Fefes Blog

I love https://blog.fefe.de/ A German hackers blog, he wrote the webserver behind it himself. The styling is as brutalist as it gets. And it just works. This is my goto "do I have access to the internet"-website because it is so damn fast.

As its about a 37c3 presentation here a comment from Fefe¹ in German https://blog.fefe.de/?ts=9b729398 According to him the exploit chain was likely worth in the region of a 8-digit dollar value. ¹ https://en.wikipedia.org/wiki/Felix_von_Leitner I guess somebody is going to get fired.

But all the things you mentioned are optional. The web is amazingly backwards compatible. Best example: one of Germany's most read blogs: https://blog.fefe.de

> Any blog IMO should have a minimalist design. You want to draw attention to the content and present it as plainly and with as little visual clutter as possible. There is a German blog who hit "minimalist" rather well. http://blog.fefe.de/ Tbh, I prefer this kind of representation not just when it comes to blogs. Hackernews is another great example for "less is more".

Eeyup. A 2009 version is archived at https://erdgeist.org/cvsweb/Fefe/blog/blog.c The best part is that where stores his posts. SQL? Nope. NoSQL? Nope. Plain text files? Nope. Fucking LDAP. [1] [1] Source: http://blog.fefe.de/?ts=a8d61c27

I read a great reader comment on the topic (also in German so try DeepL) https://blog.fefe.de/?ts=9cb54d35 Its a political push and pull about who defaults on the existing contracts on gas import, seeing as Russia wants to be payed in ruble now, while Germany would prefer the payments to be stuck on a EU bank account as a form of reparation payments to the Ukraine. To prevent this outcome, Russia in effect might be liquidating the Gazprom Germania. With Gazprom Germania being the ones doing the actual importing. Over the last weekend there was a change in ownership of the Gazprom Germania to new unknown owners. So they might be already bankrupt. To prevent this, Germany is now seizing control of Gazprom Germania and might be on the hook to prevent an insolvency to not default on the contracts with Russia. In short, the German government fucked up majorly. edit: Check "throwhow"s post in this thread for a longer summary

To quote Felix von Leitner (https://blog.fefe.de/?ts=a7666dad): > You cannot solve social problems by using technology. And when you do try to do so, it quickly gets nasty. Just look at the #Shadowban scandal on Twitter. You will need humans in the loop, and they need to be well-trained, in order to actually recognize images such as the famous Vietnam napalm girl, which FB banned for "nudity" until huge public shitstorm, and well-paid and well-"maintained" in psychological terms, given that they will see the nastiest content on the web... everything from child porn over gore to livestreams of rapes and murders. But, to be honest: this should not be done by the sites themselves - the best solution is an "ombudsman", an independent institution maintained by the state but financed by the social networks. This prevents "overcensoring" (aka that the moderators don't delete too much content that's legit out of the fear they might be hit with costly punishments), and having them mandatory financed by the "big players" prevents them from systematically understaffing or exploiting the workers. Also, they will need to have a proper appeal process: both for content creators whose work has been inappropriately taken down, and for users who believe that the content in question is, in fact, illegitimate. Also, the sites must be regulated as public utilities given their importance to people's communications. For example, my phone provider is not allowed to terminate me, only if I…

I sincerely doubt that. Please remember that the engine control software is already there, doing exactly the same thing in normal operation: adjusting the engine settings to produce optimal results for the current driving situation. For example, the mix should certainly be different when the car is stationary (sitting at an intersection), than when accelerating or going full throttle. There is nothing underhanded about this, quite the contrary, it is a Good Thing™. Once you have knobs to turn, the temptation to turn them just a little too far is always great, especially if you have conflicting goals. On the one hand, you are supposed to reduce CO2 emissions, which having great mileage does, on the other hand you are supposed to reduce NOX emissions. So you fiddle. And car companies have always fiddled with any knob they could to get performance and always pushed it as far as they could. For example, this particular problem has been known for some time and was tolerated, see http://www.welt.de/politik/deutschland/article146711288/Die-Bundesregi… or http://blog.fefe.de/?ts=ab029b73 (German). Furthermore, manipulating the catalytic converters has also been long-standing industry practice, I found a Toyota forum post complaining about the practice from 2003, also in German: http://www.toyota-forum.de/threads/kat-schaltet-unter-vollast-aus.2791… However, I remember those discussions from the late 80ies and early 90ies. So if…

"Of course, this is still just guessing about the NSA's capabilities. As it turns out, the newer Elliptical keys may turn out to be relatively easier to crack than people thought, meaning that the older software may in fact be more secure. But since 1024 bit RSA/DH has been the most popular SSL encryption for the past decade, I'd assume that it's that, rather than curves, that the NSA is best at cracking." So it is suggested to update to a newer version that uses EC, but we are not sure if EC is not breakable? Others ([1], [2]) suggest that RSA is more secure than EC!? I wish that the security experts could give "clear" advise. EDIT: Added proper links to sources suggesting RSA over EC. [1] Bruce Schneider in http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-… "Prefer symmetric cryptography over public-key cryptography. Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can." [2] Fefe (it's in German) http://blog.fefe.de/?ts=acd52294

Fefe is by no means "most Europeans", though he is quite well known as a ("political nerd") blogger in Germany. His comment on the matter, however, is less that of pointing and laughing and more that of worry, especially considering that there were some mild(er/ish) issues along similar lines in the wake of the 29C3. As a quick and dirty(!) translation of this blog post: http://blog.fefe.de/?ts=afb76b8d "The 'sexual harassment'-story at US computer conferences is escalating further. This has poisened the climate to a degree where I fear the sentiment towards women is shifting from 'great, we need more [of them]' towards 'risk, risk, stay away, better not to say anything'. Smaller cons might possibly not admit women anymore [in the future], just to avoid being subject to such risks. This is all very unfortunate [or: distressing/regrettable]. (Thanks, Michael)" Everything in square brackets '[' & ']' serves as clarification.

