Chaos Computer Club - archive feed

Computing is riddled with security vulnerabilities, many of which arise from memory safety issues. Conventional hardware architectures and the C/C++ codebase are chronically prone to exploitable errors - a 75-year-old problem at the heart of computing. This talk will introduce CHERI, showing how (finally?!) we can do better. The CHERI research project has developed a new architecture+software approach, using unforgeable hardware capabilities to implement pointers. Morello is an Arm experimental platform for evaluation of CHERI to explore its potential for mass-market adoption, part-funded by the UKRI Digital Security by Design programme, and other groups are developing CHERI-enabled RISC-V processors, including Microsoft, Google, lowRISC, SCI Semiconductor, Codasip, and RISC-V International. This talk will introduce the problem, and CHERI and Morello, for a broad audience: the hardware extensions, their potential for fine-grained memory safety and software compartmentalisation, the CHERI software stack, and machine-checked mathematical proof that the architecture design provides the intended security. CHERI complements alternative high-level-language approaches, that would need code to be rewritten from scratch, and we'll talk about the often-low cost of porting code to CHERI. I'll demo how CHERI prevents exploitable memory safety errors on a Morello box, running Arm CHERI hardware and a complete CHERI software stack. This is joint work by the CHERI and Morello teams at the University of Cambridge, Arm, SRI International, and the University of Edinburgh. about this event: https://www.emfcamp.org/schedule/2024/87-cheri-and-arm-morello

A bit more than two years ago, someone contacted our Hackspace asking if we would be interested in an electronically defective, but probably repairable industrial coffee vending machine. An industrial coffee machine with a touchscreen and cocoa toppings? No idea where we would find enough room for it or if it would actually be used, but of course we'd be interested! After a few months of collecting (additional) dust and annoying a few members, we started the quest to get this machine back to work and to explore the (questionable) world of industrial coffee vending legacy, from hardware, over electronics to software architecture. This is a talk about how we repaired the machine, how these machines usually work, a dive into legacy software and electronics setups, and why those coffee vending machines taste like they do. Last but not least, we will discuss how we started to reverse engineer the internal system communication and if we would award a hackvalue of over 9000 for this type of machines. There is also the final question: does it run Doom? about this event: https://www.emfcamp.org/schedule/2024/254-unexpected-coffee-a-dive-into-industrial-coffee-machines

The Roman archaeological record is far from complete; There are hundreds of high status Roman buildings yet to be located in Britain. I was volunteering in the ambulance service during COVID when I was given a piece of Roman pottery by a patient. With no training (I later embarked on an Archaeology degree ), I started to carefully investigate and record what is now established as an enigmatic high-status Roman building - complete with mosaic, painted wall plaster and hypocaust. My talk will demonstrate some free Web-based tools that you can use to investigate your local landscape (LiDAR, etc.). It will also show you non-invasive ways to survey and record archaeological sites. Finally, I'll have some Roman artefacts to handle. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2024/146-how-i-found-a-roman-villa-or-temple

I recently released Downpour, an app that anyone can use to make little games on their phone. And before that I made Cheap Bots, Done Quick, a website that anyone could use to make a Twitterbot on their computer. And so unsurprisingly I am a big advocate of making creative tools - I love the feeling of seeing other people make cool stuff, and knowing that I enabled that to happen. In this talk, I'm going to talk about some design principles I've gathered from making these kinds of things, share some stories of people using them in ways I didn't expect, and generally try to persuade you that it's an interesting space that you might want to play in. about this event: https://www.emfcamp.org/schedule/2024/320-downpour-more-how-and-why-to-make-creative-tools

There are three things about this poem that will surprise you. First: though written 300 years ago, it contains superb guidance on being an engineer or maker of any kind. Second: you’ll immediately recognise some of its best lines. Third: its author was an indomitable twenty-three year old hunchbacked dwarf, who had educated himself due to religious persecution. I hope you’ll take away some maxims that’ll stick with you and inform your work. And if you’re someone who’s never ‘got’ poetry, this may be the poem that unlocks it for you. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2024/218-engineering-lessons-from-a-300-year-old-poem

