Binaries for v0.18.3.3 are now available at getmonero.org

<d​ave.jp:matrix.org> Does this have MRL 108/109 patch ?

Can whoever runs the Monero Git repository publish the latest source code? The latest version on Github is still 0.18.1.0-c8214782f.

Because the source code Tarball is completely useless when it comes to compiling Monero by yourself.

remiliascarlet: compile release branch or the tag

not master branch

That one is 3 weeks behind, just like master.

not sure what you mean

there hasn't been anything merged since

I mean that the `release-v0.18` branch is 3 weeks behind, same as `master`.

it's not behind

And yet a new version of Monero came out only 1 hour ago?

yes, it took a while to update the website and put out the release

And if it's not behind, then why is the compiled binary on version 0.18.1.0-c8214782f.?

because you compiled the master branch and not the release branch

master branch isn't kept up to date with version number changes

release-v0.18 and v0.18.3.3 tag is exactly what was released today

I'll check a bit later, I'm in the middle of compiling (I had to copy over the entire ./external directory from the Git repo into the source of the Tarball to get the compilation to work).

And since I'm compiling on a Core 2 Duo P8700 machine, it will take a while.

<k​orgprivacy:matrix.org> Ring Signatures for Secure Online Voting w/ Vasilii Rogin of CryptoPoll / EPI 305 (MT 305)

<k​orgprivacy:matrix.org> TODAY'S 🎙SHOW: Douglas Tuman interviews Vasili, a software developer from Helsinki, who has developed an application called CryptoPoll that utilizes the ring signature concept from Monero.

<k​orgprivacy:matrix.org> The application aims to enable anonymous voting, surveys, and whistleblowing by leveraging the privacy features of ring signatures. Vasili demonstrates how it works and explores potential use cases for CryptoPoll.

<k​orgprivacy:matrix.org> Watch Here (YouTube) ➡️ youtu.be/83ygMo5Ml4M

<k​orgprivacy:matrix.org> Watch Here (Odysee) ➡️ odysee.com/@MoneroTalk:8/ring-signatures-for-secure-online-voting:9

<k​orgprivacy:matrix.org> Listen Here 🎧: monerotalk.live/monerotalk-305

<k​orgprivacy:matrix.org> Coffee & Monero, Go to Gratuitas.org today!

<k​orgprivacy:matrix.org> Monerotopia23 confer vids: monerotopia.com/videos

<k​orgprivacy:matrix.org> FOLLOW US monero.town/u/monerotalk & mastodon.social/@monerotalk

<k​orgprivacy:matrix.org> Thank you to sponsors, u/cakelabs and u/Stealthex_io as well as u/sunchakr for making these interviews possible! And of course our listeners and supporters for making

<k​orgprivacy:matrix.org> Monero Talk possible!

<k​orgprivacy:matrix.org> Podcasts 🎧 :

<k​orgprivacy:matrix.org> iTunes: podcasts.apple.com/us/podcast/monero-talk/id1445930212

<k​orgprivacy:matrix.org> Spotify: open.spotify.com/show/60lQ05X8lcuXv…71fhi6hl7?si=SL2rlvDPS0q68169NlCrtQ

<k​orgprivacy:matrix.org> If you enjoy our show please Subscribe, Like, Share, Rate our YouTube Channel & Podcasts. This will help us grow and spread Monero content!

selsta: OK, confirmed that what you said is indeed correct.

<d​ave.jp:matrix.org> no of txs: 1445, size: 9266.54 kB

<d​ave.jp:matrix.org> Cheap attacker is back

It looks different this time

A lot of 146/2 transactions - over a hundred of them

It's probably the previous attacker shutting down and consolidating the outputs they used

It's over 15k outputs if my math is correct

I counted ~150 transactions

<e​ndor00:matrix.org> Big whoop

<b​asses:matrix.org> monero-project/research-lab #108

<b​asses:matrix.org> monero-project/research-lab #109

<b​asses:matrix.org> Still open

<b​rick:tchncs.de> Everyone, just a late reminder to any Australians to protest against cash being slowly removed from the system by getting some cash from an ATM. You may think "Big deal, we still got monero" but monero is not big enough yet. We must fight and buy ourselves time before cash is removed and everyones money is just a number in a corrupt companies data center.

<b​rick:tchncs.de> We lose cash now we lose our freedom for a long time.

"big deal, we still have monero"? Do you realize that this would mean you'd need to carry a smartphone everywhere just for basic payment??

I withdraw all my earnings immediately anyway, jokes on you!

BlueyHealer: "Do you realize that this would mean you'd need to carry a smartphone everywhere just for basic payment??" Order everything online to work around that problem.

Or maybe something like a paper-based QR-code if that's possible?

<b​asses:matrix.org> Are there any software for monero donations where it keeps track of all donations made to monero donation wallet address?

<b​asses:matrix.org> Useful for organizations

BTCPay supports Monero.

I tried to set it up before, but it was a total pain in the ass.

Another one is Shadowchat, but it's more useful for live streamers: gitgud.io/greyarea/shadowchat

<1​23bob123:matrix.org> like a monero wallet?

relavant bounty remiliascarlet bounties.monero.social/posts/77/7-0…pay-server-configuration-accessible . Monerokon used btcpayserver to run their donation rounds

<3​21bob321:monero.social> i give up its like using monero.social is on chain and matrix.org is LN

Woshlist (multicrypto) is somehow still functional, example here: rucknium.me/donate and theres also monerofund.org (which appears to be offline Rucknium)

basses: I would assume on getmonero.org

Matrix dot org is LN -> lol

plowsof: It's not just the configuration, the entire installation process is a complete pain, especially if you're like me who doesn't want to use cope containers.

ofrnxmr was working on a shell script to setup btcpayserver on android, in fact he succeeded

<b​asses:matrix.org> yep?

matrix.org lol

<b​asses:matrix.org> libreddit.bus-hit.me/r/Monero/comme…g_exchanges_in_2024_insights_from/#

Monero is tanking hard in value this week, holy fuck!

