October 2020 - cypherpunks - lists.cpunks.org

Looking at the tor daemon source code
by Karl 13 Oct '20

13 Oct '20

``` tor]$ grep -r 'main(' src/app src/app/config/or_options_st.h: int LogMessageDomains; /**< Boolean: Should we log the domain(s) in which src/app/main/main.c:/* Main entry point for the Tor process. Called from tor_main(), and by src/app/main/main.c:tor_run_main(const tor_main_configuration_t *tor_cfg) src/app/main/ntmain.c:static void nt_service_main(void); src/app/main/ntmain.c:nt_service_main(void) src/app/main/ntmain.c: * from those given to main() function. src/app/main/ntmain.c: nt_service_main(); src/app/main/tor_main.c: * \brief Stub module containing a main() function. src/app/main/tor_main.c: * tests, which have their own main()s, can link against main.c. src/app/main/tor_main.c:int tor_main(int argc, char *argv[]); src/app/main/tor_main.c:/** We keep main() in a separate file so that our unit tests can use src/app/main/tor_main.c:main(int argc, char *argv[]) src/app/main/tor_main.c: r = tor_main(argc, argv); $ cat src/app/main/tor_main.c ... ``` This is likely the main entry code for Tor. (Hey, tell me when it's time to shut up, if you're a hacker.) These files are like the genes of tor: they make it all work when you finally 'conceive' the tor process by running it, the kernel having electronic sex (I'm a prude myself) with the harddrive, sending its data regions through the various processes of the system loader, until the kernel process grows into a confused little application. And they were handmade by software developers like the famous Jacob Appelbaum, who is unfortunately the same age as me! He doesn't have _that_ big a beard, but he does have glasses, so his beard is big enough to be a coder. ``` /* Copyright 2001-2004 Roger Dingledine. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. * Copyright (c) 2007-2020, The Tor Project, Inc. */ /* See LICENSE for licensing information */ ``` This stuff people put at the top of their source code to support various lawyer heroes they know. Often richard stallman gets a big chunk up here. Tor is kind and refers us to another file for details rather than making us scroll past it all. ``` #include "orconfig.h" #ifdef ENABLE_RESTART_DEBUGGING #include <stdlib.h> #endif ``` Header files. orconfig.h looks like some of that system-specific stuff that `./configure` might have generated. The #ifdef/#endif's basically indicate that ./configure can enable or disable the region between them. "stdlib" is used for a wide variety of functions. ``` /** * \file tor_main.c * \brief Stub module containing a main() function. * * We keep the main function in a separate module so that the unit * tests, which have their own main()s, can link against main.c. **/ int tor_main(int argc, char *argv[]); ``` This is a very clear description of the file we are looking at. The commenting style is well-accepted, and quite easy for developers to look at it, because it is so normal. The comment implies that the _real_ guts are going to be in main.c . We can look at that file after this one. ``` /** We keep main() in a separate file so that our unit tests can use * functions from main.c. */ int main(int argc, char *argv[]) ``` Here they said a very similar thing, but put the comment on the main function instead of the tor_main function. This is because programmers can get very confused after spending their lives staring at blinking rectangles instead of talking to other people. It's possible a software developer would only see the thing they are looking for, and not the things around it! Additionally, software developers learn to be very obsessive compulsive about rigorous consistency in the structures they design, because if they don't do that when working inside a computer the computer can develop a bad issue of smoke leaving its cpu. Comments don't affect the cpu. ``` { int r; ``` This defines a variable "r", saying it is an integer, and that nobody knows what it will be used for quite yet. ``` #ifdef ENABLE_RESTART_DEBUGGING int restart_count = getenv("TOR_DEBUG_RESTART") ? 1 : 0; again: #endif ``` Here's that mysterious use of `<stdlib.h>`! `getenv` is a function from stdlib that gets a variable from the environment. If this feature is enabled, the user can set `TOR_DEBUG_RESTART` to control the value of restart_count, _without changing or recompiling any code_! Miraculous! ``` r = tor_main(argc, argv); ``` This hands off control of the system to the tor_main function and is the _only thing_ actually being done here. There's no need to look any more at this file. It's basically saying that `tor_main` is the real `main`, over and over again. ``` tor]$ grep -r 'tor_main(' . ./ChangeLog: return from the tor_main() function, rather than calling the ./ReleaseNotes: return from the tor_main() function, rather than calling the ./src/app/main/main.c:/* Main entry point for the Tor process. Called from tor_main(), and by ./src/app/main/tor_main.c:int tor_main(int argc, char *argv[]); ./src/app/main/tor_main.c: r = tor_main(argc, argv); ./src/feature/api/tor_api.c:tor_main(int argc, char *argv[]) ./src/feature/api/tor_api.h:int tor_main(int argc, char **argv); ``` `tor_main` appears to be in tor_api.c . If you want to memorize the basics of how tor works, that's the next file to look in. That's all for now, folks!

