Mempo progress meeting 2015-01-06 21:00 UTC. (was initially planned for 2015-01-05.txt) STATUS: done PLACE: #mempo on irc.oftc.net + relays freenode, irc2p, FLIP DATE: 2015-01-06 21:00 UTC Document-URL-src: https://github.com/mempo/mempo-websites/new/master/mempo-main/html also user github.com/rfree2/ Document-URL-pub: http://mempo.org/meeting/2015_01_05.txt and mirrored to www.mempo.i2p/... and in future to freenet USK@ Scroll down to see the Summary of this talk, and later the full log. _____ _ | __ \| | | |__) | | __ _ _ __ | ___/| |/ _` | '_ \ | | | | (_| | | | | |_| |_|\__,_|_| |_| Tags used here: (E)=experimental (A)=not automated, trivial admin work required. (M)=manual work required. (D)=devel required to finish it. === PLAN of the meeting ==== Please, read this before joining :) Hi guys! This is our progress, and what help we look for (HELP), including trivial work or testers marked as (T). See this document and connectd links, and prepare any questions and we will gladly reply to them on the meeting; Or just tell us what you need/want. Or offer to help even just test stuff. --- rfree, mempo, vyrly on kernel, pax, apt-get --- DONE: (T) we now offer hardened kernel, with pax flags(A), in apt-get repository accessible from internet and darknet Freenet(E) and i2p(E) and Tor, we also support Freenet board system FMS(M). DONE: We have http://deb.mempo.org webiste, also via .i2p and via Freenet (addresses are on the page) DONE: (T) apt-get works over freenet :) this is first time ever. Details are on the page. Apt-get is configured by i.sh install script. TODO: use the newer reproducible dpkg developed at #debian-reproducible https://reproducible.debian.net DONE: simple pax_flags.sh script configured programs like firefox, java to disable some of strong Pax protections that kill programs using JIT. TODO: the pax_flags.sh should be packed in a .deb, with dpkg triggers (man 1 deb-triggers) to observe /usr/[s]bin , /[s]bin, to reapply flags on binary programs upgrade TODO: a freenet-dumb-installer.sh that makes user srv_fn, downloads freenet installer .jar, checksums/GPG checks, runs it (yeap I know this is not the best way) TODO: a freenet-dumb-installer.deb (yes I know this is not the best way) that does the above later HELP: maybe someone wants to develop a real serious .deb installer for Freenet? Some work was started on this. TODO: a .deb with FMS (freenet message system) TODO: publish in repository the .deb of libpoco that fixes utf8 bug. The solution is not fully the Debian-Way but works: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=671477 just need to publish it. Our solution is reproducible build script: https://github.com/mempo/mempo-deb/tree/master/pack/poco but is uses odd script and does not have a deb-src HELP: Someone could make a real debian package for the libpoco fix in form of deb orig tar gz + debian patch so we can generate deb + deb-src. HELP: Someone could make a real fix for libpoco not just a work around; AFAIR the patch is not a preferred solution for Debian because it duplicates library symbols? HELP: (T) someone with freenet: could keep-alive our repository and also run the script that keeps downloading our files as posted on FMS. HELP: (T) someone with a server: could run an automatic mirror spider of deb.mempo.org to his server, and tell us to list him as backup. TODO: make the kernels have a package with same name so that aptitude upgrade does upgrade it, instead of manual search for newest kernel. We have a solution in form of virtual package e.g. linux-image-3.2-mempo-servmax that will depend on the newest kernel release like mempo 0.1.97. TODO: above solution has downside of not deleting old versions like 0.1.96, it should have some conflict or recommend remove field? Just markign it for auto-removal might not be enough as linux-image* packages AFAIK are by default retained and not cleared from apt local cache, using disk space in /var/. We must remove the package installation to clear disk space in /lib/modules/ and /boot/ (and for security - old kernels) HELP: provide a .deb with TBB, verify it's build (I hope it is determinitic) so we can push that to our repo HELP: provide a script to run kvm image with Tails one-time OS - looking for developer. Probably make a .deb with run-tails script, and deb with the iso image. --- kocka on newer kernels --- DONE: TODO: 3.14 ? TODO: Kali ? TODO: other? --- tigusoft.pl on compilers --- TODO: provide a dumb install script that locally builds and installs in ~/.local/ llvm compiler at least TODO: provide a nice .deb of more recent gcc version needed by developers for C++11 TODO: provide a nice .deb of more recent llvm version needed by developers for C++11 Test or backport, release to mempo repository. See if build can be made deterministic. --- dg, lg on i2p --- i2pbote is a plugin for i2p (geti2p.net) that offers hihgly secure, remailed-based (like mixmaster) highlevel onion-routed email, traveling over i2p, and not needing any servers at all. DONE: i2pbote mailer - questions how it works - dg TODO: i2pbote basic security audit (does it not have obvious problems) - dg? TODO: