General January 2015

general@lists.hackerspace.pl

34 participants
36 discussions

Fwd: Re: [Cryptography] open hardware as a defence against state-level attacks
by rysiek 14 Jan '15

14 Jan '15

Joł, takie pytanie się pojawiło w pewnym zakątku Internetów. Podrzucam jako ewentualną inspirację. ---------- Treść przekazywanej wiadomości ---------- Temat: Re: [Cryptography] open hardware as a defence against state-level attacks (...) Where are the open fabs for makers instead of submitting open designs to closed fabs? It's 2015, crowdfunding, open source, non-profits, and public monitoring are done. We're not talking TSMC scale tech here, but a basic backyard shed capability to print useable, useful, marketable silicon. ie: Print off some USB RNG's, radios, DACs/ADCs, even 74 series and discretes, whatever works. Then with that open initial platform, start taking commercial production contracts (even private runs) to pay for growing the open fab. Even including openly replicating yourself. What is the minimum capital and endowment needed to gear up to put 1k, 100k, 500k, 1M, 100M, 1B gates that someone, including makers, would buy down on silicon? ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

NAS (не догонят)
by Piotr Szotkowski 11 Jan '15

11 Jan '15

Drugare, dojrzałem do rozwiązania problemu pt. „mam cztery dyski przenośne, wszystkie wolne, jeden już chyba nie żyje, nie wiem co na czym, a i tak korzystam tylko w domu” sposobem pt. „kupię jedno coś z dużą pojemnością i podłączę do routera” (tak, spróbuję przez te skromne 100 Mbit/s – dwutygodniowe dziecko dzień w dzień udowadnia, że mam więcej cierpliwości w sercu niż by ktokolwiek podejrzewał). Coś polecacie gotowego? Kupić ileś-tam dysków w RAID-zie? Co jest teraz modne fogle? — Piotr Szotkowski -- Internet of things that should not be. [cms the chaos wizard]

6 5

Kocham mój blender miłością krwawą
by spin＠hackerspace.pl 10 Jan '15

10 Jan '15

Siema Właśnie possałem sobie set acidcore'owy z YT, wywaliłem z niego ścieżkę wideo, dociąłem i przekompresowałem pod rozmiar (20MB), i wyeksportowałem do MP3. Zajęło mi to jakieś 15 minut, razem z obczajeniem jak to zrobić i czasem renderowania audio. Odsłuch na żywo z renderowanego pliku w VLC. Kuźwa, blender, ty szatanie.

1 1

Looting the corpse: Makerbot and the death of the opensource 3d printer market
by spin＠hackerspace.pl 09 Jan '15

