Fully Encrypted Welders

Hey guys, it's time for another episode of Space Welders, episode 86. Recorded Friday, 14th of July, 2017. With your hosts, Mike Wise and Steve Rogers, it's the fully encrypted welders, coming to you with encryption on. That's right, SSL certificates are go.

They're on. The little green lock thing is on, although it's impossible to actually find if the certificate is valid because God knows where it is in Chrome anymore. Yeah. It's just completely gone.

Why have they moved that all around? Oh, who knows? I mean, go in and look. It's hidden.

Yeah. It's impossible. You can't find it. It's not there.

Look, I'm on a site right now. It says secure. I click it. Secure information.

And you click on learn more, and it just goes to some Chrome, like, help thing, but I can't actually see the certificate. Can't you push the- Come on, Chrome. The developer. Get with it.

The thingy bob and the developer whatsit? Maybe that's where it is, but I don't know. How do you know who's verified it? Who's root to that thing, or whatever?

Well, I mean, that's maybe the slight problem with SSL certificates, that there's really no way to tell that anyone could really verify it. But anyway, we don't need to go into that conspiracy. Yeah. Well, generally there's a little information icon next to the URL with some kind of little padlock and some kind of green thing.

Well, yeah, it depends on your browser of choice, whether it's most of us use Chrome. So you're generally looking at whether or not you are encrypted at all. But someone who doesn't want you encrypted, as at today, they're going to be bringing in new laws to the Australian government for some reason. And this follows- They're on top of current technological advances and innovation.

It is. They're referencing an investigatory powers bill, which was submitted by Apple, Facebook, Google, Microsoft, Twitter, and Yahoo. But this is something that, in the UK, they've had since 2015, 2016. And it basically offers extra- what's it called?

It's sort of extraterritorial judition, or the ability to basically go off and ask a provider to offer more information. And the Australian government are attempting to follow suit, but it seems to be covered up in something around decryption laws. And so what they're asking is that laws to provide- to force providers to provide end-to-end encrypted communications or decryption of these messages. So the way it works, if you go and buy a certificate, generally in the subject line, you will specify the website.

So you go to Komodo, and then you choose the sort of thing that's providing the certificate delivery, whether or not it's Apache Mod SSL, it could be IIS. What you do is you ask for your server key, and then you provide- you can generate that using OpenSSL or whatever, and it goes through a process of saying, what do you want the certificate for, who is it from, so it's from Likewise, and I'm an AVN, ACN, or something like this. And you give it a subject line, and you request a certain sort of certificate, whether it's for a specific endpoint, a URI, or whether you wildcard it, so you say star.spacewilders.com or something like that. And the subject only works to the first level, Steve, so you can't sort of go something dot something dot something on a star, you can only go to one level on the subject.

Anyway, you put that into your Komodo or whatever, and then it whizzes away and it generates and works out whether or not you can generate a certificate. You go through the process of verifying your site, either putting in a CNAME or you put some kind of information on your web server to say that you own this site. The provider will then verify you and then from their domain generate a certificate for you and provide you with the CSR, the cert itself, and the keychain. And that has the private part of the certificate, which has got your password in it and all that sort of stuff, when he had created it.

In other language, you can call it what they call a P12. There are different names for the sorts of certificate that you get, the private key-based certificates that you get. What they're used for is really for encrypting the communication between the client and the web server or traffic of some kind. So as you're sending information across HTTPS on that protocol, then the software will be using this certificate and its private key to encrypt and then using the public key to de-encrypt on the communication.

So in terms of the practical application of this, what happens is that you type a message in which would be your credit card information, so you go credit card information, and obviously it's really come about because porn sites want to be able to protect commercial transactions, but there are many other sites which are using this obviously for secure conversations and ever since we've had the Enigma device we've wanted, or Navajo Indian language, which was also used in World War II for encryption, there has always been a need for securing or hiding someone's conversations. And this sort of leads to net neutrality and it leads to a number of areas. So what the Australian government are asking today is that they want to put in place laws at the end of the year so that they can have access to what happened on the other side of the encryption. I don't think they're actually talking about whilst it's in mid-air, they can't be that silly.

But I know in France they have specific laws for software to not encrypt their data, so you can't, you're not allowed to encrypt your database, you're not allowed to encrypt or you have to have specific, it's like export laws or support export rules when you're distributing software to that country, to say that you're not using specific encryption with inside your software etc. So there's interesting shipping laws, so when I was working for Oracle we had those kind of concerns when we were writing software. So I think this is kind of a new tack to try and introduce, I don't know, basically it's just so that the securities and the authorities can... Well they want to read the messages that people send on these platforms, that people send on Facebook and Snapchat and Google and whatever else, that are encrypted both on the fly in the air and encrypted in their database, they want to be able to see these messages.

