While cleaning a storage room, our staff found this tape containing #UNIX v4 from Bell Labs, circa 1973
Apparently no other complete copies are known to exist: https://gunkies.org/wiki/UNIX_Fourth_Edition
We have arranged to deliver it to the Computer History Museum
booo. TIL you can no longer search Google from the Lynx browser. You could do the search by faking -useragent=FAKEUA but then you get to a page telling you to enable javascript.
Same end result for eww in emacs.
This list of good things by @dansinker is speaking to me. I'm hallfway through @annaleen's Automatic Noodle now -- as usual, I was mid-book on something different when my library hold came up, and a chapter in it hooked me and took precedence.
The list also hits at my soft spots for newspapers, public transit, and Austria. I started out in Philadelphia's alt-weeklies, so it's heartwarming to see a new one pop up, the Bay Area's Coyote. Also stoked to see a nod to the tram drivers world championship that was in Vienna earlier this month
Needlepoint Break
The paper itself is not that China heavy, but it lists a lot of observed traffic routed to different, unexpected countries, including "proactive communication", the phoning-home aspect (tho it also links to a 2021 article discussing this with physical SIMs). Alongside possibility of data interception and location tracking and opaque ownership hierarchy of what are essentially white-label resellers, it also delves into the workflow of deploying eSIMs and weak points attackers could hit, not just in travel situations but also for private networks like hospitals and warehouses (think IoT). These things are convenient, but there's no guardrails.
link to paper: https://www.usenix.org/system/files/usenixsecurity25-motallebighomi.pdf
New security risk unlocked, eSIMs edition, and especially the kind you pick up prepping for an international trip. The article goes hard on the China angle, and for sure: who knew Irish eSIM brand Holafly would connect to networks owned by state-owned enterprise China Mobile? The installer runs from their servers, and wherever the phone is, it even has a public IP address in China.
EDIT: I originally wrote that Holafly was a subsidiary of China Mobile, which is not what the paper states.
test
While I was reading: hands off keyboard, I finally fixed a decent swag backpack marred by a crappy logo. Bonus to finally find a good place for this patch, and, whip stitches whip ass
I was asked a really interesting question about whether the US government (or others, but we all know why people are worried about the US right now) could seize domain names, and what would happen if they did.
This is:
* An excellent question
* Quite important to answer
* Probably impossible to answer in practice
🧵 1/?
Let's dig in, based on what I know (which to be clear is mostly on the technical side, I don't know a lot on the legal side; I invite additional information added or corrected by people with more knowledge):
The question here is about the vulnerability of the DNS to government-level attacks. I am going to limit the scope of this post to the DNS; there are plenty of potential nation-state attacks on the Internet, I can't talk about all of them nor am I qualified to.
The good news is that this is, in fact, the kind of attack that people have thought about quite a bit when designing and deploying these systems. That does not, however, mean that they are invulnerable to or that there are not hidden dependencies or vulnerabilities - and honestly the reason why this question is impossible to answer is that there are probably enough hidden dependencies that we just don't know what will fail until (if) somebody tries it.
If someone tries to seize domain names, either one at a time or in bulk, the direct point of attack would be against the domain registrars; these are the entities who you pay to register the name, and who maintain the top-level information about them, such as whose name they are registered in, the contact information for those parties, and which DNS servers are authoritative for providing further information about those domains. Note that those DNS servers *may* be provided by the registrar, but they don't have to be. More about domain name registrars here: https://en.wikipedia.org/wiki/Domain_name_registrar
So what's the attack? The government tries to force the registrar to either de-register the names, or re-register them to another party. They would do so by applying legal pressure on the registrar.
This is one place where there is probably a very thorny legal question: who *owns* the domain name, really? Does the registrar own it? Does the registrant own it? There may be law on this, but I'm not aware of it; I do know that there have been cases regarding trademark law to reassign domain names, some of which have been successful. I'd love (for some definition of "love") to learn more here if folks have good sources to contribute.
