00:06 < bridge> <chairn> @learath2 sorry
00:06 < bridge> <chairn> https://www.reddit.com/r/linux/comments/1lvlxy9/systemd_has_been_a_complete_utter_unmitigated/
06:10 < WHO> where can I write to the moderators so that they ban people on the server?
06:21 < bridge> <Ewan> #✉-create-a-ticket
06:34 < bridge> <melon> Oh, I don't think IRC can interact with it
06:34 < bridge> <melon> ChillerDragon: can you check if IRC/matrix can interact with anything in #✉-create-a-ticket for me please
07:13 < bridge> <ryozuki> anyone has experience running perf inside docker
07:47 < bridge> <TsFreeeeeeeeeeeeeddient> ~~time to move to a web based report app~~
08:37 < bridge> <chillerdragon> @blaiszephyr: we only have developer on irc and a few other channels on matrix
08:41 < bridge> <chillerdragon> No town hall, no tickets and no map testing
08:43 < bridge> <Ewan> No equal representation
09:15 < bridge> <Assa> gumo
09:24 < bridge> <Assa> do namespaces get a letter like classes as well? Like `N`
09:25 < bridge> <Assa> seems like a no, comparing to other namespaces
09:32 < bridge> <Ewan> i cant think of a single namespace in ddnet
09:32 < bridge> <Ewan> that stuff organically sorts itself out
11:07 < bridge> <ryozuki> does anyone know how t oconfigure the terminal used
11:07 < bridge> <ryozuki> when for example i click on a text file on firefox
11:08 < bridge> <ryozuki> it opens xterm with its horrible visuals
11:08 < bridge> <ryozuki> i want alacritty
11:14 < bridge> <Jupstar ✪> Only on kde xd
11:14 < bridge> <Jupstar ✪> Ask your llm of choice
11:16 < bridge> <kollpotato> uninstalling xterm is also an option xd
11:16 < bridge> <learath2> I’m the proud creator of the only namespace in ddnet, `protocol7`
11:17 < bridge> <kollpotato> then it has no choice
11:17 < bridge> <kollpotato> did u make the translation layer?
11:18 < bridge> <kollpotato> i just wonder who and why
11:18 < bridge> <learath2> Seems some programs respect the `TERMINAL` environment var
11:19 < bridge> <learath2> Technically timakro made the initial version of it. Then I made an ugly-ish generated protocol thing so we didn’t have to translate every netmsg and netobj by hand
12:04 < bridge> <kollpotato> awesome
12:41 < ws-client> <ChillerDragon> who even needs ``sv_hide_score`` ? It still exposes the score to the master server anyways
12:46 < bridge> <melon> It's just the chat announcement anyway iirc?
12:46 < bridge> <melon> 
12:46 < bridge> <melon> To prevent spam I guess
12:46 < bridge> <ryozuki> did u know to run perf inside docker
12:46 < bridge> <milkeeycat> https://cdn.discordapp.com/attachments/293493549758939136/1392819337173139596/wcu2j70vfdi81.png?ex=6870eb97&is=686f9a17&hm=3df3a667cb0535a3aca2c787fbf2268aa528103ecabce2b11560f320e83c2a6a&
12:46 < bridge> <ryozuki> u need to build perf in it cuz custom kernel shenanigans
12:47 < bridge> <h11i_> any dev available?
12:47 < bridge> <h11i_> i have a problem
12:47 < bridge> <h11i_> i need help
12:49 < bridge> <h11i_> @ryozuki can you help me?