It doesn't matter where they see them from, they want to be able to read them to ostensibly stop terrorists and drug traffickers and child molesters, which is a noble goal but is a little bit slippery slopey to say, to paint the entire internet and everyone who uses encrypted services with that brush, to say that's the only thing that people use it for, which is a bit ridiculous. So there's all sorts of privacy issues with this. George Brandis, who is the Attorney General, was saying that the UK equivalent on which they're basing this act was feasible, they're going to base it on a warranted basis, which is what the UK does. It's the new generation of wiretapping is the way that they're positioning this, wiretapping when they would actually be able to listen to your phone calls and they need a warrant for this is a similar kind of thing but for online messaging, that's the whole point.

It's what they're trying to catch up with, but they obviously need to be a little bit careful or these companies need to be careful and people in general need to be careful, understand the implications of allowing this to happen moving forward. Sure, it's great if you can catch terrorists and drug traffickers and all sorts, but it's not necessarily the only thing that they would catch. Yeah, well Brandis told Sky News that the internet is not an ungoverned space and he said that the rule of law has to apply as much online as it is in everyday life. This is not mass surveillance and will not make people's everyday dealings online insecure.

So maybe if it's warranted, they're going to the provider and they're asking the provider to cough up information, but they've got to hand over de-encrypted versions of the end-to-end encrypted channel is what the UK bill basically talks about and how they're going to do that. And in New Zealand, who's also kind of a sister country to Australia as well, they brought in legislation like this about four years ago, so it's not uncommon. We also have data protection or data retention laws in place in Australia as well, so we have to keep certain amounts of data if you're a provider so that it can be recalled if in a warrant situation. I don't know what the enforceable elements of that are, it'd be interesting to understand how that actually works out.

But it comes in the wake of net neutrality, Steve. So net neutrality is the gift that keeps on giving as far as the United States internet bill is concerned. We've had SOPA Act and then we have had the Protect IP Act and all these various acts back in... They're all different, they're all to do with encryption.

Net neutrality is much more being pushed by the ISPs as a way to throttle internet usage depending on plans. Basically the idea is, or the founding principle of the internet, is that the internet is neutral. Every website on the internet is the same and homogenous and there shouldn't be preference given to access to one website or service over another so far as the actual pipeline of communications is concerned. This is also very different from if you go onto say AWS or Azure, depending on how much money you have, you can buy bigger machines that are closer to the pipe.

Well that's buying systems, this is on the other end, this is on the consumer end. This is throttling on the delivery to the consumer end through the providers, like Verizon for example. So what internet and consumer lobby groups have been trying to get is the internet classified essentially as a telecommunications service, much like phone lines. So phone companies can't sell packages where certain phone numbers connect better or faster than other phone numbers because a telephone system is a telecommunications system that is a core requirement of the infrastructure of the country.

Yes, you've got 1-800 numbers where you're paying more, but again that's the operator doing that because you're accessing a service then, but the actual pipeline is not throttling you. There's no difference in your pipeline if you're calling a premium 1-800 number versus your friend down the road or a mobile number or a fax number or anything like that. What the ISPs are trying to do in the US, there's places like AT&T and Verizon and places like that, is they're trying to change the laws around the internet such that they could potentially throttle access or limit access or charge more for access to particular websites through their service. This is like a paid prioritisation.

Yes, so you could imagine buying the YouTube package with your ISP. So you get faster access to YouTube or if you don't have the YouTube package, you can watch 120 minutes of YouTube a month before you can't watch YouTube anymore a month and that throttling is occurring at the ISP level. So it's got nothing to do with your general internet usage, it is specifically that website or that service that they are throttling. Yes, Verizon have actually introduced something similar to this.

It's not prioritisation but it's close enough. What they've got is a subscribe TV channel, I think it's called Go, but what they do is if you go to their TV channel that's streamed online, there's no cost. However, if you go to YouTube and Netflix, there's cost. So you've got your Netflix fee which is $10 a month.

That's sort of similar but imagine... It's a creeping. Imagine an extra step to that where you can't go to YouTube at all. You have to go to their service.

That's what the end state of losing net neutrality could be. So the FCC is, I believe today or this weekend, is voting on what they're going to do or is shortly going to vote on what they're going to do with net neutrality. Are they going to classify the internet as a telecommunication system or are they basically going to allow internet providers to potentially throttle or have what people are calling fast lane versions of the internet. So yesterday was the international internet wide day of action where companies like Google and Twitter and Reddit and Netflix and Facebook were all coming out in support of net neutrality because non-ISP websites and companies are very much opposed to losing net neutrality because they want as many people coming to them as they possibly can.

