2.0 -//Pentabarf//Schedule//EN PUBLISH K8FAFL@@pretalx.c3voc.de -K8FAFL Opening Event en en 20221227T110000 20221227T113000 003000 Opening Event The opening event of this event. PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/K8FAFL/ HIP - Track 1 - Room 5 Mitch mc.fly PUBLISH EAXPTT@@pretalx.c3voc.de -EAXPTT Crushed by the Wheels Industry en en 20221227T113000 20221227T123000 010000 Crushed by the Wheels Industry Semiconductor fabrication has been in the news a lot lately, not only because of the US government pulling the reigns down on American companies providing know-how and services to China. The actual manufacturing technology is controlled by a rather small playing field of companies. When it comes to software and IT architecture, some of them are stuck in the mid-90s, while others have apparently had some wake-up calls. Security wise, the field is equally heterogeneous, but the manufacturers who are clearly oblivious to any security requirements greatly outnumber those with more solid precautions. With average run times of machines and their software of 15-20 years the consequences can be drastic. We'll look at the state of things (with partially anonymized examples) , and some perspectives for the future. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/EAXPTT/ HIP - Track 1 - Room 5 pandzillophon PUBLISH V7UFTL@@pretalx.c3voc.de -V7UFTL Hide and seek ‒ über die Biometrie-Datenbank des US-Militärs de de 20221227T130000 20221227T140000 010000 Hide and seek ‒ über die Biometrie-Datenbank des US-Militärs Mitte April 2021 kündigte Joe Biden den Abzug der US-Truppen aus Afghanistan an. Kurz darauf beschloss der NATO-Rat den vollständigen Abzug aus Afghanistan. Der eigentliche Abzug erfolgte überstürzt, parallel zu einem Rückeroberungsfeldzug der Taliban. Im Rahmen des Abzugs blieben nicht nur Ortskräfte, welche sich auf Grund der Zusammenarbeit mit den NATO-Staaten in Lebensgefahr befanden, zurück. Alleine die USA ließen militärische Ausrüstung [im Wert von circa sieben Millarden US Dollar zurück](https://www.forbes.com/sites/zacharysmith/2022/04/27/us-left-7-billion-in-military-hardware-in-afghanistan-as-taliban-took-over-dod-reportedly-finds). Darunter befanden sich auch [Geräte zur Erfassung biometrischer Daten](https://theintercept.com/2021/08/17/afghanistan-taliban-military-biometrics/). Diese Geräte wurden sowohl zur biometrischen Erfassung des lokalen Personals, als auch für Grenz- und Übergangskontrollen verwendet. Der Einsatz von Biometrie-Geräten durch Militärs ist schon seit Jahren bekannt. Zu den eingesetzten Geräten sind erstaunlich detaillierte Informationen frei im Internet verfügbar. Nicht nur das US-Militär setzt solche Systeme ein. Auch Deutschland gehört zu den Nutzer-Staaten und übermittelte sogar biometrische Daten an die Amerikaner, wie aus einem geheimen, [auf Wikileaks veröffentlichten Memorandum of Understanding](https://wikileaks.org/bnd-inquiry/docs/BMVg/MAT%20A%20BMVg-1-1/MAT_A_BMVg-1-1d-8.pdf) hervorgeht. Was aus den öffentlich verfügbaren Daten nicht ersichtlich wird, ist, welche Sicherheitsmechanismen zum Schutz der hochsensiblen biometrischen Daten auf diesen Geräten zum Einsatz kommen. [Da das US-Militär selbst vor der Gefahr solcher biometrischen Datenbanken warnt](https://www.wired.com/2007/08/also-two-thirds/), haben wir ein besonders hohes Schutzniveau erwartet. Wir hatten die Möglichkeit verschiedene Geräte des US-Militärs zu untersuchen. Bei der Untersuchung wurde schnell klar, dass auf den Geräten selbst keinerlei Sicherheitsmechanismen implementiert wurden. Die potenziellen Konsequenzen dieses Verzichts auf Absicherung wurden noch (un)fassbarer, als wir auf einem der Geräte eine Datenbank mit einer großen Menge sensibler Daten rekonstruieren konnten. Die Tatsache, dass höchstwahrscheinlich unveränderbare biometrische Daten besonders vulnerabler Personen ungesichert in einem Konfliktgebiet zurückgelassen wurden, zeigt einmal mehr deutlich die Gefahren biometrischer Datenbanken. Content Notice: Militär, Krieg, Überwachung PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/V7UFTL/ HIP - Track 1 - Room 5 kantorkel Starbug snoopy PUBLISH EJYKY7@@pretalx.c3voc.de -EJYKY7 IT Security: a game of counting the negatives, but can we do better? en en 20221227T150000 20221227T154500 004500 IT Security: a game of counting the negatives, but can we do better? IT security, just like safety, has been focusing on the negatives, trying to learn from the times when things failed. Hence, we have become experts at counting the negatives, at finding all the holes. Because we rightfully fear failure, we have put more and more constraints on our systems through policies and guidelines and ways of working that constrain how they can be built and operated to avoid all the holes we have found. However, we tend to forget that the vast majority of the times, things go well. In fact, often they go well despite all the constraints we have put on the systems. Are we missing important learning opportunities by ignoring how things go well? In this talk, I will try to demonstrate how we could bring what safety literature calls "Safety II" or "Safety Differently" into the practice of IT security. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/EJYKY7/ HIP - Track 1 - Room 5 Mate Soos PUBLISH LUEPLZ@@pretalx.c3voc.de -LUEPLZ 50 years of C, the good, the bad and the ugly en en 20221227T160000 20221227T165500 005500 50 years of C, the good, the bad and the ugly The C programming language first appeared in 1972 and became enormously popular. It has this magical combination of features that allows developers to quickly write portable code that can be reused and easily ported to different architectures. It has been the foundation of most operating systems and systems programming in the past 50 years. In this presentation, I explore its history, why it's been so popular and what its drawbacks are. And there are many drawbacks. Even so, for the past 50 years we've put up with them, because the language is just so incredibly powerful and useful. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/LUEPLZ/ HIP - Track 1 - Room 5 Ilja van Sprundel PUBLISH JYX7JA@@pretalx.c3voc.de -JYX7JA US government demands direct police access to European biometric data en en 20221227T183000 20221227T191500 004500 US government demands direct police access to European biometric data Visa-free entry to the United States is to be tied to a new rule. Authorities of the US Department of Homeland Security want in return permission to search for fingerprints and facial images in the databases of the countries concerned. The demand is of utmost political importance, because in Germany alone this would affect several million facial images and fingerprints in police and asylum databases. There are now questions in Brussels about the EU's competence. From a legal point of view, are these bilateral agreements between individual states and the government in Washington, or is the EU-US visa regime as a whole affected, for which the EU Commission must ensure equal treatment of all members? At least three EU states are said to have already unilaterally agreed, also Israel and Great Britain. How should digital civil society react to this unprecedented generosity for extremely sensitive data? PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/JYX7JA/ HIP - Track 1 - Room 5 Matthias Monroy PUBLISH YYQ7DK@@pretalx.c3voc.de -YYQ7DK Update on Kubernetes Security in Critical Infrastructure en en 20221227T194500 20221227T204500 010000 Update on Kubernetes Security in Critical Infrastructure Cloud native technology has made its way into critical infrastructure. Controlling transmission grids, energy stock exchanges and in the future government applications gets closer and closer to the way how the big providers are running applications in their public cloud. However, for security reasons expressed in regulation and standards require air gapped environments. The talks describes the architecture of applications designed for this kind of environments, how they are developed and updated and secured. The author