Reminder: Costumes encouraged for tonight’s meeting

We’re meeting this evening in the usual space. You know, that place where we put that thing that time. Costumes are encouraged. Someone will probably live-stream it on Discord for those who can’t make it, but come on out.

Here’s the current CDC guidance on gatherings:

https://www.cdc.gov/coronavirus/2019-ncov/your-health/gatherings.html

Real-World Uses for Cyberdecks

Tonight I’m applying updates to my cyberdeck (CrowPi) in preparation for using it as a portable network stack build and rescue platform (PXE boot + ISO images and installers).

Sometimes it’s preferred to set up new environments in spaces where there may not yet be connectivity to the Internet. Or maybe limited internet. Maybe at a meetup.

Serving pxe clients with dhcp, tftp and ftp. Maybe the menu includes an ESXi installer, a couple of Linux installers, a Live ISO for rescues, DBAN for non-SSD emergencies. The sky’s the limit, right? Updated for the twenty-first century by including support for UEFI clients.

But first, updating to the latest everything. Later, I migrate the whole thing to a larger SD card, and replace the Raspberry Pi 3B that came with it, with a much more powerful 4B with 4GB of RAM.

Maybe even have a process watching the logs, and have certain events trigger LED matrix animations, buzzer and vibration activity, countdown timers on the clock, or display status on the small display. This’ll be a fun longer-term project.

Self-hosted Password Manager Round-up

Haven’t you ever set up a network for a specific project and wanted a simple way to manage passwords within the project network while sharing them between the project participants?

Don’t you hate/mistrust the cloud?

For this project, I did a quick rundown on a few available self-hosted password managers that can live inside a network enclave without involving the cloud.

  1. PASSBOLT

I wanted Passbolt to work. Even after I found out the installer* isn’t available beyond CentOS 7 and won’t run under Rocky. Seriously, who uses a closed installer anymore?

So i built a C7 VM and let her rip. Flawless install, got all the way to the point of logging in, and then?

Fucking hell. It REQUIRES a BROWSER EXTENSION to browse the site. That’s a lot of trust you’re asking me to extend. It also requires an email address to validate users. This seems more like a cloud offering hastily made into a self-hosted offering. These are not features I want or need in a closed, self-hosted password manager.

2. BITWARDEN

I wanted to disqualify this one simply for deploying it in Docker. If you know me at all, you know I f’n HATE Docker. And the first set of instructions I found completely validated my hate.

But then I found this. Specifically happens to be for the exact platform I’m working with. https://computingforgeeks.com/running-bitwarden-password-manager-using-docker-container/

Other than dealing with SELinux (either by disabling it or by poking holes in it) and using a different cert mechanism than those described, it was flawless, and I had a Bitwarden instance complete in about an hour.

3. Anything file-based

Immediate automatic disqualification for being file-based. No matter how you share them, sharing them never works out.

4. Integrations

I noticed that NextCloud has a password manager app available for it. So that’s another valid option if it turns out we don’t like Bitwarden.

P.S. I still hate Docker.

Flying blind with network appliances

I was tasked with reclaiming some decommissioned network appliances. More specifically, some pretty decent Lanner appliances. Multiple ethernet interfaces, 16GB RAM, and a decent processor.

Fun, right? Well….

No access, no passwords. They have IPMI, but we don’t have passwords for that either.

We have access to serial, but all that gives us is access to BIOS, and then a boot failure, ostensibly because they’ve been wiped.

So I fought with this in several directions before coming up with a possible solution.

Wrestle with BIOS until I can get it to PXE boot. Set it to PXE from LAN0. Boot it, see what MAC address it comes up with. Add that MAC to my FOG server and deploy an image via FOG. In my case, I imaged it with Rocky Linux 8.4.

Then, because it’s still unconfigured, incomplete and flying blind, go back to serial, boot to the hard disk, edit the grub menu entry to add “console=ttyS0,115200” to the linux line, then let her rip. Sure enough, it’s now fully booting to serial and I’m able to IP it, set up permanent console redirection, make sure sshd is starting, and boom.

I probably could have done mostly the same thing with a USB boot disk, but then I’m stuck doing a full install, whereas using FOG gives me an already-standardized image. Now I’ll be done with this stack in about two bourbons.

