363: The Theoretical Becomes Real

00:00SPEAKER- Hey Brad, I printed 3D decorations for the house.

00:05SPEAKER- That looks obscene.

00:07SPEAKER- No, no, oh.

00:08SPEAKER- It's flesh colored.

00:10SPEAKER- Oh, it's orange, it glows.

00:11SPEAKERSo when you put it on a black light, it glows.

00:14SPEAKERDo you know the concave eye illusion?

00:16SPEAKERAre you familiar with this?

00:18SPEAKERBasically if you put a kind of ovoid, pointy ovoid shape

00:23SPEAKERin the center of a concave disc or a super oval,

00:31SPEAKERand you put it flat with a dark background,

00:34SPEAKERthen when people move in front of it,

00:36SPEAKERit looks like the eye is watching them

00:38SPEAKERas they walk in front of it.

00:39SPEAKERIt's a thing that Disney uses in like,

00:41SPEAKERfor like Haunted Mansion faces and stuff like that.

00:43SPEAKERA lot of the faces are concave instead of convex.

00:47SPEAKERSo I printed a whole buttload of them

00:49SPEAKERand stuck them in the front yard,

00:51SPEAKERand then put a black light on so that they,

00:55SPEAKERI printed them with 3D, with glow in the dark filament,

00:58SPEAKERand then I put the black light on

00:59SPEAKERso it's a bazillion little tiny orange glowing eyes

01:03SPEAKERin the front yard at night.

01:04SPEAKER- Like are these even like paired,

01:06SPEAKERlike two eyes for each face shape,

01:08SPEAKERor is it just a bunch of free floating eyeballs?

01:10SPEAKER- It looks like, you know the scene

01:12SPEAKERin like an animated movie from the '50s

01:15SPEAKERwhere like the guy's walking through the forest

01:17SPEAKERand you just see a bunch of eyeballs

01:18SPEAKERstart popping up in there?

01:20SPEAKERYeah, it's real good.

01:21SPEAKER- Man, like random eyeballs in things

01:25SPEAKERhave always been one of the best spooky atmosphere,

01:27SPEAKERambiance kind of thing.

01:28SPEAKER- Oh yeah.

01:30SPEAKER- I've really got World of Warcraft on the brain right now

01:32SPEAKERwith WoW Forever coming out in a few days.

01:35SPEAKERBut like that was a thing you remember,

01:36SPEAKERdid you play much WoW?

01:37SPEAKERDo you remember Dustwood?

01:38SPEAKER- I played a ton of WoW, but I played Horde.

01:40SPEAKERI didn't play on your Care Bear side.

01:44SPEAKER- What?

01:45SPEAKER- I was an undead warlock, baby.

01:47SPEAKER- All right, well, I hope everyone's enjoyed the tech pod.

01:50SPEAKERThis will be our last episode.

01:53SPEAKERNo, I don't actually care.

01:56SPEAKERI just, I don't care.

01:57SPEAKERIt's just that I never would have guessed you

01:59SPEAKERas a Horde guy at all.

02:00SPEAKER- I picked it 'cause the starting of the cities were better.

02:03SPEAKERI like the cities better.

02:03SPEAKERI like Ogrimmar and I liked the undercity better.

02:05SPEAKER- Wait, really?

02:06SPEAKER- Yeah.

02:07SPEAKER- Man, Ironforge though.

02:08SPEAKER- It's too, no, no, thank you.

02:10SPEAKER- Ironforge though.

02:12SPEAKER- I didn't play on a PvP server, so.

02:14SPEAKER- Okay, I don't remember.

02:19SPEAKERDid that split exist at launch?

02:21SPEAKERI guess it did.

02:22SPEAKERThere were PvE and PvP specific servers at launch, right?

02:24SPEAKERI'm getting way off topic here.

02:26SPEAKER- I think so, and you could opt into PvP, I think too.

02:28SPEAKER- Well, I think I'm a- - On a PvP server.

02:30SPEAKER- I only remember this 'cause I've been talking

02:31SPEAKERto a lot of people who play way more WoW than me

02:34SPEAKERwith "Forever" coming, but I think it was always

02:36SPEAKERthat you could opt into PvP on a PvE server.

02:39SPEAKER- Or for like a time period or something.

02:41SPEAKERLike you type slash fight or something.

02:43SPEAKER- It was in contested zones only, I believe.

02:45SPEAKER- That sounds right.

02:46SPEAKER- Anyway, I'm thinking about rolling on a PvP server

02:49SPEAKERand that's not a popular decision

02:50SPEAKERon the next "Lander" Discord.

02:52SPEAKERBut the whole reason I brought up WoW is that Duskwood,

02:54SPEAKERthe Halloween-themed zone south of it.

02:58SPEAKERWell, I guess, I don't know if you really ever went there,

03:00SPEAKERif you only played "Hoard."

03:01SPEAKERDid you ever play an "Alliance" character?

03:02SPEAKER- Never played an "Alliance."

03:03SPEAKER'Cause at the time you had to pick.

03:05SPEAKERRemember, they didn't let you switch back and forth

03:06SPEAKERon a server.

03:07SPEAKER- Oh, that's right.

03:08SPEAKERI guess you could have rolled on another server, right?

03:10SPEAKER- I could have rolled on, yeah.

03:11SPEAKERI probably did roll on another server,

03:12SPEAKERbut that was another 80 hours of grinding.

03:15SPEAKER- I'm just gonna make a statement here.

03:18SPEAKER"Alliance" has way better zones.

03:20SPEAKER- Wow.

03:21SPEAKER- From what I've seen of the "Hoard" side.

03:23SPEAKER- Wow, the plains, that was the best all chat.

03:27SPEAKERBarrens, yeah.

03:28SPEAKER- Yeah, Barrens chat is legendary for questionable reasons.

03:33SPEAKEROkay, anyway, maybe you've never seen "Duskwood" then,

03:35SPEAKERbut it's like Disneyland-tier Halloween zone.

03:40SPEAKERLike it is straight up "Sleepy Hollow" level

03:45SPEAKERof Halloween vibes in that zone.

03:48SPEAKER- Is that the one where the ghost elves are?

03:49SPEAKERLike the invisible elves are?

03:51SPEAKER- Maybe, I don't remember any elves there,

03:53SPEAKERbut it's possible.

03:53SPEAKERThere is like this massive like kind of crater/grove

03:58SPEAKERin the middle of it that I think is like occupied

04:00SPEAKERby some kind of cult or something.

04:02SPEAKERSo maybe there's elves there,

04:03SPEAKERbut primarily it's a human zone.

04:05SPEAKERBut again, it's just straight out of "Sleepy Hollow."

04:07SPEAKERLike you feel like the headless horseman

04:09SPEAKERis just gonna come galloping over the hill at any moment.

04:12SPEAKER- Oh, I never saw this.

04:13SPEAKERYeah, I never got there.

04:14SPEAKER- It might be my favorite zone for pure spooky vibes.

04:18SPEAKERBut anyway, like a bunch of the bushes

04:20SPEAKERand underbrush in "Duskwood" have a bunch of eyeballs

04:23SPEAKERkind of blinking and like evil looking orange eyeballs

04:26SPEAKERblinking at you all the time.

04:28SPEAKERAnd that's just a, that is a great, it's a great effect.

04:30SPEAKER- So the next phase on the eyeballs is,

04:33SPEAKERright now there's a hole in the middle

04:35SPEAKERis what makes the dark that makes it,

04:36SPEAKERthat looks like the pupil.

04:38SPEAKERBut I realized if I put a little divider in there,

04:41SPEAKERlike if I printed a black thing

04:43SPEAKERand put a little tiny LED on the top and the bottom,

04:46SPEAKERI can turn them on and off and make them blink.

04:48SPEAKER'Cause when the light turns off,

04:49SPEAKERit stays, if it stays luminescent for a minute.

04:52SPEAKER- Sure.

04:53SPEAKER- And like, you can have them turn on and off

04:55SPEAKERand change colors and stuff like that

04:56SPEAKERin a way that would be really good.

04:57SPEAKERSo that's a project for next Halloween.

05:00SPEAKER- I thought you were gonna say with a little divider

05:01SPEAKERin there, it would look like a cat's eye.

05:03SPEAKER- Oh, I could also do different pupil shapes, I think, yeah.

05:06SPEAKERYeah, and different eyeball shapes.

05:08SPEAKER- This is an evil project.

05:10SPEAKER- Yeah, it's good.

05:11SPEAKERYou walk by the house and it'll be like,

05:12SPEAKERit's unsettling right now, which I approve.

05:15SPEAKERThere's also a bunch of blow up ghosts

05:16SPEAKERand demogorgons and stuff.

05:18SPEAKERSo, you know, we have the normal Halloween crap too.

05:20SPEAKERThis has been a 3D printing Halloween, actually.

05:23SPEAKERI need to post this on the sites,

05:25SPEAKERbut I printed a bracket 'cause we have a bunch

05:28SPEAKERof those styrofoam tombstones.

05:30SPEAKERHave you ever seen, I don't know if you get those

05:31SPEAKERin the city.

05:32SPEAKER- Yeah, there's a few around.

05:33SPEAKER- Yeah, but they're notoriously hard to get to stay

05:37SPEAKERin people's yards down here in Pacifica 'cause it's windy.

05:39SPEAKER- There's one lying face down on the sidewalk

05:41SPEAKERlike a block from here.

05:42SPEAKER- Yep, so I designed a bracket in Tinkercad

05:45SPEAKERin like 15 minutes.

05:47SPEAKERAnd usually we use these, they're like stakes

05:52SPEAKERthat you use for landscaping.

05:54SPEAKERLike if you wanna do like concrete forms

05:55SPEAKERor something like that, they're like one inch

05:56SPEAKERby two inch stakes and you hammer 'em in

05:59SPEAKERand you put your concrete forms or whatever around.

06:02SPEAKERSo I measured those and I made a bracket

06:05SPEAKERthat's like a little tiny bit bigger

06:06SPEAKERthan those on all sides and has a big flat spot

06:09SPEAKERand just wood glued 'em to the back of all of these,

06:12SPEAKERto these tombstones.

06:14SPEAKERSo now that you just hammer the stake in

06:16SPEAKERand then slide the thing down to the top of the stake

06:18SPEAKERand you're good to go, it's fantastic.

06:20SPEAKER- Halloween.

06:21SPEAKER- Yeah, it's a 3D printing holiday.

06:23SPEAKER(upbeat music)

06:46SPEAKER(upbeat music)

06:51SPEAKERWelcome, there we go.

06:54SPEAKERWelcome to Brad and Will Made a Tech Pod.

06:57SPEAKERI'm Will.

06:58SPEAKER- I am Brad.

06:59SPEAKER- Hello.

07:00SPEAKER- Hi.

07:01SPEAKER- It's morning, it's early today.

07:02SPEAKER- It is early morning, kind of been up since four.

07:06SPEAKER- I woke up at five and then went back to sleep,

07:09SPEAKERwhich I was very happy about.

07:10SPEAKER'Cause usually if I wake up at five,

07:12SPEAKERthat's in the danger zone.

07:13SPEAKER- Oh yeah.

07:15SPEAKER- You know what, I like getting up at,

07:16SPEAKERif I went to bed at like nine, 9.30

07:19SPEAKERand managed to sleep well, I like getting up at five.

07:21SPEAKER- Everybody in my house is up until midnight or one.

07:23SPEAKERSo it's--

07:24SPEAKER- That's a problem.

07:25SPEAKER- Yeah, it's bad.

07:26SPEAKER- That's a problem, everybody?

07:27SPEAKER- Yeah.

07:28SPEAKER- Even your daughter?

07:29SPEAKER- We're all nocturnal now.

07:29SPEAKER- Man.

07:31SPEAKER- Homeschool, her classes don't start until like noon.

07:33SPEAKER- Okay, okay, that's fair, well.

07:35SPEAKER- So morning is homework time usually.

07:37SPEAKER- Okay.

07:38SPEAKER- Which means that evening is also homework time

07:40SPEAKERif she doesn't get up in the morning.

07:41SPEAKERIf I'm well rested, the hours of between five and 7 a.m.

07:45SPEAKERare my favorite time of the day.

07:47SPEAKER- Yeah, so now that we have the dog,

07:49SPEAKERI have to be so quiet.

07:50SPEAKERLike usually, like that's the time I would come out

07:52SPEAKERand I'd put on like the AirPods and watch a TV show

07:54SPEAKERor something that nobody else in the house was interested in.

