213 Followers
77 Following
293 Posts
TCMBC

@DuncanYoudaho

I suggest #000000 background with #000000 text, but I've not found many supporters. I tell them it is like invisible ink that can be made visible with the right tools.
(This is a joke and not a genuine suggestion.)

@defcon @thedarktangent

I bought a simple USB C, 8TB SSD last year (about 6 months ago) for around $300 with tax. I checked it a few months ago and it was up to $600, and I just checked yesterday and the same model is $900.

After decades of experiencing primarily an increase in performance of tech at decreasing prices (on average) it is so strange to see such a long period of older tech increasing in price so much.

It reminds me of artificial shortages during the pandemic as people perceived or expected a scarcity, and some hoarded masks, toilet paper and more. Many hoarders of scarce supplies choosing to sell these at markup online.

It also reminds me of any historic $winter_holiday_of_choice "must-have" gift which are in short supply to meet the demand of $winter_holiday_of_choice sales.

If this AI race is a bubble, the sooner it ends, the better. If it isn't a bubble, each specialization of "AI" will probably have only one leader, and several losers struggling to find ways to recover their large bets.

A more interesting problem:
I expect the code-base that runs and is fed datasets can have IP, but can the resulting trained data be IP? How can you patent the resulting "learned" data if you can't describe it in a way that is distinct and unique from all other AI gamblers on a patent application?

It is increasingly complicated if the training data is copyrighted and significant elements from that copyrighted data appear (and can be reconstructed) by prompting the "AI" "learned" dataset.

None of this is financial or legal advice. It is a list of worries I have about risks to tech.

I am amazed that popular travel businesses would put forward the effort to use a 3rd party mail service, make sure SPF and DKIM work and validate but fail to account for "alignment" of the domain used to send the message matching, so that once SPF and DKIM pass, DMARC could also pass.

I am also still annoyed that SPF macros exist in records which CANNOT be validated as remaining under the "10 DNS lookup limit" for SPF unless you have a sample email message and sometimes envelope/smtp-session data associated with the message, sometimes added as headers to a message.

As a result, SPF validators can only validate some SPF records for syntax, not compliance with RFC. (Validators cannot chase down macros unless they know the values of those macros.)

Do you have something like "fail2ban" installed on the destination? Try checking for changes to iptables on the destination device while trying to ssh.

If you are using ssh-key based auth, and you are running an ssh-agent with several keys installed, is your ssh client trying to serialize all of the keys loaded in your agent, and exceeding the server configured max-login attempts? If so, open a new terminal on the client device, remove all Env Vars in that new terminal that refer to the ssh-agent, then ssh to the server using client flags to specify just a single identity/pub-key when trying to auth.

Does the destination server have a "full" or "readonly" filesystem in some place that ssh expects to be able to write?

@lattera

@deviantollam

I encountered this a while back, but found a work-around.

(1) When you slide an ongoing call away and use apps, and then launch the "phone" app, there is a "keypad" option in the phone app, but this keypad from the phone app does not generate DTMF for your call in which you are presently participating.

(2) If you do not slide your ongoing call away, or after siding away, you find the ongoing call in the list of running apps, that ongoing call "app" has a different "keypad" option. This *other* keypad option seems to work to generating DTMF in the call you are participating. (If you start with the "phone" app and make a call or receive a call, you may need to then switch to the "on-going call" or "current call" running app to see the other "keypad.")

At one time, I seem to recall both worked, but now, only the "keypad" tones from the "ongoing call" view seems to generate tones understood by the other end of the ongoing conversation.

Does this work-around work for you?

Would you like to participate in a customer survey? If so, please wait until after the customer support service agent ends their call. (this is a joke)

Good news for maybe everyone:

pphosted.com servers (ProofPoint Hosted domain services) which can be used to send mail on behalf of a domain appears to finally support ECC based certs (ECDSA) in addition to RSA.

We see mail services for *@defcon.org see STARTTLS sessions in SMTP being started and working on or before Aug 15 , 2025 and our ECC based cert.

This is good news!

Before this support was added, ProofPoint would only use encrypted sessions when delivering to STARTTLS SMTP servers capable of STARTTLS that had RSA-based certs.

@sambowne @defcon

Do you remember the programming language Logo ( https://en.wikipedia.org/wiki/Logo_(programming_language) ) ?

If I have any Logo programs when I travel, I'll have to remember to:

HT

🙂

(
Explained: https://personal.utdallas.edu/~veerasam/logo/
...
HT : Hide the turtle (triangle).
ST: Show the turtle (triangle).
...
)

Logo (programming language) - Wikipedia

If you are a company that is a specialist in email delivery for customers, and you want to claim support for STARTLS encrypted sessions to the greatest number of recipients, maybe you should be sure your company supports ECDSA based certs in addition to RSA.

Sure, RSA is nearly 50 years old, while ECDSA was proposed a little over 30 years ago, but how many decades will need to pass before you support ECDSA certs?

Joking/Sarcasm: I can understand that something that is over 30 years old might be "too new" for antiquarian tech companies with nostalgia for Luddite beliefs to consider supporting, but please, let us know which decade you plan to make a decision. Is this an issue that "will be decided after heat death of the universe" kind of thing?

And another thing, if you specialize in email delivery, why not also support TLS/1.3 ciphersuites with STARTTLS over SMTP sessions? All the cool kids support TLS/1.3. (All the cool kids support the latest TLS version or successors.)

(It would be best if email could move off the need to use STARTLS and just expect everyone to use TLS without STARTTLS and impose the same requirements of host name matching (older mostly obsolete ) "CN" in subject or modern "SAN" for connected hostname and validate before delivery, but that is a more difficult change.)

In other news: if you run a domain that receives mail, check out MTA-STS:
https://mxtoolbox.com/dmarc/details/mta-sts/what-is-mta-sts-record

It can be a nice complement to using DANE/TLSA with DNS using DNSSEC for adding security to mail server certs.

What is MTA-STS? How to set up an MTA-STS Record - MxToolbox

MxToolbox

Today, the pre-DEF-CON "Creative Writing" short story contest winners were announced:

https://forum.defcon.org/node/253034

Please consider entering into these kinds of pre-DEF-CON contests, as if you do not win, you still exercise skills useful at the workplace. If you win, you may earn a badge to get into DEFCON, and the money you were going to spend on badge could be spent on something else.

Thanks to the people running this contest and those that sent time working to win.

Congrats!

forum.defcon.org

This year was our fiercest competition ever, with more than 25 stories! We asked and you delivered some fabulous writing. Judging was extra difficult as there was so much talent in those .txt files! Without further ado, here are the winners: 1st place - All In by Serum 2nd place - Double Vision by jam People's choice -

DEF CON Forums

Did you all notice? Yesterday the pre-DEF-CON contest "Phish Stories" announced winners:
https://forum.defcon.org/node/252999#post252999

Please consider entering into these kinds of pre-DEF-CON contests, as if you do not win, you still exercise skills useful at the workplace. If you win, you may earn a badge to get into DEFCON, and the money you were going to spend on badge could be spent on something else.

Thanks to the people running this contest and those that sent time working to win.

Congrats!

forum.defcon.org

Read. Rate. Sleep on it. Read again. Re-rate. Repeat. A little taste of the process our judges had to go through this year as we took on the challenge of 17 amazing Phish Stories! It was NOT EASY. The quality of every submission made it difficult to say the least. All four potential targets were chosen by contestants with

DEF CON Forums