2 3

Trying to Connect with a Hacker Online
by Karl 13 Oct '20

13 Oct '20

So, every hacker [s/is slowly forgetting due to global gaslighting and abuse/knows firmly/] that plaintext, unsigned communications are pointless because all the political influences between you and the person you're communicating with will alter your communications. In order to connect we have to find each other on networks that are more reliable than e-mail. A clue to finding these networks, people, and other exotic information, is weird strings of numbers and letters that seem like random gobbledygook, almost as if we were copy and pasting computer glitches to each other. No, these confusing strings of characters are the words of computer hackers: especially if the alphabetic characters never exceed 'f' in the alphabet, which does not stand for 'fuck this is confusing', but rather for 'we made computers highly efficient by braking them into powers of two'. It's called hexadecimal. > On 10/12/20, Stefan Claas <sac(a)300baud.de> wrote: [snip...] >> Regards >> Stefan >> >> >> -- >> NaClbox: cc5c5f846c661343745772156a7751a5eb34d3e83d84b7d6884e507e105fd675 >> The computer helps us to solve problems, we did not have without him. Here, we have a hexadecimal string associated with the phrase 'NaClbox'. 'NaCl' is a stupid-people-who-use-computers word for encryption and verification. 'box' is the same for computer. Let's search for it and see i we can find this random string of hexadecimal! This time, I'm going to [s/heal my injured spine/wise up to the manipulative marketing AIs/] just a smidge, and use a search engine other than google. Even better would be _asking a human being_, but we're not quite that smart yet. I'll try duckduckgo. I typed 'naclbox' into duckduckgo and the first hit is ... https://www.naclbox.com/ ! This has to be it, right? It has the right domain name! A computer game thing! This hacker must have been asking us to play computer games with them, how friendly! Let's do some wizardry called a 'dns lookup' on that url. There's a way, given _any url_, to get information on who purchased it and stuff like that. If [s/you're actually part of a major corporate conspiracy and are frequently hired to kill people who look into the origins of coverups/you have schizophrenia from too many dns lookups/] you may have trouble doing this important research, but it's not very hard to do. Searching the internet for "lookup dns purchase command line", I see a way to copy the term that [s/gives me severe traumatic flashbacks/i haven't learned to use yet/]: "whois". My system doesn't have "whois" installed because I'm a normal person, not a mumbo-jumbo computer wizard, but I can install it like any other package, and run it on www.naclbox.com: ``` $ whois naclbox.com Domain Name: NACLBOX.COM Registry Domain ID: 1653881042_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.gandi.net Registrar URL: http://www.gandi.net Updated Date: 2020-03-27T19:42:08Z Creation Date: 2011-05-01T15:51:02Z Registry Expiry Date: 2021-05-01T15:51:02Z Registrar: Gandi SAS Registrar IANA ID: 81 Registrar Abuse Contact Email: abuse(a)support.gandi.net Registrar Abuse Contact Phone: +33.170377661 Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Name Server: NS-1219.AWSDNS-24.ORG Name Server: NS-1965.AWSDNS-53.CO.UK Name Server: NS-259.AWSDNS-32.COM Name Server: NS-544.AWSDNS-04.NET DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/ >>> Last update of whois database: 2020-10-12T13:36:17Z <<< ``` This record claims that the domain was purchased on 2011 and expires 2021. It's been a really long time since I've done this, but I was expecting to see some information on e.g. a technical contact or something: a real human being associated with the website. Maybe I have too look somewhere else. I tried this: ``` $ whois -h whois.gandhi.net naclbox.com ``` which just sits there and hangs. Anyway, it sounds like the _cryptographic_ nacl project would be able to purchase this domain in 2021 if they wanted. Farther down the duckduckgo results is a more promising link, that leads to https://pkg.go.dev/golang.org/x/crypto/nacl/box . Unfortunately, this project now calls itself "package box", not "nacl box", which is discouraging. Still, we can look it over. Woohoo! "package box" says it is a generic frontend for NaCl encryption, which implies that it's possible that the signature we found is a public key for sending somebody private messages in a reliable manner, and that any tool that does this NaCl encryption can communicate with him. "package box" links to a central nacl website: https://nacl.cr.yp.to/box.html . A great way to check if we interpreted these letters-and-numbers-mumbo-jumbo correctly is to try to use them. We'll try to send this guy ... what's their name? >> NaClbox: cc5c5f846c661343745772156a7751a5eb34d3e83d84b7d6884e507e105fd675 We'll try to send cc5c5f846c661343745772156a7751a5eb34d3e83d84b7d6884e507e105fd675 a message ! This might mean learning to use nacl. The page I found is a c++ interface, so I'll just use that since [s/my fingers and eyes spazz out uncontrollably when i use the web now/it's a good exercise for me to write a small C++ program/]. ``` $ sudo yum install nacl-devel # nacl is a software development library for secure communication that's been available on linux systems for some time now ... ``` If you've been through [s/an abusive enslavement experience where you suffered severe injuries and learned to dissociate from your memories as way of life/a corporate or government training program/] you may have difficulty forming encrypted communications with a hacker online, but rest assured everything is fine: since the worldwide digital coronavirus has thoroughly filled your device with malware, all the corporate goonies can make sure everything is okay, and since this guy is an experienced enough hacker to communicate with letters and numbers, they'll be able to tell that you aren't one of them. That doesn't mean they'll be able to keep themselves safe from your oppressive surveillance and control situations! It's your job to [s/manage those by communicating with your contacts/mourn your wake of dead hackers after the fact/]. So please make a record of what you do so that others can learn from it after somebody new [s/dies horrifically or gets forcibly enslaved by a criminal corporate dictator/gets bored and ignores the rest of us/]! First we need to generate a naclbox of our own, to send the communication from. It's just a set of small personal letters and numbers. The website has this in it: ``` #include "crypto_box.h" std::string pk; std::string sk; pk = crypto_box_keypair(&sk); ``` > The crypto_box_keypair function randomly generates a secret key and a corresponding public key. It puts the secret key into sk and returns the public key. It guarantees that sk has crypto_box_SECRETKEYBYTES bytes and that pk has crypto_box_PUBLICKEYBYTES bytes. The secret key is like your brainstem and your heart. You don't let anybody else even get a whiff of them, _certainly_ never touch them or see them, or you could get hurt. Since [s/I'm a corporate slave/this is just an example/], I'll be storing my brainstem on the