i2pbote deterministic build and includion in mempo repositoru as i2p-i2pbote package - db, rfree? _____ / ____| | (___ _ _ _ __ ___ _ __ ___ __ _ _ __ _ _ \___ \| | | | '_ ` _ \| '_ ` _ \ / _` | '__| | | | ____) | |_| | | | | | | | | | | | (_| | | | |_| | |_____/ \__,_|_| |_| |_|_| |_| |_|\__,_|_| \__, | __/ | |___/ The meeting took place as planned. Clarified mempo for users: freeroute, cryptoferret, prot0n, legit, irea. New goal: make i2p-i2pbote that packages i2pbote plugin; Deterministic build. str4d, kytv are upstream New goal: research banana-pi / r-pi for secure hardware e.g. to run secure Darknet. CPU firmware blob? New goal: patch irssi to by default hide realname, username (=nick), make it easy to change, easy to randomize. New goal: 3.14 builds New goal: i386 builds, offers New goal: use git-issues as bugtracker for now, and FMS boards, and i2p irc - document it. New goal: make roadmap on www (not in irc log) New goal: mirror www.mempo.org the same way as deb.mempo.org (not in irc log) New goal: find more anonymous developers and auditors New goal: donations address New goal: package bitcoin, monero rfreeman: i'll keep you updated if i can provide you a 32b kernel - just to know: is it possible to make reproductible builds on airgapped machines ?\ Tahoe-LAFS storage servers then i create a mempo APT mirror like this: https://gist.github.com/david415/cbd6342db0894ba98f94 _ _ _____ _____ _____ _ _| || |_ |_ _| __ \ / ____| | | |_ __ _| | | | |__) | | | | ___ __ _ _| || |_ | | | _ /| | | | / _ \ / _` | |_ __ _| _| |_| | \ \| |____ | |___| (_) | (_| | |_||_| |_____|_| \_\\_____| |______\___/ \__, | __/ | |___/ #mempo meeting is in 1 hour ok let's just push online the meeting plan dawuud, has an idea to publish our repository deb.mempo.org also from a collective onion grid storage (but will be mostly AFK today) * SeekingFor is now known as SeekingFo in a few minutes i'll post some informative links about how i use tahoe-lafs with tor hidden services etc.. Ok guys, as you know on deb.mempo.org we have working repository that also works over Freenet cloud, and we have installer i.sh to set all up avvs, how did i.sh installer performed? * dg (dg@irc.dg.i2p) has joined #mempo * Xtothec has quit (Connection reset by peer) * ChanServ removes channel operator status from dg hello everyone, I heard about mempo on reddit and decided to check it out. hi freeroute :) Do you plan to use it as Desktop or Server? Any questions? i.sh works with freenet options, without torify; installation is very simply - run script and follow instruction * Xtothec (Xtothec@kz3ej4mosdw74shm36wrwh7f2bn56m62b2uqlm5sg7wbzi7cugka.b32.i2p) has joined #mempo * dg has quit (irc.postman.i2p irc.dg.i2p) * dg (dg@irc.dg.i2p) has joined #mempo * prot0n (proton@j2i7nrxbt7ck5ljstnwstmdlhzaisa7wtbmlvvtd6fixcsofsn6a.b32.i2p) has joined #mempo * zerorax (zerorax@zidpmybkglps46mqynj4rrsuvbmdev44t7jealq4a53essjsvgmq.b32.i2p) has joined #mempo meeting? rfreeman_w: I hope to use it as desktop environment, but I'm not sure how hard this will be. I noted my used case here - https://ssl.reddit.com/r/linux/comments/2r3t8u/id_like_to_use_security_measuers_such_as/ * cryptoferret (cryptof@xabi2tcjfitus34chow7ehsonctnhpggfwjo4sqcvtwvdeihw2uq.b32.i2p) has joined #mempo hello hi psi, yes. is this system suitable for bitcoin wallet? In what is it secure once i've setup a "restrictive proxy gateway" on one of the Tahoe-LAFS storage servers then i create a mempo APT mirror like this: https://gist.github.com/david415/cbd6342db0894ba98f94 Title: Tahoe-LAFS APT mirror (at gist.github.com) hello cryptoferret =============================================================== Basic info and meeting points are on http://mempo.org/meeting/2015_01_05.txt = http://www.mempo.i2p/meeting/2015_01_05.txt =============================================================== i'll be sure to set a blank ("") Tahoe-LAFS convergence secret this time before creating the new mempo mirror avvs, good. Was install from Freenet used? How long did that took? yes, ~15 minutes freeroute: ok, desktops works very well, just make sure to apt-get install the -desk variant of server, it is most compatible. Things that do NOT work yet are binary drivers (e.g. nvidia, radeon binary drivers) but I think we could support it in future if people need (though heaving a binary blob means giving up on some privacy. there was already a user to root exploit in nvidia driver) cryptoferret: one moment freeroute: for your use case: using Mempo on a Debian: KVM will work. Chromum, Firefox works, just use the pax_flags.sh script from deb.mempo.org avvs, you use chromium? it works ok after setting pax flags right? rfreeman_w: ah yes, I remember that exploit. One of my considerations when purchasing hardware was use with Linux, so hence I chose for a mobo with Intel HD4000. Although sadly that platform onto itself is prob;ematic in terms of privacy/security (Intel AMT, binary blobs in UEFI etc.) yes, it works * lazygravy (lazygravy@c3ggstldtwkw7jsmcomejysglgmgxfs6bnc66i77i2tz3xa3ul7a.b32.i2p) has joined #mempo freeroute: movie/video works (on -desk kernel variant, others might