33rd Chaos Communication Congress Livestreams • Hacker News Board

Re: 33rd Chaos Communication Congress Livestreams

#31

Post by digi_owl » Tue, Dec 27, 2016, 4:58 PM UTC

happynewyear wrote: post #30

digi_owl wrote: post #27

Earlier quoted context omitted.

Those security entries for security and ethics makes me want to shut down my computer and disintegrate it to individual atoms. Its like the technologist handed STASI their wet dream while trying to improve the world...

> Its like the technologist handed STASI their wet dream while trying to improve the world... The error here is assuming that for all technologists "[handing] STASI their wet dream" and "trying to improve the world" are mutually exclusive. I am beginning to think they knew[/know] exactly what they were[/are] doing.

https://en.wikipedia.org/wiki/Hanlon's_razor

That said, there are times it reeks of "aimed for the moon, hit London" style thinking...

Re: 33rd Chaos Communication Congress Livestreams

#32

Post by berdario » Tue, Dec 27, 2016, 5:01 PM UTC

Mithaldu wrote: post #22

lawl wrote: post #21

Earlier quoted context omitted.

The exploits he presented in high profile perl software are very real, irregardless of if you agree with his reasoning on what is broken or not. So he gave a talk on exploits he found but you call the talk "outright and clear lies", because you disagree with his conclusion that perl is broken?

He found vulnerabilities in (very old) third-party software written in Perl (that's the 1%) then did nothing but lie and attribute them to the language while demonstrating his (accidental or willful) lack of understanding of the language. His code slides often aren't even valid Perl, which is an achievement in itself.

I watched both of his talks, but I've never heard before about this "code on the slide was not valid Perl" complaint.

You're not talking about a small typo, are you?

Can you point to the wrong examples/slides?

Re: 33rd Chaos Communication Congress Livestreams

#33

Post by xxyxx » Tue, Dec 27, 2016, 5:12 PM UTC

Mithaldu wrote: post #25

thewavelength wrote: post #24

Earlier quoted context omitted.

Or you just simply have to accept the fact that congress is more than 100%-always-correct-scientific-talks but rather is about entertainment too. And that is a thing Rubin can bring to congress.

His talks were in the Security track, not the entertainment track. At no point in the talks did he acknowledge that it wasn't meant to be factual either. Additionally, there's a wide gulf between 1% correct and 100% correct he could've aimed for. I would be understanding if the CCC orga put him in the entertainment track, but they did not do that for two years in a row despite having received feedback. He was intenti…

He really seemed strange to me when I saw him at first, I have no clue about perl, but even to me he made some kind of impression, that he has not really done his research.

His character and presenting seemed really strange to me. I was honestly totally confused by his presentation and couldn't make out if this was supposed to be funny or if he is serious.

And if it was supposed to be funny, I didn't find it funny at all.

All in all, I was really irritated by his talk and avoided all his talks ever since.

reading your comments, it seems that was the right choice

Re: 33rd Chaos Communication Congress Livestreams

#34

Post by throwaway161220 » Tue, Dec 27, 2016, 5:22 PM UTC

dividuum wrote: post #28

mnutt wrote: post #20

I recently came across the software they use for mixing their livestreams, and it looks really useful for anyone trying to build out a system to stream or record talks: https://github.com/voc/voctomix

And if you have seen the intermission screens and wondered how these work: They run my software info-beamer ( https://info-beamer.com/hosted ) on a Pi3 in each Hall. Basically those intermission information screens are written in Lua. My info-beamer software uses both hardware accelerated video decoding as well as OpenGL(ES) to make things run smoothly. I'll release the complete Lua source code early next year. If yo…

> Our operating system detects even the tiniest corruption to files and will automatically restore them from our service. The system is completely self-healing.

Can you share details here?

Re: 33rd Chaos Communication Congress Livestreams

#35

Post by minxomat » Tue, Dec 27, 2016, 5:24 PM UTC

Mithaldu wrote: post #25

thewavelength wrote: post #24

Earlier quoted context omitted.

Or you just simply have to accept the fact that congress is more than 100%-always-correct-scientific-talks but rather is about entertainment too. And that is a thing Rubin can bring to congress.

His talks were in the Security track, not the entertainment track. At no point in the talks did he acknowledge that it wasn't meant to be factual either. Additionally, there's a wide gulf between 1% correct and 100% correct he could've aimed for. I would be understanding if the CCC orga put him in the entertainment track, but they did not do that for two years in a row despite having received feedback. He was intenti…

I remember a talk of his about Perl sec issues in bugzilla (I think - correct me if I'm wrong here). Even though it was a problem that was a result of clearly bad code, he still blamed Perl for it.

At first, I thought he was going for a darker Brooker-ish humor, but in the end, the lack of research showed. I got the impression that he tried to shoehorn some corner-case examples into the general "Perl is a security nightmare" narrative.

It could have been someone else, but it sure sounds like him. It's a bad thing to do in a talk either way.

Edit 1: I've found a rather angry response[1] to the talk I was thinking of (Perl Jam 2). This is just for reference, I don't necessarily share the blog post's opinions.

Edit 2: Here's the Bugzilla[2] "bug".

[1] - http://blogs.perl.org/users/joel_berger/2015/12/response-to-...

[2] - https://bugzilla.mozilla.org/show_bug.cgi?id=1230932

Re: 33rd Chaos Communication Congress Livestreams

#36

Post by dividuum » Tue, Dec 27, 2016, 5:38 PM UTC

throwaway161220 wrote: post #34

dividuum wrote: post #28

Earlier quoted context omitted.