<3​21bob321:monero.social> Maybe the “usage” spammer is dumping it

<m​odul8:matrix.org> i only saw something about this on youtube in the evening, im surprised i watched it as it was from sky news. reddit failed here.

<o​cean:matrix.thisisjoes.site> reddit fails everywhere

<m​odul8:matrix.org> damn you made me check price. well...its not the only one tho.

sorry jp the spammer is not back

please hold.............

<t​rasherdk:monero.social> Compared to?

<t​rasherdk:monero.social> matrix.monero.social/_matrix/media/…ero.social/FrrmlvnNcwtaERRukYuEDUZR

basses, thank you for the reddit post

@basses

<b​asses:matrix.org> keepassxreboot/keepassxc #10535#issuecomment-2032146436

<b​asses:matrix.org> >

<b​asses:matrix.org> I prefer donations in a currency that can pay the bills.

<b​asses:matrix.org> > I prefer donations in a currency that can pay the bills.

So BTC/ETH and SOL (!!!) can pay the bills?

<r​ucknium:monero.social> plowsof: Thanks. Fixed.

BTC can indeed pay the bills... Of whoever receives its fees!

<b​asses:matrix.org> >Chainalysis will continue to be a part of those efforts in partnership with our government customers in Israel, the United States, and elsewhere. We look forward to sharing more updates on these efforts when possible.

<r​avfx:xmr.mx> Spam of the day is different, A lot more imput than outputs

<r​avfx:xmr.mx> matrix.monero.social/_matrix/media/…oad/xmr.mx/SuXsWfdcmaxwQThbudgAZWZh

<r​avfx:xmr.mx> matrix.monero.social/_matrix/media/…oad/xmr.mx/XEmWLWFCxNhONhZuZsanEUwM

<r​avfx:xmr.mx> matrix.monero.social/_matrix/media/…oad/xmr.mx/SlNPhaNWwQJpdmKFWJzQdmEW

You can't have a sustained spam if you have more inputs than outputs. You'll run out of inputs pretty quickly

I think it's just the previous spammer consolidating to get what's left of their funds

<r​avfx:xmr.mx> Yeah, really possible indeed

<b​igmenpixel:matrix.org> Why doesn't translate.getmonero.org work?

<b​asses:matrix.org> Moneroed

<b​asses:matrix.org> they are currently fixing it for about 1+ year

<b​asses:matrix.org> some real progress was happening lately to finally fix it but they got hit with matrix issues

<c​trej:matrix.org> thanks for the heads up

<r​avfx:xmr.mx> He is probably a bitcoin extremist

<r​avfx:xmr.mx> At the speed he closed the issue

<c​trej:matrix.org> A bitcoin extremist doesn't accept SOL

<c​trej:matrix.org> If he has enough money, the 50$ will find another use, idc

<r​avfx:xmr.mx> ohh, yeah, your are right

<b​asses:matrix.org> my wallet

<c​trej:matrix.org> send link to foss project you are working on

<b​asses:matrix.org> github.com/jermanuts/bad-opsec

<b​asses:matrix.org> does that count?

<c​trej:matrix.org> unfortunately no, but I also see no XMR address on that profile

<b​asses:matrix.org> (joke)

<b​asses:matrix.org> might add later in general

<b​asses:matrix.org> divestos, grapheneos, non google appstores

<b​asses:matrix.org> I just realized how most FOSS projects got VC funding or Gov funding (OTF for example)

<c​trej:matrix.org> also Signal

signal is sus

<r​avfx:xmr.mx> Consider most foss project backdoored and act accordigny. Been saying that since forever because I know how easy it is.

<r​avfx:xmr.mx> For XZ i think it's no fed but just dude wanting to make money selling 0day on dnm

<r​avfx:xmr.mx> And wen someone find a backdoor, it become a bug and it get fixed.

<s​iren:kernal.eu> According to your logic, consider all software backdoored

<s​iren:kernal.eu> matrix.monero.social/_matrix/media/…/kernal.eu/TbjcovGTBDzPGTcZwDsvjlNn

<s​yntheticbird:monero.social> According to my logic, consider all software safe from backdoors 👍️👍️👍️

<s​yntheticbird:monero.social> (my logic = no computer)

<c​trej:matrix.org> if you can choose between "assumed backdoored" and "assumed backdoored without the ability to check" one should still obviously pick the former

<b​asses:matrix.org> SimpleX is much better but already VC funded

<s​yntheticbird:monero.social> I prefer Signal UX/UI

I am concerned about probably 99% of Simplex messages going through the central servers.

<b​asses:matrix.org> conspiracy

<c​trej:matrix.org> and both are better then whatsapp or telegram. don't let perfect be the enemy of good

Like, you can selfhost, but chances are most of your conversations would still go through the central servers.

<s​yntheticbird:monero.social> It's end to end encrypted, without IDs, and you can use it through Tor. I wouldn't be so concerned.

syntheticbird, I HATE UX/UI of Signal. I want to use it without a smartphone, and it doesn't like being used this way.

<b​asses:matrix.org> jermanuts.vercel.app/posts/secure-apps

You have to use Signal-Cli, which is inconvenient AF.

Still probably better than Electron app tho

<s​yntheticbird:monero.social> you're right. Signal UX on desktop is shit

syntheticbird, yes, indeed, but it's still effective centralization.

That was easy, even Telegram had this! How much would it cost to just have a little box for the SMS registration code? But "fuck you, go eak your conversations to a smartphone first lolol"

I would not mind TUI, but this is not it. You type the command evety time you want to send or receive a message, which is annoying as fuck.

<r​avfx:xmr.mx> Assume proprietary software (Say windows) is backdored by Microsoft and the NSA

<r​avfx:xmr.mx> Assume FOSS is backdored by the Glowies if over 100 countries

<r​avfx:xmr.mx> So yeah, Assume everything is backdoored, it's easier lol

<r​avfx:xmr.mx> It's what I do.