12:52 < bridge> <Cammodude> bruh
12:52 < bridge> <Cammodude> https://cdn.discordapp.com/attachments/293493549758939136/1392820890328367126/image.png?ex=6870ed09&is=686f9b89&hm=3a7059db9eafa44e1b78de3c2742bb0fb865292d9200249582f3af5a614e32c4&
12:53 < bridge> <h11i_> oh sry
13:20 < bridge> <ryozuki> dont ask
13:20 < bridge> <ryozuki> show ur problem
13:20 < bridge> <ryozuki> if someone wants to answer will do
13:20 < bridge> <ryozuki> if someone wants to answer they will do
13:20 < bridge> <ryozuki> https://dontasktoask.com/
13:21 < bridge> <ryozuki> https://nohello.net/en/
13:30 < bridge> <kebscs> why does the real hookline not go thru tele
13:30 < bridge> <kebscs> https://cdn.discordapp.com/attachments/293493549758939136/1392830249972269076/real_hookline.mp4?ex=6870f5c1&is=686fa441&hm=d2ccbaddf840509f4fee543cb1b1d395c9d10d06aff4c45a44187b2e410d3858&
13:30 < bridge> <kebscs> why does the real hookline not start at tele
13:30 < bridge> <kebscs> https://cdn.discordapp.com/attachments/293493549758939136/1392830249972269076/real_hookline.mp4?ex=6870f5c1&is=686fa441&hm=d2ccbaddf840509f4fee543cb1b1d395c9d10d06aff4c45a44187b2e410d3858&
13:30 < bridge> <kebscs> ddnet code :tear:
14:02 < bridge> <Assa> Keith is beatiful, like my C++ code ❤️
15:08 < bridge> <chillerdragon> No it affects scoreboard and iirc there were complaints about competitive players or some shit xd
15:09 < bridge> <chillerdragon> It’s not like official servers use the setting anyways. No I doubt any custom servers use it either.
15:09 < bridge> <chillerdragon> It’s not like official servers use the setting anyways. And I doubt any custom servers use it either.
17:05 < bridge> <Assa> I am currently trying to integrate render layers into the editor :3 I guess the textures are wrong, but this looks already promising. But man is the code ugly
17:05 < bridge> <Assa> https://cdn.discordapp.com/attachments/293493549758939136/1392884431848603738/screenshot_2025-07-10_17-04-19.png?ex=68712837&is=686fd6b7&hm=9b8bb36adb1cb0aa451932235df9881ef04efd0ebef136b98e1f0390afaeb222&
17:33 < bridge> <learath2> It's truly fascinating how complex the initial boot of a modern processor is. Stuff like BootGuard that is mostly completely undocumented makes it very hard to actually research
17:37 < bridge> <chillerdragon> @learath2: security by obscurity? Guarding us from ppl hacking the cpu? Xd
17:44 < bridge> <ryozuki> ```rust
17:44 < bridge> <ryozuki> pub fn measure_time() -> (u32, u64) {
17:44 < bridge> <ryozuki>     let edx: u32;
17:44 < bridge> <ryozuki>     let eax: u32;
17:44 < bridge> <ryozuki>     let ecx: u32;
17:44 < bridge> <ryozuki> 
17:44 < bridge> <ryozuki>     unsafe {
17:44 < bridge> <ryozuki>         asm!(
17:45 < bridge> <ryozuki>             "mfence",
17:45 < bridge> <ryozuki>             "rdtscp",
17:45 < bridge> <ryozuki>             "lfence",
17:45 < bridge> <ryozuki>             out("edx") edx,
17:45 < bridge> <ryozuki>             out("eax") eax,
17:45 < bridge> <ryozuki>             out("ecx") ecx,
17:45 < bridge> <ryozuki>         );
17:45 < bridge> <ryozuki>     }
17:45 < bridge> <ryozuki> 
17:45 < bridge> <ryozuki>     (ecx, (edx as u64) << 32 | (eax as u64))
17:45 < bridge> <ryozuki> }
17:45 < bridge> <ryozuki> ```
17:45 < bridge> <ryozuki> asm ftw
17:56 < bridge> <chairn> security by obfuscation is a classic in corporate world, but it never works and they never realize that...
18:05 < bridge> <learath2> This is currently my mental model of it, this is just for an Intel processor
18:05 < bridge> <learath2> https://cdn.discordapp.com/attachments/293493549758939136/1392899548426539018/image.png?ex=6871364b&is=686fe4cb&hm=13ff62fb975306f07711812542bf240f5dd0a6acd4bee66a4608609ce0a0ccfa&
18:05 < bridge> <TsFreeeeeeeeeeeeeddient> excalidraw enjoyer
18:08 < bridge> <learath2> I'm writing a small summary paper on the blue part to the right. I was curious about the "Core Root of Trust for Measurement". Turns out it is fairly complicated. But if your cpu has support for it the CRTM is extended all the way to the start of the boot. If not it's actually the OEM UEFI firmware, so lots of random vendors writing code for what could be the true root of trust
18:09 < bridge> <milkeeycat> I love your funny words magic man
18:09 < bridge> <totar> It works if you're intel and hire Christopher Domas to prevent him from leaking your secrets.
