@hanno@mastodon.social
@hanno@mastodon.social avatar

hanno

@hanno@mastodon.social

Freelance Journalist with a focus on Climate, Energy, IT-Security. #searchable

This profile is from a federated server and may be incomplete. Browse more on the original instance.

hanno, to random
@hanno@mastodon.social avatar

Bekomme die selbe Presemittielung 2x, nur der Einstiegssatz ist anders. "Von Potsdam über Berlin bis nach Cottbus" vs. "Von Nürnberg über Aachen bis nach Berlin". Bin ich wohl sowohl im Westdeutschland- als auch im Ostdeutschland-Presseverteiler...

hanno, to random
@hanno@mastodon.social avatar

I'll be giving a talk at the miniDebConf Berlin about the Debian-OpenSSL-Bug-in-DKIM disclosure, and there is a livestream, in around 1,5 hours. https://berlin2024.mini.debconf.org/

hanno, to random
@hanno@mastodon.social avatar

I'm still not sure if BIMI is just an elaborate joke or a subtle form of parody. I mean... the official recommendation to create BIMI logos in the right format (a subset of SVG) is to save them in another format via adobe illustrator, and then manually edit the XML in a text editor. No, I'm not kidding... https://support.google.com/a/answer/10911027

hanno, to random
@hanno@mastodon.social avatar

Due to a new regulation, green electricity providers in the EU+EEA have to provide their customers information about the countries of origin of their electricity (or the certificates, which... isn't really the same, but I disgress...). If you got something like that lately, can you scan it or make a photo and send it to me? https://hboeck.de/en/contact.html I'd be particularly interested to see those from the "real" green electricity providers.

hanno, to random
@hanno@mastodon.social avatar

There's a conference on guarantees of origin (green electricity certificates) in Iceland. Shall I... ? https://landsvirkjun.com/go-conference

hanno, to random
@hanno@mastodon.social avatar

In case the anonymous person who reported a bug in badkeys via my webpage contact form without leaving any contact info reads this: thanks, it's fixed now. https://github.com/badkeys/badkeys/commit/e5d094a8583418c4c07f365400198c1b81aa5131

hanno, to random
@hanno@mastodon.social avatar

Today, 16 years ago, Debian published a security advisory announcing CVE-2008-0166, a severe bug in their OpenSSL package that effectively broke the random number generator and limited the key space to a few ten thousand keys. The vulnerability affected Debian+Ubuntu between 2006 and 2008. In 2007, an email signature system called DKIM was introduced. Is it possible that people configured DKIM in 2007, never changed their key, and are still vulnerable to CVE-2008-0166? https://16years.secvuln.info/

hanno, to random
@hanno@mastodon.social avatar

For reasons that I cannot disclose right now, but will soon, I recently looked into BIMI. And... I have some concerns. BIMI is a spec built on top of DKIM and DMARC, and allows companies to show a logo beside their emails in supporting frontends (like gmail). It requires purchasing a very expensive certificate, I think the justification for it is dubious, and I am not a fan. But even if we put that aside, it's also very strange on a technical level. 🧵

hanno,
@hanno@mastodon.social avatar

The concept involves servers checking a DNS record with references to a logo and a certificate. The server then should set some headers that the MUA uses to show the logo. However... there's an inherent flaw in this: The MUA cannot know whether these headers come from the server or the sender. I raised this issue on the BIMI mailing list: https://mailarchive.ietf.org/arch/msg/bimi/PS8Xf1hQ41oCAwtsUvVsbRSs34Q/

hanno,
@hanno@mastodon.social avatar

As I explained there in detail, it all looks like there is some missing piece somewhere, something that the spec designers had in their mind, but haven't written down. And that's symptomatic: The spec contains multiple references to "other documents" and "elsewhere", but leaves implementors alone finding these. Even on a mere technical level, that's all hugely problematic. It looks like an unfinished early draft, but at the same time BIMI is already implemented and sold.