<r​avfx:xmr.mx> My only safe machine is my 486 running on DOS

<b​asses:matrix.org> what outcome of that assumption?

<r​avfx:xmr.mx> It's extremely easy for a proper agency to backdoor foss.

<r​avfx:xmr.mx> 1 - You pull the git

<r​avfx:xmr.mx> 2 - You get your team to stufy the code and work a backdoor

<r​avfx:xmr.mx> 3 - You pull les of contributor with commit access

<r​avfx:xmr.mx> 4 - You run your intelligence on these peoples to know who is the best canditate for bribery

<r​avfx:xmr.mx> 5 - You contact the contributer, tell him about the .patch you made, give him 2M now and another 2M after it get commited in the code.

<r​avfx:xmr.mx> Microsoft won't allow backdoor that are not necessary (hence probably NSA only) The risk is too hard, if everyone can push backdoor in microsoft code and it get leaked, you can short Microsoft... The cost of doing stupid is very high.

why bother with money if you can just threaten him with death

<r​avfx:xmr.mx> You can't short Glibc or XZ...

<r​avfx:xmr.mx> Plus, unlike Linux code (Not specifically the Linux kernel but all the kitchen sink that get included in distribution) is barely audited.

<s​iren:kernal.eu> You'll get cancelled from the whole job market and possibly internet as the contributor (unless you were anonymous, it's actually rare to be that outside of Monero dev). Not sure if it's worth 4 million.

<s​yntheticbird:monero.social> why bother with hacking if you can just threaten people with death

<r​avfx:xmr.mx> Risk of leaking way higher.

<r​avfx:xmr.mx> Just give him half of the money, the high he will get from the digit hitting his account will make him push the patch without even looking

<b​asses:matrix.org> lool

<b​asses:matrix.org> What is the worse outcome?

<b​asses:matrix.org> no one uses Windows cuz backdoored?

<y​asabi:matrix.org> man I'm starting to suspect all the anti-FOSS posting this week is an IC op

<b​asses:matrix.org> nope

<r​avfx:xmr.mx> Then everyone use Linux even if more backdoored 😂

<r​avfx:xmr.mx> I'm not anti foss, I actually find that a better development model in general

<r​avfx:xmr.mx> But you can't just assume foss is better and more secure, most foss project don't get proper audit

<b​asses:matrix.org> Linus bullied bad code multiple times

<r​avfx:xmr.mx> And even proper audit can't detect well made backdoor

<b​asses:matrix.org> proper audit?

<b​asses:matrix.org> cuz it's expensive and most devs do it for free

<b​asses:matrix.org> unless you want to sponsor security audits

<r​avfx:xmr.mx> You think glowies will produce bad code? They have the capacity to provide good qualoity code with a small surprise in it

<b​asses:matrix.org> for them

<r​avfx:xmr.mx> But you just said it, who audit Linux? Only Linus?

<b​asses:matrix.org> NSA contributes to Red hat

<y​asabi:matrix.org> if you can't assume a codebase that is capable of being reviewed publicly is on average more secure than a codebase that cannot receive any public scrutiny then you should just defenestrate all your computers and go live in the woods

<b​asses:matrix.org> also made Ghidra

Windows can backdoor whatever they want and deny it happened.

<b​asses:matrix.org> who audits any software, with your logic

<s​iren:kernal.eu> Do you have an example of a project that went through a code audit that had a backdoor in it?

<r​avfx:xmr.mx> Do you know that microsoft developement is segmented, dev don't access to whole code. Onde dev working on X is done with a patch, another dev working on same X look at the code and if approved, the suppervisor who is also auditor for the group working on X also audit the code.

<r​avfx:xmr.mx> So every piece of code in Windows is double audited

<y​asabi:matrix.org> okay Ballmer

<b​asses:matrix.org> bruh lol

<r​avfx:xmr.mx> google.github.io/security-research/…s/linux/cve-2021-22555/writeup.html

<r​avfx:xmr.mx> Siren

<r​avfx:xmr.mx> If you count Linus audit as proper audit of course

<s​iren:kernal.eu> This is not a backdoor

<r​avfx:xmr.mx> Prove it

<r​avfx:xmr.mx> Like I said, most found backdoor are very likely to be dismissed as "bugs"

<s​yntheticbird:monero.social> thx for the link.

<r​avfx:xmr.mx> FOSS so great that backdoor stay in the code for 15 years

<r​avfx:xmr.mx> Yay, people can all read the code, we are all safe...

<y​asabi:matrix.org> this kind of rhetoric results in nothing but fearmongering among technological illiterates

<r​avfx:xmr.mx> What about that classic one? csoonline.com/article/562859/the-he…enssl-caused-a-security-crisis.html

<r​avfx:xmr.mx> How much time that "bugs" did stay in openssl? 10 years or something like that if I rememnber

<y​asabi:matrix.org> if you care this much, audit some code yourself. otherwise you're just doing the IC's work for free

<y​asabi:matrix.org> presumably

<d​ave.jp:matrix.org> How many audits did monero have

<b​asses:matrix.org> quite a few

<b​asses:matrix.org> for protocol

<s​yntheticbird:monero.social> At least one per hard fork implementation

<r​avfx:xmr.mx> Can you audit the code yourself, really?

<r​avfx:xmr.mx> For every bloaty libs you have installed on your system, and everytime one get updated?

<d​ave.jp:matrix.org> Full code audit

<r​avfx:xmr.mx> plus like a said, it's apparenly easy to pass audit with C/C++ code

<d​ave.jp:matrix.org> For every like of code that was added ?

<s​yntheticbird:monero.social> nah. Cryptography and consensus code.