Monday In Person: 10/4 Good Buddy

We’re in person tomorrow. Likely someone will make it hybrid but I’ve proven useless at dividing my attention between virtual and IRL, so I tend to focus on the IRL. After all, that’s where the booze is.

Anyone who has come to previous meetings is welcome. If you’ve only met us virtually hit one of us up if you’re interested in attending. We prefer to vet strangers because it’s a private space.

Optionally, bring a snack or festive bevs to share. This seems to be shaping up to be one of the larger in-persons we’ve had in a while, this could be interesting.

Indoors vs outdoors is currently unknown. WX report indicates rain possibility around meeting time of around 50%. We can handle either, but if you can’t, that’s on you. Please be vaxxed and/or masked if indoors. None of us want the delta variant.

Activities: laser engraving, staring at psychedelic lighting, and badge thoughts for DC30.

Don’t be a dick.

Just Because I’m Paranoid…

Doesn’t mean they’re not out to get me.

So I ordered some more PCBs, what, ten days ago now. This evening after dinner I was thinking, “wow, I should have gotten a ship notice by now…” then, a few minutes later, it showed up. That’s not the paranoid part.

The shipping notice from the fab house was normal, package on the way via DHL, etc.

An hour or so later, I got a phishing email purporting to be from DHL.

I get lots of phishing emails. I’m not going to categorize them based on quality, because to me, almost all phishing emails are low effort.

But I think it’s strange that I, who normally only gets DHL packages a couple times per year, get a DHL phishing email within an hour or so of an actual DHL package being sent my way.

Now I’m not saying there’s a connection, but if there is a connection, then either:
1) Someone’s got access to the fab house records;
2) Someone’s got access to DHL records; or
3) Someone’s got access to the “Deliveries” tracking app. (I entered the tracking info into that app like I do every time I learn of a package enroute). I suspect this, the rogue phone app, is most likely.

If I’ve got any phishing expert mutuals that have anything to share, I’m all ears.

DC540 pizza night this evening

In the backyard. 6:30.
If anyone wants to try laser engraving, bring an image on a flash drive. 1.5″ round, or 2.5 x 3.5″ rectangle. Take home a souvenir of your obnoxious insensitive nerdy friends and their messy habits.
I’ll try to have the pizza show up around 7.

Closed the Meetup account for good today

Obviously DC540 lives on, but I really don’t feel like Meetup is worth the cost. They make it surprisingly obscure to shut down. The default is to “step down as organizer” allowing any rando who’s joined your group to take over. Anyhow, y’all can still find us here, wherever it is that you see this message.

How I Recovered Defcoin from a borked wallet in Coinomi

Crypto warning: I am not an expert. I don’t claim to be an expert. Don’t “ekshually” me. I figured something out, I’m sharing it with other people, some of whom are stupider than me, in case it’s useful to someone some day. I also may have the facts wrong. I’m not a Defcoin insider either.

So, a while back, Coinomi started supporting Defcoin. YAY.

No, they didn’t allow exchanging it with fungible cryptocurrencies. BOO.

But at least we had a nice phone-based wallet to send, receive, etc. at the con. YAY.

But then it stopped working. Was it last year? I’m fuzzy on the whens. BOO.

Apparently there was some legacy shit in there, maybe it had to do with finding other clients, a hard-coded list, I don’t remember.

Anyhow, sometime fairly recently, it started working again. YAY.

But not for me. BOO.

Turns out, the coinomi wallet I had set up had a LOT of transactions. And I think it was too much for the app to handle. Or maybe something got mangled somehow in the blockchain. Someone explained it once, but you know, I forgot it right away. Like a goldfish.

Look, it’s not about the “money.” I’m not even sure how many Defcoin were in that wallet anymore. Thousands? Value of 0? It’s about wanting a working Defcoin wallet on my phone. And sure, I could have just deleted it and started fresh, but I wanted to learn something and get what I could recover from it.

SO, here are the steps I took and how that worked out for me.