The good news on this front is that there are lots of registrars. Tons. One would assume that a government would have the most leverage, by far, against registrars in their own jurisdiction. Registrars are, however, spread out all across the world, and most domains are portable across registrars - you can move your domain to a different registrar just like you can move your mobile phone number to a different carrier in many (most?) countries. Most TLDs (the last bit in the domain name, such as .com. .org, .social, etc.) are handled by a large number of registrars. So, for most domain names, there is a fairly straightforward step to take for protection: transfer the domain to a registrar outside the jurisdiction you are concerned about. There is, for example, no registrar one can go to in order to seize all .com domains for a given country. (Some TLDs have different rules, but I'm not going to get into that here.)
Basically, attacking this at a large scale is not impossible, but it would require a lot of resources and can only move so fast, giving domain name owners a chance to try to take proactive steps. It could certainly be disruptive, and targeted attacks against certain domains are possible, but there is enough resiliency that it's very, very hard to snatch the whole thing in one go.
So, let's go deeper: who gives the registrars the ability to register individual domain names?
In fact, let's go straight to the root: IANA: https://en.wikipedia.org/wiki/Internet_Assigned_Numbers_Authority . This is the standards organization that administers the list of TLDs and the information in the root DNS servers. It is international; that probably makes it hard for individual governments to assert control over it, though it's hard to say, maybe it means any member is a point of vulnerability instead. IANA more or less delegates responsibility to administering specific TLDs to other organizations; for example, .com is administered right now by Verisign: https://en.wikipedia.org/wiki/.com . Those organizations are themselves a potential point of vulnerability for seizing individual domain names; the system overall does have enough resiliency built in that if one domain name is seized, this does not prevent the person or organization that registered it from getting a new domain name in a different TLD: this is commonly done by sites that are not legal in certain jurisdictions, for example.
In other not-good news, standing down Cyber Command planning on Russia isn’t only bad for Ukraine, but also elections and fighting crime. It worked on election interference (and there’s a bunch of European elections coming up) and Defend Forward took down TrickBot
https://therecord.media/hegseth-orders-cyber-command-stand-down-russia-planning
actually decent M&A news: Tor + Tails merge
Is it #Caturday? Here’s Dumpling comfortably passed out on some cyber pillows: Bruce Schneier’s “Applied Cryptography” and @blackhillsinfosec’s “Infosec Survival Guide vol. 2”
I’m taking Schneier’s cybersecurity and policy class now, so I thought I’d revisit this Bible that I picked up fresh from the Temple University library back when it came out, then saw the Greek letter math and promptly put it back. Thought after all this time /maybe/ I could now glean something useful for the cryptography lesson. Nope. Taking this beast back on Monday. (Not the fur beast, the book).
Glad the people who dug a shortcut through the Great Wall were caught, but if there's truly karma, it will be repaired by China's Angkor Wat restoration team, using plain ol' sidewalk cement that will crumble and flake in a year
But as everything old is new again, "boiler room" was way more common 25 years ago. In Cambodia then, it was a novel way to bypass international toll call rates using VOIP. And that's basically the only reason they got busted. No other countries were leaning on Cambodia about it, so the authorities only cared about the missing telecoms income. In those call centers, they called mostly Australia and the US to sell nonexistent stocks.
Props to @campuscodi on the good writeup here on Myanmar's raids of scam-call centers -- noting not only pig-butchering scams, but also using the term "boiler room" -- plus a good backgrounder on them
https://riskybiznews.substack.com/p/china-cracks-down-on-se-asia-scam-call-centers
Mastodon hive mind, is there anyone here who's moved to the US and navigated apartment hunting with mostly non-American recent history? I'm a US citizen, but basically have no recent footprint there, and my wife is Austrian. There's parts of Zillow applications that I can't even fill out, I end up making notes in any available text box where I can.
LPT: If you're up before sunrise working in front of a screen, manually disable night shift. This just dawned on me and the attention boost is like another cup of coffee