Notices by Matthew Garrett (mjg59@nondeterministic.computer), page 2

The promised writeup of how I discovered that the Feeld dating app was protecting private data by doing client-side filtering: https://mjg59.dreamwidth.org/70061.html

Nobody should have to agree to a commercial entity's terms of service to access state services or participate in democracy

(you have an SSH server with a wall time that is not correlated with anything, you have a client, you have a CA that issues SSH certs. You want the server to be able to verify that the cert is fresh, but can't use validity dates because you have a different idea of time. So, server does TPm2_GetTime(), sticks the attestation in the SSH banner, client retrieves that, passes it to the CA, CA puts it in the cert, client gives the cert to the server, server knows cert was issued after that time)

I know it's a running joke that all my problems are solved with a TPM but today I spent a bunch of time working with coworkers trying to figure out a secure way to solve a problem and realised that TPM2_GetTime() solves it perfectly

Cursed PSU that's fixed 12V but has a USB-C connector

Look at this shit. Just horrifying.

Losing the "Matthew doesn't get arrested in the UK" challenge by not having the right passport despite having citizenship would be a hilarious outcome

In the "I need to get a haircut so I can get my passport renewed" stage of planning a trip back to the UK (Timatic says that apparently my UK passport needs to be valid for me to get back into the UK but thankfully I have a valid Irish one that'll work if I fuck this up)

If you're not familiar with Timatic then United has a convenient form at https://www.united.com/en/us/timatic/ that you can fill in and it'll show you exactly what the checkin agents get shown about what paperwork you need for a flight and it's pretty fascinating (I've had the fun experience of violating these constraints with a letter issued by the US embassy in London and I do not recommend that experience)

@Foxboron uhid, but usbip would also have worked

I have forwarded a yubikey over SSH and made it work in Chrome at the far end and I think that's enough for one day

@JackPine use uhid or usbip to pretend to be a hardware token, receive the request, shove it over a custom SSH agent extension, have a local custom agent pass the request to the local hardware token, do the reverse with the response @Foxboron

Starting a music streaming service that only implements SSL with 40-bit RC4 because it sounds warmer than modern TLS

I think the thing that most people do not realise is that correctly implemented privacy preserving apps are very much the exception, not the norm

So many social norms are entirely based around nobody ever hitting F12 and looking at the network traffic

App security is frequently based on the idea that nobody can just hit F12 there, and, sadly, things like mitmproxy

They have no publicly posted security contact. I ended up paying for a month of Linkedin Premium to message their head of Trust and Safety, and was originally pointed at a HackerOne program that had a ToS link that 404ed (it's now marked as "Program not live"). I was finally given a non-public email address, and provided details. I received no feedback until I queried the status and was told it was fixed. In fact, they'd fixed the specific issue but not the general category of issues.

Anyone using the Feeld dating app should be aware that it performs client-side filtering - returned responses that are marked "Status: HIDDEN" will be invisible in the UI but visible in the UI response. I reported the original and most egregious example of this over 90 days ago and that was fixed, but there's at least one remaining case where data is leaked that shouldn't be.

The obvious answer to "Does UEFI Secure Boot add any actual security" is "Basically every cache of leaked documents from state-level actors or companies selling shit to them has included discussion of how to circumvent UEFI Secure Boot" and why would they bother if it didn't

@Suiseiseki Emacs doesn't integrate with lldb because it's under a permissive license