07:57SPEAKERAnd now that we have the dog, I can't do that

07:59SPEAKER'cause he wakes up and wants to go out

08:01SPEAKERand like he wants to be active

08:03SPEAKERand go visit people in their bedrooms and it's a mess.

08:06SPEAKERAnyway, Brad, I launched a new podcast this week.

08:10SPEAKER- You did?

08:11SPEAKER- Yeah.

08:12SPEAKER- It's been a busy week.

08:13SPEAKERI have not had a chance to look at it yet,

08:14SPEAKERbut give me the pitch.

08:17SPEAKER- Well, it's called "Take Control of Your Tech."

08:18SPEAKERIt's a podcast about making your technology work for you.

08:22SPEAKER- It's part of the fine content town family of products.

08:25SPEAKER- It is part of the fine content town family of products.

08:28SPEAKERIt's a sister company, I guess.

08:31SPEAKER- A subsidiary, there's not just a content.town, is there?

08:34SPEAKER- I realized that I need to make a content.town, I think,

08:37SPEAKER'cause like not having a content.town

08:39SPEAKERwith all of the associated content.town stuff

08:42SPEAKERis probably an error.

08:43SPEAKER- All right, I found the podcast.

08:45SPEAKER- Yeah, it's at takecontrol.content.town.

08:47SPEAKERAnd the idea is really simple.

08:50SPEAKERIt's that our stuff doesn't give us joy anymore.

08:55SPEAKERLike technology used to give me a lot of joy

08:57SPEAKERand I'm not finding that anymore.

09:00SPEAKERSo it's like everything from my switch to Linux,

09:04SPEAKERhow to disincentivize Windows and Mac OS

09:08SPEAKERand all the other places that use computers,

09:10SPEAKERall the software that you use,

09:11SPEAKERpicking services that are good,

09:13SPEAKERtaking the services that are kind of crappy

09:14SPEAKERand making them good.

09:16SPEAKERAll of that kind of stuff is on the table.

09:18SPEAKERAnd I think that there's like having been on this life,

09:23SPEAKERworking on this life for the last year or so

09:25SPEAKERsince Adam and I started doing dual boot diaries,

09:30SPEAKERthere's a lot of, it's a lot of little changes, right?

09:33SPEAKERIt's a lot of small incremental changes.

09:34SPEAKERAnd then one day you look up and you realize

09:36SPEAKERyou're not being constantly marketed to.

09:38SPEAKERAnd it turns out that feels good.

09:40SPEAKERAnd yeah, so that's the pitch.

09:43SPEAKERYou can check it out.

09:44SPEAKERFirst episode's up, it's on YouTube too.

09:46SPEAKER- What's it about?

09:48SPEAKER- The first episode talks about

09:49SPEAKERsome of the stuff we're gonna talk about today a little bit.

09:51SPEAKERI recorded it the morning that the E-Moodra

09:53SPEAKERand the PHP stuff broke.

09:54SPEAKER- Ah, okay.

09:55SPEAKER- So it's like, hey, maybe update your shit

09:59SPEAKERand here's what we know so far.

10:03SPEAKERI talk about switching to Nocturnia v5.

10:06SPEAKER- I see a Nocturnia tag on this post.

10:08SPEAKER- Yep, I talk about the server,

10:12SPEAKERmoving the server to a busted little laptop

10:14SPEAKERwith a busted hinge.

10:16SPEAKERSo my Beelink server is dying.

10:18SPEAKER- Oh, wait, dying how?

10:20SPEAKER- It's just crashing sporadically

10:22SPEAKERin a way that doesn't recover.

10:23SPEAKER- Let's table that 'cause we are recording

10:26SPEAKERthe patron episode right after this.

10:28SPEAKERAnd I also got some mini server stuff I wanna talk about.

10:32SPEAKER- Yeah, so anyway, we'll talk about that

10:34SPEAKERin the patron episode.

10:35SPEAKERYou can go to tech pod, patreon.com/techpod

10:38SPEAKERto get access to that if you are interested.

10:40SPEAKERBut this week, well, we're gonna talk about

10:42SPEAKERthe security stuff 'cause we wanted to dig into it.

10:44SPEAKERThere's been a, it's kind of,

10:46SPEAKERthe security people are calling it Black October.

10:49SPEAKERIt's affecting a ton of sites.

10:51SPEAKER- Yeah, it's kinda likening it to like the stock,

10:53SPEAKERlike the historic stock market crash,

10:55SPEAKERbut for CVEs or something.

10:58SPEAKER- Yeah, I talked to a friend who like,

11:01SPEAKERI've talked to a bunch of friends who work in these spaces.

11:03SPEAKEROne who has, maintains a bunch of PHP sites

11:07SPEAKERfor places that you would have gone, let's say.

11:12SPEAKERAnd he was like, yeah, it was a pretty rough day

11:16SPEAKERthat the day that all these CVEs dropped

11:18SPEAKERor the days that they didn't drop in some cases, I guess,

11:23SPEAKERin that he spent like 14 hours figuring out

11:26SPEAKERwhich servers needed to be updated, like making up.

11:29SPEAKERThey basically, their first step was mitigate stuff,

11:33SPEAKERthen make a plan to fix it.

11:35SPEAKERAnd then the next seven days,

11:37SPEAKERwe're fixing thousands upon thousands of servers.

11:41SPEAKERBut anyway, so where do you wanna start?

11:44SPEAKER- Well, I wanna start by saying

11:45SPEAKERwe are not security researchers ourselves

11:48SPEAKERor infosec professionals.

11:49SPEAKERSo I consider myself a, what's the term, journeyman?

11:54SPEAKER- Dilettante. - Sure.

11:55SPEAKER- More than that maybe?

11:56SPEAKERI think you're better than a,

11:58SPEAKERyou're further along this path than I am,

12:00SPEAKERbut yeah, we're not experts here.

12:02SPEAKER- I do keep an eye on this stuff a lot

12:03SPEAKERout of personal paranoia, primarily.

12:05SPEAKER- Yeah.

12:07SPEAKER- But so I feel like I've got an intermediate understanding

12:11SPEAKERof a lot of this stuff.

12:12SPEAKERAnd I feel like I check myself often enough

12:16SPEAKERand confirm my suspicions enough to feel okay

12:19SPEAKERabout describing this stuff.

12:21SPEAKERBut you know, grain of salt, again,

12:23SPEAKERlike there are working infosec people out there

12:26SPEAKERwho are also weighing in on these topics

12:27SPEAKERif you want that kind of thing, but.

12:30SPEAKER- And it's important to remember you're not paranoid

12:32SPEAKERif they really are out to get you, that's the thing, yeah.

12:34SPEAKER- Well, as we will see, some of my previous paranoia

12:37SPEAKERis now coming due on some of these things.

12:40SPEAKERSo I feel a bit more validated recently.

12:44SPEAKER- Look, I'm looking at some of the things

12:45SPEAKERthat I used to think of that you did

12:47SPEAKERand was like, that seems paranoid to me.

12:49SPEAKERAnd now I'm like, you know, maybe Brad had it right here.

12:51SPEAKER- Well, you know, look, if you always design

12:54SPEAKERaround the theoretical worst case scenario,

12:57SPEAKERthen as real world conditions get worse,

13:00SPEAKERyou're only going to look more and more prescient over time.

13:02SPEAKER- Wow, grim.

13:04SPEAKER- Yeah.

13:05SPEAKER- So should we start with PHP?

13:06SPEAKER- Yeah, I mean, you already mentioned it

13:08SPEAKERand I think that is definitely the widest ranging one here.

13:11SPEAKER- I actually, I'm not sure.

13:12SPEAKERI think the Emudra thing, which we'll talk about too,

13:15SPEAKERlike that touched more people probably.

13:17SPEAKER- It also seems bad.

13:19SPEAKERI was reading about it right before this

13:20SPEAKERand I think the scope of impact

13:23SPEAKERmight be worse on that than I realized.

13:25SPEAKERI thought it was only places

13:27SPEAKERusing those particular certificates,

13:28SPEAKERbut I think it's actual, well,

13:30SPEAKERI don't want to cannibalize that segment, I think.

13:32SPEAKERYeah. - Yeah.

13:34SPEAKER- Okay, PHP is a very popular

13:37SPEAKERor very widely used programming language

13:40SPEAKERfor building websites, basically.

13:42SPEAKER- Yeah, from like, what, 2000, mid 2000s?

13:45SPEAKER- Yeah, I don't know.

13:46SPEAKER- There was like a 10 year period

13:47SPEAKERwhere it was the thing everybody used

13:48SPEAKERand then people moved to other frameworks

13:50SPEAKERand stuff like Ruby and Python and all that stuff.

13:52SPEAKERBut it's massively used for everything

13:56SPEAKERfrom like MediaWiki to WordPress to Joomla.

13:59SPEAKER- Yeah, it's still used everywhere.

14:01SPEAKERThe statistic I saw was something like,

14:04SPEAKERI don't know, I have no idea

14:05SPEAKERhow you would track this comprehensively,

14:07SPEAKERbut like 70% of the web still uses PHP in some capacity.

14:10SPEAKER- It's a large double digit percentage

14:13SPEAKERis the best thing I could find.

14:15SPEAKER- Yeah, and PHP is a programming language

14:17SPEAKERjust to clarify where it sits in the web stack,

14:20SPEAKERlike it is equivalent to Python or Ruby

14:23SPEAKERand then frameworks are built on top of it,

14:25SPEAKERlike Symfony is the only PHP framework I know of, but.

14:29SPEAKER- Yeah, so people may not realize this,

14:31SPEAKERI'm sure people listening to this podcast probably do,

14:33SPEAKERbut websites these days are not just a flat HTML file

14:39SPEAKERthat somebody writes and puts on a server someplace

14:41SPEAKERand then gets served to people who go to that URL, right?

14:44SPEAKERLike they're now, most of them are dynamically generated

14:48SPEAKERat some point along the path from templates and code

14:54SPEAKERand databases and stuff like that.

14:55SPEAKERAnd PHP is one of the languages,

14:58SPEAKERwhat was one of the early languages that made that possible.

15:00SPEAKER- Yeah, yep.

15:01SPEAKERSo anyway, these are pretty standard bugs in PHP.

15:06SPEAKERLike they are, PHP is written in C or C++, I forget which,

15:09SPEAKERbut I think both of these exploits are memory safety bugs,

15:14SPEAKERwhich are like the classic C bug for this kind of thing.

15:19SPEAKERI don't know how much we wanna get into the nature

15:21SPEAKERof the bugs, but the point is you could basically

15:23SPEAKERexecute code remotely on any server running

15:26SPEAKERan affected version of PHP.

15:28SPEAKER- That's the important part, yeah.

15:29SPEAKER- Which is basically enough to get you kind of,

15:31SPEAKERnot necessarily root access,

15:33SPEAKERbut at least shell access on that machine

15:35SPEAKERand that lets you do kind of a lot of stuff.

15:37SPEAKER- Well, once you got the remote access,

15:40SPEAKERyou could use cURL to download something

15:43SPEAKERthat would give you root access basically,

15:44SPEAKERwas the kind of TLDR.

15:46SPEAKER- Is that right?

15:46SPEAKERAre you sure about that?

15:49SPEAKER- That was the example that I read multiple places.

15:52SPEAKERMaybe that is the case.

15:54SPEAKERSome of this is where colliding with my understanding

15:56SPEAKERof generally how exploits over a network work,

16:00SPEAKERwhich is to say that typically you would have

16:03SPEAKERthe privileges of whatever user was running the process

16:06SPEAKERthat you exploited, but there are definitely

16:08SPEAKERprivilege escalation attacks as well

16:10SPEAKERthat maybe that was part of this.

16:12SPEAKER- Well, so the point isn't that there was

16:15SPEAKERsome privilege escalation attack

16:16SPEAKERas part of these vulnerabilities.

16:18SPEAKERIt's that having the ability to download,

16:21SPEAKERto run remote code, to run a non-privileged code

16:24SPEAKERon your exploited server,

16:27SPEAKERthen opens you up to all the other stuff

16:29SPEAKERthat you may not actually maintain.

16:30SPEAKER- Yeah, right, that's bad in and of itself,

16:34SPEAKERregardless of what local privileges you immediately inherit

16:38SPEAKERon the machine you've compromised.