Even if, say, something like Netflix would be part of one of these fast lane packages, for example, but they don't want to limit their customers. It's really the ISPs that are pushing this forward. So how does this affect us in Australia? It really sort of doesn't because Australia doesn't have net neutrality, really.

We already don't because... And we've got completely crap internet. And we've got completely crap internet because of how it was set up. So there was a post on Reddit, which is very interesting, about the history of internet in Australia.

It's basically because Australia is so isolated from the rest of the world, it's a lot of money and it's expensive to run cross ocean cables to connect Australia to the rest of the world. So there's only one or two companies that have actually done that. And so if you're an ISP in Australia and you want to access the internet for the rest of the world, you have to use these companies. And there's only a few places to do this.

So for example, if you're on the east coast of Australia, your internet signal might go to Perth and then back again because Perth is where these nodes are. And Internode is or was one of them. Pipe Networks is another one. There's a few of these singular companies that will peer with other ISPs, but they don't necessarily have to.

And you can see this in Australia. Companies like Optus and Telstra will offer internet plans that give preference to their own services and systems. So you might get an Optus plan where Netflix is faster, but you've got to pay an extra level above your base level, otherwise Netflix is slower, for example. So here in Australia, it's kind of already too late, but it's sort of as a result of how the internet was developed here and the fact that our politicians aren't necessarily the most technical savvy people in the world, let's say.

But it's still an important point for people in the US. It could potentially get worse elsewhere, even though we don't necessarily have the protections in Australia, but it's still an important thing to do and to support. Speaking of not technically savvy, it seems Pakistan's government is in a bit of trouble. And it's quite interesting the way that they got into trouble because of how, I guess, they've released documents in a particular font, or they've been seen to be discussing things and a particular font was used and it was combined with a point in time.

Now, some clever people had worked out that the font that was being used in the communication was not available at that point in time. And so Engadget and a few other websites are running a font gate story around Calabri. Just to go off on a tangent, the whole something gate thing pisses me off. It was called the Watergate scandal because the hotel was called Watergate.

It wasn't the Water Hotel, then, that was the Watergate scandal. If that scandal happened again today, it would be Watergate gate. No, no, the funniest thing is— Not everything has to be gate as the scandal of the day. Come on.

Ben gate, phone gate. The funniest thing with Trump Jr. was—it's hilarious because Watergate involved reasonably smart people. What Trump Jr.

was doing now is like—it's kind of like—most people are saying, we're in an age where we can't even work out—this would be huge if it was a thing, right? But if it's not, it could not be a thing. We don't know whether it's a big thing or not. But the people involved are so stupid, are so bereft of any kind of intelligence at all, he just tweeted out— The reporter's waiting for this, and they're going, oh, goddammit, I was— I think it was a Washington Post journalist or someone who'd written for the Washington Post or something like that, went, I've been researching this for years, and he just tweeted it.

But anyway, moving back to Fontgate— Well, they didn't use Comic Sans, but they could have— No, they should have done. They should have done. Comic Sans has been around forever. So this was all part of the Panama Papers leak from a few years ago, which didn't really Nothing came of that.

No, not really. So the Prime Minister of Pakistan was implicated in the Panama Papers about owning overseas properties and hiding ownership and fraud and all the rest of that stuff. So his daughter submitted a document from 2006 to try and explain this away, but someone has determined that the font used in the document was Calabri, which was not available until 2007, therefore the document was written after they said it was written. Oops.

So it was submitted by Mariam Nawaz, who's the daughter of the Prime Minister Nawaz Sharif. So if this really hits the fan, then Pakistan is going to be Saan Sharif. That joke was done live. Thank you for predicting my joke.

That's gold. Font jokes, people. Font jokes. There aren't enough font jokes.

No, well, we had the time when I was in love with that programming font. I thought that was brilliant. But here we go, here's Calabri being used. Sometimes I'm dyslexic because there's actually a real estate agent who's Calibre.

And I always get Calibre and Calabri mixed up when I'm looking around. So why would you name a real estate agency after a font? But that's because I'm in IT, and often, you know, we see through the lens of our little computer screens. So yeah, I think it's quite interesting.

It's so... Imagine, like, did someone just read it and go, that's not the right font? Yeah, it's like... It doesn't make sense.