stop it mplayer, vlc works. KVM works. dosbox and wine should work - if they would not then tell me/us we will make less strict version of kernel freeroute: as for the other applications: it could happen that some application is killed by system. Then go to root and see "dmesg" there will be message explaining while it was killed. Then edit that pax script and put there the name of application with "m" or "r" or "mr" flags and run the script again - it will allow that application to run then. freeroute: USB (camera, keyb/mouse, g3 modem etc) work freeroute: VGA passthrough with KVM <--- which one is that? I used just kvm, and then it runs in small X window, that works fine. also kvm quemu internal VNC server works (but that is slow) freeroute: so to summarize I think all will work very well :) If you have initial problems just ask us here everything can be worked out. Repeat question each few hours, usually we reply in 24 hours. You can also add me on jabber: rfree@mempo.org (and @mempo.org has open registration frrom clients like jabber, and allows tor connections) , but better also ask in IRC :) cryptoferret: yes bitcoin wallet (the core wallet) works very well with grsecurity. I recommend to try also -deskmax or even -servmax kernel variant, after you get -desk working, that is more secure cryptoferret: it is much more secure then regular debian, by applying cool grsecurity feautures as described on grsecurity.net page. They stopped 0day bugs in kernel in the past! cryptoferret: it is best to use a separate computer for wallet storage, or even an offline (or usually offline) one. Also fell free to ask us any questions here - or contact me rfree@mempo.org if any questions. With bitcoins, always be vigilant :) I recommend to first try around for a week how all works with Mempo yeah pax+grsec rock cryptoferret , freeroute - install instructions on deb.mempo.org should be very carefully read, e.g. remember to check for updates manually with apt-get search mempo! cryptoferret: still best security with BTC wallets are IMHO multisig keys freeroute yeap. Maybe one node should be online like a hotwallet and half of signature, and always-offline computer for signature and bigger storage thank you, I will check it out later it seems useful * cryptoferret has quit (Quit: leaving) rfreeman_w: this is what I meant with VGA passthrough - https://www.youtube.com/watch?v=37D2bRsthfI - basically Windows running inside KVM, but all the video stuff is passed to GPU directly. Title: Qemu/KVM + vfio = Virtual machine for gaming with 95% of native performance = no more dual booting, Views: 39331, Rating: 98.0% YouTube Title: Qemu/KVM + vfio = Virtual machine for gaming with 95% of native performance = no more dual booting Views: 39,331 Length: 2:08 Uploaded: 2014-02-02 hello prot0n. As for the kernel deb - we (me, kocka_ usually) are packaging and building the grsecurity patches so that you do not have to do it yourself each week, it gets really annoying. autobuild? the kernels we build are built in such way that if in doubt you can always rebuild our kernel and get identical .deb that we publish in repository how is it better than, installing debian + grsecurity patches? prot0n currently we build it ourselves, that will be more automatic in future so it does not take any of our time (looking for DEVELOPERS for that btw, it's easy bash scripting - contact me) the build is on our server, everyone gets the same .deb with the same kernel with the same random seed. Adventage: + you can always know if given .deb and given /boot/vmlinuz.gz is correct very easily Disadv: - you have the same layout of kernel as rest of mempo users, which could make certain attacks less hard then if it would be randomized on your computer maybe we will in future make a .deb package that runs the build on your computer when installed. and emails you with seed (the prove needed to later confirm if build was == source) that would be then most secure. kocka_ what do you think That was about Kernel .deb. We also auto install pax flags. That will be more automated soon. Then we will release RBAC profiles for some apps maybe, and fixes for other apps (e.g. gpg with paranoid long keys) you will ask users to give their email address ? legit, hmm no? This is a repository of .deb , everyone can use them, also anonymously (over tor, i2p, freenet) or fork the project it's all fully free what are PAX flags? prot0n, PAX flags can be set for given file, e.g. for /usr/bin/gedit for example. They tell the hardened kernel to not be too strict about given program because it does some things that are "strange" e.g. writes and runs code in own memory in runtime. firefox needs that * iRelay has quit (Killed (NickServ (GHOST command used by iRelay`))) what does it do when another program does that? it seems the IRC relay connecting irc channels together died now; No problem we will later post logs of chat too * iRelay (i2prelay@killyourtv.i2p) has joined #mempo also, consider looking into Project Tox, it's a Skype replacement but actually it could even replace IRC as well ok we are back. When any program does strange operation