16:39SPEAKERBut anyway, we're kind of talking around the real issue here

16:42SPEAKERwhich is that, again, these exploits are pretty common

16:47SPEAKERas this type of vulnerability goes.

16:49SPEAKERThe differences here were A, that PHP is so widely used

16:52SPEAKERacross the web, B, the disclosure process

16:56SPEAKERfor this whole thing seems to have been a giant mess,

17:00SPEAKERwhich the PHP Foundation themselves

17:02SPEAKERposted a blog about describing.

17:05SPEAKERI don't follow this stuff super closely,

17:06SPEAKERbut my general understanding of how these things

17:09SPEAKERare disclosed is security researchers find exploits

17:12SPEAKERlike this privately and do everything they can

17:17SPEAKERto make sure that information does not get out

17:19SPEAKERin the public as soon as they've discovered them

17:21SPEAKERbecause bad actors can immediately start exploiting them.

17:24SPEAKERInstead, what they do is go to maintainers

17:26SPEAKERof whatever the software is that's been compromised

17:28SPEAKERand other kind of responsible parties around that ecosystem

17:33SPEAKERand privately disclose the problem to them

17:36SPEAKERso they can then work on fixing it.

17:37SPEAKERAnd I think, I gather that process,

17:39SPEAKERgenerally it takes a period of like weeks.

17:42SPEAKERYou know, they kind of take their time doing due diligence

17:45SPEAKERand making sure that they're dotting Ts and crossing Is

17:49SPEAKERand fixing the problem and getting patches ready.

17:51SPEAKERBasically, the idea is, and they embargo

17:53SPEAKERthe disclosure of these things

17:54SPEAKERis generally how this process works.

17:56SPEAKERThere's a whole, if you wanna look up what a CVE is,

17:58SPEAKERa common vulnerability and exposure,

18:00SPEAKERthere's like a whole industry standard database of CVEs

18:03SPEAKERthat tracks all these vulnerabilities

18:06SPEAKERacross kind of everything,

18:07SPEAKER'cause obviously it's in everybody's best interests

18:09SPEAKERexcept for bad actors to make sure these things

18:11SPEAKERare well-documented and cataloged.

18:14SPEAKER- Well, and the best practice is kind of very based

18:15SPEAKERon the project and the scale of the problems

18:17SPEAKERand stuff like that.

18:18SPEAKERSo you'll see that like if somebody finds a zero level

18:22SPEAKERfor an OS, for the Linux kernel or something,

18:25SPEAKERzero date for the Linux kernel or something like that,

18:27SPEAKERthen they might have a different timeline

18:30SPEAKERthan say your text editor or something like that.

18:34SPEAKER- Yeah, so anyway, typically again,

18:37SPEAKERthis is supposed to kind of be slow rolled

18:38SPEAKERbecause, you know, presumably like if a security researcher

18:41SPEAKERfound something and they had to work pretty hard to find it,

18:43SPEAKERlike nobody's gonna find it in five or six weeks

18:47SPEAKERwhile they work diligently to address it.

18:50SPEAKERBut the point is the second they disclose it to the public,

18:55SPEAKEReverybody with a vested interest in or with a product

18:58SPEAKERor a piece of software that is affected

18:59SPEAKERalso has a patch ready to go.

19:01SPEAKERAnd they can say, hey, go update your shit right now.

19:04SPEAKERThis is now out in the wild,

19:06SPEAKERbad people are gonna start exploiting it,

19:07SPEAKERbut here are the fixes, go to town.

19:10SPEAKERA bunch of stuff happened here that compromise that process.

19:13SPEAKER- Yeah.

19:15SPEAKER- And some of it seems to be of indeterminate origin.

19:17SPEAKERIt sounds like the fact that there were CVEs

19:20SPEAKERstarted circulating as a rumor two or three days

19:23SPEAKERbefore the disclosure was supposed to happen,

19:26SPEAKERbut not like what they were just like maybe the CVE,

19:30SPEAKERnot like numbers, you know, the kind of database numbers,

19:32SPEAKERbut they got people talking.

19:35SPEAKEROne of the security firms that was involved

19:39SPEAKERin identifying and fixing this thing

19:41SPEAKERapparently accidentally posted a video

19:44SPEAKERdescribing it early as well.

19:47SPEAKER- Shaking my head.

19:49SPEAKER- And I think, I assume they probably took that down quickly,

19:52SPEAKERbut like basically more and more information

19:53SPEAKERwas getting out about the nature and existence

19:55SPEAKERof these things to the point that they then moved up

19:58SPEAKERthe date of disclosure by around, I think, 24 hours.

20:01SPEAKER- It was 24, yeah, it was from Thursday to Wednesday.

20:03SPEAKERIt was the thing.

20:04SPEAKER- And it sounds like that's probably

20:05SPEAKERwhere things really got sticky

20:07SPEAKER'cause then they suddenly had less time to fix things

20:09SPEAKERor get the fixes ready than they thought.

20:12SPEAKERAnd then finally, one of the parties

20:15SPEAKERas a kind of a security research firm called Chain Guard,

20:17SPEAKERwhich was an official part of this process,

20:20SPEAKERone of the entities that this whole thing was disclosed to,

20:24SPEAKERlike they just went out and posted their fixed binaries

20:27SPEAKERlike six hours before the even moved up

20:30SPEAKERearly disclosure time was supposed to happen.

20:33SPEAKERLike I think it was just compiled binary fixes.

20:36SPEAKERI don't think it was source code,

20:38SPEAKERbut I think that was still enough for people

20:39SPEAKERto get those binaries and compare.

20:41SPEAKER- And figure out what had changed.

20:43SPEAKER- Do some kind of analysis against the previous versions

20:46SPEAKERand kind of get an idea of what was going on.

20:48SPEAKERAnd so I think it was cloud flare

20:51SPEAKERthat posted a timeline of what they were seeing

20:53SPEAKERin terms of attempts at exploits once that had happened.

20:57SPEAKERAnd it was like hour by hour,

20:59SPEAKERlike the number of detections of attempted exploits

21:03SPEAKERthey were seeing was going up

21:04SPEAKERby like an order of magnitude every hour after that

21:06SPEAKERor something like it was bad.

21:08SPEAKERSo like if the whole disclosure process

21:11SPEAKERhad not been compromised,

21:13SPEAKERit seems like this would have been a whole lot less

21:16SPEAKERof a mess than it was.

21:17SPEAKEREven though again, PHP is everywhere

21:19SPEAKERand it was already gonna be a huge mess

21:20SPEAKERbecause everybody in the fucking world

21:23SPEAKERhad to like scramble to update their stuff in the best case.

21:26SPEAKER- Yeah, if it had been the normal path,

21:28SPEAKERthen the exploit wouldn't have leaked the people

21:31SPEAKERthat wouldn't have been circulating in the wild.

21:33SPEAKERThe speed from the time that the exploit leaked

21:35SPEAKERto the exploit actually being developed and built

21:38SPEAKERis probably accelerated by AI

21:39SPEAKERis the other thing that we haven't really talked about here.

21:43SPEAKER- And AI was used to find this vulnerability

21:45SPEAKERin the first place,

21:46SPEAKERwhich is actually kind of the theme of everything

21:48SPEAKERwe're talking about here.

21:49SPEAKER- Yeah, I think that's the new normal is probably real bad.

21:53SPEAKER- Yes, that's what's led to this new world.

21:56SPEAKERBut anyway, it was crazy watching the response

21:58SPEAKERand the hours and days afterwards

22:01SPEAKERbecause you were seeing everybody from like the NSA

22:03SPEAKERand the FBI to like the prime minister of Japan

22:07SPEAKERgetting out on social media and saying,

22:09SPEAKER"Hey, please, please either patch your websites

22:12SPEAKERor take them down immediately until you can patch them."

22:15SPEAKERLike this is very serious.

22:16SPEAKERLike in the video game world, just as an example,

22:20SPEAKERlike Capcom had to pull Street Fighter V from sale

22:22SPEAKERand also disabled its online multiplayer.

22:25SPEAKER- Because all of the backend runs on PHP?

22:27SPEAKER- Oh yeah, it's in there somewhere.

22:29SPEAKERThey didn't say exactly where it's affected enough

22:31SPEAKERthat they straight up.

22:32SPEAKERAnd granted Street Fighter VI has been out

22:34SPEAKERfor like two or three years now.

22:35SPEAKERSo that's an older game

22:37SPEAKERthat probably not a lot of people were playing,

22:38SPEAKERbut still to see a game like fully pulled from sale

22:41SPEAKERand having its multiplayer disabled was pretty drastic.

22:43SPEAKERBut there are way worse effects than that.

22:47SPEAKERLike Railway, the kind of cloud application host

22:51SPEAKERapparently got hit real hard with this,

22:53SPEAKERhad a bunch of customer secrets, API keys and so forth.

22:59SPEAKERBreached, like a bunch of different breaches

23:01SPEAKERhave been reported all over the place.

23:03SPEAKER- Yeah, they lost access to top level,

23:06SPEAKERtheir private keys for some stuff,

23:07SPEAKERwhich caused them some real downstream consequences,

23:10SPEAKERmy understanding.

23:11SPEAKERSo anyway, yeah, this one is rough.

23:13SPEAKERThere's an article in the Atlantic by Charlie Warzell

23:18SPEAKERon an interview with Andre Suri,

23:21SPEAKERwho is the guy who implemented a lot of the,

23:25SPEAKERor who pushed a lot of the fixes.

23:27SPEAKER- Yeah, I'd enjoyed, I didn't finish that interview,

23:29SPEAKERbut I read probably the first half of it

23:30SPEAKERand kind of enjoyed the like kind of breathless tone

23:35SPEAKERof the interviewer.

23:36SPEAKER'Cause I think they led with a headline,

23:37SPEAKERsomething like the man,

23:38SPEAKERmeet the man who saved the internet or something like that.

23:40SPEAKERAnd like, you can tell he's kind of like,

23:44SPEAKERthis guy is just very moderately kind of like,

23:48SPEAKERyeah, they were bugs and I fixed them.

23:50SPEAKERLike it's all very much a matter of course for this guy,

23:52SPEAKERbecause again, these are like not uncommon

23:55SPEAKERor unusual bugs at all,

23:57SPEAKERwhich is a pretty standard process for him.

23:59SPEAKERLike it's just, it's kind of funny watching

24:01SPEAKERkind of mainstream people who don't understand software,

24:04SPEAKERtry to grapple with what's going on here.

24:06SPEAKER- There's two, A, he's the kind of person

24:10SPEAKERthat we talked to a lot when we were doing the FOSPOD, right?

24:11SPEAKERLike just a real practical, like salt of the earth guy

24:16SPEAKERwho's doing the work.

24:18SPEAKERBut the other thread through here is,

24:20SPEAKERhey, this stuff isn't funded well enough, right?

24:22SPEAKERThis is infrastructure that 70% of the internet runs on.

24:25SPEAKERAnd like the, yes, it has a foundation, all this stuff,

24:29SPEAKERbut I'm one person doing a lot of this maintenance

24:34SPEAKERand there's not a lot of backstop if something happens to me

24:36SPEAKERor if I get tired of doing this.

24:39SPEAKER- Yeah, but I felt since we were doing the FOSPOD

24:43SPEAKERand talk to a lot of those types of people,

24:45SPEAKERlike I felt that the lack of corporate,

24:47SPEAKERlike Jean Baptiste from Video Land, the VLC people,

24:51SPEAKERwas very opinionated about this,

24:52SPEAKERthat corporations are making insane amounts of money

24:56SPEAKERusing these projects and contributing little or nothing back

24:59SPEAKERto maintaining them and that fucking sucks.

25:02SPEAKER- Look at the amount of money that's made

25:03SPEAKERusing FFmpeg every day and look at their funding model.

25:07SPEAKER- Yeah, it sucks, man.

25:09SPEAKERLike it's, I don't know what to do about it.

25:11SPEAKER- Twitch wouldn't exist without OBS.

25:14SPEAKER- Right. - Right?

25:15SPEAKER- Right, like, well, I mean, at least in their case,

25:17SPEAKERI would have to check if Twitch is,

25:19SPEAKERlike OBS does have quite a few corporate sponsors

25:22SPEAKERI would hope Twitch is one of them, if anybody is,

25:24SPEAKERbut like some projects do get a decent amount of money,

25:27SPEAKERI think, although it even--

25:29SPEAKER- But they're making billions of dollars

25:30SPEAKERand they give them like 50 grand a year.