<y​asabi:matrix.org> even the best developer in the entire world is incapable of auditing every single line of code on each layer of their own systems

<r​avfx:xmr.mx> Monero have better audit than most of what's in Linux afaik

<s​yntheticbird:monero.social> None afaik. But core team have good coding practices. vulnerabilities are very rarely severe. You can check HackerOne to see some of them

<y​asabi:matrix.org> you clearly know nothing so that statement isn't worth much

<r​avfx:xmr.mx> Hence assume everything is backdoored, make it easier for you to manage your security model

<y​asabi:matrix.org> so why are you on a computer?

<s​yntheticbird:monero.social> yeah

<s​yntheticbird:monero.social> touch grass

<r​avfx:xmr.mx> Everyone use computers today lol

<y​asabi:matrix.org> if everything is backdoored, you should be using stone tablets and a chisel

<s​yntheticbird:monero.social> (I like windows)

<b​asses:matrix.org> news.ycombinator.com/item?id=37702491

<y​asabi:matrix.org> so you're just full of shit

<s​yntheticbird:monero.social> Stone can be backdoored

<d​ave.jp:matrix.org> Hacker one bounty is so low

<b​asses:matrix.org> news.ycombinator.com/item?id=36773242

<y​asabi:matrix.org> this chatroom is backdoored, BETTER SIGN OFF NOW BEFORE THEY GET YOU

<y​asabi:matrix.org> too late now i own all ur momos

<r​avfx:xmr.mx> Glowies are listenig for sure

<y​asabi:matrix.org> put down the bong dude

<s​iren:kernal.eu> nvd.nist.gov/vuln/detail/CVE-2021-22555

<s​iren:kernal.eu> Attack vector: Local

<s​iren:kernal.eu> Shitty backdoor honestly

<s​yntheticbird:monero.social> no need to be listening. Just check out the record later

<s​yntheticbird:monero.social> USER_NS strike again

<r​avfx:xmr.mx> You do know that local privilege escalation are usefull right.

<r​avfx:xmr.mx> A assume that on your server you don't run services as ROOT.

<r​avfx:xmr.mx> So once someone break it using a "bug" from something else, then you use the local privilege escalation to get the root

<r​avfx:xmr.mx> So I assume glowies want to keep a constant supply of nice local escalation exploit available

<b​asses:matrix.org> ofrnxmr would disagree 🤣

<r​avfx:xmr.mx> That one local privilege escalation on where linux-ld.so.2 was giving root to everyone asking was sooo funny 😂

<r​avfx:xmr.mx> Fortunately it did not affect unbloated distribution (like Alpine)

<s​iren:kernal.eu> Yes but this is not a backdoor. And it doesn't look like it was deliberately introduced by someone either. Probably was discovered by fuzzing.

<r​avfx:xmr.mx> You can't prove if it was deliberately introduced by someone

<r​avfx:xmr.mx> or no

<s​iren:kernal.eu> You can by checking the commits. Too difficult to deliberately introduce things like this.

<r​avfx:xmr.mx> For the two people who linked ycombinator about Azure, I still try to find the relation with windows

<r​avfx:xmr.mx> For the double audit thing it probably only apple to the product named "Windows"

<r​avfx:xmr.mx> Well, that botched ZX issue we got went on until someone working from Microsoft found it was sus that it was adding 0.5s delay on ssh 😂

<s​iren:kernal.eu> Don't get me started on AD and Windows. It's way shitter.

<s​iren:kernal.eu> And? Your point?

<s​iren:kernal.eu> Someone discovered that tiny little change and since it was FOSS they could check it out. Great.

<r​avfx:xmr.mx> only use Windows on Desktop behind a NAT lol.

<r​avfx:xmr.mx> Anything else (like server shit) Use Linux (if possible one that is not bloated, like Alpine)

<s​iren:kernal.eu> Nah need to live like osama bin laden

<r​avfx:xmr.mx> Yeah, the FOSS developement model is great, It allow cooperation from people from all over the world and gave birth to great products, like Linux

<r​avfx:xmr.mx> Imagin trying to run Windows server on a VPS with 1GB of ram and 20 GB of storage lol

<r​avfx:xmr.mx> Linux is the best os for the Internet infrastruction, there is no second best really

<r​avfx:xmr.mx> But I don't assume something is more secure because it's FOSS. Linux just do the job better for that use case... Way better

<b​asses:matrix.org> idk if you are even talking about intential backdoor or insecure code, cuz if all foss libraries are backdoored then govs are also backdoored so anyone auditing may use it against govs

<s​iren:kernal.eu> If you're so worried about supply chain attacks in FOSS, I suggest investing in SAST.

<s​iren:kernal.eu> Stuff like sonarqube can find suspicious code or malware in the libraries you use

<r​avfx:xmr.mx> Will look at that one, thanks

<y​asabi:matrix.org> stop pointing out such logical discrepancies, we have fear mongering to do here

<r​avfx:xmr.mx> I already try to minimize the quantity of code I run on my server.

<r​avfx:xmr.mx> I replced all Debian with Alpine recently (almost, I still have some Debian running but there been replaced slowly)

<b​asses:matrix.org> is it a VPS?

<r​avfx:xmr.mx> A lot of gouvs still use Windows, so they have the possible NSA backdoor, so it's not better lol

<b​asses:matrix.org> and what does NSA use?

<r​avfx:xmr.mx> I have rented VPS, rented dedicated hardware, and owned dedicated hardware. All my monero stuff run on the later

<y​asabi:matrix.org> do you own the switches that your dedicated servers are patched to?

<r​avfx:xmr.mx> Good question, ask them, i'm sure they will tell you

<r​avfx:xmr.mx> My guess is they use Windows and Linux, you know, use the best tool for the job

<s​yntheticbird:monero.social> I maybe wrong. What are you refering to exactly ?

<y​asabi:matrix.org> how about the routers those switches are on? the cables between the routers?