The blog is fine, it just looks like he didn't foresee that there would be a month where wouldn't post anything, so the navigation links break down. If you go to the last month he posted in, everything works as usual: http://blog.fefe.de/?mon=202505

There was actually a one-time post in December as well http://blog.fefe.de/?mon=202512

He actually made a blogpost on December 6th regarding Warner Bros & Netflix but it's kinda weird: http://blog.fefe.de/?ts=97cd29cd Seems like he still needs a lot of time to recover.

> Holy hell, I had missed that post Here it is: > http://blog.fefe.de/?mon=202512 (note that https currently does not work).

Historically, it was a rather famous page. It's a watchblog by the German security expert Felix Von Leitner. It exists since 2005, but since May this year, he didn't write anything until one new entry that you can see here: http://blog.fefe.de/?mon=202512

He authored https://blog.fefe.de without interruption for years. Blog is empty since weeks.

According to [1], 3/4 came from renewables during the re-startup. Most of today's inverters are black-start ready. That is, they don't require external energy to startup, unlike nuclear, which is heavy, costly, and slow. German readers may find fefe interesting here [2]. He debunks many of these myths. [1]: https://www.spiegel.de/wissenschaft/stromversorgung-in-spanien-und-por… [2]: https://blog.fefe.de/?ts=96ee73ea

I like this explanation[1]: We live in a simulation where crypto became popular. All those hash function evaluations can't be approximated by the simulation engine, unlike most other natural phenomena, and so our reality uses up more compute than it was allocated. The renderer compensates by removing the most distant objects. It's a cosmic renice. [1] https://blog.fefe.de/?ts=a308f88d

(Some in) the Greifswald team seem to estimate that it takes ~€20bn for a commercial deployment based on Wendelstein 7-X (according to a blogger who went there to ask: https://blog.fefe.de/?ts=9a9561ab)

Here is Fefe's blog entry about filing this bug: https://blog.fefe.de/?ts=bb5517a4 > Update: Here's the bug, and as you can see, the gcc guy who's to blame for the problem (he admits as much in the other piece of code) thinks that's fine if people get outed because he can justify an optimization in formal legal terms. Sick. Makes you wonder what you're actually doing audits for if you're then torpedoed like this. Oh, by the way: with icc (the Intel compiler) you get an assertion correctly. (translation by DeepL)

A source (German) attributed to the Max Planck Institute for Solid State Research thinks the paper is bogus [0] [0] https://blog.fefe.de/?ts=9a3f8740

> Has there been any commentary on that? German, but nevertheless: http://blog.fefe.de/?ts=9a3f8740 "I work in the field [...] we don't believe a word of this. [...] The data set in Fig. 4(b) is also a treat. It is VERY unusual when the heat capacity decreases again at high temperatures. This can happen at low temperatures, but not at high temperatures. [...] My personal assumption is that the authors measured an insulator, so no current flow and therefore no voltage occurred (4-point measurement). This would look like a superconductor. But if you then turn up the current (i.e. the applied voltage), breakdowns may occur and a current begins to flow. That would explain the sharp increase."

You could also link to the original source (in German): https://blog.fefe.de/?ts=9cb54d35

> The decision comes as Europeans grapple with record-high power bills, driven in large part by a gas supply shortage. an artificial shortage made by private investors. the russians are selling the gas as per contract, but because it is cheaper than what you can get on the spot market, some idiots are making a quick buck by selling the cheap gas for the spot market price. well, something like that https://blog.fefe.de/?ts=9fb268bf

One thing I, personally, find very interesting is that a lot of wording from the coalition contract on this and related matters is apparently taken from or at least based on [0] a document [1] released by the CCC for that very purpose. I haven't personally carefully verified this to be true, but I have no reason to distrust the linked report. [0] https://blog.fefe.de/?ts=9f60b12e [1] https://www.ccc.de/de/updates/2021/ccc-formulierungshilfe-regierungspr… (both in German)

What's interesting is that in the weeks leading up to the agenda, the Chaos Communication Club put up their own demands written like a digital agenda, essentially prewritten rules. And it turns out that the new agenda includes many of these rules! See https://blog.fefe.de/?ts=9f60b12e Things like companies being legally responsible for security holes in their products, a right to encryption, open standards in government bodies, no 'hackbacks' from German security agencies, software updates and replacement parts need to be available for the lifetime of a product, all these things in the new government's agenda seem to come from the CCC. Lobbbying works! English auto-translation of the CCC's demands: https://www-ccc-de.translate.goog/de/updates/2021/ccc-formulierungshil…

I like this one a lot: https://blog.fefe.de/ It's in german, but has a nice mix of political and technical topics

https://blog.fefe.de/ (in German, about software security, politics etc.) I like the design a lot.

Thank Fefe for that: https://blog.fefe.de/?ts=9e9221ad (second update in posting, completely in german) Coincidence or bad press covfefe? ;)

Here are some notes on the paper's authenticity (in German): https://blog.fefe.de/?ts=9ec00c82 Amusingly, at the bottom of the page, it states “Proudly made without PHP, Java, Perl, MySQL and Postgres”.