25:32SPEAKER- No, it is absolutely not even remotely proportionate.

25:35SPEAKERIt sucks.

25:36SPEAKERIt's like, it actually, I'm not, I haven't,

25:39SPEAKERI have not thought this statement through

25:41SPEAKERand I'm not prepared to defend it,

25:43SPEAKERbut it makes me feel like there should be some regulation

25:45SPEAKERabout this perhaps or something.

25:47SPEAKERIt would be better for everybody.

25:49SPEAKER- YouTube, Logitech, and Twitch all support,

25:52SPEAKERare premier tier sponsors for OBS, so.

25:54SPEAKER- I figured they were, but again, like you said,

25:56SPEAKERwho knows what a premier tier actually is in that case?

25:59SPEAKER- Yeah, anyway, this exploit took a bunch of sites down.

26:03SPEAKERSome are still coming up, AO3 famously,

26:05SPEAKERthe kind of fan fiction hub,

26:08SPEAKERone of the big fan fiction hubs is down

26:10SPEAKERfor the next month, it seems like,

26:11SPEAKERbecause of what looks like this PHP exploit

26:14SPEAKERgetting into their stuff, so.

26:15SPEAKER- Yeah, yeah, and again, we should stress again,

26:18SPEAKERlike this type of bug is totally a classics category of bug.

26:23SPEAKERLike it's nothing outlandish,

26:24SPEAKERlike this happens all the time with this type of--

26:28SPEAKER- The reason it's a cluster was the early release.

26:30SPEAKER- Yeah, yeah, but we'll get into that again.

26:32SPEAKERI will put on my amateur programming,

26:35SPEAKERunderstander hat and comment at the end of this, but.

26:39SPEAKER- Yeah.

26:40SPEAKER- There was, there was what started as,

26:44SPEAKERso I don't know if this name came out of AI,

26:47SPEAKERbut everybody is using like thing to shell nomenclature

26:50SPEAKERfor these things, like it was PHP to shell.

26:53SPEAKER- Oh, that seems good.

26:54SPEAKER- Which I mean, all of these are remote code executions,

26:57SPEAKERso all of them ultimately are basically leading

26:59SPEAKERto you getting shell access on the machine.

27:01SPEAKERSo there was PHP to shell,

27:04SPEAKERand then right around the same time,

27:05SPEAKERlike the day, I think a day later or so,

27:07SPEAKERthere was node to shell,

27:08SPEAKERwhich is a node JS vulnerability

27:11SPEAKERthat was similar in its effect.

27:14SPEAKERAlthough that has since evolved

27:15SPEAKERinto being called now HTTP to shell.

27:19SPEAKER- Great, oh, that sounds good.

27:21SPEAKER- 'Cause it turns out the vulnerability

27:22SPEAKERwas not in node JS itself,

27:24SPEAKERbut in, I guess you pronounce it Brotli, B-R-O-T-L-I.

27:30SPEAKERIt's funny, I'm familiar with that term

27:31SPEAKERbecause from updating my Debian server,

27:34SPEAKERoccasionally I'll see an update to some Brotli library.

27:39SPEAKERIt is a Google compression library is all it is,

27:42SPEAKERbut it's used in a bajillion things,

27:44SPEAKERand that's where the vulnerability was.

27:45SPEAKERSo it turns out basically just about any,

27:48SPEAKERlike this could be exploited over HTTP

27:50SPEAKERand like it affects,

27:51SPEAKERlike there's the C++ library, Python.net,

27:54SPEAKERor some other examples of programming languages

27:56SPEAKERthat have Brotli libraries that are affected.

28:00SPEAKERSo this was another route into getting remote access

28:04SPEAKERbasically to machines using this.

28:06SPEAKERLike this is also ongoing and it's been mitigated,

28:09SPEAKERI think like the PHP thing,

28:11SPEAKERthere are fixes out for basically everything.

28:13SPEAKER- Is this one another one that broke containment

28:16SPEAKERbefore the embargo was up?

28:18SPEAKER- I didn't read up on the disclosure,

28:20SPEAKERbut in fact, I didn't see anything to read

28:21SPEAKERabout the disclosure of this one.

28:23SPEAKERSo I don't know that there was anything untoward there.

28:27SPEAKER- Gotcha.

28:28SPEAKER- But again, like I said,

28:29SPEAKERit seems like it went from everybody

28:31SPEAKERthinking it was just a node JS issue

28:33SPEAKERto turning out to be much, much broader,

28:35SPEAKERbut I don't know if that was AI driven or what.

28:39SPEAKER- Like to be clear, this is a library

28:41SPEAKERthat does like compression when you're using curl

28:43SPEAKERand stuff like that.

28:44SPEAKERLike it works at an incredibly low level.

28:46SPEAKER- Right, right.

28:47SPEAKERIt's just one of the many, many, many libraries

28:50SPEAKERbehind the scenes that applications are built against

28:52SPEAKERto do different web things or internet things.

28:55SPEAKERIt seems like there are so many,

28:57SPEAKERI mean, how many tens or hundreds of thousands

29:01SPEAKERof similar libraries could be out there

29:03SPEAKERthat are also ripe for exploitation?

29:05SPEAKERLike that's just...

29:07SPEAKER- Just go on your distros repos

29:11SPEAKERand look at what the dependencies are for that.

29:13SPEAKERWhat are things gonna look like a year from now?

29:15SPEAKERActually, maybe the glass half full view

29:18SPEAKERis that maybe things will look better a year from now

29:20SPEAKERbecause there's gonna be a lot of pain upfront

29:23SPEAKERas all these things, these edge cases are discovered by AI,

29:26SPEAKERbut then they'll all get fixed

29:28SPEAKERand then maybe we end up in a more secure place

29:30SPEAKERdown the road.

29:32SPEAKER- My fear is that it's all edge cases,

29:34SPEAKERis that there's just an infinite number of these.

29:36SPEAKER- Yeah, sure.

29:37SPEAKERWell, again, we'll get into my amateur proselytization

29:43SPEAKERabout stuff like this at the end of this.

29:46SPEAKER- You're gonna talk about Rust again?

29:48SPEAKER- Maybe.

29:49SPEAKER- Okay.

29:50SPEAKER- In a way that I am not qualified really to...

29:52SPEAKERWell, okay.

29:53SPEAKER- Yeah, anyway.

29:54SPEAKER- Let's wait till we get there.

29:55SPEAKER- Yeah.

29:56SPEAKER- You had not seen these,

29:57SPEAKERbut these have been hot topics on the Discord Linux channel.

30:01SPEAKER- Yeah, I don't pay attention.

30:04SPEAKERRunning the rolling distro,

30:05SPEAKERI just update when it says there's an update.

30:06SPEAKERSo I get all the fixes as they come

30:08SPEAKERand don't have to think about it too much.

30:10SPEAKER- I think I've mentioned this in recent weeks.

30:12SPEAKERLike I saw this graph a few months ago

30:14SPEAKERthat like, I mean, this is happening to everything,

30:15SPEAKERbut I guess it might've been Linus Torvalds

30:18SPEAKERor somebody involved in kernel maintenance

30:20SPEAKERposted a graph of kernel CVEs.

30:24SPEAKERAnd it's just the classic hockey stick.

30:25SPEAKERThis was one of the bellwethers

30:27SPEAKERthat really got me thinking about

30:28SPEAKERthis new world we're entering,

30:30SPEAKERwhere the line for Linux kernel vulnerabilities

30:34SPEAKERis like not flat, but like a very gentle upward slope.

30:39SPEAKER- Okay.

30:40SPEAKER- And then we hit the LOM inflection point

30:42SPEAKERand then it just goes like almost vertical.

30:44SPEAKER- That seems bad.

30:45SPEAKER- And so like, you know, and again,

30:47SPEAKERlike it's probably good to be finding

30:49SPEAKERall these vulnerabilities.

30:51SPEAKER- I mean, presumably that these are all things

30:54SPEAKERthat like state actors and stuff like that,

30:55SPEAKERthe people who look for hacks and don't submit them, right,

31:00SPEAKERhave been aware of at least some subset of these.

31:02SPEAKER- Possibly, or if they haven't been aware of them,

31:04SPEAKERthey also have the same AI tools that everybody else does

31:07SPEAKERand they can find them and not disclose them

31:09SPEAKERand just use them for their own purposes instead.

31:15SPEAKERA couple of pretty notable ones jumped out at me

31:17SPEAKERin the last couple of weeks

31:18SPEAKERthat people have been talking about on the Discord.

31:20SPEAKEROne has a name, one does not.

31:23SPEAKEROne of them is PwnEscape, which is,

31:26SPEAKERI don't need to get into the mechanism.

31:28SPEAKERI barely understand it.

31:29SPEAKERIt's something, but in fact, both of these

31:30SPEAKERare through the networking stack of the kernel.

31:36SPEAKER- Okay.

31:36SPEAKER- But PwnEscape is basically a way

31:38SPEAKERfor a process inside a virtual machine

31:40SPEAKERto read memory on the host,

31:42SPEAKERlike outside the virtual machine.

31:45SPEAKER- Oh, that seems bad.

31:47SPEAKER- That's kind of like you had one job, VM.

31:51SPEAKER- Yeah, like the whole point of running the VM

31:53SPEAKERis that it should be contained and like no mistakes.

31:57SPEAKER- Yes, like the VM.

31:59SPEAKERIn fact, like we talk a lot about,

32:01SPEAKERthis comes up kind of all the time on the Discord.

32:03SPEAKERThere's system level containerization.

32:06SPEAKERThere's like Docker style images, LXC,

32:10SPEAKERlike kind of containers that run on the same host kernel,

32:14SPEAKERbut they have a minimal amount of isolation

32:17SPEAKERcompared to a VM.

32:18SPEAKER- Those are more of a convenience though

32:20SPEAKERthan a security thing, right?

32:21SPEAKER- They're still pretty, no, they're secure-ish.

32:24SPEAKERLike it would be easier to escape them,

32:26SPEAKERbut that still requires some specific mechanism.

32:28SPEAKER- Yeah.

32:29SPEAKER- And they use all kinds of tricks

32:31SPEAKERto maintain some amounts of isolation

32:33SPEAKERand you can make them more secure

32:35SPEAKERby running the containers, not as root, for example,

32:39SPEAKERminimizing the privileges and capabilities

32:41SPEAKERthat the container has.

32:42SPEAKERAnyway, all that is to say that VMs are supposed to be the,

32:45SPEAKERlike what's the term I'm looking for, the nuclear option.

32:50SPEAKERLike the VM, VMs are the ones that use

32:52SPEAKERlike CPU hardware level virtualization features

32:57SPEAKERto maintain isolation in a much more holistic way.

33:01SPEAKERSo seeing that there was a bug here

33:03SPEAKERthat allowed interaction between the innards of a VM

33:07SPEAKERand the host that it's running on was kind of crazy.

33:11SPEAKER- So does this impact hypervisors or is this just-

33:15SPEAKER- Like I said, I think it's, if I understood,

33:17SPEAKERthen again, this is kind of maybe over my head,

33:19SPEAKERlike this is a bug in the networking stack of the kernel.

33:22SPEAKERSo I don't think it's a specific problem with like KVM,

33:27SPEAKERthe kernel virtualization or hypervisors that run using it,

33:31SPEAKERI don't think, but still like the idea that this is possible

33:35SPEAKERjust felt worthy to me to see.

33:37SPEAKER- I mean, I've seen these pop up before here and there,

33:40SPEAKERbut they're unusual is my understanding.

33:42SPEAKER- Yeah, like this one was big enough

33:44SPEAKERfor people who know what they're talking about

33:45SPEAKERto show up on the Discord being like,

33:46SPEAKER"Hey, heads up, keep an eye on it."

33:48SPEAKERAnd this has been fixed, of course, like you can,

33:50SPEAKERI think 7.2.11 was the first kernel

33:53SPEAKERthat had a fix for this.

33:54SPEAKER- Okay.

33:55SPEAKER- And of course they backport security fixes

33:57SPEAKERfor things like this to all currently supported

34:00SPEAKERolder kernels as well.

34:01SPEAKER- That makes sense.

34:02SPEAKER- There's another one that I just became aware of yesterday,

34:04SPEAKERwhich is even scarier to me,

34:06SPEAKERwhich is that there is a remote code execution exploit

34:11SPEAKERin the TCP part of the kernel networking.

34:14SPEAKER- Okay, that seems bad.