then it is killed. This will kill large part of typical exploits/troyans. As root user, you see that in dmesg, and you can disable protection for given program tox i would recommend to avoid psi, got any opinion about tox? I read it has some cool ideas, but I also read someone (you?) that it has/had exploits oh, how so psi? i don't trust tox until it is audited i trust otr better er more also oh yeah definitely, it's still in beta. Caution is necessary. irc + otr is also usable, and irc is too simple protocol to leak data. XMPP for example is quite complex. Dunno about tox. i think IRC should disable the "real name" field to leak less data https://img.bi/#/eUTB0Mg!s3SDD9auM7TLxOvmb2ohgpV0vocXVRIdw2GmM8Dv also that prot0n, good idea. We could patch irssi/xchat to do this by default also the ident is redundant too, at least in context of i2p Title: {{config.name}} (at img.bi) but it needs pro auditors, so if you guys know the know-how and/or know any who is willing to check it out, then please contribute to that project because I'd really like Skype to be replaced someday. * Xtothec has quit (Connection reset by peer) that image is called everything_wrong_with_tox.png and it really does show everything wrong with it For all this programs, our Mempo Kernel can surly protect your kernel from program that has vulnerability. And can make it harded to exploit random vulns in program. this is our role for now I strongly recommend to run different things on different linux users. E.g. have user for normal stuff, other one for banking, other for say. work as a lawyer, other for admin, other for games/skype/video user-user isolation is much improved with grsec. oh and chmod 700 /home/* :) * Xtothec (Xtothec@kz3ej4mosdw74shm36wrwh7f2bn56m62b2uqlm5sg7wbzi7cugka.b32.i2p) has joined #mempo psi: heh, yeah that doesn't look all too good. Hopefully it will get better with time and otherwise I hope that either someone forks it or makes something even better. and if in doubt, run given thing in kvm. it hasn't gotten any better tbhj tbh* OK rfreeman_w: yeah that's what I'm going to go for, kind of like QubesOS isolation but with a hardened hypervisor being something like mempo do we have any more questions from users? yeah I was wondering, I have to use a special kernel with mempo? any 32bit kernel ? (like, the one made by the mempo team)? *bits legit, no 32 bit kernel currently. It could be done if people want. Best would be if new, anon devel would come and make the 32 b version of the config and test it, then we could make repo for that we should make a list of tasks, like that "32 bit kernel", with priorities, devels. Maybe on mantis? Or something more pro (not in php, not requiring real email by default etc)? freeroute: currently Mempo exists as .deb packages that you install on to existing Debian, especially the Kernel package. So using Mempo's kernel is the main point currently. You can apt-get install our kernel, then you have grsecurity. i.sh installer gives proper flags. In future we will also work on RBAC profiles but that is not required now rfreeman_w: ah I see, seems reasonable. And what is the latest kernel that Mempo uses currently? we follow grsecurity stable 3.2 line . kocka_ might work on 3.14 line so, how is apt-get currently different from apt-get linux-patch-grsecurity ? * Xtothec (Xtothec@kz3ej4mosdw74shm36wrwh7f2bn56m62b2uqlm5sg7wbzi7cugka.b32.i2p) has joined #mempo prot0n, it works :) the linux-patch downloads just the sources. and is very outdated grsecurity 3.2 is updated around weekly grsecurity for 3.2 line is updated around weekly and the mempo kernel patch? debian's package with path delivers patch from like 2012.. wow. absolutely do NOT use that *patch eh. * K1773R (K1773R@k1773r.i2p) has joined #mempo prot0n, we today made 98th release (since started counting) prot0n, when you try it out, if anything would not work then ask us here, we will fix it. It's very stable: I'm using it at over 10 computers all together (plus VMs). for a year, over almost 100 versions now totally unrelated: I discovered the hardening-wrapper package few days ago, it enables some security hardening flags to compilers it might interest you, because of you know... security. legit, we will in time rebuild all packages 1) with hardening flags 2) with the reproducible dpkg rfree: thanks, I will. starting with security important ones ok :) This covers all questions from users currently? One more please :p What about packages? I assume they can just be from Debian's repos? rfreeman: k what is currently the best way to download/get these patches? (sorry if I missed it already) I've heard Debian unstable didn't really prioritize security packages. freeroute yes: by using "Mempo linux" you are now simply using your Debian, plus few added packags from deb.mempo.org - for now the kernels, and soon paxflags, other such security tools, fms, freenet and i2p dumb installer, tbb, bitcoin etc freeroute: no assigned security team to this branch does freenet have a significant impact on cpu use? i found it to be a hog on an older computer prot0n, just follow instructions on deb.mempo.org . It's just 2 pages of text, best read it all to have better idea. but basically you run the i.sh there and done prot0n, freenet the anonymous cloud network? It has almost zero CPU use nowdays. HDD use can be some concern, but simply set the disk limit to say 500 MB when installing yes. had some significant cpu use on a computer that runs i2p fine pr0ton if installing freenet etc, you might want to wait randomly a day or few, because ISPs see who uses freenet and could guess that is is "prot0n" . if you care about this with freened * peno_ has quit (Client exited) sure. (oh, it's actually running. maybe. or not.) if you would set apt-over-freenet option in i.sh then that is very cool, but be patient, it will then take around 5 minutes for update and downloads are slow. and sometimes timeout this can be improved in future (so stay on channel to get info about updates :) so far i saw no issue with that, local authorities don't really care what darknets you run (though that might change in the future) I know, just saying that it opens a way to seach for "prot0n", if that nick would be very important to keep totally secret for you nope. i just set this nick up randomly. but anyway irc disconnects correlated with ISP disconnects are probably most problematic OH BTW CONTACT: using a bouncer for 1 of your connections, should fix that ideally? correlation attack between darknet/clearnet irc drops best way to most securely and privately contact us, is on Freenet message board system FMS (that is linked on Freenet main page) and encrypt with PGP and post to board mempo there. This is very secure. (just use random delays of few hours between startup, download, new ID, post etc) ^---------- CONTACT prot0n, I think it would help a lot. Ask also psi he seems to be the IRC-guy :) good idea. correlation attacks are concerning. it's easy to leak info via realtime systems like irc Freenet FMS avoids time correlation (especially if you disable publishing your trust-list, and disable set active=FALSE your identity some hours after posting, when you do not use it) * Irc2PGuest48747 has quit (Ping timeout: 321 seconds) Freenet FMS used in above secure way, should be most secure, especially if you find friends with Freenet to build trusted darknet (or over VPN - that is one idea we have) sounds secure. what cryptography does VPN use? * SpaceApe (SpaceApe@znc.str4d.i2p) has joined #mempo provided FMS code is secure (grsec will help there). and minus e.g. hardware backdoors but that is other story (and banana-psi could help). huh? avvs, what is like rpsi but better? how much ram is there? * Gnosis_ has quit (Client exited) err like r.pi * SpaceApe is now known as Irc2PGuest8328 * particle_zoo^ has quit (Client exited) bannana pi, 1 GB neat then freenet+fms should work on bannana-pi. We should do a Mempo for r and bannaa pi * Gnosis (nunya@gmfakhkrpt754dh3udqk74zmxgzdys2fgc3dtkrdwwh7ncia3gia.b32.i2p) has joined #mempo hi Gnosis are you here now? doesn't the RPi still have a huge binary blob in the PowerVR driver? freeroute it was a bit improved I think. freeroute would you like to research this (google, find articles and peer review, see which information seems FUD and which real, which is up to date etc)? is there no documentation for driver developers? psi, maybe we should have a Wiki for mempo. But also accessible from normal internet and tor. Any ideas? * particle_zoo^ (particle_z@i5ik6oiazhkmwojfmgohwhf7rwb3ltkn45htqk7fo4yiqano5nbq.b32.i2p) has joined #mempo zerorax, I dunno * rfreeman has quit (Connection reset by peer) not sure if Gnosis is online, but I wanted to also add that rfree: sounds like a good idea in Mempo we will support Anoncoin, Monero and Bitcoin, Namecoin and Dogecoin in next months. what do you mean by 'support' ? so you will be able to apt-get install monero or bitcoin (the current version, not the 2 year old from debian stable) = have client installed by default? or offer as a repo prot0n, make it trivially easy to install also make it good: with hardened flags and reproducible build also PAX flags (but I hope none will be needed here) and in future RBAC profile how anonymous is Anoncoin? RBAC is awesome, you can tell each app exactly which files it can/can't use and when sounds good. is there a practical feature to track what process uses which files? like, access log prot0n, for now most anonymous coin there is, is Monero (monero.cc). Anoncoin will be when they implement that zerocoin crypto. Dark seems be be not at all afaik. rfree: Well my source is from the Reddit comments, as I've understood the PowerVR people are not giving anything up. So everyone recommended to use that new Odroid that came out recently. Also has a bunch more features than RPi - https://www.reddit.com/r/linux/comments/2ov5v1/the_odroidc1_a_35_quadcore_linux_computer/ prot0n, yes there is "auditing". I did not tested it. Maybe you can read about it and try. Probably it's a matter of adding program to the proper GID number that you will find in /proc/system///.grsecurity/.... and them read dmesg logs. Title: The Odroid-C1, a 35$ Quadcore Linux computer : linux (at www.reddit.com) thanks