And if you have seen the intermission screens and wondered how these work: They run my software info-beamer ( https://info-beamer.com/hosted ) on a Pi3 in each Hall. Basically those intermission information screens are written in Lua. My info-beamer software uses both hardware accelerated video decoding as well as OpenGL(ES) to make things run smoothly. I'll release the complete Lua source code early next year. If yo…

> Our operating system detects even the tiniest corruption to files and will automatically restore them from our service. The system is completely self-healing. Can you share details here?

Sure. The base system is quite minimal an runs from a squashfs read only image. Total size is ~40mb. The squashfs file is stored on the first partition (FAT formatted) which is not mounted rw during normal operation (only while updating the system which happens rarely). The second partition is the data partition. It stores images, videos, the Lua code and other files that are required to actually show content on the screen. This partition is mounted rw.

info-beamer hosted always stores those files using content based addressing. So every file that enters the system gets hashed and is then addressed by that hash both on the website itself as well as on the devices. On the website this might look like this: https://cdn.infobeamer.com/dynimg/blob/image-c40ba24410fb9ca..., on the device they end up on /space/cache/. This is great for all kind of reasons: Cache invalidation and offline verification. For the website, all files can be cached indefinitely as the url changes once the content changes. On the device each file required for a visualization must only be downloaded once, as it's trivial to see if the same file was already downloaded earlier by just comparing filenames. So fonts that might be shared by visualizations are only downloaded once. Also the device can trivially verify that all files are still correct by hashing all cached files and comparing the result with the filename. If it matches, the file is correct. If it doesn't, something is wrong and a new sync is started to repair the problem.

Works pretty well. Does that help?

Re: 33rd Chaos Communication Congress Livestreams

#37

Post by happynewyear » Tue, Dec 27, 2016, 6:22 PM UTC

digi_owl wrote: post #31

happynewyear wrote: post #30

Earlier quoted context omitted.

> Its like the technologist handed STASI their wet dream while trying to improve the world... The error here is assuming that for all technologists "[handing] STASI their wet dream" and "trying to improve the world" are mutually exclusive. I am beginning to think they knew[/know] exactly what they were[/are] doing.

https://en.wikipedia.org/wiki/Hanlon's_razor That said, there are times it reeks of "aimed for the moon, hit London" style thinking...

I can not agree with applicability of that aphorism in this case.

We have had a very vocal feedback loop of raising issues ("stupidity", "misunderstandings", "neglect") with OP conference as one type of such feedback.

Nothing has been corrected. Do you happen to know of another aphorism that covers the "willful stupidity", "willful neglect" etc. and what it all means (as I certainly don't desire hitting London.)

Obviously those with their hands on the production pipeline of tech disagree with the feedback. Is that really a controversial observation? Really?

Re: 33rd Chaos Communication Congress Livestreams

#38

Post by Mithaldu » Tue, Dec 27, 2016, 7:29 PM UTC

berdario wrote: post #32

Mithaldu wrote: post #22

Earlier quoted context omitted.

He found vulnerabilities in (very old) third-party software written in Perl (that's the 1%) then did nothing but lie and attribute them to the language while demonstrating his (accidental or willful) lack of understanding of the language. His code slides often aren't even valid Perl, which is an achievement in itself.

I watched both of his talks, but I've never heard before about this "code on the slide was not valid Perl" complaint. You're not talking about a small typo, are you? Can you point to the wrong examples/slides?

Problems that make it look like he has never written working Perl code without accidents intervening on his behalf. I'll get examples later.

Re: 33rd Chaos Communication Congress Livestreams

#39

Post by fnord123 » Tue, Dec 27, 2016, 7:50 PM UTC

Mithaldu wrote: post #22

lawl wrote: post #21

Earlier quoted context omitted.

The exploits he presented in high profile perl software are very real, irregardless of if you agree with his reasoning on what is broken or not. So he gave a talk on exploits he found but you call the talk "outright and clear lies", because you disagree with his conclusion that perl is broken?

He found vulnerabilities in (very old) third-party software written in Perl (that's the 1%) then did nothing but lie and attribute them to the language while demonstrating his (accidental or willful) lack of understanding of the language. His code slides often aren't even valid Perl, which is an achievement in itself.

Are you talking about CGI.pm? That was removed from core modules in 5.22 (in 2015) which was only the year before his talk. Debian Jesse even has Perl 5.20 as the stable version[1]. Centos 7 ships with 5.16. Of course you can have your sysadmin install an up to date version, but CGI.pm is still in play as part of Perl.

Maybe this year he'll talk about Perl 6 since 5.x is all old hat. ;)

[1] https://packages.debian.org/jessie/perl-base

Re: 33rd Chaos Communication Congress Livestreams

#40

Post by fnord123 » Tue, Dec 27, 2016, 7:53 PM UTC

berdario wrote: post #32

Mithaldu wrote: post #22

Earlier quoted context omitted.

He found vulnerabilities in (very old) third-party software written in Perl (that's the 1%) then did nothing but lie and attribute them to the language while demonstrating his (accidental or willful) lack of understanding of the language. His code slides often aren't even valid Perl, which is an achievement in itself.

I watched both of his talks, but I've never heard before about this "code on the slide was not valid Perl" complaint. You're not talking about a small typo, are you? Can you point to the wrong examples/slides?

http://blogs.perl.org/users/joel_berger/2015/12/response-to-...