34:16SPEAKER- Basically this is if you have a listening TCP socket,

34:20SPEAKERlike TCP is, you know, TCP/IP you've probably heard of

34:23SPEAKERis one of the underlying network protocols

34:25SPEAKERthat run the internet.

34:27SPEAKERIf you have a specific type of listening TCP socket

34:31SPEAKERor, you know, process listening on a TCP socket,

34:35SPEAKERit can be exploited to run remote code.

34:39SPEAKERIt is multipath TCP, which I barely know what that is

34:42SPEAKERbeyond what I've read about

34:44SPEAKERin this particular vulnerability,

34:46SPEAKERwhich I think might have to do with multiprocessing.

34:49SPEAKERI think like kind of using multiple cores

34:51SPEAKERor multiple threads to handle the networking

34:55SPEAKERis about the limits of my understanding of it.

34:57SPEAKERSo you'd have to be running a multipath TCP socket

35:00SPEAKERfor this to matter.

35:02SPEAKERSo unless you are exposing a service to the open internet

35:07SPEAKERthat is using that specific type of socket,

35:09SPEAKERyou're probably okay.

35:11SPEAKERSo you're probably fine unless you know

35:13SPEAKERthat you're doing this specific thing with one exception,

35:16SPEAKERwhich is a big oops that I saw going around on,

35:19SPEAKERI think somebody on Hacker News or actually, sorry,

35:21SPEAKERthis came out of Usenet, Usenet's still doing the work.

35:24SPEAKER- Wow, really?

35:25SPEAKER- Go, the programming language Go,

35:28SPEAKERapparently enables multipath by default

35:30SPEAKERwhen you open a TCP socket.

35:32SPEAKERSo it seems like a lot of applications written in Go

35:36SPEAKERthat listen on a TCP socket at all,

35:39SPEAKERwhich is a lot of them might have this going on,

35:41SPEAKERlike that can be disabled.

35:42SPEAKERYou just have to like change a couple of things

35:44SPEAKERto disable that and rebuild the program.

35:46SPEAKER- So I should go look at what depends on Go basically

35:49SPEAKERand then update all that.

35:50SPEAKER- Like definitely my blocky instances,

35:53SPEAKERlike blocky is the thing I use,

35:54SPEAKERwhich is similar to Piehole.

35:56SPEAKERObviously not facing the internet, thankfully,

35:58SPEAKERbut I'm sure those probably are vulnerable to this.

36:01SPEAKERMy poor LAN.

36:03SPEAKERAnyway, those are a couple of pretty big kernel,

36:05SPEAKERLinux kernel ones that have come through

36:07SPEAKERand again, both fixed,

36:08SPEAKERbut it just feels like this is just gonna keep happening.

36:11SPEAKER- I think that's the TLDR.

36:14SPEAKERThere's a couple other things.

36:15SPEAKERI wanna talk about the Plex to shell thing briefly.

36:17SPEAKERIt's like, it's a multi-tier attack

36:19SPEAKERthat basically hits OpenPlex servers older than,

36:22SPEAKERI think it was three months old.

36:24SPEAKERI don't remember.

36:25SPEAKERIt didn't actually pull the version number.

36:27SPEAKER- Like three months sounds old to me,

36:28SPEAKERbut then if you're a set and forget kind of person

36:31SPEAKERand you've just been running it

36:33SPEAKERand not really thinking about updating it often,

36:34SPEAKERalthough frankly that you shouldn't do that.

36:36SPEAKERLike you should not face anything to the open internet

36:40SPEAKERand then forget about it.

36:41SPEAKERLike you absolutely should be updating it a lot.

36:43SPEAKER- I'm a big fan of running Plex in a Docker container

36:46SPEAKERor Podman container or whatever,

36:47SPEAKERand just setting it to reboot every night

36:49SPEAKERso that it restart the container every night

36:51SPEAKERso that it updates or once a week or whatever.

36:54SPEAKERThat'll build a new image

36:56SPEAKERand you don't have to think about it at that point.

36:58SPEAKER- Right, it's like some people would be like,

37:00SPEAKERah, you might run into breaking changes

37:01SPEAKERby pulling new versions without knowing what they do,

37:03SPEAKERbut I would probably say that's better

37:05SPEAKERthan forgetting to update it and just let it sit

37:07SPEAKERand get out of date and then be exposed

37:09SPEAKERto something like this.

37:10SPEAKER- Or you could not put it on the public network

37:12SPEAKERis the other thing.

37:12SPEAKERAnd we'll talk about that stuff in a minute.

37:15SPEAKER- I think that's the real lesson here.

37:16SPEAKERBut yeah, there were multiple exploits

37:18SPEAKERin a pretty recent version of Plex

37:19SPEAKERthat allowed once again, remote code execution.

37:23SPEAKERAnd I saw a post from somebody on Reddit

37:26SPEAKERwho was hit by this and had whoever compromised them,

37:30SPEAKERadded their machine to a botnet.

37:32SPEAKER- Yeah.

37:33SPEAKER- And so they basically realized this was happening

37:35SPEAKERwhen their upload got completely clogged

37:38SPEAKERby DDoS traffic coming from whatever.

37:42SPEAKERLike I think, didn't you say you've seen people

37:44SPEAKERtalking about having crypto miners installed

37:47SPEAKERon Plex hosts and stuff like that?

37:48SPEAKER- Yeah, apparently people were targeting

37:50SPEAKERbecause they often have GPU, real GPUs in them.

37:52SPEAKER- Oh, of course, yeah.

37:53SPEAKER- So they were running crypto mining on them, which like-

37:56SPEAKER- Tons of people put like Nvidia cards

37:57SPEAKERin their Plex machines to do transcoding.

38:00SPEAKER- Yep, good stuff.

38:01SPEAKER- Yeah, this really feels like the week

38:06SPEAKERwhere the theoretical became real in a lot of cases.

38:09SPEAKERYou know, this is like the kind of thing

38:10SPEAKERyou've like warned about for a long time,

38:11SPEAKERbut have just always been like, oh, that could happen,

38:14SPEAKERbut we're not really seeing it.

38:15SPEAKERAnd all of a sudden it's like, ooh, wait, here we are.

38:17SPEAKER- So I talked to a friend who works in this space

38:19SPEAKERthe other day and I asked him if this is like,

38:23SPEAKERI asked him how much of this is hype

38:25SPEAKERand how much of this is real stuff.

38:27SPEAKERAnd he works in a place where he can't come on the show,

38:29SPEAKERunfortunately, because of the job stuff.

38:32SPEAKERBut his basic take was this was high,

38:37SPEAKERit felt like higher than normal volume to him

38:39SPEAKERand higher than, much higher than normal scale of things

38:44SPEAKERthat affect actual people.

38:46SPEAKERLike usually, like the PHP thing would have been

38:49SPEAKERa nothing burger if they hadn't leaked that,

38:51SPEAKERthe vulnerability 36 hours in, 24 hours in advance

38:54SPEAKERor whatever it was, 36 hours in advance.

38:56SPEAKER- I mean, it still would have been a massive effort

38:57SPEAKERto update all the servers, but at least it would have

39:00SPEAKERhappened in a responsible way.

39:01SPEAKER- Well, and they would have had time, right?

39:03SPEAKERLike the big change is that they didn't have time

39:05SPEAKERbecause the exploits were already circulating.

39:09SPEAKERThe next one he said was, he described us

39:11SPEAKERthe stupidest thing he'd ever seen.

39:14SPEAKER- This is the Emudra certificate authority problem.

39:18SPEAKERIt's not even a hack.

39:19SPEAKERIt's just somebody did something incredibly dumb.

39:21SPEAKER- Yeah, this was the other big one

39:23SPEAKERthe same day as the PHP one.

39:24SPEAKER- Yeah, and this one impacts everyone, literally everyone.

39:28SPEAKER- I moved it past all these others

39:30SPEAKERbecause it is a difference in kind.

39:31SPEAKERLike all these others are bugs in,

39:35SPEAKERI guess all C code bases probably,

39:37SPEAKERwell, no, no, no, Plex is not,

39:39SPEAKERbut like those were all like of a kind basically.

39:41SPEAKERAll those exploits were generally.

39:44SPEAKER- Remote code exploits is the thing.

39:45SPEAKERThey let somebody run software on your computer

39:47SPEAKERthat wasn't supposed to build run software on your computer.

39:49SPEAKER- And this concerns web certificates

39:53SPEAKERand extreme negligence in their generation and maintenance.

39:56SPEAKER- Yeah, so the way web certificates work

39:58SPEAKERis there's kind of a nested hierarchy of authority.

40:02SPEAKERSo you have one top level authority

40:04SPEAKERthat hands out certificates to people

40:07SPEAKERthat are known good, right?

40:08SPEAKERAnd then those are all cryptographically signed.

40:11SPEAKERAnd then the downstream ones can cryptographically sign.

40:13SPEAKERAnd you end up with this kind of cascade of authority

40:18SPEAKERso that you know if a certificate that's signed

40:21SPEAKERby somebody whose original certificate

40:23SPEAKERwas signed by Verisign,

40:25SPEAKERyou know that that certificate is theoretically good.

40:28SPEAKERSo the C Mujer company

40:29SPEAKERis an intermediate certificate authority.

40:31SPEAKERSo they're kind of near the top of that tier,

40:34SPEAKERbut relatively high on the kind of waterfall or cascade.

40:38SPEAKERAnd they had a handful of certificates that had,

40:44SPEAKERlike calling them incredibly low complexity private keys

40:47SPEAKERunder sells it because they were one to three digits

40:52SPEAKERbetween one and 384.

40:54SPEAKER- Yeah, or it may have even been--

40:55SPEAKER- Four and 384, I think technically.

40:58SPEAKER- You know what, I should just pull up the list.

40:59SPEAKERI saw somebody talking about that

41:01SPEAKERand I think they were actually all between zero and 255.

41:05SPEAKER- Great.

41:06SPEAKER- I would put them, well, I had seen some speculation

41:10SPEAKERthat the types of private keys

41:12SPEAKERthey were supposed to be generating here

41:13SPEAKERhad 384 bits of entropy.

41:16SPEAKER- Which is 100 to 150 characters or something.

41:18SPEAKER- Yeah, I mean, it's a very long alphanumeric string,

41:20SPEAKERbut I saw some maybe joking speculation

41:23SPEAKERthat maybe they had misunderstood this

41:25SPEAKERto mean they needed to pick a number between one and 384.

41:28SPEAKER- Sweet mother.

41:29SPEAKER- But I don't know that that's actually the case,

41:32SPEAKERbut then hang on, let me just pull up the list again.

41:34SPEAKERMaybe we should just do a dramatic reading of--

41:37SPEAKER- The private keys.

41:38SPEAKER- Of the eight private keys that were--

41:41SPEAKER- Well, and I think the important thing is

41:43SPEAKERbecause these people were high in the trust scheme,

41:47SPEAKERa lot of other certificates also trusted them.

41:49SPEAKERSo if you used a web browser,

41:54SPEAKERthat web browser has a certificate file that basically says,

41:57SPEAKERhey, anybody that's signed with these keys is probably okay,

42:00SPEAKERis okay and we should trust them for things like SSL

42:03SPEAKERso that when you go to your bank's website

42:05SPEAKERand you have the little padlock in the corner of the bar

42:09SPEAKERthat says, hey, this is encrypted

42:10SPEAKERand nobody can look at what you're posting,

42:13SPEAKERwhat you're saying is, hey, this is good.

42:16SPEAKERBy making their private keys so, so easy to guess,

42:20SPEAKERwhat they did was they let bad actors generate

42:23SPEAKERbad certificates that look like good certificates.

42:25SPEAKER- Yeah, yeah, you can forge certificates

42:29SPEAKERwith their extremely unsecret secrets or their trivially

42:34SPEAKERsimple secrets.

42:35SPEAKER- So if you wanna make a certificate

42:37SPEAKERfor say wellsfargo.bank,

42:40SPEAKERnot a real website for the Wells Fargo bank,

42:43SPEAKERyou could do that really trivially with these private keys,

42:48SPEAKERthe easy to predict private keys.

42:49SPEAKER- Oh, I found the list.

42:51SPEAKER- Okay. - Yeah, they are,

42:52SPEAKERyes, they are all between zero and 255,

42:55SPEAKERwhich puts them, here I am with my amateur programmer hat

43:00SPEAKERagain, that puts them in the range

43:01SPEAKERof an unsigned 8-bit integer.

