What's up everybody? Welcome to Freedom Tech Wrap. My name is Marks and on this show we discuss the
latest developments that affect privacy, speech, and the technologies you can use to have a more
independent life. We live in a highly connected world and Freedom Tech lets you decide how you
want to connect and where you want your data to live. When I'm not making this show, I'm spending
time with family and friends and I also work on a developer platform called OpenSecret that brings
strong privacy and encryption to the apps you use every day. If you're an app developer, check out
what we're building over at OpenSecret.cloud and see how you can add stronger privacy and freedom
technology to your existing stack. Together, let's enable privacy by default. Aside from my personal
affiliation with OpenSecret, Freedom Tech Wrap is an independent show. You can support what we're
doing by sharing the show with others and by sending us value in your Podcasting 2.0 enabled
app. Your support and feedback are greatly appreciated. And now on to the news. First up today, we bring news from one of the
biggest privacy tools invented and that is the Tor network. The Tor network has been undergoing a spoofing
attack over the last month or so. It's an IP spoofing attack and they've announced that they have finally
mitigated it and shared some information about it and there's still cleanup going on. But what happened
is at the end of October, Tor directory authorities and relay operators and even the Tor project sysadmin
team started receiving abuse complaints from their providers about port scanning going on on the network.
And these complaints were a coordinated attack, an IP spoofing attack, where attackers spoofed non-exit
relays and other Tor related IPs to trigger abuse reports aimed at disrupting the Tor project and the Tor network.
So they were purposely using the prevention tools that were meant to safeguard the network and doing a denial of service
of sorts against the network by spoofing fake abuse reports. The Tor community along with InterSecLab and then it says the support of Andrew
Morris and the team at GrayNoise, they all worked together. They identified where the spoof packets were coming from and they shut it down
on November 7th earlier this month. So they have a great write up on their blog. You can check it out to learn more about it. They do
say that there's still work ahead. We need to support relay operators in getting their accounts reinstated and assist providers in unblocking IPs for
Tor directly, directory authorities. So great work by the community and the teams over there. And I'd also recommend if you want to help support the
Tor network, you can either donate to them or you can actually run your own relay, a non-exit relay or an exit relay and help keep the whole network thriving.
Next up, we have final news from the court proceedings of Roman Sterlinov, who used Bitcoin Fog. And he has been sentenced to 12 and a half years for allegedly running the Bitcoin Fog network.
But he still claims and his lawyer still claims that he was but a user, not the person running the network. In fact, the network still has continued to run even while he has been in custody.
No BS Bitcoin.
The website did a whole write up of this. Quick, quick side note. No BS Bitcoin does great journalistic work and bringing the news to many of us every day. So I recommend going over there and donating to them and helping support their work.
But I just want to call out so he was sentenced to 12 and a half years for allegedly running the service. But what I find somewhat disturbing is the use of chain analysis.
In this court case, and then specifically the judges comments and the judges take on the chain analysis research that was provided as evidence to get Sterlinov thrown into prison and get the sentence.
No BS Bitcoin says at trial, Judge Moss defended chain analysis is reactor software as quote, sufficiently reliable.
Adding that, and again,
quoting, it doesn't need to, at least as offered in this case, offer, you know, absolute precision. So if it were right, you know, only 90% of the time or only 80% of the time, I think it would still be valuable for offering the evidence that the government is seeking to offer it for.
That is incredibly dangerous precedent to say that we are going to depend on this tool that promotes itself as being scientific.
scientific,
evidence of, you know, cryptographic proof that someone is has done something on the network. Yeah, they can only be 80 to 90% Sure, probably less, I would guess. We should not be using that to lock somebody up for 12 and a half years, especially when it's a crime, like money laundering, which is debatable if it should even be a crime at all. Okay. Next up, we have a case that we're going to talk about today. We're going to talk about the
when it's a crime like money laundering, which is debatable if it should even be a crime at all.
Okay. Next up, we have Plub Lab. Plub Lab has announced their Top Builder Season 2.