Earlier this year, a developer was trying to benchmark a database. But something was wrong - SSH was taking up too much CPU time in the background. This accidental observation led to the discovery of an audacious attempt to introduce a backdoor that would allow an attacker access to almost any system in the world running SSH, an attack made up of both technical and social components. This talk will describe the backdoor itself, the process that went into it being possible to inject in the first place, and how this was exacerbated by a series of entirely reasonable decisions on the part of Linux distributions. It's a story of social engineering, novel obfuscation mechanisms, and a long con over several years. We'll delve into why distributions patch upstream code, why dependency chains are complicated, and how it's even possible for a compression library to break all the SSH security mechanisms that are intended to prevent this sort of thing from happening in the first place. about this event: https://www.emfcamp.org/schedule/2024/409-the-xz-backdoor-what-why-and-how

Short 10 minute talks on any topic about this event: https://www.emfcamp.org/schedule/2024/547-lightning-talks-friday

Get ready to take a trip into space. We'll be travelling 400km up to the International Space Station, to take a look at Earth through the lens of the Astro Pi computers that were sent there in 2020. This talk will focus on what has been learnt from years of giving young people the chance to take photos from the ISS using affordable commercial hardware. There will be plenty of the amazing images that have been captured so far, along with some examples of unexpected interruptions and the challenges when you can’t actually see or touch the equipment yourself. There will also be a chance for the audience to join in with an interactive game based on some of the photos. You'll need an Internet connected device to join in. Ground replicas of the actual hardware will also be on show and available for inspection. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2024/165-photobombed-by-a-robot-arm-in-space

With the speed of 400G coherent technology was introduced to pluggable optical transceivers (OIF 400ZR and OpenZR+). This technology is complex and powerful for your network, it even has influence on your network device operating system. This talk will provide first insight in Nokia's implementation as well as known or potential interoperability issues addressed by the OIForum. If your transport system, router or even switch already provides coherent pluggable transceivers check the available interface parameters. You can send me these CLI outputs / management software screenshots to [email protected]. I will try to include it into the presentation. And finally new formfactors for 800G and 1,6T will be part of the game as well. Stay tuned.... about this event: https://cfp.gulas.ch/gpn22/talk/8TKX7Q/

You become aware of a security vulnerability affecting your Go program(s)! What now? This talk tries to answer that question for various common scenarios, explaining the roles of the various technologies and services (like the Go Module Proxy or Go Checksum Database). The recent xz vulnerability brought the topic of Supply Chain Security to everyone’s attention. I don’t have a solution for preventing the social engineering aspect of the vulnerability. So let’s focus on the part we can control: assuming it has happened, what does our incident response look like? Aside from the more general details about Go, we’ll look at the gokrazy system as a concrete case study in Supply Chain Minimalism (Linux kernel + Go) and how it can be used for sensitive use-cases. about this event: https://cfp.gulas.ch/gpn22/talk/WY37UN/

Federated Learning (FL) offers a privacy-preserving machine learning method by enabling collaborative model training across multiple clients without data sharing, securing sensitive information at its source. This talk explores Machine Learning applications and how to keep them secure, for example in critical sectors like healthcare. Collaborative learning, and in particular Federated Learning (FL) is a Machine Learning approach in which multiple clients collaboratively train a Neural Network model on their private data without the need to share the data. This strategy guarantees that data stays in its initial location, never being disclosed to external entities. This talk, will cover an introduction on how FL is used and its advantages when supporting secured data collaboration projects for example in environments like health care, where it is not possible to publish patient data for Machine Learning purposes. We will focus on the security perspective of Machine Learning and privacy attacks and defenses in those systems. This introduction draws upon the teachings of a course conducted by Phillip Rieger from System Security Lab at TU Darmstadt. about this event: https://cfp.gulas.ch/gpn22/talk/8MNJ9B/