43:04SPEAKER- Yeah.

43:05SPEAKER- So I don't know if there was maybe something,

43:07SPEAKERI only know that from my time in IPv4 networking.

43:11SPEAKERIt's, who knows how this came about,

43:14SPEAKERbut yeah, basically they generated

43:15SPEAKERthese extremely short numbers as private keys

43:18SPEAKERthat is just not supposed to be how that works at all.

43:20SPEAKER- So this impacts literally everything that uses SSL

43:24SPEAKERor anything that uses pre-encryption.

43:26SPEAKER- That was the thing that I just came to realize

43:28SPEAKERthat I didn't before.

43:29SPEAKERI thought this was like, oh, only sites

43:31SPEAKERthat are using certificates from the CA are affected,

43:34SPEAKERbut it's actually, it's at the client.

43:36SPEAKERIf I understand it correctly, it's at the client level,

43:38SPEAKERright, like if you're basically your OS

43:40SPEAKERor your application includes these certificates

43:44SPEAKERin its list of trusted certificates, then you're vulnerable.

43:47SPEAKER- Yeah, that's exactly it.

43:49SPEAKERSo the fix for it is to update all of your OSs,

43:52SPEAKERall of your browsers and every app on your system.

43:56SPEAKERAlso, all of your Linux Docker containers,

43:58SPEAKERall of your Linux installs, all of the things that you,

44:01SPEAKERall of your Internet of Things things

44:03SPEAKERthat may use SSL to connect

44:05SPEAKERto some sort of web service someplace.

44:07SPEAKER- Yeah, I don't wanna jump ahead to the best practices here

44:10SPEAKERas well as we can provide them, but update everything.

44:14SPEAKERLike you should just update everything immediately

44:16SPEAKERand make it a practice to keep your eye on updates

44:20SPEAKERfrom now on because at least until this stuff slows down

44:24SPEAKERor maybe forever from now on, like you need to be,

44:27SPEAKERyou're gonna have to be more vigilant

44:28SPEAKERabout keeping things up to date

44:29SPEAKERif you don't wanna be at risk of these things.

44:31SPEAKER- Let me tell you about my new service.

44:32SPEAKERIt's a piece of software that just updates everything

44:34SPEAKERfor you, it's gonna need root access to everything.

44:37SPEAKERIt's gonna be great, people are gonna love it.

44:39SPEAKER- I think most stuff updated.

44:40SPEAKERLike I saw even, you know, like the iPhone and iPad

44:43SPEAKERpulled updates that day type stuff.

44:45SPEAKERI think, I believe most everybody has mitigated this

44:49SPEAKERwith the apparent exception of Apple

44:50SPEAKERat the system level in Mac OS.

44:51SPEAKER- The Mac OS thing is wild.

44:53SPEAKERI hadn't seen this until yesterday when you pointed it out.

44:55SPEAKER- Apple has mitigated this in its applications.

44:58SPEAKERLike Safari is up to date.

44:59SPEAKERBasically like they updated like the networking framework

45:02SPEAKERthat a lot of their applications are built on.

45:05SPEAKERSo, you know, things like Safari are protected,

45:07SPEAKERbut at the very low level in the Unix-y parts of Mac OS,

45:11SPEAKERthings like Git, you know, that reference kind of the system

45:14SPEAKERCA whatever store or trusted list or whatever.

45:17SPEAKER- It's a certificate of authority in this case.

45:19SPEAKER- That has not been updated.

45:21SPEAKERSo things like the Git that Apple itself ships

45:24SPEAKERas part of its developer tools is still vulnerable.

45:27SPEAKERIn fact, maybe I'll put it in the,

45:31SPEAKERon emudra.wehaveaproblem.com

45:34SPEAKERis where I was reading an article about this.

45:35SPEAKERThey have set up a quick Git

45:40SPEAKERthat you can try to pull a file list from.

45:43SPEAKERAnd if that's successful,

45:44SPEAKERyou know your Mac OS is still compromised.

45:47SPEAKER- Wild.

45:48SPEAKER- Even worse, and I actually ran into this problem

45:50SPEAKERin a completely different context the same week.

45:53SPEAKEREven worse, you can go in and hand edit the files.

45:56SPEAKERIt's just like a file in etsy/ssl basically.

46:00SPEAKERLike you can go hand fix this,

46:02SPEAKERbut then Mac OS updates will revert that change

46:04SPEAKERthat you've made.

46:06SPEAKER- That's bad.

46:07SPEAKER- So, and I believe if you're using like the Homebrew

46:09SPEAKERor like Nick's version of Git,

46:11SPEAKERif you run a separate package manager

46:14SPEAKERon your Mac and pull stuff like Git from there,

46:16SPEAKERI don't think you'll run into this.

46:17SPEAKERThis is I think just affecting the equivalent tools

46:20SPEAKERthat Apple itself ships,

46:22SPEAKERbut it still seems insane that they have not fixed this.

46:24SPEAKERAnd that again, you can fix it yourself

46:27SPEAKERand it'll still be undone.

46:28SPEAKERIt's maybe, maybe I'll save the rest of this for info.

46:31SPEAKERYes, in fact, I will save my Nick's adventures

46:33SPEAKERfor the patron episode,

46:34SPEAKERbut I might need to amend the thing I said recently

46:37SPEAKERabout Mac OS being a Unix,

46:39SPEAKER'cause I keep running into all these edge cases

46:42SPEAKERwhere it seems very clear

46:43SPEAKERthey don't want you using it that way.

46:45SPEAKER- It's, I mean, it's weird 'cause like the developer

46:48SPEAKERand like the number of people who do web development

46:51SPEAKERwho still work on Mac is really, really high.

46:53SPEAKER- Yeah, it's crazy 'cause yes, tons of developers use Mac,

46:56SPEAKERso it's kind of crazy how locked down

46:58SPEAKERand outdated some of the stuff is, but anyway.

47:01SPEAKER- Yeah, so I guess let's,

47:04SPEAKERshould we jump to how to protect yourself from this stuff?

47:07SPEAKER'Cause that's the big question, right?

47:08SPEAKERThe update everything is obvious, I think.

47:12SPEAKERStay on top of your operating system

47:14SPEAKERand application updates.

47:16SPEAKER- And also things like internet of things and home hubs

47:19SPEAKERand all the little things that you don't think about

47:21SPEAKERthat you've set up and run

47:22SPEAKERor just sitting there going in the background,

47:24SPEAKERyour pie holes, your Docker containers, your game servers,

47:27SPEAKERall of that stuff.

47:28SPEAKER- Yeah, that stuff definitely,

47:29SPEAKERbut the internet of things stuff

47:30SPEAKERis something I have really started worrying about

47:32SPEAKERin the last week,

47:33SPEAKERbecause I've got like a ton of like smart plugs and stuff

47:35SPEAKERthat are just on my regular LAN around here

47:38SPEAKER'cause I've never done the VLAN work

47:40SPEAKERand also don't want to buy managed switches.

47:42SPEAKERSo, you know, of course those are mostly wifi,

47:44SPEAKERso that's not necessary, but you know what I mean?

47:46SPEAKERLike it's, well, putting that stuff on its own VLAN

47:50SPEAKERis like kind of a lot of work and fiddly

47:52SPEAKERthat I don't understand it super well,

47:53SPEAKERbut I'm starting to worry more and more

47:56SPEAKERabout those things being compromised.

47:58SPEAKER- So my feeling on those is that

48:00SPEAKERas long as they're only inside the network,

48:02SPEAKERthey're generally okay.

48:04SPEAKERIt's the stuff that lives outside that I worry about.

48:07SPEAKER- Well, that's the thing I worried about,

48:08SPEAKERbut the more I looked at,

48:09SPEAKERI don't know how universal this is,

48:11SPEAKERbut I got the sense that a lot of that stuff

48:12SPEAKERis still phoning home to like firmware update type resources

48:17SPEAKERand things like that.

48:18SPEAKERAnd so the thing that really worried me

48:21SPEAKERis that I only just found this out

48:23SPEAKEReven though it happened in January,

48:24SPEAKERbut Belkin has sunsetted the Wemo brand.

48:27SPEAKER- Oh, I didn't know that.

48:30SPEAKER- We've got a handful of Belkin Wemo smart plugs

48:33SPEAKERrunning just lamps on timers around here.

48:36SPEAKERApparently they just completely end of life

48:38SPEAKERthat product line at the beginning of the year.

48:40SPEAKERSo like the cloud app doesn't work anymore.

48:43SPEAKERYou can't even use the app to like read

48:46SPEAKERand to administrate them.

48:47SPEAKERYou can't do anything with them other than let them sit

48:49SPEAKERon your network at this point.

48:50SPEAKERAnd so like, if something like that,

48:52SPEAKERgranted that's probably a pretty limited

48:56SPEAKERtarget of opportunity.

48:57SPEAKERLike, is anybody actually gonna bother

48:59SPEAKERto try to compromise those particular devices?

49:03SPEAKERI don't know, but like it just...

49:05SPEAKER- Yeah.

49:06SPEAKER- Like it makes you worry, you know,

49:07SPEAKERwhen you buy things, like I bought those at Best Buy.

49:09SPEAKERLike, you know, like those Belkin

49:11SPEAKERis a relatively trusted name.

49:14SPEAKERLike you can just wind up with things sitting

49:16SPEAKERon your network that suddenly have no more support

49:18SPEAKERand could potentially be hijacked to do things.

49:21SPEAKER- I mean, it's funny 'cause like,

49:23SPEAKERdon't, hey, don't buy stuff from shady AliExpress dealers

49:27SPEAKERor Teemu or whatever was the thing I was gonna say.

49:29SPEAKERBut also a lot of that stuff just has open chip sets

49:33SPEAKERand it's just supported indefinitely

49:34SPEAKERbecause the people who write the implementations

49:37SPEAKERfor that in Home Assistant keep updating

49:38SPEAKERthe software for them.

49:42SPEAKERI, again, I feel like as long as you're not

49:45SPEAKERconnecting to the internet, it's fine.

49:47SPEAKERThat does mean that you have to be hygienic

49:49SPEAKERabout how you firewall that stuff off

49:53SPEAKERwhen you plug it into your network though, so.

49:55SPEAKER- Yeah.

49:56SPEAKER- I like, I worry about things like fridges and TVs and--

50:00SPEAKER- Oh yeah.

50:01SPEAKER- And all the smart washing,

50:03SPEAKERlike my washing machine is connected to wifi

50:05SPEAKERso I get notifications when it's done

50:07SPEAKERand like, is LG updating that?

50:09SPEAKERI don't, probably not, I'd be surprised.

50:12SPEAKERI don't know.

50:13SPEAKERI think your advice about not using open ports

50:16SPEAKERfor things like Plex and game servers

50:19SPEAKERis probably a pretty good choice in the modern era.

50:23SPEAKER- Yeah, line in the sand, don't open ports.

50:24SPEAKERDon't forward ports to things anymore.

50:26SPEAKERLike, I know it's easier to get your family

50:29SPEAKERonto your Plex server that way,

50:30SPEAKERbut look at what just happened with Plex.

50:32SPEAKERLike, you can have your Plex sitting there

50:35SPEAKERfacing the internet for people to use

50:38SPEAKERand you could end up with a crypto miner installed on there

50:40SPEAKERor joining a botnet or something

50:42SPEAKERbecause this is a pretty tangible case

50:44SPEAKERof why that's not good.

50:46SPEAKER- Well, 'cause the other part of this

50:48SPEAKERis fixing the vulnerability

50:51SPEAKERbefore you've been exploited is pretty easy.

50:53SPEAKERIt's usually just patching some software.

50:55SPEAKER- Yeah, it's just running an update.

50:56SPEAKER- If people get hold of you, get into your stuff,

50:59SPEAKERit's much harder to untangle that mess.

51:03SPEAKER- Yeah, and the reason I worry about this stuff so much

51:05SPEAKERis that as much as I play act

51:07SPEAKERas like some kind of freewheeling admin or whatever,

51:11SPEAKERlike I do not have the skills

51:13SPEAKERto do some kind of forensic analysis if I were compromised.

51:16SPEAKER- Yeah.

51:17SPEAKER- Like figuring out what they did

51:18SPEAKERis like probably way beyond me.

51:20SPEAKERLike that's the actual,

51:21SPEAKERthat's where a lot of the paranoia comes from to me.

51:23SPEAKERIt's not just the act of being compromised.