09 Jan '15

Due to time constraints I'm gonna be brief (ok, I intended to. Fuck it.), and I'm gonna write in English so this can reach a wider audience. Perhaps. Or not. "Be wary what you wish for" they say, eh? Anyway! DISCLAIMER: THis stuff is full of opinions. Don't grow attached to them, cause I don't. I make a lot of jokes, and when people tell me I'm crossing the Red Line, I tell them that animu was pretty rad. I kind of eye affectionately the (xirdal's?) Cupcake makerbot that's in the hackerspce, myself working with a clone of the dual-headed wooden Replicator, and did some stuff with 2X, and that model starts to show some bad design decisions. By 'did stuff' I mean like, pulled it apart and went at it with a file, lathe, drill press, sandpaper, etc. Come to think of it, I rarely print anymore, and my relationships with printers became more intimate. It's kind of fitting that the Hackerspace is located in a dungeon. Ahem. So. I'm a latecomer to every party (1). The early makerbot printing hype passed before my eyes unnoticed. I was observing it from a distance, not sure what it was about, and whether it would be nice/good/beneficial to participate. Now I know it was about a direction. I browsed old galleries, followed old links, read old blogs... and it looks like a postwar landscape. In a kind of a sad way, but then again, I enjoy post-apo muchly. So we had a wonderful team. Hoeken and Pettis were a very good pair, regardless of what people seem to think about Pettis, and what Hoeken may be doing out in China. A hardware guy and a marketing guy, a great brand... and suddenly you have a lot of people developing things for a de facto corporation! I mean, the way they scaled up was amazing. And the amount of research and development was crazy awesome. And Thingiverse was a brilliant idea that hit the spot. And they were on a right path, perhaps one to parallell Elon Musk's (except he was only one guy). They could have changed the way hardware was developed. There was a lot of dedication from the user base, a lot of belief, a lot of wanting more, a lot of participating in something bigger, and a lot of making something awesome. And it was all heading the right way, seemingly, following Hoeken's vision of a machine that can make stuff (not only print, mind you). I've seen things you people wouldn't believe. Attack ships on fire off the sho... Well, ok, I've seen mods of this device that were brilliant. They were gamechangers. They are from, what, 2009? Those things didn't feel like free gold,jewels and uranium, they felt like cheat codes, even when you find them 5 years later! Those were the things that went 'holy fuck'(2) in my head for 72 hours duration at 7 hertz. And they were usermade, often modelled with software I would't touch with a dick-tentacle ripped out of alien cloaca, stiffened with wire and wrapped in paper towels. (Note the alliteration. I couldn't do that if this were not English.)(3) Now, if you look at that landscape, it's all there, like juicy, fruitful ruins of dead cities. (4) Beause there is no one who could pick up what Makerbot left off. Many of their solutions are beginning to be cloned, successful, and closed source. I could name companies. There are several. Oh, Opensource? Cannot patent? Sorry dear friend, but this is not how it works. I could patent my mom's tits, and she would have to shave them off, or face a $6M lawsuit. Well, she would win, eventually... ... but not until she paid up the costs. See a hook here? Or, should I say, a bandsaw? Skeinforge, oh god, this is a 3d printer... printu... printing...person's? dream. I could do things to it that the Shortbus movie is too prude to show. It's years ahead of everything out there, and it's from 2012 (last update, last time I checked). I remember people being hyped about Slic3r and then Makerware and Cura, and now I am delighted to see how many battle hardened 3d printerers (rererers) return to this glimmering sapphire of duct tape, paper bags, styrofoam and wood glue, and produce the most amazing results. Hell, this bunch of Python scripts now sits behind several closed source applications, or is bundled with them contary to the license, AND NO ONE GIVES A HAMSTERFISTFUCK.(5) It's all out there, all those ruins plundered by everyone, closed into black boxes, driven to their enclaves like war loot, and sold as dumb shiny blobs with a sticker "NEW"!. And Ultimaker disappeared somewhere, or maybe they are outside of this Fallout mind-map of mine. I don't feel that there is this soul of making crazy stuff surrounding them as it was with Makerbot, I appreciate what they do, but it feels like careful marketing more and more. Like wanting a piece of cake on your boss's birthday party. And in the end, all this stifles development, pushes us back into our human condition. When my kids grow up, I'm gonna tell them a story, along the lines of "Once upon a time we had a hardware equivalent of Linux that got sold to a big corporation that could have became Redhat, but they chose to become Microsoft, and it's another 40 years since they decided to release something opensource." ******** But it all proved a point. Today we have full-metal-frame printers that look nice and cost tons of money. And people buy them. The fun thing is that they are in no way better than the second lasercut generation of the makerbots. I've printed those things to death. Several deaths actually, break it fix it, as the saying goes. I could print anything on them. While the closed ones? Well, they go like bouncers in a night club when you grab the wrong kind of ass one time too many. Protip: you don't get a refund, unless you count the bruises. Hell, when I pay for it, I want to grab ass all I like! I'll stick with my opensource stuff that makes those squealing startup efforts sound like a pig farm fed tortillas. The amount of R&D and released projects and clones this hardware model has to offer is unprecedented. Makerbot was the first working open source firm, and after all that time, I think I'm fairly certain I've pinned down most of the elements that made it tick (in b4 tock, in b4 Intel). It has proven that the open company model, the prosumer-participating company model, the let's-do-stuff-together and our-clients-are-a-part-of-us model has amazing benefits to offer. It's like crowsourced design thinking(6). What I'm worried about is how much fucking time is it going to take this species to discover that cooperations makes things 600% more awesome? A single then-opensource company pushed the development of a device stagnant for 30 years to unprecedented levels within 3-4 years, on a limited budget. Once it went closed-source, the market divided, shit gone closed source, development not only became stagnant but actively REGRESSED. It will take 3 to 4 generations of closed source FFF printers to match what Makerbot was before it was sold. ********* Now, what's worrisome is that the Makerbot was a one of a kind company. OK, PeachyPrinter may be another, but time will tell. Most people at hackerspaces are more interested in their corporate jobs and their Dells/Thinkpads or in staying homeless and angry than actually BETTERING THE HUMAN CONDITION. I would even say that they are actively UNCOOPERATIVE, they are like an amorphous liquid that fucking STAYS LIQUID for, like, fucking EVER, be it polar winter or equatorial monsoons. And if they do finally harden, we get Makerbot, that breaks easily under tension (or repeated stress. Like amorphous metals. Durr hurr.) I am not satisfied with this state of affairs. I am majorly pissed, actually. Pissed, disillusioned, and busy working my ass off to the limits (dis?)allowed by biology, for this shit will not stand.(7) Bring it on, world, we'll have a topless battle and I will gouge your eyes out with my nippless, because they're as hard as hell, and I'm not gonna take it anymore! (yes, this is a movie reference, no don't goggle it, I'm a duckduckfag, in b4 Amazon. All is futile, go watch External World). ********** (1) and I always bring a taser (2) in Christian mythology Angels don't have sex organs, you have to carve your way in. (3) if anyone tells you that studying Arts is useless, show them this message. My state educated me to my full ability when it comes to writing these things. Poland, you're the best, even if your english is funny. (4) I didn't mean the corpses you sick fuck. (5) Ok, I give, but that could possibly put me in conflict with animal right activists. (6) I hate... uh, ok, I'm sceptical towards this term, it was annexed by the wrong kind of people. To both those terms actually, it feels like they blanket-cover more shit than content. We should let it dry in the sun for a while and pull off the blanket, the shit would stick and we'd end up with the real deal. I wonder if you could commercialize this process in chemistry. Or sociology. Or eugenics... (7) Unless you imagine alternate history with Columbus and the egg...

