Share this page!

Enter Twitter Thread URL to Unroll

Needs to be the full URL like: https://twitter.com/threadreaderapp/status/1644127596119195649

How to get URL link on Twitter App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Robᵉʳᵗ Graham😷, provocateur Profile picture
Robᵉʳᵗ Graham😷, provocateur
@ErrataRob
Created:[BlackICE,IPS,sidejacking,masscan]. Doing:[blog,code,cyber-rights,Internet-scanning]. Unethical coder.
Daniel Bilar Profile picture kiddphunk Profile picture 2 subscribed
Oct 9, 2018 • 4 tweets • 1 min read
So Schneier has a book on how IoT will doom us based on the same reasoning why Windows was going to doom us all ten years ago. Yet, Windows didn't doom us, and neither will IoT. It's like Paul Ehrlich's book "Population Bomb": all his predictions have spectacularly failed to come to pass, yet this doesn't stop True Believers, because it's Moral Truth.
Oct 9, 2018 • 4 tweets • 1 min read
It's amazing watching Bloomberg doubling down on its bad hardware hacking story. Instead of addressing the bad reporting pointed out in the original story, it continues with the bad reporting in new stories. This is technical gibberish, telling techies nothing. Is it one MAC address or two? Or two IP addresses on one MAC address? Networking isn't so complex that you have to avoid sufficient details.
Oct 8, 2018 • 7 tweets • 2 min read
So this New Yorker story quotes me as the lone dissenter on the Trump-Alpha scandal. At least it gets some details correct, like how the server in question is located in rural Pennsylvania and not Trump Tower.
newyorker.com/magazine/2018/… To clarify my position: the DNS lookups may be evidence of some sort of relationship, some extraneous artifact of some other communications, but are not themselves part of a covert communications channel.
Oct 8, 2018 • 12 tweets • 3 min read
1/ So in today's sermon, I thought I'd point that you are wrong obsessing about the three-way-handshake in establishing TCP connections. How connections are closed is far more important than how they are opened. 2/ You can see this in the TCP state diagram. There's 4 states for opening a connection, and 7 (almost double) for closing a connection. The reason you like the three-way-handshake is because you understand it, but don't really understand how they are closed.
Oct 4, 2018 • 5 tweets • 1 min read
In case you were wondering, the "baseband managment controller" is a wholly separate computer inside your computer, either layered on top of your existing Ethernet controller, or even with it's own separate Ethernet port.
supermicro.com/products/nfo/I… It runs it's own operating system, often Linux. Putting your own flash chip, or even updating the correct flash chip with your own image, allows you to subvert the code and install your own malware/virus into the computer, regardless of the "real" operating system installed.
Oct 4, 2018 • 11 tweets • 3 min read
1/ We can see flaws in the Bloomberg story even if can't verify the truth. 2/ Not only is Bloomberg overly relying upon anonymous sources, they aren't even first hand sources, or secondhand, but people vaguely "brief" on the subject. At this point, it's rumor in the intelligence community they are passing along.
Oct 4, 2018 • 4 tweets • 2 min read
So I have a question about IPv6. I only understand 3 out of the 4 addresses in here:
#0 IPv4 address
#1 link-local fe80::... address
#2 static address based on MAC address ..ff:fe...
#3 temporary/privacy-enhanced address
#4 ??? address macOS similarly has the same 4 addresses, though it was a "secured" static address instead of a static address based on the "MAC address". I don't understand the one labeled "dynamic".
Oct 1, 2018 • 6 tweets • 1 min read
The absurd part of this story is repeating the claim that Python has some sort of inherent advantage over other programming languages. It doesn't. No language has an inherent advantage. However, every language has it's die-hard fans who claim it does. To outsiders, who can't parse the difference between advocacy and education, it makes it look like there is some inherent advantage.
Sep 29, 2018 • 4 tweets • 1 min read
I've started writing a guide to "Sockets Programming" out of spite. If you have any questions you want answered about the topic, tweet them to me. The "out of spite" bit is that it will include no mention of byte-swapping or the ntohs()-htonl() macros, because they are wrong and have taught generations of programmers to be stupid. G-e-n-e-r-a-t-i-o-n-s.
Sep 28, 2018 • 5 tweets • 2 min read
I assume this means "session cookies". Why can't they use real language to describe technical attacks? "Access tokens" doesn't help the average person understand what happened any better than "session cookies". But it helps techies understand a whole lot better, who can then explain to non-techies.
Sep 25, 2018 • 4 tweets • 2 min read
Okay for you crypto people (by which I mean "cryptographers" not "tulip bulb investors"), I have a question that seems simple to me that can't be right.