  1. Set up a new Defcoin instance in Coinomi. Yes, it’ll allow you to add a coin twice.
  2. For my next trick, I wanted to sweep the old wallet into the newly-added instance.
  3. Coinomi doesn’t exporting private keys that allow you to do so, but you can use your mnemonic recovery phrase to generate that. Download this to your local machine, or better yet, put it on an air-gapped machine. Because you’re going to be typing your mnemonic phrase into it, and anyone that gets their grubby paws on that can steal your fundage. https://iancoleman.io/bip39/
  4. OK, so load that page up locally on your safely air-gapped system, then type your mnemonic phrase into the BIP39 mnemonic phrase field.
  5. Set the “COIN” to “Defcoin.”
  6. In the Derivation Path section, go to the BIP44 tab.
  7. From your broken Coinomi defcoin wallet, look at Account Details. Get the Derivation Path from there. Mine was m44h/1337h/0h. Type that, without the h characters, into the derivation path field.
  8. Now look at your receive addresses in the old account. Including previous receive addresses. You should see those addresses down below in the extractor, in the “Derived Addresses” section. One by one, take the private keys associated with those addresses, and throw them into the “Sweep Wallet” private key field in the NEW Defcoin instance in Coinomi.

    This worked for me for several of my receive addresses, leading to thousands of Defcoin recovered into the new wallet. However, the one I used so often that I recognized the preamble, took way longer for Coinomi to attempt to sweep it, and it came back with “The private key does not contain any funds,” which I believe is bullshit, I just think there are, once again, too many transactions for Coinomi to handle. But at least now I have a working wallet that can send and receive funds. I just may have lost those funds associated with the largest receive address in my wallet. Perhaps I’ll try again in the future.

Another option is to try to sweep it into a native Defcoin-QT wallet, but that would require converting the private key to WIF format, which might be a bit beyond me at this hour.

Monday 9/13 DC540 Meeting = VIRTUAL

I polled the core group, resulting in two votes for virtual and two votes for “either.” The virtuals win. 6:30PM Monday in the group’s Discord.

Reminder that the Meetup site is going away. I believe it’s going away this month sometime.

PINECIL One Month Later…

A month ago I posted about the PINECIL portable solder iron, and the high-output 65W PD battery bank I had to buy to power it:

https://dc540.org/xxx/2021/08/pinecil-soldering-iron-for-the-win/

So it’s been a month, and no exaggeration here, I have soldered over 10,000 joints since then, and I have zero complaints. It’s my new old-reliable. In fact, during a recent solder party, when my battery bank was depleted (the failure was 100% mine in forgetting it needed to be charged), I gave up soldering for the evening rather than revert to my wired unit or my TS-80. The PINECIL outperforms the others by that much.

Some details:

1) ONCE, it thought it was at temp but had cooled down. Reset it, it went back to normal.

2) Behavior differences:

The TS-80, when left alone for a while, stops pulling power, which causes the old ZeroLemon ToughJuice Battery to shut down. In fact, sometimes it would stop while soldering. This was annoying.

The PINECIL, by contrast, when put down, goes into visible sleep mode, putting z’s on the screen to let you know what it’s doing, and then begins to cool down, reporting the temp as it does so. When you pick it up again, it immediately starts heating back to your preset temp (for me, for what I’m doing, I keep it at 320 C).

The EasyLonger battery (as this is about the combo, not just about the PINECIL) also has better functionality, in my opinion. The ToughJuice would require you to press the on button to start powering objects connected to it. And then shut down when it detected low draw. The EasyLonger powers the object as soon as it’s plugged in, which means it keeps my PINECIL running as long as I have it plugged in. Safety violation, are you wondering? No, because the accelerometer in the PINECIL tells it to go to sleep.

It’s been a month, and I’m using the shit out of the PINECIL and the EasyLonger, and I couldn’t be happier.

In fact, last week I ordered accessories direct from PINE: A fine tip set, a mini stand, a transparent shell, a break-out board, and yes, a second spare PINECIL. They also have a very nice desktop power supply that I will probably go back and order, now that I think about it.

DC540 8/30 Meetup is VIRTUAL

This week’s meeting will be on Discord. The basement needs some TLC after the last couple of frantic weeks since Defcon. And I need a break from solder fumes and new-PCB smell. Short reprieve while the next batch is on the way. A Discord meetup is a great time for new folks to join in and meet the group, and we welcome you. The Discord link is on the website, and we meet in the Monday meetup voice channel. Please show your beautiful faces, even if they’re ugly.