freeroute. Maybe we should discuss this in detail on reddit and them write down conclusions? Would you like to lead such a reseach? (e.g. I do not have time to research deeply every interesting thing but I could look at final report to elp judge it :) it looks like broadcom released full documentation for the rpi graphics http://www.raspberrypi.org/a-birthday-present-from-broadcom/ =========================================================================== =========================================================================== This was the user questions part (for now :) If any user has private question to ask best way is to find me on Freenet-FMS and use GPG and use board #mempo (see above talk for how to do that in secure way). Or rfree@mempo.org - connections from tor work, registration in protocol works. =========================================================================== rfreeman_w: sure that would be cool but I'm not really an expert on hardware (and especially not on ARM) OK now for development What should we develop in next month? * awire has quit (Connection reset by peer) karc, lazygravy particle_zoo^ SeekingFo Sledgehammer benbrown, bgupta dawuud DrWhax kocka_ sugarpuff xor-freenet that is mostly for you (or anyone else who would like in any way to help) also avvs written some ideas in: http://mempo.org/meeting/2015_01_05.txt = http://www.mempo.i2p/meeting/2015_01_05.txt I'm not really a dev.. but was kinda lurking to figure out if there is any overlap between mempo, and tails. (It seems there is possibly room for colaboration.) iRelay: ^^ Hello rfree: (1) thx, but sorry i have my hands full atm. (2) btw, you should really look into Maidsafe if you haven't already. rfreeman: I dont think we've met at 31c3, or did we? DrWhax, rather no. There is always next year ;) hi, http://mempo.org/ why has chrome os in the table a green check on "patching all privacy problems" (even with question mark) rather not? :P onoez! Title: Mempo Project: Security+Privacy (at mempo.org) bgupta, it's me (nick ) the iRelay is just the relaying bot between irc networks. About tails, I thought we could aslo do a dumb-tails-run script that grabs the tails iso and runs it in kvm. i thought chrome os would be the exact opposite of privacy ahh. I understand now. bgupta, other option is that of course tails is free to use our .deb with kernels (the irelay bit) rfreeman: what do you achieve with that? Can't people already run tails in whatever virt environment they like? bgupta, would anyone like to work on packaging tails.iso into tails-data-image.deb , and writting tiny script tails-run.deb that depends on that + runs kvm /usr/share/tails.iso etc? or can you find someone who would like to? if yes then they should contact us here and on FMS DrWhax: comfort. Now I have to download, wait, check gpg. And if that is other user then copy files or as to root... apt-get once, and then it always auto updates... so I know always alt+f2 run-tails works.. seems far better :) I see right makes sense * rfreeman (rfreeman@fizkzbx54u5fhmvnl2mjykvlu2pglxikviovj3ke4vxhch5ewuoq.b32.i2p) has joined #mempo it auto updates from the iso if you make a persistent volume :) but yeah I see your point iera: Chrome OS is/was employing security researcher working with/on grsec, and therefore got good grsec support. The system seems secure. The added on marketing spying cloud crap is other thing rfreeman: ok but thats another row, patching ALL privacy problems clearly isnt it, imho it should be changed to red completely personally I think it tries to be secure, but just is more loyal to maker/corp then to given user. Secure tool used for bad motives. Kind of like a prison or police can be secure, but then you corrupt it's leadership (chiefs, gov) and use the secure tool to make end-users less secure :) when the homepage says created within debian, does that mean It's basically a debian metapackage, using official repos? oh nvm has an extra repo iear: maybe. that table is not very accurate. I would like to get opinion from someone who knows a lot about chromeos or link to good established research right, but as we all now privacy needs security, but does not imply the other way around ok, i just avoided it of obvious reasons bgupta, you keep using debian and debian's repo, but add deb.mempo.org - this is what i.sh installer there does iera: yes I agree, of course using chromeos, e.g. because of storing things "in cloud" means you are not secure (because you have to trust admins of the cloud, the owners, the gov, the police, anyone is malicious or makes mistake or is hacked and you lost privacy) iera maybe you would like to make a git pullrequest with added row about privacy, and say that chrome os by default keeps most of your data in it's cloud. if that is the case? plus a link to reputable source confirming this is how that all works (I do not own chromeos/chromebook) "anything in cloud" != secure, usually I see but are the repos signed by debian signing keys? or other? (I'd think the goal would it to be something within d.o? bgupta, as written there, there is mine key: 21A5 9D31 7421 F02E C3C3 81F3 