malware that's infesting the system I am typing this on. On my system, I'll have to mutate the example from the website just a tiny bit, to get it to compile. ``` // nacl-generate.cpp #include <nacl/crypto_box.h> #include <fstream> #include <iostream> int main(int argc, char **argv) { if (argc != 2) { std::cerr << "Error: provide new delicate brainstem file as first argument." << std::endl; return -1; } std::string pk; std::string sk; pk = crypto_box_keypair(&sk); std::string brainstem = argv[1]; std::ofstream delicate_precious_guts_we_are_going_to_figure_out_how_to_protect(brainstem.c_str()); delicate_precious_guts_we_are_going_to_figure_out_how_to_protect << sk; // this is a c++ way to convert from computer innards to hexadecimal letters and numbers std::cout << brainstem << "'s name is: " << std::hex; for (char const * byte = pk.data(); byte != pk.data() + pk.size(); ++ byte) { std::cout << ((*byte) & 0xff); } std::cout << std::endl; std::cout << "Don't lose track of it or nobody will be able to find 'em!" << std::endl; } ``` I actually had to work with it quite a bit while handling my issues. ``` $ g++ nacl-generate.cpp -o nacl-generate -l nacl $ ./nacl-generate delicate delicate's name is: 1934067c6303d231b897152a989bd905fe82b5130de209a1ddb61e118e7a477 Don't lose track of it or nobody will be able to find 'em! $ mv delicate 1934067c6303d231b897152a989bd905fe82b5130de209a1ddb61e118e7a477 `` This file of letters and numbers is now _our_ identity. We can make similar programs to send and receive messages with them. There are likely tools out there already to do this automatically, and if not it would be a problem to be solved. Here's some code to receive messages with the file we made: ``` // nacl-receive.cpp #include <nacl/crypto_box.h> #include <fstream> #include <iostream> #include <sstream> std::string binary2hex(std::string binary) { std::stringstream ss; ss << std::hex; for (char const * byte = binary.data(); byte != binary.data() + binary.size(); ++ byte) { ss << ((*byte) & 0xff); } return ss.str(); } int main(int argc, char **argv) { if (argc != 2) { std::cerr << "Error: provide delicate private file as first argument." << std::endl; return -1; } std::string pk, pkhex; std::string sk; std::string n, nhex; std::string c, chex; std::string m; std::ifstream skfile(argv[1]); skfile >> sk; std::cerr << argv[0] << " receiving." << std::endl; // Although hackers like to share things in confusing ways, for example by // cramming the public key, the nonce, and the ciphertext all together, // we're separating them out here to ease my learning this new system. // When sending the greeting to the hacker, we may want to jam all the data // together, offering it as either a reasonably-confusing puzzle or a guess // as to having already put the time in to learn the system, so that we // speak their language more. Hackers tend to assume that everybody has as // much free time as they do, and might misinterpret things if somebody // didn't act as if they also did. This assumption would be easy to change by // playing their hacking games with them or preferably simply talking // clearly and directly and publically, rather than [s/fucking up their open // source people and projects/waiting for them to notice/]. But obviously // we can't do that, since we're [s/a bunch of people who want to help, // not the people in charge/too busy to get personally involved/]. std::cerr << "Enter public key of sender: " << std::flush; std::cin >> pkhex; pk = binary2hex(pkhex); std::cerr << "Enter nonce: " << std::flush; std::cin >> nhex; n = binary2hex(nhex); std::cerr << "Enter cyphertext: " << std::flush; std::cin >> chex; c = binary2hex(chex); m = crypto_box_open(c,n,pk,sk); /*The crypto_box_open function verifies and decrypts a ciphertext c using the receiver's secret key sk, the sender's public key pk, and a nonce n. The crypto_box_open function returns the resulting plaintext m.*/ std::cout << m << std::endl; } ``` In the next possible episode, we would either make a sourcefile to send a message to the hacker by again copying from that same website, or find a pre-existing tool that already does so, and then try sending a message to see if we even interpreted their signature at all correctly. We might also make an embarrassed reply, asking what their signature means, or search the archives of the list to find a clear explanation of it sitting there.

3 26

Turkey "cannot wait another 30 years" - but Syria cannot wait another 100 years :D - [PEACE] [UND] [POLITICS]
by Zenaan Harkness 13 Oct '20

13 Oct '20

The hubris and chutzpah of Turkey's neo-Ottoman sultan Erdogan is humorous, especially where it's thick with hypocrisy. Erdogan wants "Armenia" out of Ngorno-Karabakh (which is populated by ethnic Armenians who ceceded at referendum some decades ago), whilst hilariously causing chaos in northern Syria, in a disturbing attempt to undermine Syria's re-claiming of her Northern lands when Turkey's 100 year lease expires in about 2 years. Turkey Notifies Russia: Armenia Must Withdraw From 'Occupied Azerbaijani Lands' Via AlMasdarNews.com https://www.almasdarnews.com/article/turkey-to-russia-armenia-must-withdraw… https://www.zerohedge.com/geopolitical/turkey-notifies-russia-armenia-must-…

1 0

Threads
by grarpamp 13 Oct '20

13 Oct '20

On 10/11/20, Punk-BatSoup-Stasi 2.0 <punks(a)tfwno.gf> wrote: > [Yet another lame attempt at putting words in people] COINTELPRO - Still working the program eh Juan, disrupting distracting asserting everyones threads, seasoning with aggro assholery, nihilism contributing nothing... classic approaches, good show. Where you at now, GS-10 or so with a fat QSI... Quoting Cari Machet for the list... "Shut the fuck up > rude"

3 3

Anglin - "ANGeL withIN" - artistic commentary on "Raised by Wolves" - [PEACE]
by Zenaan Harkness 13 Oct '20

13 Oct '20

Andrew Anglin, just as David Duke, is a trooper - in the constructive, persistent, creative, mission focussed and mission critical sense of that word. Word deconstruction of the day: Anglin - the Angel Within. Anglin is often vehement, often (oh horror of horrors) guilty of 'shock comedy' in its various forms, yet remains at all times an example for others, an encouragement to lost Souls to Find Themselves™©®, th at timeless imploration to find you're own "angel within" - your Soul by any other word. Let no man come between you and God. Andrew happens to be quite the artist, and has for some years put his skills to great use in service of his causes - in the face of (as many of us have experienced, and continue to experience) incredible op position, de-monetization, censorship, and even MULTIPLE thefts of domains, beginning with DailyStormer.com some years back. David Duke's journey has been no less epic, nor any less RIGHTEOUS and PRINCIPLED and conducted in DIGNITY, notwithstanding the haters who fail to either read past the "mainstream" demonisation to the actua l source material, or further into any depth, to discover the true, and absolutely epic pathos, truth and facts, principles, history of discovery, failure, and lifting oneself up 100 times in the face of be ing beaten down again and again, over and over. For those able to get past