discusses regulations, especially of the German BSI, CIS, NIST, what is there and what is missing and must be adapted from international standards. These kind of use cases assume a certain maturity of K8S, we check what has improved in the last year and what is still missing. The talk contains more than traces of DevSecOps, GitOps and code signing. ~Hacking~ Trainings examples are available at https://github.com/thomasfricke/training-kubernetes-security PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/YYQ7DK/ HIP - Track 1 - Room 5 Thomas Fricke PUBLISH 9KFG8N@@pretalx.c3voc.de -9KFG8N Perimeter security is dead, get over it. en en 20221227T210000 20221227T214500 004500 Perimeter security is dead, get over it. Perimeter security has been a principle of our security architecture for decades and for a long time it has served us well. But lately especially malware waves have shown that its not working well anymore. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/9KFG8N/ HIP - Track 1 - Room 5 mc.fly PUBLISH HCNL3V@@pretalx.c3voc.de -HCNL3V Pacman can have the cookies and eat the ghosts too en en 20221227T220000 20221227T224500 004500 Pacman can have the cookies and eat the ghosts too How software gets to the user plays a very centric and important role on Linux distributions. Distributions based on binary package managers such as pacman require not only tooling to build the packages, but also software to maintain the repository infrastructure of the resulting packages, so that users can install them. In this talk we will investigate the use of different pieces of software, that are currently employed for maintaining the official repositories on Arch Linux. Repod [1] - the upcoming tooling - is evaluated in regards to its current feature set, its design goals and planned integration with the existing packaging ecosystem. [1] https://gitlab.archlinux.org/archlinux/repod PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/HCNL3V/ HIP - Track 1 - Room 5 David Runge PUBLISH WHRJMW@@pretalx.c3voc.de -WHRJMW The train has left the station: Building systems for a +2C world en en 20221227T230000 20221227T234500 004500 The train has left the station: Building systems for a +2C world Following on from the failure of COP27 and recent events that seem to show that our models underestimated climate sensitivity to CO2 by at least an order of magnitude, it appears that climate chaos is unavoidable. We seem dead set on a course that will take global temperatures to +2C and possibly beyond into territory uncharted by humans in our evolutionary history to date. How we build everything from now on will have to have resilience built in at its core, but this needs a very different of way thinking compared to the way we have previously thought about technology or imagined the direction of progress. This talk aims to describe some of the problem space and how the presenters experience with disasters and crisis has shaped some of their work in the payments technology space. This might be enlightening as to how we will have to rethink technology from the ground up in order for it still to be useful for the majority of humanity on a hot planet. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/WHRJMW/ HIP - Track 1 - Room 5 emerson PUBLISH 8BSVFY@@pretalx.c3voc.de -8BSVFY How To: Legal Blockieren de de 20221227T130000 20221227T140000 010000 How To: Legal Blockieren Im Januar 2022 gründete sich in Dresden eine lose Gruppe von Aktivist:innen, die unter dem Namen „QuerstellenDD“ diverse Querdenken-Aufmärsche nicht weiter unwidersprochen durch die Stadt laufen lassen wollte. Montag um Montag gelang es trotz deutlicher zahlenmäßiger Unterlegenheit, den - zu dieser Zeit oftmals unangezeigten - Aufzügen den Weg abzuschneiden, ihre Route zu beeinflussen und sie aus der Innenstadt oder gar aus ganzen Stadtteilen herauszuhalten. Frei nach dem Motto: Whose Streets? Our Streets! Diese Wochen waren und sind noch immer ein großes Lehrstück für den Umgang mit rechten Protesten, Polizeikräften und Versammlungsbehörden. Im Gegensatz zu klassisch linksaktivistischen Blockaden wurde bewusst und gut vorbereitet mit der Polizei und der Versammlungsbehörde in Kontakt getreten. Die Aktionen brachten einige beachtliche Erfolge mit sich: 1. Versammlungsbehörde und Polizei konnten nicht anders, als die legalen Blockaden vor dem mitunter aggressiven oder sogar gewalttätigen Mob zu schützen. Erst durch den Gegenprotest wurden die öffentlichen Stellen überhaupt genötigt, die bis dato weitgehend unbehelligten, unangemeldeten Versammlungen stärker unter Kontrolle zu bringen. 