4623 E8F7 4595 3F23 - see http://deb.mempo.org/#trust btw guys perhaps you should add a donation address Title: Debian Repository for: Mempo - Hardened Privacy (at deb.mempo.org) hm rfreeman: i'll keep you updated if i can provide you a 32b kernel - just to know: is it possible to make reproductible builds on airgapped machines ? rfreeman: no idea what focus this should have then, privacy is so general and if you eg install chrome on gentoo its bad as well bgupta, Debian will not take at least some of our changes, and others it will take months/years later, because it does not put security above following certain established procedures. This is why we have Mempo instead of just developing things inside the official Debian :) We are other distro, now as addon. So other GPG key, because it is not "by The Debian Project". We do not have own remastered .iso instealler because no need and lots of k proabably. one day. legit, yes it is possible, and that is a very good idea. nice * Sledgehammer has quit (Quit: leaving) legit, if you would like to verify our older builds that would be awesome too. Though keep in mind for much older builds you need to find archived older version of libc that debian used because it changed at some point and it affects the build rfreeman: also: "Paranoia-free lead developers" is a but funny without any sources and why is chrome os+mempo red, rest green? iera: well it is supposed to say that we are "paranoid" developers :) Most of developers should be anonymous (well, pseudonymous). We will build on air-gapped machines. even ER shielding is something we consider "cool" instead of "crazy". Maybe you can reword that part to sound better rfreeman: no objection to mempo, but do you know the chrome os devs? if other develes e.g. Tails, Whonix are also so paranoid that they are using (or considering to use) building on airgapped computer *in faraday cage* (at least for the most important parts), then they also deserve a point there. for example I would say Debian does not deserve to be considered "paranoid", it does many things good (one of first to do GPG signatures of packages etc?) but unfortunately drops the ball a bit eg regarding grsec. of course, no objection there, just wondering about chrome os iera: I do not know. if you find better information, fell free to correct that table :) It might contain outdated or bad info, then please do fix dg, any chance of getting at least a basic security review of i2pbote by you or str4d or anyone? if anyone fixes anything, please ping me in channel or on rfee@mempo.org - we will get it merged. Also as I mentioned Freenet FMS is very secure. oh and i2p bote, I should get address there. psi you use bote, it works good, stable and all? im fine to work with git i2pbote is an email remailer, uses no servers, has high delay on each hop, works over i2p (like tor - no ip), extreamly secure too but if you also dont have better info on the chrome os devs, its probably better to assume non-paranoia bote is neat also: someone should fix the ssl cert on mempo.org, if possible :p thanks for the idea with donation address, freeroute. I think eventually the mempo.org page will be updated with that. Afair there was some old address. Might be outdated, better wait legit: yes it's described in #trust . We will probably move the server too +ssl redirect for http * str4d (str4d@znc.str4d.i2p) has joined #mempo did anyone noticed how pro is deb.mempo.org regarding security of the page? entire index.html is GPG signed :> MITM of deb.mempo.org is not possible for that reason :) also the same for freenet USK@ version of page and hsts hi str4d. We would like to use i2pbote for developers in Mempo project; and maybe even, if possible, implement apt-get install i2p-i2pbote in Mempo str4d, any thought? In particular, you could help us (and everyone) a lot by doing at least basic i2pbote audit, at least to confirm it has no obvious mistakes or backdoors I'm the primary developer of the Bote Android app. I would think that implies I have confidence in I2P-Bote :P str4d, oh? I thought H.Hobo developed i2p-bote? HH is the main I2P-Bote developer I develop the Android app sorry what is Bote Android app, you mean it is i2pbote for Android right? (and make various changes to I2P-Bote as necessary to get the Android app to work) ok I see, so this is a fork of i2p-bote plugin, to work on Android? Yes Same backend, new UI Not a fork, it uses the same I2P-Bote code str4d, did you at least glanced over entire code of i2p-bote? Only difference is it has an Android frontend, instead of a web frontend I have looked at enough of the I2P-Bote code to be satisfied with it. * str4d actually redid the crypto code a few days ago str4d, ok cool, could you make a short GPG statement that you reviewed the code with checksum ..... on day and it seems rather fine etc? (to make it provider-agnostic so I could use more up-to-date crypto libs on Android) heh, "rather fine" str4d, we will be building it for Debian, we will recommend openjdk7. str4d, is the build reproducible? I assume it is, as usually with java, at least the unpacked .jar will be identical