Or was it like one of those things where they had pages on the wall, they had push pins in the wall, strings between all the push pins. The forensics involved. A screenshot of Word 2007 with Calabri circled, you know, multiple times in big red ink. Screenshot through and they're unshaven, disheveled, they haven't eaten properly, pizza boxes all over the floor, the lights in the apartment are off, but the TV's on late at night, but it's just on static, and they're just staring at the wall.

And they're just forming an idea, and they're like, gotcha, Calabri. Again. She should have just used Ransom font. Ransom font is older than Calabri, and lots of people used Ransom font, particularly lots like Word 2.

She should have put it on a typewriter. Oh yeah, well, no, no, Ransom font does a Ransom font, you know, you can do that sort of thing these days. Or she could have just went with something a bit more interesting. Yeah, so it's kind of like that scene from, like, Naked Gun, where, you know, they've got the forensics guys coming in.

So it seems like it is possible to be caught out by just simply using the wrong font. So check your fonts. At the wrong time. So Steve, there seems to be an emergency in planet Earth.

I don't think it's a real one, apart from there's some gorgeous pictures at the moment coming back of Jupiter's red spot on JunoCam. But in World Science Today, there's a lot of talk about a huge iceberg breaking away from the Antarctica Larsen Seashelf. Now the discussion around this, the scientists have come out and said, no, no, no, no, this is quite a normal thing that goes on, and particularly down in the Antarctica, which is close to Australia, which we kind of identify with because at the moment it is freezing cold and we generally get Antarctic winds up this way that even cools sunny Queensland. But this particular piece of chunk of ice, it's a bit bigger than what you could put in your scotch or whiskey glass, but it does threaten shipping lanes and it does cause a hell of a lot of problems, and it is a large chunk of ice.

But it is not related to global warming, it's quite a normal thing. This is the discussion. Well, it sort of is and it isn't related. So this is the iceberg, well there's been a crack propagating through the Larsen Sea Ice Shelf in Antarctica for the last several years, last 10 or so years, but only in the last year or two it has rapidly accelerated towards the coast and in the last week has reached the coast and this iceberg, which is about either the size of Wales or a quarter of the size of Wales, has broken off from the Larsen Ice Shelf in Antarctica.

It's kind of on the big peninsula of Antarctica that reaches towards South America, if you can imagine that bit of Antarctica, on the eastern side of that peninsula. So it's broken away, so yes, things like this happen all the time. Icebergs break off, that's the whole point, because ice comes from behind it and pushes it off and eventually the weight over the water is such that it can no longer be supported and it breaks off. What's different about this one is the size, it's 5,800 square kilometres and weighs about a trillion tonnes.

So this is one of, if not the largest ever recorded iceberg that has ever broken off, at least in recorded history, from Antarctica and will drift away. And the actual drifting away is not a huge deal, it's big enough that they can track it. If it approaches any shipping lanes they'll be able to route around it. It'll be good for studying because they'll be able to study what happens in this kind of thing.

The potential issue that it might cause is it could be holding up the ice behind it. So with this having broken off now, the kind of break on the glacier behind it is removed and so there could be an acceleration of the remaining ice. Because the remaining ice is still on land, if that ice were to go into the water then the sea levels may rise. This is all may and could because no one actually knows what's going to happen for real.

There's a lot of variation in what could happen and how long it could happen and what will be the cause after it happens because ecosystems like this are very complex and it's very difficult to model which way it's going to drift, what's going to happen to the whole area around it and things like that. So the other thing is it's not necessarily 100% related to global warming although that doesn't help. So normally if icebergs break off due to global warming there's a lot more surface water. So there'll be literal creeks and streams and puddles on the surface of the iceberg if it breaks off due to melting which is not the case as far as I'm aware for this iceberg.

This isn't a crack that's propagated but it could be due to warmer water beneath it that's eating away any structure underneath it and certainly warmer water and warmer temperature in general is not helping the situation considering this is broken off in the middle of winter when the sea ice should be at maximum extent. So it is and it isn't related to global warming, it is and it isn't a problem, it is and it isn't a future issue. It's difficult to tell at this point, this has been known that this is going to happen for a while. The acceleration of this crack has been very rapid in the last year, it's basically taken ten years to get halfway and then two years to get the rest of the way.

So it's very rapidly accelerated cracking. So it remains to be seen what the future issues could cause and you'd have to see if the ice shelf just regrows in which case everything's all great but it could lead to further issues and then if the entire ice shelf collapses then that's a big issue but and they don't know how long that could be they say Professor Larkin says years or decades but who knows really if warming accelerates then who knows. I think yeah it's definitely the key to this. It's not a sky is falling event but it is interesting because it's the largest.

It is one more piece of evidence though because it's not not caused by global warming I think is the point. It's not, global warming is not the primary cause of this breaking off but it certainly doesn't help. Yes. So therefore stop burning goddamn coal.