2. Es wurde öffentliche Aufmerksamkeit auf das Gewaltpotential, mitlaufende Nazis, Rechtsextreme und die Gefährlichkeit der verbreiteten Verschwörungsmythen gelenkt. 3. Es wurden auf Seite der Blockierenden weder ID-Feststellungen durchgeführt noch Straftaten oder Ordnungswidrigkeiten festgestellt. Alle Teilnehmenden konnten somit weitestgehend vor polizeilicher Repression geschützt werden. Wissen ist zum Teilen da - Zeit, für Strategien und Tipps zum „legalen Blockieren“. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/8BSVFY/ HIP - Track 2 - Room 2 Anne Herpertz PUBLISH VL3KS3@@pretalx.c3voc.de -VL3KS3 Regenerative Hacking : Ecosystemic design workshop for rural community hackspaces en en 20221227T143000 20221227T160000 013000 Regenerative Hacking : Ecosystemic design workshop for rural community hackspaces We will look at the emerging Regenerative Paradigm which is often defined in contrast to the currently dominant extractive paradigm and involves taking a living systems view of the world. Is a Hackerspace a living systems? Living systems can only be understood in the context of their environment. We'll take a holistic lens and look at a poor rural community in Wales, we'll identify the patterns of life energy in local systems (such as the food economy, the stuff economy, the local community knowledge economy) and explore how we can design a community hackerspace for a rural setting that might shift systems from the extractive to the regenerative. PUBLIC CONFIRMED Talk/panel 75 min + 10 min Q&A (85 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/VL3KS3/ HIP - Track 2 - Room 2 Liam Kurmos PUBLISH 3D3JF9@@pretalx.c3voc.de -3D3JF9 What I learned from making an 1836 LED dodecahedron en en 20221227T170000 20221227T173000 003000 What I learned from making an 1836 LED dodecahedron Inspired by a huge dodecahedron installation by xHain hack+makespace and seeing Greg Davill's D20 LED cube at #36C3, davedarko swore to himself to make an LED covered dodecahedron. Two years later the design process started, by deciding on a way to distribute LEDs. Then the next questions formed. How many LEDs can I put on it? How do you control 1836 LEDs that are spread over 12 PCBs? Do you chose neopixels or find an LED controller? What size is the angle between sides and what is it even called? How do you power it? Can I make new friends with it? Be warned: This talk will cover enough information to make you consider building a platonic solid covered in LEDs yourself! PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/3D3JF9/ HIP - Track 2 - Room 2 davedarko PUBLISH LYZXBP@@pretalx.c3voc.de -LYZXBP Hacktivism - past, present and future en en 20221227T200000 20221227T213000 013000 Hacktivism - past, present and future Join this panel and listen to former members of Telecomix, Lulzsec and other hacktivist groups discuss about their experiences doing hacktivism, any consequences they suffered, and how they envision the future for this form of activism. PUBLIC CONFIRMED Talk/panel 75 min + 10 min Q&A (85 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/LYZXBP/ HIP - Track 2 - Room 2 leon PUBLISH A9TXSW@@pretalx.c3voc.de -A9TXSW CiP - Chatting in Parallel ... What's happening in the Matrix-Multiverses? en en 20221227T130000 20221227T143000 013000 CiP - Chatting in Parallel ... What's happening in the Matrix-Multiverses? A workshop which bring and collect the latest developments from Matrix. PUBLIC CONFIRMED Workshop 90 min https://pretalx.c3voc.de/hip-berlin-2022/talk/A9TXSW/ HDMI (room 3) Yan 't' Minagawa PUBLISH LADFAB@@pretalx.c3voc.de -LADFAB Weaving, Old and New Technology: from Design Concept to Diva Fashion en en 20221227T150000 20221227T160000 010000 Weaving, Old and New Technology: from Design Concept to Diva Fashion This will be a presentation documenting the process of creating a high-end designer scarf with mathematical patterns, from concept design to final product. The journey will take us from pencil, paper, and computer design, to spreadsheet assisted dyeing of yarns, to the preparation the loom, to the weaving process itself, and the final finishing touches to arrive at the beautiful finished product. Hopefully it will familiarize the uninitiated with the processes involved in creating a real world woven object. I also hope that this discussion will inspire collaborations for future work involving computerized looms, computer-assisted weaving designs, new tech-enhanced fibers, and anything else that could extend the possibilities of weaving. Maybe next conference we will have a working computerized loom! PUBLIC CONFIRMED Workshop 45 min https://pretalx.c3voc.de/hip-berlin-2022/talk/LADFAB/ HDMI (room 3) chris lombardi PUBLISH 3QLP7D@@pretalx.c3voc.de -3QLP7D Quantenverschlüsselung in einer Box de de 20221227T170000 20221227T174500 004500 Quantenverschlüsselung in einer Box In den letzten Jahrzehnten ist die Transistordichte so hoch geworden, dass klassische Computer mit den Eigenheiten der Quantenmechanik zu kämpfen haben. Auf der anderen Seite machen sich Quantencomputer genau diese zunutze und revolutionieren moderne Rechenprozesse. So versprechen sie beispielsweise sichere Kommunikation, Simulation komplexer Moleküle und vieles mehr. Eine Problemstellung, in denen Quantencomputer besonders stark sind, ist die Primfaktorzerlegung, auf Basis welcher viele unserer heutigen Kommunikationsschlüssel erzeugt werden. Um in Zukunft sicherer zu kommunizieren, wird vor allem auf sogenannte Quantenschlüssel gesetzt. Im Workshop werden wir uns genauer auf das BB84 Protokoll konzentrieren. Um die quantenmechanischen Grundlagen zu erklären und den Schlüssel zu generieren, benutzen wir eine open source laser-gecuttete Holzbox. Die Box wurde in Zusammenarbeit mit den Jungen Tüftler:innen und der TU Berlin entwickelt und wurde vom Bildungsministerium für Bildung und Forschung gefördert. Die Laser-Cut-Dateien findet man unter https://tueftelakademie.de/quanten1x1/quantenverschluesselung/gey-gen PUBLIC CONFIRMED Workshop 45 min https://pretalx.c3voc.de/hip-berlin-2022/talk/3QLP7D/ HDMI (room 3) Tobias Schubert Franz Sitzmann Charlotte Kasper Rothaus PUBLISH EWAQC7@@pretalx.c3voc.de -EWAQC7 Introduction to C Programming en en 20221227T190000 20221227T210000 020000 Introduction to C Programming C is still one of the major programming languages used for development and maintenance of existing software. It has a deep history as being the language that was designed for developing UNIX with. Due to this, it traditionally has no features other than those strictly required for building a 1970s era operating system. While it is probably not fit for developing the Next Big Thing, it's still the language of choice for many due to its versatility and "simplicity". Many critical components are written in C or at least expose a C interface, as such, C can be considered the "lingua franca" of interoperability, required for glueing everything together. This workshop's goal is to have fun while learning C and also, hopefully, understanding some of its design choices. C is a small language making it easy to cover in such a short time—yet difficult to master, due its age and the complexity that arise through that. PUBLIC CONFIRMED Workshop (longer than 90 minutes) https://pretalx.c3voc.de/hip-berlin-2022/talk/EWAQC7/ HDMI (room 3) ElleJay (LJ) PUBLISH YBPSJK@@pretalx.c3voc.de -YBPSJK Arduino For Total Newbies en en 20221227T140000 20221227T173000 033000 Arduino For Total Newbies Arduino is an amazingly powerful tool that is very simple to learn to use. It was designed so that artists and