The US vendor used Chinese contractors, and yes, they added backdoors
it turns out.

You would think in this day and age, we would be smarter than this.

This is why at my office we're increasingly careful about approving dependencies.

But then somebody in HR wants to use an HRaaS package (like Rippling) that wants admin-level access to all our employee laptops, in the name of automation and security. No thanks.

I'm not even comfortable with our IT department having admin-level access to my laptop, but I have to deal with it. I really wish they'd go full VDI so we wouldn't have to deal with it.

2021-10-25 11:36 from IGnatius T Foobar

The best way of beating latency in this case would be for people to

download the already existing Citadel client tunnel its connection

through a tunnel to

Uncensored, but that may be a bit too cumbersome.

And that's exactly what we've settled on.

Telnet tunnel:
d77ompkdxbd6fq6mfxba2ulx46r37jlncvyy5fmvbmhqf4hlmgjq.b32.i2p
Client tunnel:
czesg4qmyrkbybkngoldpcv2ndem4lwo5y2f4paf6e377es43oga.b32.i2p

zelgomer said that using a dedicated Citadel client is working well.

darknetuser, you should try it too. If there is continued success then

perhaps I will see about publishing some sort of standalone trustworthy

build of the client for this purpose.

I will give it a try when I can.

Right now I am pretty pushed up against it for personal reasons and I don't even have a personal computer with which to test your awesome stuff. This, incidentally, it si the reason why you are hearing so little from me as of late.

No worries, and I hope you come out the other side in better shape.

Finally took a day to make my i2p connection to uncensored a little more convenient. Now my gateway VM has its own bbs@ user which launches the citadel client, so I can ssh to it from any machine and it acts as an i2p bouncer. I think I am happy with this for now.

And don't try sneaking any crazy connections into the client, because it's also running in a network namespace where any other traffic is routed through tor.
I should have put it in a container but I already have too many OSes to keep up with. So I guess you could spy on my filesystem. Please don't do that.

2021-11-13 17:22 from zelgomer
Finally took a day to make my i2p connection to uncensored a little

more convenient. Now my gateway VM has its own bbs@ user which launches

the citadel client, so I can ssh to it from any machine and it acts as

an i2p bouncer. I think I am happy with this for now.

That sounds awesome.

I should move my lazy ass and do the same, but my hobby servers are a bit low priority at this point.

2021-11-13 18:07 from zelgomer
And don't try sneaking any crazy connections into the client, because

it's also running in a network namespace where any other traffic is

routed through tor.
I should have put it in a container but I already have too many OSes

to keep up with. So I guess you could spy on my filesystem. Please
don't do that.

Add pledged() and unveil() support to the client (wehich is trivial to do), then run the client in OpenBSD - and the client will be magically sandboxed.


YOu won't see SELinuxes and AppArmors the same way after trying this.

You don't have to worry about the Citadel client. What's published is what you're running. If I tried any funny business it would be outed pretty quickly.
The next thing we have to figure out is how to make this kind of thing *easy*.

The next thing we have to figure out is how to make this kind of thing

*easy*.

Well, to be fair, I think it is pretty easy today. Everything about my experience that wasn't easy was self-inflicted because of my own neuroticism.

2021-11-27 11:33 from Nurb432
Subject: Re: mysterium
Actually, reading more, not a fan. Just ignore this :)

Sat Nov 27 2021 08:27:55 AM EST from Nurb432 Subject: mysterium

Ran across this by random.   Seems interesting. But its not well

known. Any opinions?  https://www.mysterium.network/

As soon as I notice the website of a project has been designed by one of those UX masturbation morons, I send the project to /dev/null.

It is fine if the site is fancy, but if it is so fancy you have to wade through 10 TB of graphics to find a description of 1) what the product is 2) how the product works, then it is not worth my time.

This is specially bad with some security products whose website is aimed at managers. "SecurityNetOfDeath will make your network secure! Engage more customers! Comply with GDPR! Buy now!" But you are not given a single explanation of how they do all those things.

As soon as I notice the website of a project has been designed by one

of those UX masturbation morons, I send the project to /dev/null.

Thanks. I did the same thing but I didn't want to come across as rude or stupid. I gave it an honest five minutes trying to figure out what it was. All I learned was that it was an "ecosystem," so I guess it's a bundle of several technologies that they're trying to sell (maybe figuratively or maybe not, I'm not sure) as a package.

Five minutes isn't very much time, but it seems like after five minutes I should at least know what I'm getting into. Imagine taking five minutes to read the abstract of a paper and still not knowing what topic the paper is going to cover.

Slight tangent, but I got the same sense from Matrix. It looks interesting to me, but it's way too hard to get to the meat. And once I did get to the meat, it looked a little too "webbish" for me. I don't get why everything has to be so over-built. What ever happened to KISS?

Five minutes isn't very much time, but it seems like after five
minutes I should at least know what I'm getting into. Imagine taking
five minutes to read the abstract of a paper and still not knowing what

topic the paper is going to cover.

Also I2P and TOR aren't innocent of this, either. I've revisited both websites recently and thought, if I didn't already know what these things were, how in the hell would I learn about them from these websites?? I get that they don't want to be intimidating to non-technical people, but there has to be some middle-ground. These are highly-tecnical subjects. It shouldn't be so hard for me to get past the sock puppet explanation.

Slight tangent, but I got the same sense from Matrix. It looks
interesting to me, but it's way too hard to get to the meat. And once I

did get to the meat, it looked a little too "webbish" for me. I don't

get why everything has to be so over-built. What ever happened to KISS?

KISS turned into a Linux distribution called KISS Linux. Try it out, and you will either love it or fall down to your knees, tearing your clothes appart and crying at so much nerdiness crammed within the same tarball.

As for Matrix, as far as I know it is just a fancy way of bridging communitation protocols which are unrelated together, so you can have all your IRC, XMPP and the like in the same place. I am not a big fan of the idea, and it is web centric, but you could do much worse :)

2021-11-28 08:58 from zelgomer
Subject: Re: mysterium

Five minutes isn't very much time, but it seems like after five

minutes I should at least know what I'm getting into. Imagine taking

five minutes to read the abstract of a paper and still not knowing

what

topic the paper is going to cover.

Also I2P and TOR aren't innocent of this, either. I've revisited both

websites recently and thought, if I didn't already know what these

things were, how in the hell would I learn about them from these
websites?? I get that they don't want to be intimidating to
non-technical people, but there has to be some middle-ground. These are

highly-tecnical subjects. It shouldn't be so hard for me to get past

the sock puppet explanation.

The Tor website used to be much better. Back then the logo was an actual onion, instead of an abstrabt representation of an onion, they explained the core ideas and why it was sueful pretty much in the homepage.

The i2pd website at least tries to explain what i2pd and i2p are. It is not super helpful but at least they don't hide behind a shitload of corporate marketing.

Same thing with the official java I2P implementation, really.