<s​yntheticbird:monero.social> everyone knows copper is backdoored ore

<y​asabi:matrix.org> if not then you're PWNED

<y​asabi:matrix.org> better shut it all down now!

<r​avfx:xmr.mx> That's another can of worm 😂Try at minimum to have nothing exposed on the internet (specially the router stuff)

<y​asabi:matrix.org> take a hammer to you computer ASAP or you're just concern trolling

if you don't like it, just build your own internet

<r​avfx:xmr.mx> They say don't trust, verify.

<r​avfx:xmr.mx> So go just audit all the code you run, without exception 😂

I hear the Amish are doing well this time of year

<b​asses:matrix.org> kiwifarms?

<y​asabi:matrix.org> just fabricate your own CPUs bruh

<r​avfx:xmr.mx> I do have safe CPUs, there maybe older than you (don't know how old you are so it's an assumption)

<y​asabi:matrix.org> did you audit every line of their firmware?

<r​avfx:xmr.mx> Intel have ME since the Core2?

<r​avfx:xmr.mx> And AMD have that PSP since Ryzen. Sad AMD did not want to open the code even if they initially planned to

<y​asabi:matrix.org> if not how do you know that they're safe?

<b​asses:matrix.org> why you are acting like you are the only one not backdoored?

<y​asabi:matrix.org> yeah there were no architectural or firmware vulnerabilities before management engines because a thing

<y​asabi:matrix.org> 🙄

when auditing the code, how do you know your programming skills are good enough to spot a state-sponsored backdoor?

<y​asabi:matrix.org> *became a thing

<r​avfx:xmr.mx> It's not good enough, at least mine

<r​avfx:xmr.mx> I'm not

<s​iren:kernal.eu> Someone can probably break into his home wifi and _schedule a print job_ en.wikipedia.org/wiki/PrintNightmare

<s​yntheticbird:monero.social> I pray. God knows give strength to find vuln when I need it

<r​avfx:xmr.mx> It use to be easier to unpack BIOS into there different modules and then desassemble the modules. Ganted, it take time and brain.

<r​avfx:xmr.mx> But it's more doable than now, way more doable.

<r​avfx:xmr.mx> Back then you have 64KB BIOS, now you have 32MB EFI. One of them will require more work to reverse engineer, wonder which one.

<r​avfx:xmr.mx> There also alternative bios for these antique

<y​asabi:matrix.org> i agree EFI was an atrocity

<y​asabi:matrix.org> giving Microsoft design control over such a low level standard was fucking stupid

<b​asses:matrix.org> hire best coders in the world with experience in safe coding practices/memory safe langues. Build your OS from scratch, will take about 10 years with $100mil in funding, just to get backdoored by the programming language you used, hardware backdoor or side channel analysis.

<r​avfx:xmr.mx> Back then the stuff was so simple

<r​avfx:xmr.mx> You could remove the BIOS chip from an ASUS or MSI board, and stuff it in a ACER board, And it would just work (assuming it have the same chipset and same super IO chip)

<y​asabi:matrix.org> back then this stuff was simpleR, it wasn't simple per se

<r​avfx:xmr.mx> By back then I mean 386 & 486 era, way before they begin to lockdown everything

You can't prevent your house from being burglarized, best you can do is make it a less attractive target than the next house over and a pain to break in to

<r​avfx:xmr.mx> Yep, exactly

<r​avfx:xmr.mx> you know your house can easily be burglarized, so take proper measure.

<y​asabi:matrix.org> there are no absolutes in this world, at all really

<s​iren:kernal.eu> matrix.monero.social/_matrix/media/…/kernal.eu/vbOYZfZkHrZmJuGEeSamZnFf

<y​asabi:matrix.org> and certainly no such thing as absolute security

<y​asabi:matrix.org> all things are processes with tradeoffs, especially security

And layer your defenses too.

<y​asabi:matrix.org> by and large, an open codebase that can be peer reviewed by anyone with the interest in doing so will result in better security overall. but also, we have no consumer-scale open hardware due to the particularities of intellectual property law, logistics, and production

<y​asabi:matrix.org> the real root of this issue is not a technological one - it's certainly possible to build and scale up open architectures

<r​avfx:xmr.mx> If the general Linux space was less fragmented, it would help a lit

<r​avfx:xmr.mx> lot*

<y​asabi:matrix.org> but in the reality of power structures as they exist in our present world, that's not going to happen anytime soon

<y​asabi:matrix.org> describing it as fragmented is your ideological perspective. mine sees it as decentralized, and that decentralization provides a defensive barrier towards monopoly by entrenched interests and power structures

<r​avfx:xmr.mx> If all brains working of 4 distribution instead of 69 distribution, there would be more people to see that code and maintains the packages on these specific distribution.

<r​avfx:xmr.mx> If we had like 3 WM instead of 42 WM, I assume they would have a way better integration and hopefully better code quality

<r​avfx:xmr.mx> (that's a few example, assume the same for everywhere the wheel got reinvented 16 times)

<y​asabi:matrix.org> remember how hard Microsoft tried to snuff out Linux in the first decade?

<r​avfx:xmr.mx> Yep

<r​avfx:xmr.mx> And now Linux come with Windows 😂

<s​iren:kernal.eu> Linux come with Windows?

<y​asabi:matrix.org> Yep, and now there's even talks of Windows being rewritten to base it on Linux

<y​asabi:matrix.org> that's testament to the efficiency and strength of decentralized development

<r​avfx:xmr.mx> Yeah, I was thinking in the past that microsoft could use WSL as a way to slowly port there whole Windows shit on Linux then eventually just replace the kernel

<r​avfx:xmr.mx> clipboard.png

<r​avfx:xmr.mx> that's like the default windows explorer, no plugin added.

<r​avfx:xmr.mx> You add the linux of your choice with one command in powershell

<b​asses:matrix.org> >maintains the packages on these specific distribution.

