Notices by Micah Lee 🔑 (micahflee@mastodon.social), page 8

Apple CEO Tim Cook calls for Bloomberg to retract their SuperMicro supply chain attack story.

“We turned the company upside down,” Cook said. “Email searches, data center records, financial records, shipment records. We really forensically whipped through the company to dig very deep and each time we came back to the same conclusion: This did not happen. There’s no truth to this.”

https://www.buzzfeednews.com/article/johnpaczkowski/apple-tim-cook-bloomberg-retraction

@therealraccoon yup. I haven't tried inspecting the PDF to see what it does though

Wow how lucky am I to get selected?!

Support FBI whistleblower Terry Albury, who is set to be sentenced next week https://freedom.press/news/support-fbi-whistleblower-terry-albury-who-set-be-sentenced-next-week/

Really interesting Twitter thread about how radical the Sears catalog was and it's role in fighting white supremacy during Jim Crow https://twitter.com/louishyman/status/1051872178415828993?s=19

I don't know how many GPG Sync users there are in the wild, much less ones that also use Qubes and Split GPG. But if that sounds like you, I wrote a wiki thing for you https://github.com/firstlookmedia/gpgsync/wiki/Using-GPG-Sync-in-Qubes-with-Split-GPG

lol

@rbonifaz @jorge the official old-school diceware website has wordlists in many languages including Spanish. But the quality of those non-English wordlists is pretty low. Check it out here http://world.std.com/~reinhold/diceware.html

@absor70 so far the only wordlists that are included are from EFF. I could totally maybe add more...

It's high quality? How many words does it contain? Do Portuguese keyboards make it easy to type unicode characters in the language, or would it be better to make the full wordlist ASCII?

@absor70 you can already use -d to pass in a custom wordlist, e.g:

passphraseme -d /path/to/portuguese-wordlist.txt 7

For a 7-word Portuguese passphrase.

Check it, I just released a new version of passphraseme: https://github.com/micahflee/passphraseme

Now you can make diceware passphrases uses wordlists scraped from Game of Thrones, Harry Potter, Star Trek, and Star Wars.

pip3 install passphraseme

A good reason to be skeptical of this story https://twitter.com/securelyfitz/status/1049699417840791552

@freakazoid also, they don't even name the US telecom company this time, which makes it harder for the company to issue a denial

Bloomberg now has a follow-up story claiming that an unnamed "major U.S. telecommunications company" discovered a malicious implant in an Ethernet port on a server manufactured by Supermicro https://www.bloomberg.com/news/articles/2018-10-09/new-evidence-of-hacked-supermicro-hardware-found-in-u-s-telecom

House Approves the National Quantum Initiative Act https://science.house.gov/news/press-releases/house-approves-national-quantum-initiative-act

Berkeley Police Posted Mugshots Of Activists To ‘Create Counter-Narrative’ Of Protests Against Far-Right https://shadowproof.com/2018/10/03/berkeley-police-posted-mugshots-activists-create-counter-narrative-protests-far-right/

And here's Amazon's strong denial about the supply chain attack https://aws.amazon.com/blogs/security/setting-the-record-straight-on-bloomberg-businessweeks-erroneous-article/

Apple's longer response to the Bloomberg China supply chain story https://www.apple.com/newsroom/2018/10/what-businessweek-got-wrong-about-apple/

@pettter @HerraBRE Thanks for checking.

If such an attack happened, knowledge of it would probably be compartmentalized within Amazon and Apple, and their PR departments (who respond to journalist queries) wouldn't be aware of it. Especially Amazon, who were allegedly working directly with the US government in their classified investigation

@Xyc0 I'm not sure a minimum character length is necessary. In my experience I only ever hit maximum character lengths when trying to use diceware passphrases places (and also, no uppercase and special chars)