Why can't we ship valid SSL certificates with IoT for their management consoles? Obviously, for a Linksys router, you can't ship a certificate in the linksys.com domain. But why not ship it for 23486983.linksysdevice.com, where that's the serial number of the device? This could be signed by an intermediate linksysdevice.com signing certificate.
Sep 25, 2018 • 4 tweets • 1 min read
Yet again a reminder that techies don't understand technical debt. It's not a bad thing as they believe, but a good thing to be embraced. People have a prejudice against "debt", so it's widely assumed that debt is bad. Quite the opposite, debt is good. Corporations love debt, and seek to get more of it.
Sep 20, 2018 • 8 tweets • 1 min read
1/ So I've known how IPv6 works for 20 years, really, even before that, since it was a glimmer in the IETF's eyes. Yet, I still don't know how it works in practice. 2/ Example, how do you subnet it? such as attaching another WiFi access-point to the network that then communicates with the router to your ISP? Subnets need to be /64 in size, but your ISP gives you a /64 network address. Since 64+64=128, there are no bits left over for subnets.
Sep 20, 2018 • 4 tweets • 1 min read
So you jerks in the media, if your story is about a "newly published" document, and you don't link to the document, you are a bunch of jerks. I know it's a complicated dance, it's an embargoed document, and you write the story before a valid link exists. But this goes to the very core of journalism ethics: what value are you really adding versus letting the people just read the source document themselves???
Sep 19, 2018 • 5 tweets • 2 min read
1/ So I want tech details on the $99 "PlayStation Classic". What's the CPU? Does it have other features, like WiFi? Can I stick other things into the USB ports, like an Ethernet controller? 2/ You can already use a Raspberry Pi running MAME to play most all PlayStation 1 games. Is that what "PlayStation Classic" is doing? Just an ARM CPU running Linux and MAME? (Or IoT Windows or FreeBSD?)
Sep 18, 2018 • 6 tweets • 1 min read
1/ Cooper is awesome, and despite drawing him into a debate he doesn't want to participate in, he's wrong here. Even if you are a peacenik, you want the military doing cyber offense. Let me explain why... 2/ First of all, you don't want our military defending your computer. You don't want some national firewall at the border of our country like what China has. You don't want them controlling a firewall in your home.
Sep 16, 2018 • 9 tweets • 2 min read
Um, no. Economic indicators are just that, indicators. They aren't a measure of "best". It's like saying "best temperature decades": higher temperatures aren't necessarily better (or worse) temperatures. I mean, some numbers do measure good vs. bad tings, like "unemployment", but there are still nuances behind them: have they improved because people are getting jobs? or because they've dropped out of the labor force? Labor force participation is still problematic.
Sep 16, 2018 • 6 tweets • 2 min read
So Linus gets this wrong: swearing isn't the problem people claim it is. The most corrosive personalities in groups don't swear, and indeed, are usually nice and polite to your face.
lore.kernel.org/lkml/CA+55aFy+… It's like how Richard Stallman is on every measure a worse person than Linus Torvalds -- even though he doesn't swear. I mean, yes, Linus should stop the swearing/insults, but even with them he's still a vastly better person than Stallman.
Sep 14, 2018 • 18 tweets • 4 min read
1/ So I'm stuck in a lawyer-loop, convinced lawyers like at the @EFF and @OrinKerr misunderstand an 11th circuit decision because of a misunderstanding about technology. So I'm spending a lot time reading lawyer stuff -- it's like reading code in a program language you don't use. 2/ The case is where they traced a child pornographer to his hotel room based on IP address and grabbed TrueCrypt encrypted USB drives, and then demanded he decrypt the drives.
Sep 13, 2018 • 5 tweets • 2 min read
I'm sure we can all agree the stupidest politicians are those who claim every winter that since it's unusually cold, there is no global warming.

Only slightly less stupid are the politicians that point to every threatening hurricane as evidence of climate change. That picture shows nothing unusual, expect that it puts a circle around every storm that is not a hurricane making them look as dangerous as a hurricane. It shows the typical assembly line of storms that always form in the tropics this time of year.
Sep 11, 2018 • 6 tweets • 1 min read
How do IPv6 devices get their addresses IN PRACTICE. I'm up on basic theory, but I want to know what's really happening out there. How Windows, Mac, and Linux do it are their own particular ways that don't exactly match generic theory. What about LTE/4G devices? My iPhone doesn't appear to have an IPv6 address on AT&T. WTF? Isn't that wrong??