hanno,
@hanno@mastodon.social avatar

I have more concerns about the spec, some parts read like they were written by people who use words without knowing what they mean. There are some design decisions that are extremely questionable from a security point of view. And it appears to me that gmail, the largest mail service that already implemented BIMI, did not so based on the publicly available spec.

hanno, to random
@hanno@mastodon.social avatar

I gave a talk at this year's Nullcon about a vulnerability I found in HSTS as implemented in Firefox, and also a general overview of HTTP/HTTPS mixing problems. It wasn't recorded at the conf, so I've now re-recorded the talk. You can find it here: https://www.youtube.com/watch?v=JjMb7Z8ak2k

hanno, to random
@hanno@mastodon.social avatar

Does Python really have no DNS functionality built in at all beyond resolving IPs? I have a use case where I need to get a TXT record, and everything I can find recommends dnspython. If possible, I'd like to avoid adding a dependency.

hanno, to random
@hanno@mastodon.social avatar

Do I know someone or can anyone recommend someone who is a nerd in the EU emission trading system (ETS)?

For two unrelated stories, I have some extremely specific questions.
I'm looking for the kind of person that will not say "oh, I don't know that, sorry", but rather "I don't know that, but I know how to find out, and I will", or "I don't know that, but I know who does".

hanno, to random
@hanno@mastodon.social avatar

Is GNU software really free software? I may legally have the freedom to study it, but it is wrapped in so much GNU buildsystem obscurity that studying it is impossible without a PhD in GNU buildsystem crap. So I don't really have the freedom to study it.

hanno, to random German
@hanno@mastodon.social avatar

Was mich ja an diesem erneuten aufwärmen der Atomdebatte so ärgert ist wie irrelevant das ganze ist. Ich meine reden wir doch mal klartext: Die Atompolitik in Deutschland wird sich nicht mehr ändern, und zwar völlig unabhängig davon wer regiert. Es wird ja niemand ernsthaft erwarten dass man die jetzt im Rückbau befindlichen Kraftwerke nochmal anschaltet. 🧵

hanno,
@hanno@mastodon.social avatar

Und neue Kraftwerke? Also mir fehlt schon die Vorstellungskraft dass sich das irgendwo in Deutschland durchsetzen ließe. Aber selbst wenn. Und selbst wenn wir sagen wir mal eine schwarz-gelbe Regierung hätten in der die größten Atomfreunde aus CDU+FDP die entsprechenden Posten besetzen. Und irgendwie finden sie noch einen Landkreis in dem das Zustimmung findet. Dann müsste da ja immer noch jemand das Geld auf den Tisch legen.

hanno, to random
@hanno@mastodon.social avatar

I have seen my fair share of strange reactions and rejections by bugbounty plattforms, but this is new: Rejected, because the report mentions a CVE. No, I have no idea what they are thinking. (I can only guess that they get lots of low quality reports from automated tools mentioning CVEs. But the idea that a security report that mentions a CVE is invalid is... whatever...)

hanno, to random
@hanno@mastodon.social avatar

Do I know anyone who knows BIMI from the technical / protocol side? I'm neither interested in the PR pitch nor in people complaining (correctly) that it's a moneymaking scheme. I have some specific questions about details about the protocol implementation that seem very odd to me.

hanno, to random
@hanno@mastodon.social avatar

Some proprietary software lobbyists are trying to spin the xz story as an "anti open source" story, and I see demands like "you shall only use opensource software if you have a contract with someone guaranteeing support and security". I'd be curious: Can I see the contract those people have with Microsoft or whatever company you never heard of that wrote the firmware in their wifi card that guarantees the same for the closed source software they're using?

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • megavids
  • kavyap
  • DreamBathrooms
  • tacticalgear
  • magazineikmin
  • khanakhh
  • everett
  • Youngstown
  • mdbf
  • slotface
  • rosin
  • ethstaker
  • InstantRegret
  • thenastyranch
  • JUstTest
  • ngwrru68w68
  • cisconetworking
  • cubers
  • osvaldo12
  • modclub
  • GTA5RPClips
  • tester
  • Durango
  • provamag3
  • anitta
  • Leos
  • normalnudes
  • lostlight
  • All magazines
    •