if builded with same compiler/platform right? Sure. I will reference the Monotone commit ref, instead of a checksum. Java builds are not completely reproducible (At least, not without a strict build env) Java compilers include timestamps in various parts of the bytecode IIRC * str4d has not tried to make it reproducible * Itsjustme1 (itsjustme@reljhm7dww7drcracxfhp5nkunvz3uer2uscttg3elqys2hegexa.b32.i2p) has joined #mempo str4d, is it possible to also do a checksum, or a .zip and checksum that (zip > tar, tar leaks UID/UNAME etc), so that anyone even not using monotone could later confirm it? Maybe it is possible. I haven't had the need to find out * tsukamoto (turing@j24d7zyunodao3brpag6tn3ihj5cttykgtc6pjwkz6sotgoym3dq.b32.i2p) has joined #mempo str4d, I was doing reproducible builds of Freenet, it worked. Maybe they used same build path. Would you like to show me how to build i2p bote or even take over that task in mempo? this is the part where I need to delagate a bit, to people far more knowlegable :) * legit has quit (Client exited) rfree: checksum is linked to the exact way the source gets packaged, which is fragile. The Monotone commit ref implicitly hashes all source data, so acts as a checksum. rfree: if they got it working then it's probably possible. I just haven't been interested enough in it to try/test. re: apt-get install i2pbote - not possible (yet), desktop I2P-Bote is an I2P plugin. str4d, so monotone can be always checked (even if servers would die etc) as long as someone has the copy of monotone clone, same like it works with git clone? Yes str4d, yes the idea was to install i2p and then install i2p-i2pbote plugin str4d, when I have running i2p, and I have the .jar of i2pbote, can I from commandline install it? e.g. copy file somewhere? so this could be scripted in postinstall script rfree: you need to talk to kytv about that, he is Debian package builder, and is the most likely person to know how to handle a .deb for I2P plugins. allright rfree: not directly from commandline, but you can install from routerconsole /configclient using a file:// URI (to the i2pbote.xpi2p or i2pbote.su3) ok cool :) <-- dg ok I'm putting i2p and i2p-i2pbote on agenda speaking of monotone ... is there a bugtracker for mempo? OK what about task tracker, bug tracker. Any idea? iera: :) telepathy? * legit (legit@yl5mxz66dab2i2exqvhrzm33mafwtem7gmgitbeslywan4bxxgsq.b32.i2p) has joined #mempo str4d, you use trac on i2p, I used trac and Mantis in the past. Any hints? Trac is in python, not being in PHP is a plus what do you guys think about using Mantis for our bugtracker? str4d is it easy to make Mantis send emails to i2p like to @mail.i2p or in future to bote? list of decentralized bugtrackers http://dist-bugs.branchable.com/software/ Title: software (at dist-bugs.branchable.com) git-issues looks nice. It needs only git protocol? we know git can work over i2p and over freenet didnt look at these but trust-wise of course vcs bugtrackers are far better than database backend trackers because the admin just can make a bug disappear or a bugtracker on bitcoin architecture, where nothing can be erased rfree: http://pastethis.i2p/show/qAigQweySBA4LdhNVuM5/ Title: Paste #qAigQweySBA4LdhNVuM5 | LodgeIt! (at pastethis.i2p) in such scenario like on git, can the bugs have still nice serial numbers 1,2,3... because git uses 1. sha1 which can be considered broken in the near future and 2. i dont know if you can sneak in/remove silently something from git (maybe git is ok) in git you can not remove silently, but indeed sha1. They really should move to sha2 but then again this applies to all sources we have so we will be f*** anyway :p iera: btw as for uncensorable bug reports, a bug report in FMS board "mempo" is a good way too ok rfree: I know nothing about Mantis, but anything that can send to a SMTP server is fine - point it to a smpt.postman.i2p tunnel. Just make sure that the From: email address is the same as the user you log into postman's server with. I2P-Bote has an SMTP interface, you can use that to send Bote emails. str4d, nice. There is yet no outproxy to either mail.i2p nor to internet? Also no inproxy? Not yet, no mail with git shouldnt be a problem, just write hooks on the server which send mails (reconnect) * elgoog has quit (Ping timeout: 325 seconds) * str4d (str4d@znc.str4d.i2p) has left #mempo (leaving) ok we should pick up some tool for bugs I guess for now github issues? * theotherside (theothersi@gateway01.anonet) has joined #mempo https://github.com/mempo/deterministic-kernel/issues for bug reporting -or- post to uncensorable Freenet system using FMS program to board "mempo" Title: Issues · mempo/deterministic-kernel · GitHub (at github.com) =========================================================================== =========================================================================== Planning development =========================================================================== kocka_, how is work on 3.14 branch? I wonder should we have 2 branches of the git repo, or should we in one put both patches (but then all scripts will be more complex)