the "mainstream" demonisation propagandia, a trove of truth, righteousness and principled men are in fellowship in this training we face, the epic setbacks, the dark nights of the Soul. Would you have it any other way? Get past the crap, the shock humour, the salty language, and gems sometimes appear: Many Women Write Love Letters to Man Who Killed Pregnant Wife and Two Baby Daughters https://dailystormer.su/many-women-write-love-letters-to-man-who-killed-pre… from fellowship to shared principles, journeys worthy, to the discovery of inherent dignity, notwithstanding. Can you undo your own internal "I'm triggered" program? Yes, the journey is sometimes confronting... If you have a moment longer, take a moment to appreciate that which, in this particular case Andrew Anglin brings to the table, an eternal offering to one and all: The First Episode of Raised by Wolves is the Single Best Piece of Audio-Visual Entertainment I’ve Seen in Years https://dailystormer.su/the-first-episode-of-raised-by-wolves-is-the-single… .. There are hints within the film that it contains some forbidden meaning, symbolism, depth. As far as I am able to tell, this is an absolute bluff. A pretentious attempt to turn the viewer into Stanley Fish, projecting his own meaning onto the material, which is left purposefully vague and opaque. But I know better than to expect anything more than a hint at depth. I am content with simple beauty, and a curt nod to the idea that something could conceivably exist beyond the bounds of the utopian Marxist hell in which we currently reside. The entire first episode is available for free on YouTube in full 1080. http://www.youtube.com/watch?v=YIAIiw8UAfA I have only watched the first episode, and I cannot imagine that it gets any better in the remaining nine episodes (all of which have been released at time of writing). I may eventually watch more of these episodes, though I do fear it will pollute this first one, which means so much to me now. I know that none of the threads introduced will unravel into anything beneficial. I know it because that is impossible now. The series was made by HBO, and they would never allow it, nor do I believe that the writers would be capable of transmitting meaning even if they were allowed to do so. Watch it. Don’t look for meaning or expect anything from it. Just enjoy that it manifests beauty, and that it hints at the forbidden beyond, in a time when neither of those actions are permitted. It has broken the rules, and that is a monumental accomplishment. ... [if someone would bundle that as a torrent, that would make it available to us Ossies... TIA] Assuming everybody's favourite orange swamp drainer remains after Nov 3, short of any more practical alternative appearing, it shall behoove us to start packing any and every "weak" seat with red hat wearin g swamp drainers, targetting 2022. Every weak fence sitter who holds a seat in any house, whether red or blue, shall be targetted for 2022 replacement by memeing, decorum grabbing, shirt eatin grinning, ac tual swamp drainers. We live in the world we currently have. Our task is to take stepc to move diligently with our fellow Souls towards the world we want. Take no shorncut, read whan you must read, learn what you must, meme what you must. We collectively have a chance to shift the game big time... no longer will the halls of power be left to those who direc tly oppose us. Seize the moment - seize YOUR moment... If you failed to properly read the above, go back and read it properly, for the sake of the world YOU wish to create. Create [y]our world muffa's ;)

2 2

Building Tor from Source
by Karl 12 Oct '20

12 Oct '20

I'm too busy [s/reverse-engineering microchips from live bombs/doddering around confused/] to know how to compile anything from its source. s/A/B/ is sed script substitution notation. It means replace A with B. I tell jokes because I'm in pain, and I'd rather share nice things than harm, especially if those nice things could have some important small part. A lot of people are working on the Tor project. You can see what they're working on at https://gitweb.torproject.org/ . I have no clue how to use gitweb to actually get source code, but I'm pretty good at guessing people's [s/social security numbers/blindingly obvious facial expressions three hours later/] , so I tried typing `git clone https://git.torproject.org/tor.git` into a terminal and what do you know, it worked. [Note to zfs: I ended up using a raid1 array and git-annex repositories for now, now that i have an indoor place to put harddrives in.] ``` $ ls acinclude.m4 ChangeLog CODE_OF_CONDUCT configure.ac CONTRIBUTING Doxyfile.in LICENSE Makefile.am README scripts warning_flags.in autogen.sh changes config.rust.in contrib doc INSTALL m4 Makefile.nmake ReleaseNotes src ``` Tell me if I'm skipping too many steps and I can include a full log, but I won't unless asked directly. Yes, it's boring, you're expected to only pretend to have read it. This is an "autotools" project. Autotools is an ancient linux C thing for setting up projects. Autotools looks like dead animal vomit on the inside (this means any modern coder can tell you that nobody should have designed it how it is obviously designed), but it is still very widely used because it just keeps working. (the reason it keeps working is because some bleary-eyed people with beards have memorized all the dead vomit inside it and keep shoving it around whenever needed, to keep it working). We're lucky here: the tor people included an `autogen.sh` script, which does the autotools voodoo automatically for you. If that script isn't there, often you can get away with just running `autoreconf`, which is basically all that autogen.sh script does. If autogen.sh doesn't work for you, you're probably missing important system development packages like automake, autoconf, libtool, etc. Please ask if you need more help. Oh, junior, you think you're cool by not asking? Junior, you're going to suffer if you don't learn what to do. You won't go to college and then you'll [s/get kidnapped by a drug ring and forced to collect rape victims after you run away to the streets to pursue your dream of being a musician/disappoint the pretty girl we all care about/] [s/disappoint the pretty girl we all care about/get caught up with and protected by a bunch of genius hackers who never needed to go to college, and learn to take down the system/]. Just please ask if you don't understand and need to. You can even ask privately! You can even ask the ugly girl who wishes she had some way to please you! There's one out there. Here's what it looks like: ``` $ ./autogen.sh /bin/autoreconf configure.ac:387: installing './ar-lib' configure.ac:426: installing './compile' configure.ac:36: installing './config.guess' configure.ac:36: installing './config.sub' configure.ac:25: installing './install-sh' configure.ac:25: installing './missing' Makefile.am: installing './depcomp' parallel-tests: installing './test-driver' ``` This generates a 'configure' script, the hallmark of autotools. It's a computer program generated by another computer program, that generates parts of actual computer program we're building, in