałek, 15 września 2014, 01:02:37 Od: coderman Do: cpunks <cypherpunks(a)cpunks.org> first and foremost: WPA2 does NOT prevent an adversary able to inject packets at you from downgrading crypto to flawed RC4. due to odd forgotten legacy protocol bits, every implementation of WPA2 that i have tested is vulnerable to an active downgrade to TKIP/RC4 while still being "WPA2" and still showing all signs of using strongest security settings. let me re-iterate: _WPA2 only_ as a setting on router or client device does not prevent an active RC4 downgrade when using WPA2. AES-CCMP must be explicitly checked for, and this is not straightforward in end-user configuration or management utilities. RECOMMENDATION: use a wireless packet capture utility to specifically check for and alert on the presence of TKIP in a WPA2 session. this never happens under legitimate circumstances. [if you know of one, please tell me!] TKIP in WPA2 == Active injection attack by "well funded" adversary[0] --- i missed the renewed speculation that periodically swirls around RC4, e.g. "I feel but cannot prove that the day is coming when we learn that everything we ever encrypted with RC4 is very practical to decrypt" - https://twitter.com/marshray/status/505586082461655040 "Kind of annoyed SHA-1 is a "crypto emergency" when most of the web was encrypted with RC4 last year and almost no one cared" - https://twitter.com/bascule/status/509239990216163330 "This attack also applies directly to WPA/TKIP, with similar success rates, because of its use of per-packet keys for RC4. Here, the particular structure of WPA/TKIP keys means that a different set of biases are obtained in the first 256 bytes of RC4 keystream... For WPA/TKIP, the only reasonable countermeasure is to upgrade to WPA2." - http://www.isg.rhul.ac.uk/tls/ --- i have an advisory pending to full-disclosure with details on this WPA2 force downgrade to TKIP attack and a rant about Kaminsky's DEF CON 22 talk. advisory includes timeline indicating "in the wild" discovery of this technique late 2013. any earlier indications welcome! to be clear, this issue is with backwards compatibility in WPA2, and the manner in which a local attacker (8 miles or more with power and directional emission) can force the WPA2 protected session to use TKIP/RC4 while appearing to both client and network management equipment to be using WPA2 and best security configuration. (not WEP, not WPA) this is not about how RC4 is broken; i have no idea about the nature of the RC4 weaknesses enabling decryption, and this as yet unknown attack is certainly more effective than the attack described in CVE-2013-2566: "The attacks can only be carried out by a determined attacker who can generate sufficient sessions for the attacks. They recover a limited amount of plaintext. In this sense, the attacks do not pose a significant danger to ordinary users of TLS or WPA/TKIP in their current form. However, it is a truism that attacks only get better with time, and we anticipate significant further improvements to our attacks." the attacks observed in the wild did not rely on any additional or excessive packet creation to reach effectiveness. best regards, 0. About TKIP with WPA2... some tools know that TKIP is backwards compatible in WPA2, having written to spec. E.g. airodump-ng: "Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2." in my testing i have never seen a device that could do WPA2 but not AES-CCMP. if you find one i'd like to know about it! if you ever see a device+router pair that used to speak AES-CCMP over WPA2 suddenly using TKIP you are under active attack. finally, i mention "advanced attacker" because utilizing this downgrade also means applying an as yet unknown attack on the RC4 cipher to decrypt. ----------------------------------------- -- Pozdr rysiek

3 3

Blender głupcze
by spin＠hackerspace.pl 16 Sep '14

16 Sep '14

Siedzę dzisiaj w robocie na gościnnym kompie, muzy bym posłuchał, ale przerywać robotę i ściągać vlc mi się nie chciało/nie było czasu. No ale był blender. Wlazłem więc w blendra, wrzuciłem utwory do track editora, no i słuchałem sobie toola godzinkę jak nic. Wideo też odtwarza. I playlisty można robić. Retusz fotek też w blendrze nieźle idzie. I malować się da. Szkoda że bez warstw tylko. Jestem zdumiony tym jak ten soft potrafi wchodzić w interakcję z danymi, czasem się łapie na tym że czeszę foldery na dysku z jego wbudowanego file browsera. To cudo zaczyna zahaczać o desktopowy system operacyjny :P

10 21

Fwd: RFC 7359 on Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks
by rysiek 15 Sep '14

15 Sep '14

Elo, wygląda na relewantne dla różnych naszych Internetów. -------- Forwarded Message -------- Subject: RFC 7359 on Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks Date: Tue, 26 Aug 2014 18:23:00 -0700 (PDT) From: rfc-editor(a)rfc-editor.org Reply-To: ietf(a)ietf.org To: ietf-announce(a)ietf.org, rfc-dist(a)rfc-editor.org CC: drafts-update-ref(a)iana.org, rfc-editor(a)rfc-editor.org A new Request for Comments is now available in online RFC libraries. RFC 7359 Title: Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks Author: F. Gont Status: Informational Stream: IETF Date: August 2014 Mailbox: fgont(a)si6networks.com Pages: 12 Characters: 26506 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-opsec-vpn-leakages-06.txt URL: https://www.rfc-editor.org/rfc/rfc7359.txt The subtle way in which the IPv6 and IPv4 protocols coexist in typical networks, together with the lack of proper IPv6 support in popular Virtual Private Network (VPN) tunnel products, may inadvertently result in VPN tunnel traffic leakages. That is, traffic meant to be transferred over an encrypted and integrity- protected VPN tunnel may leak out of such a tunnel and be sent in the clear on the local network towards the final destination. This document discusses some scenarios in which such VPN tunnel traffic leakages may occur as a result of employing IPv6-unaware VPN software. Additionally, this document offers possible mitigations for this issue. This document is a product of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/rfc.html Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor(a)rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 ----------------------------------------- -- Pozdr rysiek

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

General September 2014