5 6

Network Filter: SECURITY : OPENBSD VS FREEBSD
by viq 09 Jan '15

09 Jan '15

http://networkfilter.blogspot.com/2014/12/security-openbsd-vs-freebsd.html -- viq

3 2

SAGE, czyli zamiennik WolframAlpha na GPLu
by rysiek 09 Jan '15

09 Jan '15

Elo, może komuś się przyda: http://sagemath.org/ -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

2 2

Fwd: Meet the iMarker, Russian targeted ad service which analyze your traffic on ISP side
by rysiek 09 Jan '15

09 Jan '15

Intredasting... ---------- Treść przekazywanej wiadomości ---------- Temat: Meet the iMarker, Russian targeted ad service which analyze your traffic on ISP side Data: czwartek, 8 stycznia 2015, 20:45:13 How it works? ISPs install the iMarker equipment and mirror all user's traffic on it (Russian surveillance system, SORM, works the same way). Software takes time, URL and HTTP Headers from HTTP requests. Then scraper with IP 92.242.35.54 and User-Agent WebIndex follow every visited URL and analyze its content. All this information used to build a profile for user. They says that information is removed right after analysis, and software saves only result of that analysis. Their website lists that they categorize users by search queries, online shopping activity, time of visits, activity on social networks, keywords on visited pages, visited websites, social-demographic info, such as sex, age, marital status, and education level, and then they use that data to distribute users for consumers groups. Every user has some kind of pseudonymous ID with linked profile. It's also has an opt-out option http://www.imrk.net/status How many users affected? They says it's 38 million people all over Russia. Minister of Communication Nikolay Nikiforov said in 2014 there was 62 million people in Russia using Internet, 56m of them do it every day, so it's 61% of Russian Internet users. iMarker's website list Akado, Rostelecom, ER-Telecom, NetByNet, Qwerty, and TTK as ISPs that installed iMarker's equipment. How to check if this affects you? If you are a client of Russian ISP, you can check it here http://imarker.valdikss.org.ru If you own a webserver, grep the logs for connections from 92.242.35.54. How do check script works? It generate a random link and wait for 3 seconds for connection from iMarker's IP address. How long iMarker works? Company start work on January 2010, commercial sells started on August 2011. http://imarker.valdikss.org.ru/ — script that checks if your ISP use iMarker http://www.vedomosti.ru/tech/news/15669231/bolshoj-reklamnyj-brat — report on iMarker from 2013, says they are ready to provide free DPI to ISPs in exchange of user's data (Russian) http://sporaw.livejournal.com/347832.html — blog post quoting private mails from iMarker's crew (Russian) http://www.imrk.net/privacy — TOS (Russian) http://habrahabr.ru/post/247465/ — blog post about iMarker (Russian) http://www.imarker.ru/ — iMarker website (Russian) http://www.imrk.net/status — opt-out page (Russian) http://minsvyaz.ru/ru/news/index.php?id_4=44571 — Nikiforov's statement on number of Russian Internet users (Russian) -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Microsoft patch batch pre-alerts now for paying customers ONLY
by rysiek 09 Jan '15