18:09 < bridge> <learath2> I learned quite a lot about TPMs and stuff, it's actually quite interesting, the attack surface seems huge, especially in that blue part
18:11 < bridge> <learath2> Notice the black arrow from SEC to PEI? A lot of vendors early on apparently did not quite understand that it's only safe if the entire PEI fits into the IBB. Some vendors had the part that loads and verifies the DXE outside, allowing unsigned code execution breaking the chain of trust
18:13 < bridge> <learath2> and all of this happens before the part I'm actually interested in. I wanted to explore Secure Boot originally, but was curious how the chain even got to Secure Boot
18:15 < bridge> <learath2> Also lots of keys all over the place, one leak and all of this chain goes to trash because there is no revoking these keys burnt into the silicone
18:15 < bridge> <louis> too many 3 letter acronyms
18:16 < bridge> <learath2> eh, it's only for me anyway, just using it as a tool to help me think
18:19 < bridge> <totar> Is that so? I would expect they can be updated with the same process as micro code updates
18:20 < bridge> <ryozuki> interesting
18:21 < bridge> <learath2> The two red boxes have keys burnt directly in the silicone they use for verification. There is no changing those. The OEM IBB key is in a field programmable fuse, once burnt there is no revoking it
18:22 < bridge> <learath2> There is no real way to recover from those 3 getting leaked as far as I understand (though this is all documented horribly, very hard to know for sure)
18:22 < bridge> <learath2> The two red boxes have keys burnt directly in the silicone they use for verification. There is no changing those. The OEM IBB key is in a field programmable fuse, once burnt there is no changing it
18:24 < bridge> <totar> Do you need all the keys to circumvent the chain of trust or just 1?
18:25 < bridge> <ryozuki> @milkeeycat https://flix.dev/
18:30 < bridge> <learath2> Just a single one is enough to run any code, but the intel keys are required if you want to dodge remote attestation
18:31 < bridge> <learath2> Because if you get the oem key that allows you to run any code and lie to the OS, so the computer is fully compromised, but a remote attester can still query the real boot chain hashes recorded by the TPM (the ACM handles this, so to stop it you'd need one of the red intel keys)
18:33 < bridge> <learath2> (the CSME (or with its old name Intel Management Engine) has direct access to the network, so a remote attester will interact directly with it, so it's not influenced by anything that happens outside)
18:34 < bridge> <learath2> I still think they should just document this all properly, like I understand the security concern but when has security by obsecurity really worked?
18:36 < bridge> <learath2> I still think they should just document this all properly, like I understand the security concern but when has security by obscurity really worked?
18:36 < bridge> <totar> Do they gain anything by documentating it publicy? Im sure its well documented for the people who need to know about it
18:36 < bridge> <learath2> The more people that see it the more likely people are to spot an issue
18:37 < bridge> <learath2> Even the OEM vendors with all their access were initially very confused on how to properly secure this, resulting in very real exploits
18:37 < bridge> <totar> Idk
18:38 < bridge> <totar> Maybe its a liability thing somehow?
18:40 < bridge> <learath2> If I had to guess they have deployed this far and wide and now if there is any issue with it there is no real way to fix it
18:41 < bridge> <totar> Yeah thats what I was thinking about
18:43 < bridge> <totar> At the same time I think security by obscurity gets an upper hand when you control the hardware. The last generation of xbox consoles is still unhacked, theres still no cheaters in those games.
18:45 < bridge> <totar> Their security model gaurds against even you soldering wires to the pins on the pcb
18:45 < bridge> <milkeeycat> when finish your language? :santatrollet:
18:46 < bridge> <learath2> Huh, how did they do that?
18:47 < bridge> <totar> There's a conference talk about it where they mentioned that briefly. If you search for xbox security talks you might find it, let me try
18:48 < bridge> <totar> Nvm its the whole talk
18:48 < bridge> <totar> https://youtu.be/U7VwtOrwceo
18:52 < bridge> <learath2> (apparently they did fix this issue in newer intel processors, you can apparently put the processor in a special execution mode and verify any executable before jumping to it (Intel TXT))
18:52 < bridge> <learath2> Looks like a fun watch, I'll have some food and watch this
19:17 < bridge> <learath2> LOL, trust nothing but a special SoC. Yeah I guess that's that for any attack except keys being leaked
19:18 < bridge> <learath2> Time to invest in an electron microscope to try extract the key
19:40 < bridge> <chillerdragon> @learath2: you went full hobby state hacker or what?