such a way that it has the right structures for the computer you're building it on. That's a lot of automatic moving parts that build other automatic moving parts, and this process is often guided by further automatic moving parts in centralized build systems, but no it won't [s/mind control your employees, turn into a cloud of nanites, and research more wormholes/confuse you more than we can handle/] this time. Run the `configure` script it put in the folder, to set up the project to build. You only need to do this once. ``` $ ./configure checking for a BSD-compatible install... /bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... gawk ... ``` At the end, `configure` generates a makefile, which is the guts of building a project. It lists all the files that will be worked with, what will be done to them, and what will be produced by doing that, in many layers of steps needed to reach the final goal of building Tor. It's just a bunch of computer mumbo jumbo that makes Tor exist from its source code. Whoops! When you run `configure`, it looks to find out all the stuff you need to have on your system to make it run. On my system, the dependency I was missing related to the documentation. I like to be able to work with any part of the system, so I'll probably resolve this dependency so I know I can build the documentation: ``` ================================== Building Tor has failed since manpages cannot be built. You need asciidoc installed to be able to build the manpages. To build without manpages, use the --disable-asciidoc argument when calling configure. ================================== $ # oh no! what do I do! ``` Unfortunately, every system installs packages differently. But if I got to this point, I know how to install packages: ``` $ sudo yum search asciidoc # I don't really prefer enterprise rpm-based systems, but this # one a confused family member purchased has my favorite # [s/evolved digital familiar made of malware and trojan # communities/system config that i never backed up/] [sudo] password for user: Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions. =================================================================================== N/S matched: asciidoc ==================================================================================== asciidoc-doc.noarch : Additional documentation and examples for asciidoc asciidoc-latex.noarch : Support for asciidoc latex output rubygem-asciidoctor.noarch : A fast, open source AsciiDoc implementation in Ruby rubygem-asciidoctor-doc.noarch : Documentation for rubygem-asciidoctor asciidoc.noarch : Text based document generation $ sudo yum install asciidoc ``` ``` $ ./configure ... Tor Version: Tor 0.4.5.0-alpha-dev Build Features Compiler: gcc -std=gnu99 Host OS: linux-gnu ... ``` The makefile is generated! To build the source, we type `make`, which loads the makefile and compiles it. Nowadays everybody [s/expects to be able to teleport their brain across the ocean whenever they need to buy some milk at the grocery store (for real, see amazon.com)/enjoys things more when they are faster/], so we can add `-j4` to the make command, which basically speeds it up by asking the computer to get four times more confused while doing it (multitasking on its parts). ``` $ make make all-am make[1]: Entering directory `/shared/src/tor' CC src/ext/ed25519/ref10/src_ext_ed25519_ref10_libed25519_ref10_a-fe_0.o ... ``` Each line that goes by is a sourcefile that's being compiled. A long list of very precise words handtyped by a dedicated worker with a beard or glasses or likely both, likely working in a confined indoor environment almost like chickens in an industrial chicken farm, but we love to do it! Really! Ask any one of us! It gives us nastalgia of our earlier years. Ohhh.... My source code didn't compile. This is pretty common. Nowadays [s/the corporate thugs have killed so many of our friends/people are so much more interested in adding features instead of testing things/] that everybody has to use some mysterious wizardry called 'docker' to copy the systems of the devs so as to make anything actually compile. I'm not a fan of docker, because it ignores all the problems that the devs don't see because of the specifics of their systems, [s/producing widespread bugs that are discovered in the form of hacked government systems a decade later/and makes it harder for people to work on the software on low-end systems/]. Here's the arcane compilation error I ran into: ``` CC src/test/src_test_test_slow-test_slow.o In file included from src/test/test_tortls_openssl.c:42:0: ./src/lib/tls/tortls_internal.h:55:8: error: conflicting types for ‘SSL_SESSION_get_master_key’ size_t SSL_SESSION_get_master_key(struct ssl_session_st *s, ^ In file included from src/test/test_tortls_openssl.c:23:0: /usr/local/include/openssl/ssl.h:2007:15: note: previous declaration of ‘SSL_SESSION_get_master_key’ was here __owur size_t SSL_SESSION_get_master_key(const SSL_SESSION *sess, ^ src/test/test_tortls_openssl.c: In function ‘get_cipher_by_name’: src/test/test_tortls_openssl.c:541:19: error: dereferencing pointer to incomplete type int num = method->num_ciphers(); ^ src/test/test_tortls_openssl.c:544:38: error: dereferencing pointer to incomplete type const SSL_CIPHER *cipher = method->get_cipher(i); ^ src/test/test_tortls_openssl.c: In function ‘test_tortls_client_is_using_v2_ciphers’: src/test/test_tortls_openssl.c:710:3: warning: ‘TLSv1_method’ is deprecated (declared at /usr/local/include/openssl/ssl.h:1877) [-Wdeprecated-declarations] ctx = SSL_CTX_new(TLSv1_method()); ^ src/test/test_tortls_openssl.c:717:6: error: dereferencing pointer to incomplete type ssl->session = sess; ^ src/test/test_tortls_openssl.c:724:6: error: dereferencing pointer to incomplete type one->id = 0x00ff; ^ src/test/test_tortls_openssl.c:726:7: error: dereferencing pointer to incomplete type sess->ciphers = ciphers; make[1]: *** [src/test/src_test_test-test_tortls_openssl.o] Error 1 make[1]: *** Waiting for unfinished jobs.... make[1]: Leaving directory `/shared/src/tor' make: *** [all] Error 2 ``` It looks like my `openssl` header file differs from the one used by the Tor project. There are some basic ways to approach this, the simplest of which is of course to use docker. Other things one might try might include compiling a version of the software known to be stable, changing the version of my local library, or searching for the detail of the issue to identify its cause and give it a relevant fix. In open source, especially among the gnu crowd (which is the only crowd), the idea is that everybody benefits from everyone's work. When you do something, you want to contribute back to the community, so that your work has value. For this, you get appreciation, friendship, collaboration and teaching, and often even lots of money if you know the ropes and need it! So, the right solution to my build error, is likely to provide a patch to the Tor project, that changes the source so that either it builds on people's systems with my openssl version, or the configure script gives an error and informs the user of what they need to change. Thaaaat would be in a possible further e-mail. Tata!