09 Jan '15

Welp, prosz: http://www.theregister.co.uk/2015/01/09/ms_restricts_security_pre_alerts/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Microsoft is facing fierce criticism over its decision to make pre- notification of upcoming patches available only to paid subscribers. The Advance Notification Service (ANS) formerly made information on upcoming software patches available to the public but from now on the information will be restricted to “premier” customers and some other select partners. Chris Betz, senior director of the Microsoft Security Response Center, explained in a blog post that Microsoft was restricting distribution of the patching pre-alert out of a desire to reduce "clutter". Betz argued that the security heads-up notice was no longer of much utility to the majority of its customers. We are making changes to how we distribute ANS to customers. Moving forward, we will provide ANS information directly to Premier customers and current organisations involved in our security programs, and will no longer make this information broadly available through a blog post and web page. ANS has always been optimized for large organizations. However, customer feedback indicates that many of our large customers no longer use ANS in the same way they did in the past due to optimised testing and deployment methodologies. While some customers still rely on ANS, the vast majority wait for Update Tuesday, or take no action, allowing updates to occur automatically. More and more customers today are seeking to cut through the clutter and obtain security information tailored to their organizations. Rather than using ANS to help plan security update deployments, customers are increasingly turning to Microsoft Update and security update management tools such as Windows Server Update Service to help organize and prioritize deployment. Customers are also moving to cloud-based systems, which provide continuous updating. Jon Rudolph, principal software engineer at Core Security, argued that rather than "just cutting through the clutter", Microsoft is "hiding their security report card from the general public". "The vulnerabilities teach us something every month about software, security, mistaken assumptions, and the quality of the product, and (indirectly) threats, whether we currently use that product or not," said Rudolph. "It would appear the list is still available for a price, and by encouraging users toward the new myBulletins, Microsoft takes some control away from the users on this transition." Ross Barrett, senior manager of security engineering at Rapid7, the developers of the Metasploit penetration testing tool, is even more critical. “This is an assault on IT and IT security teams everywhere," Barrett commented. "Making this change without any lead-up time is simply oblivious to the impact this will have in the real world. Microsoft is basically going back to a message of 'just blindly trust' that we will patch everything for you. Honestly, it's shocking.” In the absence of a published pre-alert, we don't know what patches or how many will appear on the first Patch Tuesday of 2015, which is due to drop on 13 January. Whether or not there will be a patch to address a local privilege escalation vulnerability in Windows 8.1 discovered by Google and published in late December is one key point of interest for next week, as noted in a blog post by Wolfgang Kandek, CTO of Qualys, here. ® - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Nowy VMM - novm
by Robert Sebastian Gerus 08 Jan '15

08 Jan '15

https://github.com/google/novm -- iNsanity!

5 25

Let's Encrypt
by viq 08 Jan '15

08 Jan '15

Darmowe CA od Mozilli, Google, EFF https://letsencrypt.org/ -- viq

15 37

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

General January 2015