02:25 <ec> lord I have no idea what I'm doing

02:57 <ec> default: Progress: 76% (Rate: 1521k/s, Estimated time remaining: 0:00:54)

03:03 <ec> i'm so bad at linux

03:04 <ec> such a waste of time and effort i h8 it i h8 it

04:55 <ec> *starts from scratch* arg.

04:55 <ec> argh

04:55 <pikajude> what you scratchin

04:56 <ec> after a year-or-so's random research and planning, I'm trying to finally *build* my icebox

04:56 <pikajude> oh, i have one of those in my freezer

04:56 <Elphaba> lol

04:56 <ec> turns out the weird obscure Linux distro I was planning to use is like dead and unmaintained, and I can't make it build

04:56 <ec> idk debian things ugh

04:57 <ec> after driving around all day writing down fucking GPG keys and taking photos of QR codes, I have a headache, want some fucking dinner, and want to stab everybody who ever thought linux-anything was a good fucking idea

04:57 <ec> also my Internet is slow and that's very frustrating

04:57 <ec> 12 minutes meh brb watching tv until it's done

07:00 <joepie91> ec: I'm good at blending in

07:00 <joepie91> :P

19:34 <ec> < gqbrielle> elliottcable is a textbook example of unreliable narrator

19:34 <ec> awwwuh

19:35 <pikajude> i can't believe they have textbooks about those

19:42 <joepie91> pikajude: with the advent of self-publishing, there's textbooks about everything!

21:37 <ja> wat. @ “after driving around all day writing down fucking GPG keys and taking photos of QR codes”

21:41 <ec> ja: no more purr.

21:41 <ec> and I was verifying encryption fingerprints on presumed-uncompramised networks

21:42 <ec> I've got a kinda play-paranoia thing

21:43 <ja> ec: you keep purr in your icebox?

21:43 <ec> no

21:44 <ec> that would make no sense because the point of an airgapped computer is it can't connect to the network?

21:44 <ec> unless ... I went and retrieved the machine, and ran purr discretely, every single time somebody addressed purr

21:44 <ec> airgapped IRC bot let's do this.

21:44 <ja> lol, nice

21:46 <ja> but... QR codes?!...

21:46 <pikajude> questionable reality codes

21:47 <ja> o i c, pikajude

21:47 <ec> one of the safest, easiest ways to transfer data around without using USB drives, in the era of a complete lack of CD drives

21:47 <ec> man am I the only security nut in here

21:47 <ec> that's kinda surprising, given the membership of this room?

21:48 <ec> tl;dr anything with a USB port or plug is fairly trivial to compromise; every publicly documented breach of an airgapped network has been via a USB device.

21:48 <ja> idk, I'm just a major noob at mostly everything

21:48 <gkatsev> I'm interested in security, definitely not a nut, though

21:49 <gkatsev> I did enable 2FA on most of my accounts with lastpass generating and storing passwords

21:49 <ec> old-school OPSEC involves CDs, because 1. no firmware, any compromise is going to have to include *executables at both ends*, as opposed to only on one end; and 2. if the airgapped system is executable-compromised, then *exfiltration* over CDs of large quantities of data is difficult — it's very obvious if a CD you intended to burn a small amount of data

21:49 <ec> to, suddenly has a huge area burnt

21:49 <ec> physically-obvious, that is

21:49 <ja> ec: why did you have to drive around writing down keys? do you scatter them across the city, carve them into old trees and such?

21:49 <ec> QR codes have the same properties, with the added benefit of it being basically *impossible* to exfiltrate any large amount of data with one, lolol

21:50 <ec> ja: Okay, so ground-zero of information-security paranoia is “assume you're already fucked all over” lol

21:50 <ec> assuming my local machines are at least partially, if not completely, compromised ... how can I build a new, non-compromised system?

21:52 <ec> software checksums and signatures give me a great start ... but if my local network is compromised to the point that someone can ship me backdoored software (or more realistically, dynamically backdoor software that's in transit), then they can easily MITM-doctor signatures, keys, etceteras as well

21:52 <ec> “Sure,” GPG says, “this set of checksums was indeed signed by John Doe Developer!” ... except, lol, how do I know that.

21:53 <ec> so without a web-of-trust of signatures and known-trusted local public keys, the only way for me to have any confidence in the keys I obtain and verify locally, is basically brute-force.

22:00 <ec> so in my little personal “wargaming security” project, I drove around the city to a couple locations with public computers, and pulled up the websites for a small array of critical software I'm about to install on my airgapped machine — the OS distribution, gpg itself, the whole-disk-encryption software, the Bitcoin wallet — and recorded/compared the

22:00 <ec> publisher's PGP-keys over separate networks and machines.

22:02 <ec> now when downloading and building that software locally, I can be slightly more secure in the knowledge that I'm installing *what the author wrote* onto my security-enhanced machine.

22:02 <ec> being paranoid is a fun exercise for the weekend ¯\_(ツ)_/¯

22:02 <ec> it's a bit like foxhunting as a HAM, or capture-the-flag infosec games

22:03 <ec> not intended to be an accurate reflection of reality, so much as an exploration of the space.

22:10 <ja> oh, like that. it all makes sense now.

22:11 <ja> ... so how many different public computers did you use?

22:14 <ja> https://i2.wp.com/www.everythinghamradio.com/wp-content/uploads/2014/07/DFsetup.gif lolwot (nice double domain name url, too)

22:15 <ec> that's a handheld YAGI attached to a HT

22:15 <ec> lmfao one made out of PVC and measuring-tapes — I love it

22:16 <ja> why the tape measures?

22:19 <ja> judging from Google Images, seems like a lot of people make them out of measuring tapes, so I thought it had some significance, but I guess not, lololol

22:19 <ec> just cheap and widely-available chunks of metal tbh

22:19 <ec> and probably because they roll up easily, makes the whole thing pseudo-portable

22:20 <ec> ugh so I had a password stolen along with my wallet

22:20 <ec> which is what's prompted this whole infosec adventure

22:26 <ja> that sucks, dude :<

22:26 <ja> at least you got an adventure out of it

22:26 <ec> it was one I haven't fully memorized yet

22:26 <ec> and have. no. backups. of. argh.

22:26 <ja> yeah, I was just about to say: you keep your passwords in your wallet?

22:26 <ec> absolutely *struggling* to remember one of the words in the passphrase

22:27 <ec> I was trying to memorize a new master-password; ugh I put it off for too long and it was in my wallet for like a couple months

22:27 <ec> I have an extremely poor memory ;_;

22:27 <ja> maybe it rhymes with something and you'll suddenly recall it when you least expect it?

22:28 <ec> ugh

22:28 <ja> maybe it was “floccinaucinihilipilification”?

22:28 <ec> lmao

23:21 <ja> oh man, I never thought I would be using C# for anything *ever*, yet here I am, typing away with pascal case method names, and MSDN is now my new best friend