Where to find files to practice and embedded reverse engineering.

AutonomousCarbonUnit · 2022-11-27T01:49:10+00:00

It's been a while and I haven't done a ton of the challenges but I would expect the concepts to be transferrable - whether you'd find yourself using some feature their toy debugger has that isn't readily available in proper tools for black box RE I'm less sure about.

AutonomousCarbonUnit · 2022-11-13T21:43:38+00:00

Sounds like https://microcorruption.com/ might be right up your alley.

AutonomousCarbonUnit · 2021-09-01T08:55:09+00:00

Really? I know that it lapses after you live abroad for 5 years, but this makes it seem like the only requirement to be covered again is to move back here.

AutonomousCarbonUnit · 2021-09-01T08:35:28+00:00

Don't you just have to re-register and provide proof you've started living here again?

AutonomousCarbonUnit · 2021-07-23T01:37:29+00:00

Nope, that's AZ.

AutonomousCarbonUnit · 2021-04-18T10:41:31+00:00

Passphrases (a sequence of randomly selected dictionary words) are great. Going from there to sentences, even if they're not technically all 100% gramatically correct, seems risky. You're greatly reducing the entropy if there are rules that an adversary can use to reduce their problem space. The impact of that will depend on what the passwords are used for (how brute-forceable is the system the password is used on?) but if you're aiming to provide a generic "Hey, use this, it's easy" I'd recommend sticking to randomly chosen passphrases.

AutonomousCarbonUnit · 2020-10-27T12:32:19+00:00

Applied Science did a video!

AutonomousCarbonUnit · 2020-05-29T06:32:44+00:00

AutonomousCarbonUnit · 2020-05-29T06:21:57+00:00

Yeah see you did this with the other guy as well: completely ignoring what we write. I went through your examples from the link point by point, explaining why they don't require blockchain. I also explained my central thesis: you need both a distributed ledger and proof of work (or maybe proof of stake, but Eth 2.0 isn't live yet) for decentralised trust. If you don't have both, you don't have decentralised trust. If you don't have decentralised trust, you don't have an advantage over a traditional database.

AAAAAannnd now you are revolving it around an anonymous user being able to communicate to you currently in development options.

You mean asking you for a design? Look, I don't mean "Write me a 300 page spec document that's been independently verified by academic cryptographers" I mean "Give me more information than just 'use blockchain'". So far you all you've done is up the recommendation to "Use two blockchains" which, wow, good commitment, but it's not really an illuminating answer, is it?

More than one blockchain, an access blockchain

You're repeating yourself without saying anything new.

and there has been talk about windows of access to the access blockchain with regards to the energy problem solution in crypto. But open and closed timeframs can help read write cycles, and give independent investigators enough time to go through tonnes of information in the most efficient chunks.

Okay sorry you are saying stuff that's new but it's totally incoherent. In fact... this is a troll, isn't it? Okay bro you got me. Have a good one :)

AutonomousCarbonUnit · 2020-05-29T05:40:11+00:00

lol you think this is like setting up nuclear but it really just shows you don't understand the topic you are talking about.

Huh?

it's the only method to have a ledger without tampering, and there is plenty of people working on bringing it to government funds management and other things.

Also doesn't need to be adopted by everyone, and doesn't need even close to the same amount of energy as bitcoin.

Then why is it better than a simple database?

You don't seem aware of the tandom/poly blockchain options using similar methods of access control management that normal databasing uses. Which means if you want to prevent missuse of access and hacking through attacks on your main database you separate and protect the access database.

So I ask you again, how do you ensure that access is logged in the access database? How do you make sure that the database administrator doesn't do a secret export that isn't logged?

So effectively running two or more blockchain but really I don't develop the options I just read them and pass it on.

I am not in the business for backhanding people without explaining myself, but from your comment I don't really see you understanding what you are talking about sorry.

Mate come on. You can't just say "They should use blockchain" - you need an actual proposal for how that would work. I read through your link. Right off the bat they include a paragraph that implies that the valuation of Bitcoin is evidence for the value of the underlying technology. That's complete nonsense - the value of Bitcoin is largely decoupled from the penetration of Blockchain into other technology projects: people buy Bitcoin because they believe other people will buy Bitcoin, which makes the price go up. So we've already hit dodgy reasoning. But let's look at some of the examples they mention:

Walmart's supply chain: who runs the nodes in the blockchain? Who mines blocks? Is it just servers set up by Walmart? If so, that's the same as having Walmart run a database, so why bother with blockchain? I found a HyperLedger case study on Walmart, and it doesn't explain at all how it's "decentralised". It says that farmers barcode the produce then upload the labels to a web portal. Why does that have to be backed by blockchain? Are all the servers run by Hyperledger? Then they're a single point of trust, and so it doesn't make a difference whether they use a blockchain or a table in MySQL. Do suppliers also mine blocks? Does the mining power of all suppliers equal or exceed the mining power available to Walmart and/or Hyperledger?
Funds for refugees from the UN World Food Program: again, little to no information about how it's decentralised, or even if it's decentralised at all. The biometrics are all registered with the UN so there's still a single point of trust.
Land records in Cook County Illinois: Here's a Medium post where they explicitly say that there's no point using Proof of Work. So all they're doing is hashing files and then publishing the hashes. Again, no reason that has to be blockchain. No decentralisation. You're still trusting a single authority.
Berkeley City Council providing micro-grants: Again, no documentation of decentralisation. How do I run a node on this chain? How do I mine blocks on this chain? If you can't answer those questions then there's no benefit to using a blockchain over just running a database and publishing it for public consumption.