This talk is about our delight, awe and fear of electricity and its effects on the human body. It charts our changing relationship with it from the 18th century to today. I particularly love the 18th century gentlemen scientists with their electrical entertainments - particularly because they appreciated the magic of electriocity and were so excited by it. Its sad that people today just take electricity for granted. Over the years I've accumulated a collection of contemporary images which I'll use to illustrate the talk. It may include a few demonstations as well. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2024/318-a-short-history-of-electric-shocks

Pulling a shot of espresso sounds so simple - just pump some water through a bed of coffee grounds. But while it sounds simple, many things can go wrong. What ends up in the cup can too easily end up bitter, sour, watery, chalky, harsh, or flat. So how can you be an espresso alchemist, and convert your bitter shots into gold? In this talk, I'll cover the anatomy of what goes on during coffee extraction, and the problems that can lead to bad flavoured coffee. I'll also give a whirlwind tour of the different coffee machines, equipment, and hacks that are designed to make better espresso - both the high-value gadets and the duds. You'll learn how to 'dial in' a shot to prevent it being too sour or bitter, and what steps you can take to maximise deliciousness! about this event: https://www.emfcamp.org/schedule/2024/133-the-coffee-fix-why-its-so-hard-to-pull-a-great-espresso

After accidentally becoming fluent in Morse Code I have waded through a sea of dots and dashes to find THE best word in Morse Code (ok, maybe its just my personal favourite - but I have reasons to back it up!) Of course, as a mathematician, I couldn't leave it there and have also determined what I believe to be the best number in Morse Code too. From steganography to lexical anomalies we explore the delights of this not exactly binary alphabet. You may not have time to learn all of Morse Code, so come and learn the singular most awesome word in Morse instead! Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2024/294-the-best-word-in-morse-code

In a world where large language models like GPT and Gemini are becoming more and more ubiquitous, what does this mean for comedy? If computers getting things obviously wrong is a factor in their comedy value, do the improvements in generative AI take us into an uncanny valley where the outputs are realistic enough to no longer be funny? Join our presenters as they each argue the case for one side of the battle between generations from large language models, vs. more naive generation approaches. We’ll explore what makes comedy funny at all, and then drill deeper into why we find content generated by computers so hilarious - often when it’s not trying to be! Throughout the talk we’ll give some examples of humorous computer generated content from past projects - intentional or otherwise. Learn why you shouldn’t join us for dinner when the recipes are auto-generated; see how we abuse state-of-the-art AI safety techniques to make LLMs funnier; and join for a group singalong for some live-generated parody karaoke. about this event: https://www.emfcamp.org/schedule/2024/169-from-haunted-karaoke-to-the-humour-feature

This talk will be a quick look into the methods of psychological manipulation that games and chore apps use make your sessions with them longer and get you to come back regulary. Ever wondered why you just can't put your game down, even though you know you should already be sleeping? Were you terrible at learning languages in school but suddenly excel at it using Duolingo? The reasons for both are probably the same. I will to go into the manipulation strategies that games and chore apps alike utilise and compare them to user hostile design patterns, that I have already talked about in the past. This talk will not tell you how to feel about these tricks, but it will hopefully provide you with the knowledge you need to detect them and make more conscious decisions on if you want to let them work on you. about this event: https://cfp.gulas.ch/gpn22/talk/S3HXXG/

Over the past five decades, the concert & live event industry has undergone a dramatic transformation into a major sector of the economy, with the production playing a pivotal role. Artists and their shows constantly seek the latest lighting & video technology, intricate stage setups, and top-notch audio quality to dazzle fans. Ticket sales are a major revenue stream for Artists, and a high-quality production show, sells tickets. This high level of production is only possible because of an industry full of talented roadies. Behind every arena or stadium show lies a hundreads of engineers tirelessly setting up, operating, and dismantling these elaborate stage setups, often in a new venue, on a daily basis. Long gone are the days of makeshift equipment cobbled together, roadies now navigate highly sophisticated AV control systems supported by intricate network infrastructures. A vast array of specialised hardware caters specifically to live events, engineered to be both flexible for on-the-fly adjustments and durable for daily setup and teardown. Reliability is paramount, with equipment expected to perform flawlessly show after show, never missing a beat. In this talk we are going to take an overview into the world of live event production, shedding light on how roadies consistently deliver stellar performances day in and day out. We'll explore the intricacies of AV networks, offering an insightful overview of the behind-the-scenes magic that brings unforgettable concerts to life. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2024/450-how-roadies-became-network-engineers