If you don't remember, this is a competition they started last year that ran for a few weeks,
and it brought together a bunch of different builders to pit themselves, not just against
each other, but also work together. And they've announced Season 2 of this. There's a prize money
at the end. Here are some of the details if you are interested. Top Builder is an intense
competition designed to discover the next wave of innovators in the Bitcoin ecosystem.
Apply before December 31st to participate in this Bitcoin-only competition. Win up to $15,000.
It's an eight-week educational program that is an exciting blend of builder sessions,
workshops, announcements, and speaker panels, all designed to foster learning and rapid growth
within the Bitcoin community. This all culminates at Plub Lab Startup Day on Thursday, March 13th,
2025, which coincides also with South by Southwest and the Bitcoin Takeover event that happens here
in Austin, Texas with South by. So if you are interested in not only trying to win the grand
prize of $15,000, but also winning the grand prize of $15,000, you can win the grand prize of $15,000,
but really to get this experience building with a cohort of other Bitcoin companies and projects,
go ahead and apply. You can go to topbuilder.dev. That's all one word,
topbuilder.dev, and apply by December 31st.
The last news item of the day is not one that you would expect, but here we are. And this is
The World of Sports.
Specifically, college football in the United States.
Texas Tech University, which is a school in Texas, has concerns over unencrypted communication.
For this, we're heading over to the Lubbock Avalanche Journal that details the story.
Big 12 tells Texas Tech football rest of conference helmet talks haven't been hacked.
So what's going on here is that this year in college football, coaches gained the ability
to communicate with one of the players. And they're going to be talking about the
players on the field just before a play starts. So they're able to radio in and give some
instructions. And then 15 seconds before the play begins, the communication is cut off.
Well, what many schools were not aware of is that these communications are happening
over unencrypted channels. And so somebody with a scanner and who knows how to tune in
to the right frequency could listen to what was going on. In my opinion, the response from the
conference and from the quote unquote experts are saying, yeah, it's not a big deal because, you
know, how can you really act on the information that's being given to a player right before?
It'd be very difficult for an opposing team to listen and respond. I think that's irrelevant
here. I do think that it's possible for people to respond in that time, but I still think it's
irrelevant. They should be using encryption. Turns out there was an option to use encryption.
They just had to update all the systems or use another option.
That was provided called CoachCom. So even though everybody's telling Texas Tech,
don't worry about it. Nothing bad is happening here. Texas Tech has made the correct decision
in my mind to use the option to turn on encryption. So now when they talk to their
player on the field, it is using an encrypted channel. This just goes along with the prevailing
mood that we all have in general. And that is we just use the service and expect it's going to be
fine for us. And then we find out later that it's unencrypted and that's no good.
We should have our things encrypted by default. Let's turn on privacy by default.
Okay, let's move on to our data breach story of the week, courtesy of some Chinese hackers.
It says Chinese hackers exploit Fortinet VPN zero day to steal credentials. And this is by
way of bleeping computer. And they talk about how the VPN service Fortinet was made aware
back in July of a vulnerability that allowed
credentials from users to be sniffed out by a service running on the same computer.
So what was happening is that the credentials were stored in memory while the VPN service was running.
And then there was an ability for another service running on the same device that knew how to go in
and grab those credentials. They were made aware of it. According to a believing computer,
they did not do anything to fix the problem and do an update.
And so now there's actually evidence that some Chinese hackers have been exploiting this in the wild
and have been getting username and password credentials from computers running the Fortinet
software. So I just recommend that be watching for updates to Fortinet and maybe don't use it
for now until you see an update. Maybe find a different VPN service. This is all up to you.
I'm just giving you the information that there is a lot of information out there.
There is this hack out there in the wild.
Okay, let's go into project updates.
First up, we have, speaking of VPNs, we have Moldad. Moldad has released their browser 14.0.