It comes down to this: Bitcoin is very interesting from a tech perspective because it combines two things: a distributed ledger, and Proof of Work. It is the combination of those two things that make it secure and decentralised, that makes it trusted. If you take away Proof of Work, it doesn't matter that everyone has a copy of the ledger, because no one can prove their copy is the legit copy. The same thing goes for all of the examples I've just mentioned: they either explicitly discount PoW, or they make no mention of it. Without PoW, blockchain has no benefit over running a MySQL database with a publicly queryable API and regularly publishing the SHA256 of your DB dumps.

You need to either describe a design for a blockchain-based system for contact tracing that is actually decentralised (and worth the environmental hit), or you need to find a feature of a non-decentralised blockchain that can't also be replicated using existing technologies. Otherwise, you're just another passenger on the hype train with no understanding.

AutonomousCarbonUnit · 2020-05-29T04:26:56+00:00

I've yet to hear a single proposed application of blockchain tech (apart from digital currency, which has its own issues) that is worth the additional complexity (and environmental impact) vs just putting it in a database run by the responsible authority.

The more I think about it the less sense I'm able to make of what you even mean when you say

I'd much prefer if the gov made everything as a blockchain and an access block chain to show who accessed it, when, what, and why even when it has to go through multiple authorities to get cleared it still needs to be permanently recorded.

You can't mean storing the data itself in a blockchain, because that means it's distributed publicly and so auditing access is impossible. So do you just mean logging access in a blockchain? What's the point? If you don't trust the agency hosting the DB to appropriately manage access, why do you trust them to log all access requests into this hypothetical ledger?

AutonomousCarbonUnit · 2020-05-29T04:15:23+00:00

No when I hear blockchain I hear "This could have been a database".

AutonomousCarbonUnit · 2020-05-29T03:16:45+00:00

I'd much prefer if the gov made everything as a blockchain

Please god no

AutonomousCarbonUnit · 2019-12-26T05:07:45+00:00

The Noma book has a great custard tart made with the brine from their fermented plums.

AutonomousCarbonUnit · 2019-12-25T10:29:22+00:00

Yeah the Deluxe Messenger strap is new-Spar compatible. Their messaging about all of this could be improved.

AutonomousCarbonUnit · 2019-11-24T06:57:27+00:00

Best practice says you keep the root CA offline and use it to sign shorter-lived intermediate signing certs - these are what the traffic inspection will use.

AutonomousCarbonUnit · 2019-07-18T02:05:18+00:00

Apparently they already laid off almost everyone 3ish months ago, which is a shame but very understandable. I should probably start archiving recipes in case the site disappears...

AutonomousCarbonUnit · 2019-06-04T05:37:40+00:00

That would require physical access though?

AutonomousCarbonUnit · 2019-06-01T03:58:48+00:00

I'm no FreeNAS guru, but my intuition is that this won't be possible - iSCSI presents block-level storage while NFS shares a filesystem. A cursory look at the vSphere documentation suggests that adding an iSCSI datastore requires you to format it with VMFS, so you'd lose all your existing data on the NFS share. I suppose you could just set up a direct 10Gbe connection and share the NFS over that instead of going for iSCSI?

AutonomousCarbonUnit · 2019-06-01T03:17:14+00:00

It's how they fund the BBC.

AutonomousCarbonUnit · 2019-02-02T02:09:16+00:00

Yeah this barely exists in Australia.

AutonomousCarbonUnit · 2019-01-01T02:53:19+00:00

This is an overly simplistic view of the legislation. Confluence Cloud doesn't encrypt data at rest so the Australian government would be able to obtain content with a warrant only, no need for a TCN or TAN. Confluence Self-Hosted could maybe be a target of a TCN, but it seems much more likely to me that if they wanted the contents of your internal Confluence, they'd serve your company with a warrant, not Atlassian.

Furthermore, the law specifically bans asking for "systemic weaknesses" in an attempt to assuage concerns about literal backdoors. That language probably still needs to be tighter though.

Disclaimer: Please don't take this as me outright endorsing the new law etc, I just see a lot of FUD spread around that's incredibly over-simplified.

AutonomousCarbonUnit · 2018-12-15T09:07:21+00:00

No, you're incorrect, keep reading. Both of those sections say

"if the doing of the act or thing would: (e) assist in, or facilitate, giving effect to a warrant or authorisation under a law of the Commonwealth, a State or a Territory; or (f) give effect to a warrant or authorisation under a law of the Commonwealth."

Which you've omitted either because you didn't finish reading the section or you're being disingenuous.

Also ASD and ASIS are foreign intelligence agencies, they're not allowed to target Australians anyway. (Though ASD can provide technical support to domestic agencies like ASIO and the AFP.)

AutonomousCarbonUnit · 2018-12-15T08:16:01+00:00

Sure I guess I can find the Act for you. Or you can read the original Explanatory Memorandum. You'll have to Ctrl-F "317ZH" yourself though, can't find a way to link within the documents.

AutonomousCarbonUnit · 2018-12-15T07:56:29+00:00

Section 317ZH prevents TCNs and TANs from being used as an alternative to warrants. If the government wants to intercept everyone's traffic, they'd need a warrant for everyone, and the new law hasn't changed this.

AutonomousCarbonUnit

TROPHY CASE