This talk is about RFID/NFC-based payment systems that are often seen in university mensas or company canteens. You typically pay with the student ID card or you employee badge, which is preloaded with money or linked to you monthly salary. The security of some of these systems is severely broken due to the usage of old and insecure RFID/NFC technologies. We will learn some basics about those insecure RFID/NFC technologies and hear stories of broken systems I've analyzed in the past. about this event: https://cfp.gulas.ch/gpn22/talk/VZFLQB/

Welche geheimnisvolle Zutat macht eigentlich einen Haufen elektrischer Bauteile zu einem Computer? Und geht das auch mit unter 1.000.000.000 Transistoren, womöglich sogar für normalsterbliche Menschen verständlich? In diesem Vortrag beantworte ich diese Frage auf ganz praktische Weise: Ich stelle einen selbstgebauten, modularen Relais-Prozessor vor, der (hoffentlich) einfach genug ist, ihn vollständig zu verstehen. Klick-klack auf der Bühne inklusive. Prozessoren sind furchtbar kompliziert. Kein Wunder bei dem, was wir alles von ihnen erwarten, und dann auch noch mehrere Milliarden mal pro Sekunde. Da ist es verständlich, dass sie auf den ersten, und auch auf viele folgende Blicke, absolut unergründlich und quasi magisch erscheinen. Dabei gehört gar nicht so viel dazu, Strom zum Rechnen zu bringen. Schon aus gut 100 Relais lässt sich ein ganz einfacher Prozessor bauen, der dann klein genug ist um ihn vollständig zu verstehen. Einen solchen Prozessor habe ich entwickelt und möchte ihn in diesem Vortrag vorstellen. Es wird um drei Themen gehen: * Welche Grundbausteine brauchen wir, und wie passen sie zusammen? * Wie verschalten wir sie so, dass sie nützliche Instruktionen ausführen können? * Wie kann der Maschinencode Programmierung und Elektronik verbinden? Für den Vortrag sind nur Grundkenntnisse erforderlich. Wer weiß, dass Strom durch Kabel läuft, und dass Computer Befehle ausführen, sollte folgen können. Link zum Projekt: https://github.com/fread/visvitalis about this event: https://cfp.gulas.ch/gpn22/talk/GK8WNE/

Using a fad of the 2010s and the UK's most popular river dweller the Leeds hackspace has combined 2 hoverboard wheels with a shopping trolley to create a monstrosity. Armed with a PA system, rally lights, under glow and 2 car horns it’s the perfect centre of chaos for protests or your ALDI shop. During our presentation, we invite the audience to delve into the fascinating world of motorising random objects and the art of upcycling, along with the myriad challenges we encountered along the way. From designing our own lithium-polymer batteries to countless iterations and rigorous testing, we'll discuss the intricacies of dealing with electromagnetic interference, experimenting with various motor controllers, and even designing our own from scratch. We want people to experience the shenanigans we went through and the fun we had along the way to hopefully get more people into whacky-wheeled…..wehicles. But it's not all talk! We're excited to demonstrate the trolley live, allowing you to experience first-hand the joy and sheer mayhem it brings. Our goal is to inspire you to embark on your own wacky-wheeled adventures, learning from our missteps and benefiting from our advice and tips. No Project is ever truly done lastly we want to look into the future: The intended use cases and how we aim to share our knowledge and plans with the wider community. Our commitment to openness and collaboration means that anyone bold enough to motorise anything around them can benefit from our experiences and insights. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2024/421-remote-controlled-chaos-cart-how-to-motorise-trash