<b​asses:matrix.org> literally how

<b​asses:matrix.org> WSL

<r​avfx:xmr.mx> Instead of having people working of 42 thing you have the same quantity of people working on 3 thing. I wonder....

<y​asabi:matrix.org> really there's only a handful of "base" distributions; debian-based, rhel-based, arch-based

<s​iren:kernal.eu> Yeah I know, just didn't understand you were talking about WSL. You can evade AVs through it and do nasty shit.

<y​asabi:matrix.org> gentoo presumably has some too

<b​asses:matrix.org> 3 people working on millions of packages what are you talking about

<y​asabi:matrix.org> so saying the problem is there's too many distributions is overlooking that

well, doubling the number of engineers working on a project usually doesn't half the time or double the quality. I'd assume it's the same for software

<y​asabi:matrix.org> in a larger sense, there's even meta groupings within the base distros, namely glibc-based vs musl-based

<r​avfx:xmr.mx> Possible yeah, I did not look for Gentoo, yet

<y​asabi:matrix.org> that there's 69 variants of ubuntus doesn't contribute much to "fragmentation"

<y​asabi:matrix.org> they're all reskins really

<r​avfx:xmr.mx> non

<y​asabi:matrix.org> their maintainers are probably not capable of doing much auditing of code themselves

<r​avfx:xmr.mx> thousands people working on 3 WM instead of the same thousands people working on 42 WM

<y​asabi:matrix.org> so having them focus on whatever shitty desktop env they prefer isn't subtracting capacity away from the "core" maintainers or w/e

<y​asabi:matrix.org> you're ignoring that these groupings aren't all the same size and capacity

<y​asabi:matrix.org> 38/42 WMs are one or two devs

wait you mean my commit fixing a typo in Mint's interface doesn't translate into a core feature? say it isn't so

<y​asabi:matrix.org> they're vanity projects

<s​iren:kernal.eu> Only redhat and canonical ships kernels with custom patches usually, they sometimes screw up vuln patches. It's not that fragmented.

<j​onf3n:matrix.org> Unfortunately the issue itself had only 1 👍️

<j​onf3n:matrix.org> I added the second.

<j​onf3n:matrix.org> At least _**we**_ could show we are interested in this, even if DroidMonkey doesn't seem interested.

<y​asabi:matrix.org> there's almost certainly more fragmentation within the organizational teams that exist in Microsoft's corporate structure

<r​avfx:xmr.mx> My biggest issue with Linux (on desktop) is packaga management.

<r​avfx:xmr.mx> For servers in general it's nice and always work, considering Linux run the Internet that could explain why it's fine for server

You mean that there are multiple of said package formats?

<y​asabi:matrix.org> so use slackware and track your dependencies on pen and paper like a true greybeard :upside

<y​asabi:matrix.org> 🙃

<r​avfx:xmr.mx> I mean that stuff often break and I have to lose time to fix it (that append only on desktop, not server)

<r​avfx:xmr.mx> and sometime it's hillarious, wait a min, I confirm it's still there

<r​avfx:xmr.mx> matrix.monero.social/_matrix/media/…oad/xmr.mx/ionMkkHKltAreOffgavZaolR

<s​iren:kernal.eu> This is true because when you take a look at the source code leaks of windows you will find lots of duplicate implementations of the same functionality in many userland tools (I didn't check it in depth)

<y​asabi:matrix.org> also i work on servers all day and can confirm server package management can be as big a pain in the neck as on desktop once you get above the level of complexity of hosting a shitty wordpress or w/e

<r​avfx:xmr.mx> It's still there!!!!

<r​avfx:xmr.mx> Go get community-qt one and install in a vm, then do pacman -Syu

<r​avfx:xmr.mx> then you gonna laugh

<r​avfx:xmr.mx> Oh sad, I found it usually way more reliable than desktop.

<r​avfx:xmr.mx> And now with docker it well, you install Alpine, you install Docker and your done adding shit with the package manager 😂

<r​avfx:xmr.mx> So then it usually work

<s​iren:kernal.eu> > <@yasabi:matrix.org> there's almost certainly more fragmentation within the organizational teams that exist in Microsoft's corporate structure

<s​iren:kernal.eu> This is true because when you take a look at the source code leaks of windows you will find lots of duplicate implementations of the same functionality across many userland tools.

<b​asses:matrix.org> bring these thousands working for free on WM

<y​asabi:matrix.org> that's a big reason container solutions have become so popular, beyond their security benefits

Every time I hear about Wordpress, it's about a vulnerability in some plugin, lol

<b​asses:matrix.org> the problems also with main contributors

<b​asses:matrix.org> they may close PR

<y​asabi:matrix.org> now you don't need to manage chroots and jails and pyenvs and all that junk

<b​asses:matrix.org> so you only left with forking it

<b​asses:matrix.org> they may decline PR

<r​avfx:xmr.mx> I use to be that anti container guy until I tried them and was like... no more package manager going to bark at me... nice...

<y​asabi:matrix.org> there's real benefits that outweigh the complexity they add imo

<y​asabi:matrix.org> and, that's a demonstration that with FOSS, there will always be solutions

<r​avfx:xmr.mx> Yep, can apk update && apk upgrade in prod without having a heart attack

<y​asabi:matrix.org> if you wanna ditch a package manager and closely track everything you can! if you wanna stick with the default manager you can! if you wanna put everything in a container you can!

<y​asabi:matrix.org> remember docker didn't run on windows until like a couple years ago

<y​asabi:matrix.org> and it still sucks shit there

<r​avfx:xmr.mx> I did LFS in the past, but thanks, I value my time lol

<r​avfx:xmr.mx> I'm getting old now so I just want shiet to work

<b​asses:matrix.org> you pay with what? also do u use cpanel?