3 7

Recovering Private Keys from a Destroyed Airgapped Device
by Karl 12 Oct '20

12 Oct '20

Something that most victims of [s/having your life fucked up by being made a corporate mafia bully/accidental destruction of property/] don't all know is that it is incredibly hard to actually erase anything from an electronic device. So please if you tell your friends let them know that [s/they need to kill you, because you would be making it blindingly public that your group is surveilling this mailing list/to keep it secret from anybody who would ever cave to pressure to erase something/]. Me, I have an old device that I removed the radios from, that has things like my expired gpg private key, and two factor authentication codes for accessing various internet accounts that I no longer have access to. I used to keep it chained to my belt, which let everyone who see me know that I was [s/a cool hacker to work with/a person with exotic skills to limit and control/] except that no normal person has any clue that it indicates that, because we haven't told them yet. The way to recover all the data from a destroyed device depends on how destroyed it is. It's basically a process of exploration. My device no longer turns on, and my computers don't wear their coronavirus masks; I would have already connected it to a system and copied the data over with a normal USB cable if that worked. What we will begin doing here is the pursuit of extracting the data from the flash chip on the device itself. Let me get my device first, it's in my [s/messy broken truck that is my precious only home, where i have vivid flashbacks of torture whenever i try to organize or even enter it/desk drawer/]. ... psychotic rummaging around ... Well, I managed to find my box full of destroyed devices with important information on them, but naturally I did not find the device in question inside the box. Instead, we will be opening an example device, that does not have any crucial private keys, or inaccessible cryptographic money, inside it, at all. Here's a beat-up device on an envelope on a table in my parents' basement. I actually beat this device up myself, something [s/I was forced to learn to do to protect my body and mind/I do by accident when I'm a little careless/]. This phone has some valuable memories of mine on it, that I haven't been able to access: https://bico.media/de8fc4b698bf335a706ea59de7ce62b8db4faadf30840ed226cf0964… The first most important but optional piece of information is the model number of the phone. Looking on the back, I see it's an LG phone. Lucky for me, the back case snaps right off, like it's designed to have its battery replaced or something. Woah! There's a 128GB SD card in here. That'll be easy to image, and probably contains boring large crucial trash like torrent downloads, source code repositories, or bloated compiled libraries. Under the battery we find the model number: LX-X210APM. This will be important to google if we need help removing the flash chip, so we don't destroy the next phone we try this on after further destroying this one. Next we get to unscrew the back of the phone. Anybody who [s/reverse-engineers microchips from live explosives/thinks the insides of devices are way cooler than the outsides/], has a set of tiny little screwdrivers. We'll be using some tiny screwdrivers -- just like those from a glasses repair kit you might by at a pharmacy or something -- to remove the back of this phone: https://bico.media/80a558bac401073824196cc762dc11abcdaa38d9efbbb2dfbdad692c… I'd like to take a little time to reference part of the phone visible in that picture. On the left you can see two or three of the antennas included in the phone. Each of these antennas is connected to its own radio. The antennas are often little conductive stickers placed on plastic. The antennas are removable, and you should remove them, but this doesn't disable the radio, which can still communicate without an antenna by using more power. It does significantly reduce its range and effectiveness. There are 12 screws on the back of this device, and I will be removing all of them. ... screws tumble around as a confused man tries to figure out how to control his fingers ... Arright. They're all removed. Like usual, the back still doesn't come off. Usually devices have these kind of one-way plastic snaps, and you have to figure out where to insert pressure to get them to unlatch without breaking. Generally a repair guide tells how to do this, although sometimes such guides are only available to professional technicians. I try pressing on the back of the battery compartment, gently and carefully flexing the body of the device, and seeing if a tiny flathead screwdriver fits inside any of the crevices, to see if there are any clues on how to remove the back plate. At this point I develop an incredible urge to do things that will destroy my phone, [s/because of being forcibly trained with extensive torture to harm my own community and values, and the opportunity to hurt the phone being so near triggering my experience/because I'm kinda frustrated and breaking it is the easiest way to open it/]. So, let's see if it's easy to find a disassembly guide online. Likely not, I imagine, since there are so many cell phones out there nowadays. I use google "LM-X210APM disassembly" [s/so that it's marketing algorithms can learn better how to predict and control my behavior in network with other corporations/because google is the only search engine that gives results for me/] since [s/the developers of open source decentralized search engines have all been killed by corporate goonies/we haven't prioritized access to information yet as a software development community/]. Great! The community has caught up to cell phone diversity. There are lots and lots of disassembly guides. This one is pretty clear: https://thd.ifixit.com/Guide/LG+Phoenix+2+Screen+Replacement/105271 . I'll try to follow the steps of the disassembly guide to access the mainboard of my broken phone. The steps turn out to be for a different model of phone, but they still work great. The plastic snaps are accessed around the frame around the screen, on the front side of the phone, and now we have access to the mainboard. I want to link a third blockchained photo of the mainboard, but the transactions for the other two photos are still confirming, and my blockchaining software (https://github.com/xloem/gitlakepy.git it needs the confirmations PR to the polyglot library) isn't mature enough to not produce doublespends. Additionally, I don't know if I'll be able to control my hands well enough to remove the shielding from around the chips: but I bet I could find a way. For a possible future email.