51:25SPEAKERIt's that I would not know what I was looking for,

51:29SPEAKERtrying to figure out what had been done.

51:31SPEAKER- Having been compromised in the past,

51:32SPEAKERthe solution is pull the data off

51:35SPEAKERand burn everything else down, right?

51:36SPEAKER- Yeah, yeah, that's definitely the--

51:39SPEAKER- Time consuming and difficult and costly, so.

51:41SPEAKER- Yeah, yeah, yeah.

51:44SPEAKERLook into tail scale or WireGuard or similar VPNs

51:47SPEAKERif you want to be putting things or, you know.

51:50SPEAKER- Give people outside your home

51:52SPEAKERaccess to inside your home, right?

51:54SPEAKER- Yeah, things are getting scarier out there.

51:56SPEAKER- Yeah, I think tail scale is definitely,

51:58SPEAKERlike a tail scale and WireGuard episode

52:00SPEAKERis probably in the future, I would guess.

52:03SPEAKERThe, you put a note in here about aging C and C++ code bases

52:08SPEAKERthat seemed like a more urgent problem.

52:10SPEAKER- Yeah, that's where all these memory safety bugs

52:14SPEAKERare, not all of them,

52:15SPEAKERbut most of the ones we were just talking about

52:17SPEAKERseem to stem from some degree of memory safety issue.

52:21SPEAKER- Yeah.

52:22SPEAKER- Which is like the classic C and C++ vulnerability

52:27SPEAKERthat allows people to run a malicious code

52:30SPEAKERor any inappropriate code basically.

52:33SPEAKER- Yeah, the basic thing that happens with that stuff

52:34SPEAKERis that somebody gets access to,

52:36SPEAKERyou get the ability to read and write to memory

52:39SPEAKERthat you shouldn't be able to read and write some.

52:41SPEAKER- Yeah, like those languages require you to allocate

52:43SPEAKERand deallocate your memory usage yourself

52:46SPEAKERand like that is one of the classic common bugs

52:50SPEAKERis some misuse or not, you know,

52:53SPEAKERlike an oversight in that process where you--

52:56SPEAKER- Basically, yeah.

52:57SPEAKER- Some oversight where some part of the program

53:00SPEAKERis still able to access part of memory that it shouldn't

53:03SPEAKERand that's where bad things happen.

53:04SPEAKERAnd so like, again, not a programmer,

53:06SPEAKERbut like there's been a huge move toward newer languages

53:10SPEAKERlike Rust and Zig and Swift

53:12SPEAKERand like everybody's got their own ideas

53:14SPEAKERfor how to do memory safety,

53:16SPEAKERbut it really seems like that is like the topic

53:18SPEAKERin this particular nexus of different subjects.

53:25SPEAKER- Yeah, I feel like the people that were,

53:30SPEAKERthe, hey, let's rewrite core parts of the Unix

53:32SPEAKERand Linux infrastructure in Rust a few years ago

53:35SPEAKERwere kind of treated as cranks initially

53:37SPEAKERand now everybody's kind of getting on board,

53:40SPEAKERit seems like.

53:41SPEAKER- Yeah, I guess, I mean, you know, at the same time,

53:42SPEAKERlike Ubuntu's move to the Rust's equivalents

53:45SPEAKERof the core utils has been pretty fraught

53:48SPEAKERand extremely controversial for reasons that I understand

53:51SPEAKERbecause like those tools are not at feature parity yet,

53:53SPEAKERfor example, but I don't know,

53:56SPEAKERlike I can't imagine many legacy projects

54:00SPEAKERare going to get on that anytime soon.

54:01SPEAKERYou know what I mean?

54:02SPEAKERLike I'm pretty sure, like I think Daniel Stenberg

54:06SPEAKERhas flat out said, no, we're not moving cURL to Rust

54:09SPEAKERor, you know, like a lot of those legacy code bases

54:11SPEAKERare just gonna keep going as they have,

54:13SPEAKERbut maybe for at least for newer projects

54:16SPEAKERthat is hopefully gonna be a thing of the past.

54:21SPEAKERI got a quick update from last week.

54:23SPEAKERWas it just last week that I talked about

54:26SPEAKERwanting to move all my SSH keys

54:28SPEAKERto a hardware backed solution?

54:30SPEAKER- Putting them in the TPM or something?

54:31SPEAKER- Yeah, so I've done that.

54:32SPEAKER- Okay, let that go.

54:33SPEAKER- That turned out to be way easier than I expected.

54:35SPEAKER- Oh, that's always nice.

54:36SPEAKER- And Windows and Mac OS.

54:37SPEAKERI mean, this is only if you're SSHing to things,

54:41SPEAKERwhich I am a lot.

54:44SPEAKER- Yeah.

54:44SPEAKER- Not everybody listens to this podcast is, of course,

54:46SPEAKERbut basically what that's doing is like, okay,

54:51SPEAKERthe SSH keys give you a cryptographic way

54:53SPEAKERto prove your identity when you're signing into a server,

54:56SPEAKERright? - Yeah.

54:57SPEAKER- You can just have those files unprotected.

55:00SPEAKER- Okay.

55:00SPEAKER- And then if anybody gets their hands on those files,

55:02SPEAKERthey can also just use those files to sign into your server.

55:04SPEAKER- That seems bad.

55:06SPEAKER- You can put a passphrase, you can generate those keys

55:09SPEAKERencrypted and then have a passphrase.

55:11SPEAKERSo you're basically just typing in a password to use them.

55:13SPEAKER- Okay.

55:14SPEAKER- But it turned out to be really easy to,

55:16SPEAKERinstead of having to use the passphrase to protect them,

55:20SPEAKERjust generate them against the machine they were generated on

55:23SPEAKERso they can only be used on that machine.

55:25SPEAKER- Oh.

55:26SPEAKER- So Windows just has support,

55:28SPEAKERWindows 11 just has support for this now.

55:30SPEAKER- Oh, that's nice.

55:32SPEAKER- You'd have to, it's like,

55:33SPEAKERit's like I think version 9.5 of Microsoft's build of SSH

55:38SPEAKERis what you need, but if you're on current Windows,

55:40SPEAKERyou should have that.

55:41SPEAKER- Huh.

55:42SPEAKER- And then when you generate the key, you have to use,

55:45SPEAKERyou have to use ECDSA,

55:46SPEAKERwhich is an elliptic curve encryption algorithm,

55:50SPEAKERwhich I think is-

55:51SPEAKER- Quantum resistant, all that stuff?

55:52SPEAKER- No, it is extremely not. - Oh, okay.

55:53SPEAKER- Like in fact, the elliptic curve ones,

55:55SPEAKERmy understanding is, are the most vulnerable

55:57SPEAKERto quantum compromise.

55:58SPEAKER- Yes, I thought.

56:00SPEAKER- So if you're like me and your home servers

56:03SPEAKERare of great interest to nation state actors.

56:05SPEAKER- And who isn't?

56:06SPEAKER- Then look out, but no, I mean, I think,

56:09SPEAKERand in fact, this is only the case

56:11SPEAKERfor the Windows and Mac solutions I used.

56:14SPEAKERLike if you have a YubiKey, those support

56:17SPEAKERthe more desirable ED25519 algorithms.

56:24SPEAKERLike those are less vulnerable is my understanding.

56:26SPEAKERSo like stuff like YubiKey do support better encryption,

56:31SPEAKERbut let's be real.

56:34SPEAKERFor a home user logging into home servers

56:36SPEAKERor maybe like a cloud VPS or something,

56:38SPEAKERlike you're probably fine.

56:40SPEAKER- Yeah, yeah.

56:41SPEAKER- You're not a high opportunity target or whatever.

56:43SPEAKERBut anyway, so like all you do in Windows now

56:46SPEAKERis just use the standard SSH key gen

56:48SPEAKERwith the ECDSA-SK algorithm, I guess, SK-SK-SK.

56:54SPEAKERIs sort of the suffix that implies use hardware for this

56:58SPEAKER'cause it's the same way you do it on a YubiKey.

57:00SPEAKER- Okay.

57:02SPEAKER- And I just ran that and it popped up a Windows hello prompt

57:05SPEAKERand I typed my pin in 'cause I don't have a camera

57:07SPEAKERor a fingerprint reader for Windows hello.

57:10SPEAKERSo the best I can do is a pin, which is fine.

57:14SPEAKERAnd so it generated those keys.

57:16SPEAKERI had to go in my SSH config

57:18SPEAKERand tell it to use those new keys.

57:20SPEAKERBut now when I--

57:21SPEAKER- Would you use SSH, how does it pop up

57:23SPEAKERa Windows hello prompt for you?

57:24SPEAKER- Yeah. - Oh, that's so weird.

57:25SPEAKER- When I SSH from the terminal to any of my home servers,

57:28SPEAKERnow it just pops up the hello prompt and I type my pin in.

57:31SPEAKER- I will tell you, getting a $20 fingerprint sensor

57:34SPEAKERthat works with hello has been a really positive change

57:37SPEAKERfor me.

57:38SPEAKER- Yeah, if I wasn't so like anti-cords all over my desk now,

57:42SPEAKERI would think about that.

57:43SPEAKER- Oh dude, I just have it stuck up under my desk

57:44SPEAKERwith a piece of tape.

57:46SPEAKER- The problem is I have a lot of other stuff

57:48SPEAKERstuck under the desk now as well.

57:49SPEAKERSo I'm running out of space, but I might consider that actually

57:53SPEAKER'cause that would be nice.

57:55SPEAKERThis works well, and I was actually shocked

57:57SPEAKERthat you don't need any extra software now.

57:59SPEAKERLike what's built into the Windows stack

58:02SPEAKERis sufficient now on a current Windows 11 install.

58:05SPEAKERSo it works well.

58:07SPEAKERIt takes a little longer to pop up the hello prompt

58:09SPEAKERthan I would like.

58:11SPEAKER- But that's weird.

58:12SPEAKER- It's like three or four seconds before the prompt.

58:15SPEAKER- Oh. - I mean, it's fine.

58:16SPEAKERIt's not a big deal.

58:17SPEAKERIt was not quite as fast as I would like.

58:20SPEAKERAlso you can do this without the prompt if you want.

58:23SPEAKERYou can choose not to bind it to like your

58:27SPEAKERkind of Windows hello use or authentication on every use.

58:31SPEAKERAnd then you would get the benefit of those keys

58:32SPEAKERcan only be used on your machine.

58:34SPEAKERSo even if somebody stole them digitally over the internet,

58:37SPEAKERthey would be useless.

58:38SPEAKERBut anybody who sat down at your machine

58:40SPEAKERcould still use them.

58:41SPEAKER- So they'd have to be able to log in as you first.

58:43SPEAKER- Yeah, yeah, yeah.

58:45SPEAKERBut if you leave the on every use authentication on,

58:47SPEAKERthen you have to fingerprint or face or pin

58:50SPEAKERevery time you use them.

58:52SPEAKEROn Mac OS, it was kind of similar,

58:54SPEAKERexcept that there is a well supported popular

58:58SPEAKERopen source app called Secretive.

59:00SPEAKER- Okay. - There.

59:02SPEAKERSo you basically just install that.

59:04SPEAKERAnd it has to install an SSH agents

59:06SPEAKERthat you have to configure, which it takes two minutes.

59:10SPEAKERSo we can talk to your SSH and authenticate the keys

59:15SPEAKERthat way.

59:16SPEAKER- Interesting.

59:18SPEAKER- But it's a similar process, similar the same algorithm

59:21SPEAKERand pretty similar process except there,

59:23SPEAKERI have a fingerprint sensor and that's like instantaneous.

59:25SPEAKER- Yeah, their fingerprint sensor pops up incredibly fast

59:28SPEAKERcompared to every other one I've ever used.

59:30SPEAKER- So that feels real good.

59:31SPEAKERBut interestingly, this is a minor implementation detail,

59:35SPEAKERbut I still have private key files on Windows

59:38SPEAKERafter doing this. - Are they just encrypted?

59:40SPEAKER- Yeah, my understanding is it's unclear to me

59:42SPEAKERif those are the encrypted actual key private keys

59:44SPEAKERor if the private keys live in the TPM

59:47SPEAKERand those are like some kind of bridge

59:49SPEAKERor shim. - It's like a pointer

59:49SPEAKERor something, yeah.

59:51SPEAKER- Unclear what those files actually are,

59:52SPEAKERbut the point is they're useless without being present on,

59:57SPEAKERjust to be clear, if I'm rambling too densely here,

1:00:00SPEAKERthe point is these keys can only be used on the machine

1:00:03SPEAKERwith the hardware, the TPM.