From their release, they say, "Today we announced the stable release of Moldad browser 14.0
based on Firefox ESR 128 and incorporates a year's worth of changes from Firefox. As part of this
process, we've also completed our annual ESR 128 update. We're going to be able to update the
entire ESR 128 database and the entire ESR 128 database. We're going to be able to update the entire ESR 128 database.
ESR transition audit where we review Firefox's changelog for issues that may
negatively affect the privacy and security of Mullvad browser users and
disable any problematic patches where necessary. So, check it out. They've got
some other updates including picture-in-picture and screenshots as well
as different security levels. Go check out their full changelog. Mullvad browser 14.0.
We have OpenHAB with a release 4.3.0 milestone 4 update. So, they've
been working on this big update for a while and monthly they give updates and
so they've just given the milestone 4 update. OpenHAB, if you aren't familiar, is
an open system, an open platform for controlling all of the devices in your
house, all the smart home devices that you have.
So, scoot on over to OpenHAB's GitHub page if you want to see the latest
developments in milestone 4. Okay, on the media front we have Jellyfin with 10.10.0.
Jellyfin is a free software media system for hosting all of your own media
content and watching it on your devices in your home or away from your home. Some
of the highlights they have, they have media segments. The Jellyfin server now
supports the management of media segments. This means that we store some
additional information for certain time spans on a video that clients can then
use to provide additional actions. For example, when there is a media segment of
the type intro, a client may display a button to skip that particular segment.
They have improvements with playback, transcoding, something called trick play,
they have metadata changes and web changes. There's a lot in this update so
go check it out Jellyfin 10.10.0. Vaultwarden is out with an update. If you use
Vaultwarden for storing your passwords you can do that on a start OS, you know
start 9 server. I think Umbral also has it as well so you can host your own
password manager. Well Vaultwarden has an update 1.32.5 and in this one the
biggest change is that they have support now for SSH key storage. You can
store your SSH secrets in Vaultwarden and have them synchronized across your
devices. Vaultwarden by the way is a back-end that talks to the API of
Bitwarden so you can use Bitwarden clients to access your Vaultwarden
storage. Now speaking of home operating systems we have Umbral out with a big
update. Umbral OS 1.3 has been released. From their tweet the major features are
swappable apps, effortlessly switch between Bitcoin node, Bitcoin knots and
Libra relay, Orelectors, Fulcrum and Electrum X. New features also include
Cloudflare DNS and factory reset. It's faster and smoother, enjoy a
snappier UI and essential bug fixes. So go check out Umbral for the 1.3 update.
Last up on our list is a newcomer to my Freedom Tools list that I have and that
is FreeCAD 1.0. So FreeCAD is an open source software for doing 3D parametric
modeling. If you've ever done architecture you use CAD to draft up a
building, draft up a room. There are tons of other uses for it too. That's just how
you know AutoCAD is how I first got introduced to this type of product.
But FreeCAD is a Freedom Tech open source version that looks really
powerful. You can go check it out on their website. It's not just for
architecture designs, all sorts of 3D modeling that you can do. But you know
congratulations to them. Shipping 1.0 is always a difficult thing to do. So FreeCAD
1.0 open source 3D parametric modeler.
Okay well that's it for news and updates this week. This is Freedom Tech Graphics
and I'm your host, Frank. Thanks for listening and remember to live independent. Later.
This week's song is an ode to Bitcoin reaching new heights and venturing into places we've never
been before. This is Crow Joe with...
Out on the Open Range.
♪ ♪
♪ Introduced by pistol round ♪
♪ Trailer echo gunshot sound ♪
♪ Bodies laying on the ground ♪
♪ Out on the open range ♪
♪ ♪
I don't know where I go
It's like a band from a western picture show
It's damn, it's the one I know
Out on the open range
Lonesome valley, deserts, air
Some struck nation by moonlight splatter
The long end of nowhere
Out on the open range
guitar solo
Rusty cattle, robin strings
Gunfire, bazze, stick-em-up
The gangs back in the satire
And up the ranks
Out on the open range
Out on
guitar solo