1 0

Building Tor from Source
by Karl 11 Oct '20

11 Oct '20

I'm too busy [s/reverse-engineering microchips from live bombs/doddering around confused/] to know how to compile anything from its source. s/A/B/ is sed script substitution notation. It means replace A with B. I tell jokes because I'm in pain, and I'd rather share nice things than harm, especially if those nice things could have some important small part. A lot of people are working on the Tor project. You can see what they're working on at https://gitweb.torproject.org/ . I have no clue how to use gitweb to actually get source code, but I'm pretty good at guessing people's [s/social security numbers/blindingly obvious facial expressions three hours later/] , so I tried typing `git clone https://git.torproject.org/tor.git` into a terminal and what do you know, it worked. ``` $ ls acinclude.m4 ChangeLog CODE_OF_CONDUCT configure.ac CONTRIBUTING Doxyfile.in LICENSE Makefile.am README scripts warning_flags.in autogen.sh changes config.rust.in contrib doc INSTALL m4 Makefile.nmake ReleaseNotes src ``` Tell me if I'm skipping too many steps and I can include a full log, but I won't unless asked directly. Yes, it's boring, you're expected to only pretend to have read it. This is an "autotools" project. Autotools is an ancient linux C thing for setting up projects. Autotools looks like dead animal vomit on the inside (this means any modern coder can tell you that nobody should have designed it how it is obviously designed), but it is still very widely used because it just keeps working. (the reason it keeps working is because some bleary-eyed people with beards have memorized all the dead vomit inside it and keep shoving it around whenever needed, to keep it working). We're lucky here: the tor people included an `autogen.sh` script, which does the autotools voodoo automatically for you. If that script isn't there, often you can get away with just running `autoreconf`, which is basically all that autogen.sh script does. If autogen.sh doesn't work for you, you're probably missing important system development packages like automake, autoconf, libtool, etc. Please ask if you need more help. Oh, junior, you think you're cool by not asking? Junior, you're going to suffer if you don't learn what to do. You won't go to college and then you'll [s/get kidnapped by a drug ring and forced to collect rape victims after you run away to the streets to pursue your dream of being a musician/disappoint the pretty girl we all care about/] [s/disappoint the pretty girl we all care about/get caught up with and protected by a bunch of genius hackers who never needed to go to college, and learn to take down the system/]. Just please ask if you don't understand and need to. You can even ask privately! You can even ask the ugly girl who wishes she had some way to please you! There's one out there. Here's what it looks like: ``` $ ./autogen.sh /bin/autoreconf configure.ac:387: installing './ar-lib' configure.ac:426: installing './compile' configure.ac:36: installing './config.guess' configure.ac:36: installing './config.sub' configure.ac:25: installing './install-sh' configure.ac:25: installing './missing' Makefile.am: installing './depcomp' parallel-tests: installing './test-driver' ``` This generates a 'configure' script, the hallmark of autotools. It's a computer program generated by another computer program, that generates parts of actual computer program we're building, in such a way that it has the right structures for the computer you're building it on. That's a lot of automatic moving parts that build other automatic moving parts, and this process is often guided by further automatic moving parts in centralized build systems, but no it won't [s/mind control your employees, turn into a cloud of nanites, and research more wormholes/confuse you more than we can handle/] this time. Run the `configure` script it put in the folder, to set up the project to build. You only need to do this once. ``` $ ./configure checking for a BSD-compatible install... /bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... gawk ... ``` At the end, `configure` generates a makefile, which is the guts of building a project. It lists all the files that will be worked with, what will be done to them, and what will be produced by doing that, in many layers of steps needed to reach the final goal of building Tor. It's just a bunch of computer mumbo jumbo that makes Tor exist from its source code. Whoops! When you run `configure`, it looks to find out all the stuff you need to have on your system to make it run. On my system, the dependency I was missing related to the documentation. I like to be able to work with any part of the system, so I'll probably resolve this dependency so I know I can build the documentation: ``` ================================== Building Tor has failed since manpages cannot be built. You need asciidoc installed to be able to build the manpages. To build without manpages, use the --disable-asciidoc argument when calling configure. ================================== $ # oh no! what do I do! ``` Unfortunately, every system installs packages differently. But if I got to this point, I know how to install packages: ``` $ sudo yum search asciidoc # I don't really prefer enterprise rpm-based systems, but this one a confused family member purchased has my favorite [s/evolved digital familiar made of malware and trojan communities/system config that i never backed up/] [sudo] password for user: Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions. =================================================================================== N/S matched: asciidoc ==================================================================================== asciidoc-doc.noarch : Additional documentation and examples for asciidoc asciidoc-latex.noarch : Support for asciidoc latex output rubygem-asciidoctor.noarch : A fast, open source AsciiDoc implementation in Ruby rubygem-asciidoctor-doc.noarch : Documentation for rubygem-asciidoctor asciidoc.noarch : Text based document generation $ sudo yum install asciidoc ``` ``` $ ./configure ... Tor Version: Tor 0.4.5.0-alpha-dev Build Features Compiler: gcc -std=gnu99 Host OS: linux-gnu ... ``` The makefile is generated! To build the source, we type `make`, which loads the makefile and compiles it. Nowadays everybody [s/expects to be able to teleport their brain