<r​avfx:xmr.mx> Docker run fine on windows (WSL2)

<r​avfx:xmr.mx> But I do prefer to run them in dedicated linux PC (I have a few Lenovo tiny 1L PC)

<y​asabi:matrix.org> having more control of your environment means you're responsible for the security profile of your environment, similar to how taking self-custody of your money via crypto means you need to have your keys thoroughly backed up

<s​iren:kernal.eu> Honestly I've only seen two reasons for container usage 1. K8S 2. Stuck with PHP 5

<y​asabi:matrix.org> but the truth is corporations don't want to pay much money to properly manage their security profiles

<y​asabi:matrix.org> they want to pay the absolute least amount they can to maximize their EOY reports

<r​avfx:xmr.mx> Monero for the rented VPS

<r​avfx:xmr.mx> Monero converted to руб via friends to pay for the dedicated

<r​avfx:xmr.mx> And for the stuff I own, Cash work just fine lol

<y​asabi:matrix.org> that usually means outsourcing to a third party, and leveraging legal liability instead of investing in proper security

<r​avfx:xmr.mx> I don't use Cpanel, never used it somehow so I don't know how good it could be for me

<y​asabi:matrix.org> the long term effects of that have been compounding for decades now

<y​asabi:matrix.org> which is why we're seeing more severe vulnerabilities on the reg

<y​asabi:matrix.org> that's another example of how the root of this all isn't a technological problem

<r​avfx:xmr.mx> I use to own everything I used to host

<r​avfx:xmr.mx> then cloud came...

<y​asabi:matrix.org> and there aren't technological solutions to social problems

<r​avfx:xmr.mx> And now I'm back to slowly moving everything back into my full control

<r​avfx:xmr.mx> I think part of if is bloat.

<r​avfx:xmr.mx> Now we have CPU that run 95% bloat to run the 5% of the code that matter

<s​iren:kernal.eu> Heard of PtaaS and CISOaaS?

<r​avfx:xmr.mx> yes then no

<s​iren:kernal.eu> And then there is compliance as a service 😭

<s​iren:kernal.eu> chief information security officer as a service

<s​iren:kernal.eu> Peak corporate greed

<r​avfx:xmr.mx> Yeah, I did look it up

<y​asabi:matrix.org> the bloat is a byproduct of this corporate incentive structure

<s​yntheticbird:monero.social> it's been an hour

<s​yntheticbird:monero.social> quit ffs

<y​asabi:matrix.org> writing clean, efficient, simple code costs more in time and resources than churning out loads of junk

<y​asabi:matrix.org> same reason why the ratio of significantly unique cultural content is declining in the face of volumes of reboots and spinoffs

<h​elasse:linarphy.net> There's a difference between running bloat to please corporate interests and inefficiency developpers, and running bloat because of 25 efficient and powerful abstraction layers of lvm+luks+block devices+virtualization+...

<h​elasse:linarphy.net> My cpu runs at 3% when i'm idling in a ubuntu KVM inside a ubuntu host

<r​avfx:xmr.mx> Code and bloat is so much of a problem like.

<r​avfx:xmr.mx> Why tf my 486 with NT4 load Excel 97 faster than my Ryzen + Linux + Libreoffice

<r​avfx:xmr.mx> The Ryzen have 1000x more ram and a NVME drive that do 4GB/s instead of a compact flash stuck in PIO3 mode (~3mb/s)

<r​avfx:xmr.mx> Both program do the same thing...

<r​avfx:xmr.mx> Imajin if we had the hardware of today with the unbloated software of yesterday

<r​avfx:xmr.mx> The stuff would all run before you click on it lol

<b​asses:matrix.org> offtopic

<r​avfx:xmr.mx> There is usefull bloat yeah.

<r​avfx:xmr.mx> LVM+luck+virtualization are all usefull thing

<r​avfx:xmr.mx> and afaik there not bloated

<h​elasse:linarphy.net> > <@ravfx:xmr.mx> I think part of if is bloat.

<h​elasse:linarphy.net> > Now we have CPU that run 95% bloat to run the 5% of the code that matter

<h​elasse:linarphy.net> There's a difference between running bloat to please corporate interests and inefficiency developpers, and running bloat because of 25 efficient and powerful abstraction layers of lvm+luks+btrfs+block devices+virtualization+...

<h​elasse:linarphy.net> My cpu runs at 3% when i'm idling in a ubuntu KVM inside a ubuntu host

<b​asses:matrix.org> (as I'm no longer interested in participating)

<r​avfx:xmr.mx> We are off topic since a long while indeed

<b​asses:matrix.org> keepassxreboot/keepassxc #10535

<b​asses:matrix.org> will never accept Monero lol

<y​asabi:matrix.org> LVM is bloated in ways, it's a wrapper around MD essentially but performs worse

<r​avfx:xmr.mx> Naaa, it's one of these people, just forget it I think

<y​asabi:matrix.org> requires many times more IOPs for the same functions, etc

<y​asabi:matrix.org> tho the real issue is distributions defaulting to it even when you don't need to be able to resize volumes

<s​iren:kernal.eu> Just wow

<s​iren:kernal.eu> >I don't want their money. Spend it on your family and maybe escaping from that situation.

<r​avfx:xmr.mx> Yeah, it should not be default for sure, same for thing like luks. You use it if you need it and all these things are nicely layerable

<s​yntheticbird:monero.social> He just don't have the spark of curiosity to test out new opportunities.

<s​yntheticbird:monero.social> Still wish KeepassXC to succeed.

<s​iren:kernal.eu> At least he accepts other crypto to begin with. I use it everyday.

<s​yntheticbird:monero.social> One day I should try making my own password manager

What other similar managers even are there?

<b​asses:matrix.org> many use it to store their seed

I would rather have mine on paper)

<b​asses:matrix.org> will probably backdoor it if you have used monero RavFX right?

<s​yntheticbird:monero.social> local ? not a lot. Iirc there is one written in Go, CLI.

<b​asses:matrix.org> detect monero seeds

Also KeepassXC is now the only way I would even consider passkeys.