A rare live two way link with the Boulby Underground Laboratory, where the Boulby team will give us a tour of the underground facilities that include a Mars Yard, where real (and LEGO) Mars rovers are tested, multiple Dark Matter research experiments, understanding the radioactivity of substances and more! Have any questions you want answered? Email them to [email protected] Boulby is one of just a select few facilities in the world suitable for hosting ultra-low background and deep underground science projects. It is a special place for science, 'a quiet place in the Universe', where studies can be carried out almost entirely free of interference from natural background radiation. It also provides access & support for studies of the geologically interesting deep underground environment. We are employees of the Science and Technology Facilities Council, the UKRI research council that runs the facility. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2024/282-live-tour-of-the-boulby-underground-laboratory

This is a talk about how we combined textiles, electronics and storytelling to provide a platform for people to share experiences. For this project, we wanted to explore more the findings of previous research around the guilt mothers feel when feeding their babies, but in a more creative way. Coming at the project from 3 very different points of expertise, we worked with mums to design and make a touch interactive quilt. We asked mothers of young babies to describe their emotions around feeding, a topic often emotional and controversial, and send a voice clip along with a piece of their baby’s clothing which we stitched together to create a special interactive quilt. The quilt is embedded with electronic touch sensors which activate the clips when the metal buttons of the clothes are touched. By interacting with them you can hear the stories through headphones. All this results in a very intimate and emotional experience that provides a platform for visibility and understanding and we think is a great conversation starter to share stories and create community. The talk will include a timeline of how we created a digitally augmented quilt, and a few thoughts if you want to make one too. It will also include some of our own reflections when working on a project that brings up difficult emotions and sensitive topics. about this event: https://www.emfcamp.org/schedule/2024/34-mothers-g-q-uilt

Combining his deep interest in the biology of hair with generative music systems, Chris will give you a an insight into how he has brought the two fields together. After a chance introduction to an Austrailian biology student in 2022, Chris and Jay have spent the last few years researching the mechanics of hair growth, the structures of Amino Acids and Keratins and the composition of different parts of human hair. They used this research to develop a suite of software tools that use these bio-mechanics as a structure for creating music. Chris will cover: - the biology of hair - generative music systems - implementation in Max/MSP and Ableton Live The talk will end with a brand new piece of music created from a single strand of hair. about this event: https://www.emfcamp.org/schedule/2024/202-making-music-with-hair

Always thought it was expensive to receive signals from Space? In this talk I will go through the simple homebrew antennas and cheap (around £10) receivers that you can use to get such diverse things as weather satellite images, pictures from the ISS, receive telemetry from the orbiting CubeSats, and even begin communicating with the first Amateur Geosynchronous Satellite, QO-100 where you can receive TV pictures from amateurs across the world with a rust old satellite dish and a cheap LNB. It is amazing what you can do with a piece of bent water pipe or a coat hanger! Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2024/130-working-amateur-satellites-on-a-budget

Internet search results were a toxic hellstew of ads, SEO spam, content farms and misinformation/disinformation even before the arrival of Large Language Models like ChatGPT in 2023. In 2024 nearly half the world’s population votes in elections that will have consequential impacts for key issues like climate change and civil rights, and it’s more important than ever before that search results can be relied upon. This talk will highlight a few ways to put search back in the service of the searcher rather than a handful of global megacorps. We’ll time-travel 30 years to the Internet’s Cambrian Explosion period, before Lycos, AltaVista and BackRub/PageRank, and look how technologies like Really Simple Syndication (RSS) and open source self-hosted meta-search engines like SearXNG can help. And then, demo gods permitting, I’ll show you how this can all come together to put a search engine in every pocket. about this event: https://www.emfcamp.org/schedule/2024/13-lets-party-like-its-1994