Batch 2 is gone! Batch 3 news…

Thanks for all the support! It’s been quite the ride creating this badge and fulfilling the orders. We’ve learned quite a bit — about design, soldering, group projects, logistics and fulfillment. There’ll be a lessons learned post soon, I’ll probably write that while we wait for boards and lanyards for the next batch.

Well that was quick enough results. Demand seems to support opening up preorders again. I know it’s annoying to stalk a shop for restocks. OK, there are 40 in the shop for preorders. Shipping is mid-September. I’ll update you if something comes up, but we’ve had pretty reliable everything so far. The longest lead is the lanyards, and they’re scheduled to arrive on 9/13.

[democracy id=”3″]

Amazon Customer Service: Surreal







It is understandable that a retail computer system might have a problem understanding the basic customer service dilemma here. It is less understandable which it’s one of the largest retailers on the planet.

In any case, that’s what human customer service is for — for understanding the customer’s problem and coming to a common sense solution. Here’s what happened when I tried to elicit common sense from Amazon’s customer service:

8:10 PM: (Amazon) 

OK, looks like you requested a refund for this item, but we haven’t received it back yet.Refunds are issued once returns are received by Amazon.After you drop off your return, it can take up to two weeks for Amazon to get it and process a refund.Did you return this more than two weeks ago?

8:10 PM: No

8:10 PM: (Amazon) Okay, please allow up to two weeks for us to receive your return.We’ll send you an email as soon as we issue the refund.And you can always track your return and refund status.Is there anything else I can help with?

8:10 PM: Yes, I need help with something else

8:10 PM: (Amazon) So, what can I help you with?

8:10 PM: help

8:11 PM: (Amazon) Ok, you can chat with an associate now or request a call back.You can also go to your Customer Service hub to fix most things or to search help pages. What do you prefer?

8:11 PM: Chat with an associate now

8:11 PM: (Amazon) If you have details you think would help the associate, type them here.An associate will join the chat.

8:11 PM: NNaman has joined & will be ready to chat in just a minute.Naman | Customer ServiceHello Good Day! I am here to assist you today. Could you please elaborate the issue?N

8:11 PM: I received the wrong item. The system would not let me replace with the same item, only refund.

8:12 PM: Naman | Customer ServiceI am sorry for the inconvenience caused to you.Please allow me a moment to check this for you.As I can check this item is not eligible for replace/exchange, You can refund the item and place a new order for the item. Really sorry for the inconvenience caused.I can help you with a return label for the item.N

8:15 PM: That makes no sense. I never got the item in the first place.I’m not replacing or exchanging the actual item I ordered. I am returning the incorrect item which I received.I’m just trying to get the item I ordered.

8:15 PM: Naman | Customer ServiceI understand your concern.N

8:15 PM: So I paid several hundred dollars for an item. You sent me something completely unrelated which I did not ask for and cannot use. Now my only recourse is to have my money tied up for weeks?

[At this point, the first customer service rep just ghosted me, then Rep comes in, flying blind, apparently]

8:18 PM: VVishal has joined & will be ready to chat in just a minute.(Amazon) Hi, I am here to help you today. V

8:18 PM: I just want the item I ordered.

8:19 PM: (Amazon) Let me check this for you.As i have checked the package shows delivered V

8:20 PM: I ordered a laser engraver. You sent me a baby crib.I tried to return for replacement, it said not eligible.

8:20 PM: (Amazon) NO worries You can return the item i will help you with the full refund V

8:21 PM: I already tried that. It says I will get my refund up to two weeks after you receive the item.This is unacceptable.I’m asking you to send the correct item,.

8:22 PM: (Amazon) I am sorry for the inconvenience caused to you.But we do not have replacement option V

8:22 PM: It’s not replacement. It’s sending me the item I ordered.You have not done that yet.

8:23 PM: (Amazon) You can return the item for full refundAnd reorder the item V

8:23 PM: With several hundred dollars of my money tied up for up to two weeks?How is that fair.The problem was not caused by me. You sent me the wrong item.

8:24 PM: (Amazon) You can return the item for full refundAnd reorder the itemV

8:24 PM: You are being most unhelpful.