The coal train get off the coal train coal train get your coal train. This week in Awesome I've been watching a bit more YouTube. The Unity conference has passed and they've since put up a lot of their presentations and you can go there and watch. The interesting thing about this conference that I found from watching the presentations was the amount, so if you're a .NET developer but if more specifically if you're a C sharp guy there's a lot more information here that you wouldn't think of that's being presented that you would learn about the C sharp language about core CLR or CLR in general performance tuning stuff like that and plenty of other bits and pieces that relate to to Unity.

But this is just another piece of evidence which is talking about rise of C sharp and how the Unity game engine is really pushing that. They are so into, when they say scripting what they really mean is using C sharp they then compile that down and port it around using their IELTS C++ tool set which has sort of had mild reception and works sort of okay, sort of bad. But they definitely are really pushing the platform along and it's a very interesting set of presentations and worthwhile watching if you're into performance tuning of C sharp in general. It's a great series of presentations to sit there and watch so I definitely recommend going and having a look at that.

I'll have some links and descriptions for the show notes as usual. Steve turning to a bit of media. It seems like the Ruckerboys which is, we spoke about them last week, they've got another release on YouTube at the moment. They seem to be releasing up there and putting out a video fairly regularly.

Previously we were talking about they had God. They've got a new one called Zygote and it's from Oats Studio and it's just the usual sci-fi style. The actual creature in it reminded me of a creature from a game a little while back. I won't spoil it.

Yeah, I know the one you're talking about. Yeah, and it does the same thing, I won't spoil it, but it does the same thing. We can't even say the game, the other game. I won't say, I'll just say the other game, but there is a...

No, you can't even say the other game. Because the other game is very obvious when you're talking about the game that we're talking about. Yeah, it looked, I just went, ah, they've copied that, surely. If you've played that game, you would know that, and Zygote, you'd know what we're talking about.

But we can't name either game. But the production value is so amazing and I can't work out why the hell these guys are doing it. And surely Freddie Wong. Shits and giggles.

Yeah, Freddie Wong and Node guys must be going, holy crap. That was, the girl in it was Dakota Fanning, if you realise. She of War of the Worlds, Screamy. Oh, yeah, everything Dakota Fanning, but they've got such great talent just wandering by.

Maybe it's just a way to get out of work actors working again, or in their skills craft. I think to get Brendan Fraser in the next one. Brendan Fraser could be in the next one. Bring him back.

I'm going too old for this shit, and shooting aliens and stuff. So yeah, that's sort of back on again. Nothing else much that I've been looking at this week, so it's been pretty, pretty slow. So Steve, if you want to send an encrypted message to the Space Welders, how would you go about doing it?

Just get yourself a certificate from any reputable certificate salesman online. I've got one here. I found it in the bin. Then head over to www.spacewelders.com, there you'll find the show notes for this and every other episode.

I think it's still usable. Sure. You can subscribe to the show, Stitcher, iTunes, and SoundCloud, SoundCloud possibly for not much longer. There's reports they have 50 days of money left.

Really? Yeah. Quick. Someone send them.

Quick. Download everything from SoundCloud. I got a fitty. You can follow us on Twitter, twitter.com, spacewelders, facebook.com, spacewelders.

Mike's on Twitter, twitter.com, michael-wise, I'm on Twitter, twitter.com, thescepticaldev. Make sure you check out our store. There's a link to it on the website. You can buy a t-shirt.

Mike sees you wearing a t-shirt, he'll buy you a beer. He will. If I see you wearing a t-shirt, I'll ignore you. He will.

You can also buy a sweet iron-on-sew-on badge thing to rock. Finally, questions, comments or feedback, email us info at spacewelders.com. So guys, thanks again for listening to us and keeping up to date with the Space Welders. We're trying to keep the episodes a bit more back to back, even though it's pretty much slow news at the moment.

We will endeavour to try and get some guests on when they're available, it's very difficult. And that's really about the news at the moment. I'm also considering changing over the website to a bit more of a newsfeed-y website, rather than a staticky podcast-y website. And just in case if our good friends at the Soonclude go down, then we'll have to think about what we're going to do about re-hosting and stuff, but I doubt they'll probably find some money.

It's under the couch. So a more friendly set of VCs will come in and then try and charge more money. What we're looking at is just having a news-based feed site, so people can contribute something akin to a forum. So we'll change the website over soon, I'll keep you updated and let you know how you can get involved if you want to do that.

If you want to do that in advance and you've got some ideas, let us know at infospacewelders.com Thanks for watching. It's Mike now. Steve out.