Die Bezahlkarte für Geflüchtete kommt. Wir haben uns die drei weitverbreitesten Anbieter der Bezahlkarten genauer angeschaut. Im Rahmen des Vortrages werden Datenschutz- und IT-Sicherheitsmängel in Bezahlkarten-Apps und Webapplikationen für Geflüchtete genauer beschrieben. Durch Meldungen im Rahmen von Responsible Disclosure-Verfahren konnten zahlreiche Mängel im Bereich Datenschutz und IT-Sicherheit verantwortlich aufgedeckt und behoben werden. Nach mehrmonatiger Debatte hat die Ampel-Koalition eine Einigung im Rahmen der sogenannten „Bezahlkarte für Geflüchtete“ erzielt und am 12.04.2024 im Bundestag eine Rechtsgrundlage für die bundeseinheitliche Bezahlkarte für Asylbewerber und Geflüchtete beschlossen. Durch eine Änderung des Asylbewerberleistungsgesetzes soll es zukünftig möglich sein, Leistungen über eine sogenannte Bezahlkarte an Asylbewerber zu vergeben. Die Bezahlkarte ist eine guthabenbasierte Karte mit Debit-Funktion. Einige Gemeinden, Städte und Bundesländer haben bereits vorab Lösungen in dem Bereich eingeführt oder Pilotprojekte durchgeführt. Die Lösungen stammen dabei von verschiedenen Anbietern. Neben einer physischen Karte ist für Asylsuchende ebenfalls die Nutzung einer virtuellen Bezahlkarte im Rahmen von Wallet-Apps möglich. Die Bezahlkarte wird dabei innerhalb einer App auf dem Smartphone gespeichert und kann mittels „mobile Payment“ genutzt werden. Im Rahmen des Vortrages werden Datenschutz- und IT-Sicherheitsmängel in Bezahlkarten-Apps für Geflüchtete genauer beschrieben. about this event: https://cfp.gulas.ch/gpn22/talk/RAMYBJ/

Type theory is the secret sauce that makes a programming language awesome. The more knowledge we can make the compiler aware of, the more we can rely on the compiler. But what is the limit? What if we could take _make bad state unrepresentable_ to the mathematical extreme? What is a proof anyway, can you eat it? Come on a wonderful journey into the land of dependent types, where we try building type-safe SQL queries, and sweeten the deal with our own syntactic sugar. I give a compressed intro and overview of Lean 4, a purely functional, dependently typed programming language and interactive theorem prover. Knowledge of purely functional languages is *not* required. 1. We start from zero. Introduction to Lean 4 syntax, side-by-side with Rust. Sum and product types, `List`, some easy intro examples. 2. _Dependent types_: Example of `Vec`, i.e. lists with statically known length. Dependent pattern matching. 3. _Propositions-as-types_: You can have logical `And` and `Or` in Rust, too! But how do you model forall quantifiers? How do you model `x <= y` in the type system? 4. Playing around with _types as first-class objects_, using heterogenous lists and projections on them as example. You can't pattern match on types themselves, or... can you? 5. _Metaprogramming_: Custom syntax, custom elaborators. Using what we learned to make type-safe SQL queries work, such as (note the absence of string quotes): ``` let dragons : Table Dragon := [...here be dragons...] let dragons2 : Table ?huh? := SELECT name, coins FROM dragons ``` Code samples from slides: https://gist.github.com/Kiiyya/5566f09b2d1af6aa0d85ba01179dcfdb about this event: https://cfp.gulas.ch/gpn22/talk/WWMGVN/

Many people rely on pollen forecasts to know when their allergies are likely to cause trouble. So when the main source of them in Finland scaled back after losing funding, a replacement was needed. Hear about the process of starting at zero knowledge of pollen forecasting, discovering the available models and data, and putting it together to get 3-day forecasts for any location in Europe, as a hobbyist with some help from the Finnish Meteorological Institute. Includes learning about atmospheric science, academic data, coordinate projections, Rust and more. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2024/414-fighting-allergies-with-pollen-forecasting