1:00:05SPEAKER- Have you tried that? - Or the Mac Secure Enclave

1:00:06SPEAKERand only with your authentication.

1:00:08SPEAKERNo, I haven't moved them off the machine.

1:00:10SPEAKER- Okay. - I could try that.

1:00:12SPEAKER- I'm kind of curious.

1:00:14SPEAKERI trust the process.

1:00:15SPEAKERAnyway, on Mac OS, there are no private key files.

1:00:17SPEAKERThat's the difference.

1:00:18SPEAKERSo on Mac OS, I think the private key files

1:00:20SPEAKERactually live in the Secure Enclave.

1:00:22SPEAKER- Well, it makes sense

1:00:23SPEAKER'cause probably the Secure Enclave is accessible

1:00:25SPEAKERin the file system someplace.

1:00:27SPEAKER- Yeah, and I think it's definitely more robust

1:00:29SPEAKERand better supported.

1:00:30SPEAKERAnd another interesting thing I found out

1:00:32SPEAKERin the course of this,

1:00:32SPEAKERwhich maybe people knew and I didn't,

1:00:34SPEAKERis that I don't think really any PC motherboards

1:00:38SPEAKERare shipping with hardware TPMs at this point.

1:00:40SPEAKERI think they expect-- - They build the CPU now.

1:00:42SPEAKER- Yeah, yes, so I guess that's-- - For years, yeah.

1:00:44SPEAKER- Yeah, that's what an F TPM is, a firmware TPM,

1:00:47SPEAKERwhich means that Intel and AMD

1:00:49SPEAKERhave basically built TPM functionality into the CPU

1:00:52SPEAKERand that that's supported in the UEFI now.

1:00:54SPEAKER- Yeah, the hardware TPMs

1:00:56SPEAKERwere more an early transition thing

1:00:59SPEAKERbecause it takes a while to get stuff like that

1:01:02SPEAKERinto the CPU design.

1:01:04SPEAKERThey're more secure is my understanding.

1:01:06SPEAKER- Yes, that is the case.

1:01:08SPEAKER- You can theoretically de-resin and de-solder

1:01:11SPEAKERand get physical access to the hardware TPM

1:01:14SPEAKERon a motherboard.

1:01:15SPEAKERBut getting access to the TPM inside the CPU

1:01:18SPEAKERis like a nation state thing.

1:01:20SPEAKER- Oh, wait, no, it's the other way around.

1:01:21SPEAKER- The hardware TPMs are more secure?

1:01:23SPEAKER- Yes, 'cause they have their own memory

1:01:25SPEAKERand their own everything,

1:01:26SPEAKERwhere the CPU TPMs are using system memory

1:01:30SPEAKERto store secrets and stuff like that.

1:01:32SPEAKER- I feel like Mikey at PC World talked about this

1:01:34SPEAKERand he said he felt like the hardware ones,

1:01:36SPEAKERbecause they're accessible, were less secure.

1:01:39SPEAKER- Yeah, I'm sure-- - For normal stuff, yeah.

1:01:41SPEAKER- Yeah, I'm sure opinions differ on this stuff.

1:01:43SPEAKERI'm certainly way above my pay grade

1:01:45SPEAKERand I'm mostly rambling about it 'cause it's fun

1:01:47SPEAKERand I think it's cool.

1:01:48SPEAKER- Yeah, TPMs are cool.

1:01:50SPEAKERWho knew?

1:01:52SPEAKER- We are in a somewhat frightening new world

1:01:55SPEAKERand locking down your stuff at least feels good

1:01:57SPEAKEReven if it's just placebo.

1:01:58SPEAKER- Can I talk about the process of updating

1:02:01SPEAKERthe million devices in the house a little bit?

1:02:03SPEAKER'Cause everything was pretty easy for me.

1:02:06SPEAKER- Sure.

1:02:06SPEAKER- Except my daughter's old iPad,

1:02:08SPEAKERwhich is a 64 gigabyte iPad.

1:02:11SPEAKER- That sounds rough.

1:02:14SPEAKER- Well, let me paint you a word picture.

1:02:15SPEAKERIt's 10 gigabytes of OS.

1:02:18SPEAKER- Okay.

1:02:19SPEAKER- So we're down to 54 gigabytes.

1:02:21SPEAKERIt requires 16 gigabytes for you to do an update.

1:02:24SPEAKERSo that's 26 gigabytes.

1:02:27SPEAKER- Okay.

1:02:29SPEAKER- She's offloaded all the apps she's ever used.

1:02:32SPEAKERSo that means all of the saved files are still there

1:02:35SPEAKERfor the offloaded apps, which is another like 30 gigabytes.

1:02:40SPEAKERAnd if you have text messages with images and videos,

1:02:43SPEAKERas kids often send that stuff back and forth to them,

1:02:47SPEAKERthere's gigabytes and gigabytes of text messages.

1:02:49SPEAKERAnd then also iOS now doesn't let you say,

1:02:52SPEAKER"Hey, don't save photos on this device locally."

1:02:55SPEAKERSo if you're-- - Wait, really?

1:02:55SPEAKER- Nope.

1:02:56SPEAKER- What?

1:02:57SPEAKER- Nope.

1:02:58SPEAKERSo you can keep the web,

1:03:00SPEAKERthe options are web optimized version,

1:03:02SPEAKERwhich is good for like six or eight gigabytes,

1:03:05SPEAKERor, eh, I don't know.

1:03:08SPEAKERI couldn't get that stuff to go away.

1:03:10SPEAKER- Why would they remove that?

1:03:12SPEAKER- I think they feel like the storage optimized versions

1:03:16SPEAKERare good and small, which on a 256 gig device is no problem,

1:03:20SPEAKERbut on a 64 gig device is challenging.

1:03:24SPEAKERSo anyway, the TLDR is the only way I can update that device

1:03:30SPEAKERis by backing it up locally with iTunes the old way,

1:03:34SPEAKERand then wiping it, reinstalling,

1:03:36SPEAKERand then restoring the backup.

1:03:38SPEAKERI guess I could also restore the backup from the cloud,

1:03:40SPEAKERbut anyway, it sucks.

1:03:42SPEAKERIt's a terrible experience.

1:03:43SPEAKER- Yeah, that's bad.

1:03:45SPEAKER- The not giving people an interface

1:03:48SPEAKERfor managing the images and data

1:03:51SPEAKERand stuff that's stored in iMessage is insane,

1:03:55SPEAKERgiven how big those databases can get.

1:03:57SPEAKER'Cause their options are basically delete everything older

1:03:59SPEAKERin like three months, or you store this forever

1:04:02SPEAKERand keep paying us for more space.

1:04:04SPEAKER- Another option that I think would work,

1:04:06SPEAKERalthough it's insane you'd have to do this,

1:04:07SPEAKERis you could do a local backup of it,

1:04:11SPEAKERand then factory reset it to completely wipe it,

1:04:13SPEAKERdo the update, and then restore that backup to it.

1:04:15SPEAKER- That's the answer, yeah.

1:04:18SPEAKER- That's ridiculous that you have to do that, though.

1:04:21SPEAKER- Yeah, yeah, anyway, not a big fan.

1:04:23SPEAKER- Yeah, yeah, yeah, that's rough.

1:04:26SPEAKER- So this was originally gonna be a potpourri episode,

1:04:28SPEAKERbut I think we kinda got into the security stuff,

1:04:32SPEAKERand it's interesting. - Yeah, sorry for...

1:04:34SPEAKER- No, I learned a lot learning about this.

1:04:39SPEAKERIt was super useful, so.

1:04:41SPEAKERSo yeah, that'll do it for us this week.

1:04:42SPEAKERThe one thing, I had a really great segue

1:04:45SPEAKERfor one of the stories we were gonna talk about

1:04:48SPEAKERto going and vote, you can still do that.

1:04:51SPEAKERIf you're in the US, it's election day on Tuesday,

1:04:54SPEAKERwhich is two days from now.

1:04:56SPEAKERA lot of states you can register to vote the day of,

1:04:58SPEAKERso you can go down to your polling place

1:05:00SPEAKERand register to vote.

1:05:01SPEAKERIf you can't, but you're registered to vote,

1:05:03SPEAKERyou should go vote.

1:05:04SPEAKERIf you're not registered to vote, don't vote.

1:05:07SPEAKERAnd if you're not a citizen, then probably don't vote also.

1:05:10SPEAKERBut actually, no, don't probably don't vote

1:05:13SPEAKERif you're not a citizen.

1:05:14SPEAKERActually don't vote if you're not a citizen.

1:05:16SPEAKERThat's against the law, and it's bad.

1:05:18SPEAKERBut it's a big election, so please go

1:05:20SPEAKERdo your civic responsibility and cast a ballot.

1:05:25SPEAKER- And on that note, let's wrap the show up this week.

1:05:29SPEAKER- All right.

1:05:30SPEAKER- Brad, this is a listener-supported show.

1:05:31SPEAKERI don't know if you know this,

1:05:32SPEAKERbut we're listener-supported over here.

1:05:33SPEAKER- Oh. - Yeah.

1:05:35SPEAKER- I did see that you have a sponsor on your new podcast.

1:05:38SPEAKER- Yeah, it's Fastmail.

1:05:39SPEAKERI love Fastmail.

1:05:41SPEAKERBut yeah, but here, just listeners.

1:05:43SPEAKERSo it's just you guys.

1:05:44SPEAKERIf it's not for you, we wouldn't be doing this, so.

1:05:48SPEAKER- We are the curl of the podcast world,

1:05:50SPEAKERor the OBS of the podcast world.

1:05:52SPEAKER- I don't think that that's true at all,

1:05:53SPEAKERbut-- - Purely on voluntary support

1:05:56SPEAKERfrom the people who enjoy the product.

1:05:57SPEAKER- That part is true.

1:05:59SPEAKERThat part is absolutely true.

1:06:01SPEAKERIf you wanna find out how to support the show,

1:06:02SPEAKERyou can go to patreon.com/checkbaud,

1:06:04SPEAKERwhere for as little as five bucks a month, it's a bargain.

1:06:08SPEAKERYou can get access to the Patreon-exclusive Discord.

1:06:10SPEAKERYou get access to the monthly Patreon episodes,

1:06:14SPEAKERwhere I think, spoiler alert,

1:06:16SPEAKERBrad and I are gonna talk about Patrick Stewart,

1:06:18SPEAKERif I had to guess.

1:06:19SPEAKER- Yeah.

1:06:20SPEAKER- Rest in peace, Patrick, Sir Patrick.

1:06:23SPEAKERI mean, I briefly toyed with seizing control

1:06:27SPEAKERof this podcast and just pivoting this episode

1:06:29SPEAKERinto a next generation tribute thing, but--

1:06:32SPEAKER- The thing that, the short version

1:06:36SPEAKERof what I was gonna say is that he seemed like

1:06:42SPEAKERa delightful human being as a performer

1:06:45SPEAKERand an actor and all of those things,

1:06:47SPEAKERbut also just seemed like a generally delightful human being

1:06:53SPEAKERin all fronts, so rest in peace, Sir Patrick.

1:06:58SPEAKER- This one is rough for me.

1:07:00SPEAKER- Yeah, this one hurt.

1:07:03SPEAKERBut yeah, on that cheery note, patreon.com/checkbaud.

1:07:08SPEAKERThanks to everybody who supports the show,

1:07:09SPEAKERbut a special thank you to our executive producer,

1:07:11SPEAKERto your patrons, including Infelicitous Rips, Jordan Lippett.

1:07:15SPEAKERCelebrate 41 years of "Bunny Fiend" with an extra,

1:07:20SPEAKERoh God, I can't see the whole name, extra dessert.

1:07:23SPEAKEROh, have a dessert.

1:07:24SPEAKERYeah, have an extra dessert on "Bunny Fiend."

1:07:26SPEAKERWe all appreciate "Bunny Fiend."

1:07:28SPEAKERDavid Allen and James Kamik, thank you all so, so much.

1:07:30SPEAKER- Thank you.

1:07:31SPEAKER- We will be back next week

1:07:32SPEAKERwith another edition of the TechPod.

1:07:34SPEAKERAs always, please consider the environment

1:07:37SPEAKERbefore printing this podcast.

1:07:38SPEAKERSee you next week.

1:07:39SPEAKER(upbeat music)