across the ocean whenever they need to buy some milk at the grocery store (for real, see amazon.com)/enjoys things more when they are faster/], so we can add `-j4` to the make command, which basically speeds it up by asking the computer to get four times more confused while doing it (multitasking on its parts). ``` $ make make all-am make[1]: Entering directory `/shared/src/tor' CC src/ext/ed25519/ref10/src_ext_ed25519_ref10_libed25519_ref10_a-fe_0.o ... ``` Each line that goes by is a sourcefile that's being compiled. A long list of very precise words handtyped by a dedicated worker with a beard or glasses or likely both, likely working in a confined indoor environment almost like chickens in an industrial chicken farm, but we love to do it! Really! Ask any one of us! It gives us nastalgia of our earlier years. Ohhh.... My source code didn't compile. This is pretty common. Nowadays [s/the corporate thugs have killed so many of our friends/people are so much more interested in adding features instead of testing things/] that everybody has to use some mysterious wizardry called 'docker' to copy the systems of the devs so as to make anything actually compile. I'm not a fan of docker, because it ignores all the problems that the devs don't see because of the specifics of their systems, [s/producing widespread bugs that are discovered in the form of hacked government systems a decade later/and makes it harder for people to work on the software on low-end systems/]. Here's the compilation error I ran into: ``` CC src/test/src_test_test_slow-test_slow.o In file included from src/test/test_tortls_openssl.c:42:0: ./src/lib/tls/tortls_internal.h:55:8: error: conflicting types for ‘SSL_SESSION_get_master_key’ size_t SSL_SESSION_get_master_key(struct ssl_session_st *s, ^ In file included from src/test/test_tortls_openssl.c:23:0: /usr/local/include/openssl/ssl.h:2007:15: note: previous declaration of ‘SSL_SESSION_get_master_key’ was here __owur size_t SSL_SESSION_get_master_key(const SSL_SESSION *sess, ^ src/test/test_tortls_openssl.c: In function ‘get_cipher_by_name’: src/test/test_tortls_openssl.c:541:19: error: dereferencing pointer to incomplete type int num = method->num_ciphers(); ^ src/test/test_tortls_openssl.c:544:38: error: dereferencing pointer to incomplete type const SSL_CIPHER *cipher = method->get_cipher(i); ^ src/test/test_tortls_openssl.c: In function ‘test_tortls_client_is_using_v2_ciphers’: src/test/test_tortls_openssl.c:710:3: warning: ‘TLSv1_method’ is deprecated (declared at /usr/local/include/openssl/ssl.h:1877) [-Wdeprecated-declarations] ctx = SSL_CTX_new(TLSv1_method()); ^ src/test/test_tortls_openssl.c:717:6: error: dereferencing pointer to incomplete type ssl->session = sess; ^ src/test/test_tortls_openssl.c:724:6: error: dereferencing pointer to incomplete type one->id = 0x00ff; ^ src/test/test_tortls_openssl.c:726:7: error: dereferencing pointer to incomplete type sess->ciphers = ciphers; make[1]: *** [src/test/src_test_test-test_tortls_openssl.o] Error 1 make[1]: *** Waiting for unfinished jobs.... make[1]: Leaving directory `/shared/src/tor' make: *** [all] Error 2 ``` It looks like my `openssl` header file differs from the one used by the Tor project. There are some basic ways to approach this, the simplest of which is of course to use docker. Other things one might try might include compiling a version of the software known to be stable, changing the version of my local library, or searching for the detail of the issue to identify its cause and give it a relevant fix. In open source, especially among the gnu crowd (which is the only crowd), the idea is that everybody benefits from everyone's work. When you do something, you want to contribute back to the community, so that your work has value. For this, you get appreciation, friendship, collaboration and teaching, and often even lots of money if you know the ropes! So, the right solution to my build error, is to provide a patch to the tor project, that changes the source so that either it builds on people with my openssl version, or the configure script gives an error and informs the user of what they need to change. Thaaaat would be in a further e-mail. Tata!

1 0

freedom of speech - from Australia to The Netherlands - Geert Wilders criminal trial, opening statement
by Zenaan Harkness 11 Oct '20

11 Oct '20

youtube-dl --all-subs https://www.youtube.com/embed/pJwoygYdTmY (default max quality is ~160MiB - choose alt if too big) Nationalism is a thorn in the side of the hegemonic empire, and the simple question, when you are a watched / listened to human, can land you in criminal court, as Australia's Bernard Gaynor knows only too well. (Besides the comments, this only links to the video above: http://vladtepesblog.com/2016/09/25/geert-wilders-opening-statement-for-his… )

1 1

Expensive: Russian SU-35 and SU-30 pilots drill with live fire - on one another :) - [PEACE] [AND] [BAD] [ASSES]
by Zenaan Harkness 10 Oct '20

10 Oct '20

I try to resist, really truly I do, but like damn bros, some of these Russkies are TOTAL bad asses! This is not something you see every day - fighter pilots training with live fire, ON EACH OTHER. And I mean, what's a $50 million jet between buddies anyway? :D Thankfully the pilots of the SU-30 ejected and safely parachuted (presumably) to the ground, as they are reportedly in a "satisfactory" condition after being rescued, after the tail of their jet was shot down by live fire from an SU-35 during training ... presumably an accident but hey, you just never can be quite sure with our Russian brothers - they live for real, for the living of life to the full. We can fairly confidently presume the SU-30 pilots were role playing the Americanskis ;) [Presumed SU-35 pilot cockpit recording:] [SU-35 pilot:] RU0: "HA, take THAT Amercanski!" [Shoots a live round, TWO inches above tail of SU-30] [Unfortunately, live round ended up one inch INSIDE tail of SU-30] [SU-30 crashes, pilots naturally eject prior to crash] RU0: "OH! Sorry brutha, but why you pull into live fire? What's with THAT?" RU3: [RU3 is silent, he and his co-pilot already ejected.] [END-SKI] $50 million Russian Su-30 fighter jet accidentally SHOT DOWN during military drills, but pilots survive, reports say (VIDEO) https://www.rt.com/russia/501505-russian-su30-shot-down/ ... [Aftermath drone footage: RESULT of ONE Russian bullet:] https://t.co/H2bhjwD0cY ...

1 1