19:41 < bridge> <learath2> I wanted to apply for a masters program but they want an academic writing sample. I don't have any, so I decided I might aswell write something about secureboot.
19:42 < bridge> <chillerdragon> A so more semi professional
19:42 < bridge> <chillerdragon> doing masters? Xd
19:42 < bridge> <chillerdragon> Aren’t you in uni since 0.4 release?
19:53 < bridge> <learath2> Seems no one wants me at their company. Might aswell study a bit more
19:54 < bridge> <learath2> At least that's my thinking
19:55 < bridge> <chillerdragon> You not finding a job is crazy
19:55 < bridge> <learath2> I'm not AI friendly, AI decides who gets a job nowadays
19:56 < bridge> <chillerdragon> Just prompt inject your CV ez
19:57 < bridge> <chillerdragon> Also it’s still networking
19:57 < bridge> <ryozuki> xd
19:57 < bridge> <chillerdragon> You gotta know someone. I get a shit load of job offers and I don’t even have linked in
19:57 < bridge> <chillerdragon> Also depends on how picky you are
19:58 < bridge> <learath2> I'm not very picky except for the fact that I'd rather not be a webdev
19:58 < bridge> <chillerdragon> Xd
19:59 < bridge> <learath2> I'll study a bit more, then AI will completely replace all computer people, then I'll have to do retail
20:01 < bridge> <learath2> chillerdragon: #10489 are you satisfied with the answers Robyt3 gave to your review comments
20:01 < bridge> <DDNet> https://github.com/ddnet/ddnet/pull/10489
20:13 < bridge> <learath2> I've decided they are satisfying
20:15 < bridge> <chillerdragon> To my comments yes. But I didn’t do a full review yet. If you merge this you can not hold me accountable!!!
20:19 < bridge> <chillerdragon> @learath2: how about you review some 2 week old pr without comments :p
20:19 < bridge> <learath2> I have a headache from reading too much about proprietary secure boot mess
20:20 < bridge> <learath2> and I'm really not in the mood
20:20 < bridge> <chillerdragon> When give llama maintainer?
20:21 < bridge> <chillerdragon> Time to replace ddnet staff with AI
20:22 < bridge> <kollpotato> chiller are u still 0.7 supremacist
20:23 < bridge> <Ewan> https://cdn.discordapp.com/attachments/293493549758939136/1392934290911662090/IMG_8459.jpg?ex=687156a6&is=68700526&hm=b7bb1c2a1825cd80a90aceabbffb97925ab584498832e0db900eb9dfb5795bf1&
20:23 < bridge> <Ewan> ⬛
20:30 < bridge> <learath2> it's his middle name
20:30 < bridge> <learath2> Chiller 0.7supremacist Dragon
20:32 < bridge> <zhn> why would csme need network access?
20:32 < bridge> <zhn> silly question but i have to ask it anyway
20:33 < bridge> <learath2> So you can attest it remotely 😄
20:34 < bridge> <learath2> e.g. you are at a datacenter, you boot up your server, the central server can then query the CSME to get the hashes measured by the TPM to make sure everything in the boot chain is things you expect
20:35 < bridge> <learath2> (if there were anything between the network and the CSME, the thing could intercept the packets and give you fake values)
20:38 < bridge> <kollpotato> fancy
20:38 < bridge> <kollpotato> if i marry chiller do i get his middle name then
20:38 < bridge> <kollpotato> i love 0.7
20:39 < bridge> <kollpotato> well at least the protocol
20:39 < bridge> <learath2> No, you get his surname, you'll be Koll Dragon
20:39 < bridge> <kollpotato> well
20:39 < bridge> <kollpotato> still nice
21:33 < bridge> <chairn> what's csme ?
21:34 < bridge> <learath2> It's kinda the new name for the thing that contains the management engine
21:47 < bridge> <louis> proposed ddnet acc system allows for external servers to authenticate users right?
22:15 < bridge> <learath2> yes, but iirc avo didn't like how it was designed at all
22:51 < bridge> <kollpotato> wooo
22:52 < bridge> <kollpotato> my first pr
23:03 < bridge> <kebscs> 🎉