Monday August 23 meeting: another solder party

I was hoping to demo a laser engraver for this week’s meeting, in addition to assembling the last of the preordered Tree of Life badges and prepping the rest for stocking and immediate sale. But Amazon sent me a BabyTrend mini nursery instead of the laser engraver I asked for.

So the agenda for tomorrow evening is: meet at the usual space, work out a minor assembly line, and knock those out. It will be far easier than last time — I should have most of the front boards already assembled before then; and the castellated edge solder method is much, much faster than using pin headers, and leaves the back side of the badge much smoother.

There will also be some discussion of prototyping to try out a feature for next year’s badge. I ordered some Space Dust, but I’m low on other beers, so if Space Dust isn’t for you, and you’re not into Malört, Skrewball or Woodford, consider bringing something.

Meeting ON this evening

Meeting at the usual place this evening. Sorry for the late notice. Was traveling, got in late last night, really wasn’t sure what I was up for. But I got hot tweezers and I’m dying to try them out. And some folks who didn’t go to vegas might be interested in badge&stickers show&tell. Also there may be some front-side badge soldering.

Meeting will be hybrid on Discord as well. But you can’t taste Malört through a screen.

Or maybe you can.

If you’re new to the group, hit me up via DM on the Discord or on Twitter if you’re interested in attending. If I met you in LV, mention that. Otherwise, generally we like to get to know people a little bit before inviting them to the private space.

Tree of Life Badge documentation released

Following up with conversations we had with a few acquirors at Defcon, we have opened a public repo for the Tree of Life badge.

It contains hardware pinout documentation, and the stock .UF2 firmware.

This is so that people can feel a comfort level throwing MicroPython on it, or their own home-rolled firmware, and access all of the components, and have a place to come back to if something goes poopy.

We’d love to see what you come up with! I hope we got all the pinouts correct. Feel free to open an issue if you have any questions.

https://github.com/DC540-Nova/DC29-Tree-of-Life-Badge

Boundaries, directions, and taking it farther

I wanted to take a moment to give a little guidance to all of our new followers now that Defcon is over and everyone is resting before catching up on everything. Our twitter followers tripled in the past 28 days, and I realized new followers are coming from all sorts of different angles.

Hi. I’m Baab, sometimes Baabalicious, sometimes just Bob, and sometimes just DC540. I put out feelers for starting this group three years ago. Immediately lured in some quality people who brought intelligence, passion, curiosity and out-of-the-box thinking. The collaboration has been beneficial for all of us, I like to think.

We got the idea for doing a badge probably after DC27. We kind of faded in energy when DC28 was announced as all-virtual, so the badge idea just dragged along. But as DC29 approached and it became clear there would be an in-person component, we became energized again. On May 24, 2021 (yes, just over ten weeks before Defcon opened, we had a planning meeting, wherein we attempted to nail down specifics. The whiteboard at that meeting is attached to this post. We had wanted it themed for Hitchhiker’s Guide, but none of us came up with a structure or shape that really called out to us or that we found compelling, so it was still feeling a bit in question. After everything went home that evening, I sat down to do some reading and kind of had an epiphany.

I realized that the general shape we had settled on, which I was already uncomfortable with just because it didn’t holler “pick me” when I looked at it with my mind’s eye, seemed as if it would perfectly accommodate a Tree of Life arrangement. This made me nervous. I was well aware that some of the members of the group may have come from a religious background that might lead them to feel uncomfortable around such symbolism. So I tended to tread lightly when approaching the group with this idea. I came up with some mockups, and either they were too busy to respond or I can be ridiculously persuasive at times, because I got no pushback, and continued to develop. As usually happens with this type of group project or volunteer/nonprofit organization, the person with the most forward momentum tends to get what he or she wants. At a certain point it had gathered so much momentum that it had to be completed.

And here we are. We have presented to the Defcon community an esoteric artifact, on behalf of a group who mostly has no historical involvement or investment in such esoterica. And it’s been remarkably well-received. It led to a lot of interesting doors being opened at the con, and some great conversations. I suspect the acquirers had varying reasons for desiring this badge. Some because the backlit presentation with a black solder mask created an especially appealing aesthetic; some because they appreciate anything esoteric; some because they gotta have ’em all, and some, well, who had spend considerable portions of their lives in the study of the badge’s subject matter.