<b​asses:matrix.org> (joke)

<b​asses:matrix.org> sum of backdoors on my system will increase

What do you think of passkeys btw?

<r​avfx:xmr.mx> wdym, context.exe not found (was afk for a few min)

<r​avfx:xmr.mx> Isnt keepassXC a reimplementation of the one made in .net

<b​asses:matrix.org> gopass

<b​asses:matrix.org> and pass sucks

<s​iren:kernal.eu> I use yubikeys. They're a bit better than having your TOTP secret saved in the same place as your password.

<b​asses:matrix.org> rot256.dev/post/pass

Yubikeys are expensive iirc.

<s​iren:kernal.eu> But a hammer and a wrench always works

<r​avfx:xmr.mx> I use a phone for TOTP, I do not save them in keepassXC.

<r​avfx:xmr.mx> Same reason, I don't undersand the point of saving the TOTP where you save your password, just look like a bad idea for some convenience

<r​avfx:xmr.mx> Naa, just use that tool, work better

<r​avfx:xmr.mx> matrix.monero.social/_matrix/media/…oad/xmr.mx/VusbYXbhJNySJqCGnwwdlTHb

<s​iren:kernal.eu> Dumb people exist and in many companies I have seen people leave laptops with yubikeys attached unattended. So in that case obviously they're worse.

I would rather not have my phone touch sensitive data of mine, it is ADB-neutered stock android so not very clean.

ravfx, what if you use a separate database for 2fa and regular passwords?

<r​avfx:xmr.mx> keep a old phone with network access ideally.

<r​avfx:xmr.mx> But I do use my "yubi" where I can use it, instead of totp

I do not trust the phone's software to not snitch.

<r​avfx:xmr.mx> could be better but it would be less convenient

<r​avfx:xmr.mx> I mean, old phone without network

Old phone? You think we'd keep a functional phone around for pretty much no reason?

First world.

But yea, if you can afford that - yubi seems better.

<r​avfx:xmr.mx> like a old antique galaxy S3

<r​avfx:xmr.mx> with a fscked baseband firmware, that way LTE and Wifi totally innoperable

Why would I have a phone benched like this if it is not broken beyond repair?

<s​iren:kernal.eu> Cloudflare used to offer big discounts for yubikeys

<r​avfx:xmr.mx> Just to run Aegis auth for the TOTP collection

<r​avfx:xmr.mx> Can also use your ledger as TOTP

Ledger as in wallet? These must be expensive too...

<r​avfx:xmr.mx> that way you don't have to buy many key, if ledger it your screen at high rate of velocity, just get a new one and restore with the words list

<r​avfx:xmr.mx> I mean use ledger as a yubi lol, not TOTP

<r​avfx:xmr.mx> that way you don't have to buy many key, if ledger hit your screen at high rate of velocity, just get a new one and restore with the words list

<r​avfx:xmr.mx> I mean use ledger as a yubi lol, not TOTP

How would a new one get the keys?

<r​avfx:xmr.mx> if you already have a ledger for crypto, you can also use it as a yubi key

Ledgers for crypto seems like something for wealthy people.

<r​avfx:xmr.mx> you know these 24 words you keep safe...

<r​avfx:xmr.mx> the only place the ledger sucks for yubi emulation is for the rarer and rarer sites that also use the counter

Wait, these can be used like this?

<r​avfx:xmr.mx> yes

<r​avfx:xmr.mx> it work for websites yubi stuff and Linux PAM.

<r​avfx:xmr.mx> it does not work for keepassxc and windows auth

<r​avfx:xmr.mx> matrix.monero.social/_matrix/media/…oad/xmr.mx/KHVzVhGbGUWuAeNpfSAEaYaJ

<r​avfx:xmr.mx> DO not use the ledger as yubi for site that use the counter (I would not use a real yubi for these too)

<r​avfx:xmr.mx> Else if you replace the key (new counter) or restore the ledger (counter reset to 0) then you are going to have fun to fake auth thousand time till the counter is == to what it was the last time you logged on that site

<r​avfx:xmr.mx> The only site that did that afaik, was Bitfinex, but I think they don't use the stupid counter anymore (to reconfirm)

<r​avfx:xmr.mx> There is that one now too, did not try

<r​avfx:xmr.mx> matrix.monero.social/_matrix/media/…oad/xmr.mx/vEWQQGuxlvfrSwSYekhXTWNN

<r​avfx:xmr.mx> Ok, that one is for "WebAuthn"

<r​avfx:xmr.mx> It's sad, it seam that they removed SSH & PGP ledger app

<r​avfx:xmr.mx> It was possible to use the ledger for SSH private/public key shenanigans too

<r​avfx:xmr.mx> ah way, they removed the SSH thing because you can apparently use SSH with Fido now.

<r​avfx:xmr.mx> You use that Security Key app for SSH

<r​avfx:xmr.mx> matrix.monero.social/_matrix/media/…oad/xmr.mx/zocMajwqIOIiGlYwlwTGcyhh

<r​avfx:xmr.mx> ledger.com/blog/strengthen-the-secu…rity-of-your-accounts-with-webauthn

<c​trej:matrix.org> learned that keepassDX (not keepassXC) accepts xmr

<c​trej:matrix.org> directly featured on their front page as well

<3​21bob321:monero.social> Yeah andriod only

<b​asses:matrix.org> RavFX: investopedia.com/terms/h/hawala.asp…ries%20sending%20remittances%20home sounds more anonymous than your latin country dream land

<r​avfx:xmr.mx> I know Hawala :p

<b​asses:matrix.org> How do you guys get pdfs from elliptic.co and chainanalysis without subscribing to their shitty newsletter?

<m​odul8:matrix.org> i dont see those words in that thread. pretty sad tho for a project that keeps secrets safe.

<k​jeks:matrix.org> start using bitwarden instead

<k​jeks:matrix.org> he doesn't deserve your moneros