What is Kabbalah? Well, it’s a lot of things to a lot of people. And it’s not the same to all of them. The way I like to describe it to people with no background at all is, “It’s a framework for interpreting the world around you.” In Judaism (I’m not Jewish), it’s been around for hundreds of years. It has been adapted by others, probably most notably Aleister Crowley, and you’ve probably noticed it associated with celebrities like Madonna. It’s not my role to attempt to give you a definitive answer, that would take a whole new website, or maybe a whole new career. But if you gave me enough money, I would try. 🙂

I think maybe I was initially attracted because, you know, spooky occult. But I came back to it from a pure hacker standpoint. It’s like when my family bought a sailboat eight years ago. As a hacker, if you love boats, you will love sailing. It’s a hobby where you can learn something new every day you do it. There are lots of techniques, strategies and optimizations to geek out on. Same with Kabbalah. No matter which angle you approach it from, there is an endless amount of knowledge and information behind it. I met several people during con who have studied it for decades.

I will say this. Based on my own personal research, a fantastic and humorous introduction to Kabbalah, also known as the Tree of Life, can be found in The Chicken Qabalah of Rabbi Lamed Ben Clifford: Dilettante’s Guide to What You Do and Do Not Need to Know to Become a Qabalist by Lon Milo DuQuette. (affiliate link) At the very least, this book should give you an idea of whether Kabbalah (also spelled a bunch of different ways, blame Hebrew ambiguity) is something you’d be interested in studying.

How does this connect with, and why does it resonate with, the Hacker community? This question came up during a talk I was invited to participate in during Defcon. (It was a private talk, don’t get your FOMO in a bunch). I think it was actually during that talk that it sunk in, and I mentioned it, that I think the seeds of this interest were planted in the textfile BBSes many of us frequented back in the day. Who remembers “The Occult Technology of Power?” Every textfiles BBS had subcategories. Hardware, phone phreaking, piracy, occult, basically everything us hacker kids felt was suppressed knowledge. So maybe some of us dabbled back then. Maybe some of us deep dived. Either way, here we are.

Going forward. As I mentioned before, the members of this group come from different religious backgrounds, and it’s not fair to them to attach any prejudices associated with this badge to them, so going forward, I’d like to separate this out a bit. This might go even farther in the future, but for now, the official DC540 website (dc540.org) and Twitter (@dc540_nova) will focus on the badge hardware, functionality, software updates, and the game we released. P.S., nobody has won yet!

For deeper conversations on esoteric or related matters, to exchange related resources or suggestions, or to continue friendships made at Defcon, or to get random shitposts now and then, hit me up on my personal account (@dc540baab). I met some very interesting people at Defcon, both badge-related and not so much, and I’d love to the continue the conversations. The general rule is, if it relates to something the group gets behind, it’ll go here. If it’s something I think might be controversial to the group, it goes to my personal. I don’t want to scare new group members away with what are essentially personal pursuits.

OK, enough of my too-long-for-twitter babblings the day after returning from Con.

Monday evening Discord meetup is up to YOU.

Baab will be in the air during this evening’s weekly meetup, returning from LV. But nothing at all is stopping the rest of you from holding a Discord meetup. We’ve picked up a bunch of new friends recently, both from Kevin’s RE courses and from our many, many in-person Defcon interactions.

The normal time is 1830 Eastern. The Discord perma-invite is on the dc540.org website.

We meet in the Monday Meetup voice channel. We are welcoming to new members, we like to get to know people this way before attending an in-person gathering with us.

Badge Distribution Update

So I just left the badge creator’s meetup. Amazing talking to other badge makers and doing a few swaps, buys and sells.

Right now, I’m taking a much-needed self-care break. I have to recharge my phone, mask and body for a bit, sit with my feet up for a while, and get shower of the day.

My plan for the rest of the day is to be available to hand out preorders.

I’ll leave the room in like an hour and a half or so, and head down to the main chandelier bar on the Paris casino floor next to Cafe Americano, find a comfortable seat and hold court for any pickups. If any of you are really desperate to pick it up before then, hit me up directly (Twitter @dc540_nova) and I’ll give you directions to the room at the Linq. Extra stickers and support points for life if you pick me up a mocha doubleshot from the convenience store on the way up. It’s about $7. I’ll pay you for it.