non-geeks can start from nothing, and make something cool happen in less than 90 minutes. Yet, it is powerful enough so that uber-geeks can use it for their projects as well. This workshop is easy enough for '''''total newbies''''' to learn all you need to know to get going on an Arduino. Taught by [http://en.wikipedia.org/wiki/Mitch_Altman Mitch Altman]. Participants will make their own Arduino clone, and set it up on solderless breadboards to make their own TV-B-Gone remote control to turn off TVs in public places -- a fun way to learn Arduino (and electronics) basics. Bring your laptop, if you can. ''Big thanks to Ken Shirriff, who came up with the original [http://www.arcfn.com/2009/12/tv-b-gone-for-arduino.html TV-B-Gone for Arduino].'' == Workshop Itinerary == * Intro to Arduino * Very short lesson to learn everything you need to know about electronics! * Then we will learn to solder. Don't let this scare you! I've taught tens of thousands of people to solder, most of whom have never made anything before in their lives. It is actually a very easy skill to learn. It is also very useful. * Then we will each make our own Arduino clone from a kit made by Samurai Circuits: [https://cornfieldelectronics.com/cfe/u_do_it_duino_complete.php U-Do-It-Duino]. * Now that we each have our own Arduino, we will set up the free and open-source software on our laptops (if you bring one) -- Windows, MacOS, or Linux are all fine! * And then its time to make something and learn how easy it is to use Aruino! I'll (very easily!) show you how to read schematic diagrams, and you'll put together your own TV-B-Gone remote control using your [https://cornfieldelectronics.com/cfe/u_do_it_duino_complete.php U-Do-It-Duino]. We will use a solderless breadboard. These are really useful, and provide a fast, and very easy way to put circuits together without needing to solder. * Target practice is available after the workshop. PUBLIC CONFIRMED Workshop (longer than 90 minutes) https://pretalx.c3voc.de/hip-berlin-2022/talk/YBPSJK/ Soldering Workshop Room Mitch PUBLISH SCGVSD@@pretalx.c3voc.de -SCGVSD Berlin Hack and Tell en en 20221227T190000 20221227T210000 020000 Berlin Hack and Tell Berlin Hack and Tell is a monthly(ish) meetup where eight entities can show their hacks at c-base space station every(ish) last Tuesday of the month. This time the last Tuesday of the month is in parallel to HIP as a special edition. You have five minutes followed by up to five minutes of interaction with the audience. Show us code or other cool stuff, not slides or a sales pitch! Show off a silly/hobby project that you can’t present elsewhere. Do some software archaeology and dig in ancient code. Show some code that makes your life a little better. As long as it is interesting and/or fun and not pitch-y you are welcome to present kind of anything that can be considered hack in a wider scope you are invited to show it. Think of it like “stand up hacking”. Check out the past projects here: https://berlinhackandtell.rocks Reserve a slot by dropping a mail to mail@berlinhackandtell.rocks PUBLIC CONFIRMED Workshop (longer than 90 minutes) https://pretalx.c3voc.de/hip-berlin-2022/talk/SCGVSD/ c-base mainhall ligi PUBLISH MJSGGS@@pretalx.c3voc.de -MJSGGS Taping out a systolic array with an opensource PDK en en 20221228T113000 20221228T121500 004500 Taping out a systolic array with an opensource PDK During this talk, I will give an introduction to open-source PDKs for making custom Asics and my work on taping out a small systolic array using only open-source tools, my work is part of the zero to ASIC community https://www.zerotoasiccourse.com/. All of the content to be presented is from the perspective of an embedded software engineer learning digital design in his free time, without previous knowledge of digital design. The related work can be found at https://github.com/tucanae47/etpu and https://github.com/tucanae47/wrapped_etpu Slides can be found here https://docs.google.com/presentation/d/1TU46SYttMdoLC8L0s6AiSN3k3dQAGPlPGogErm2m1ds/edit?usp=sharing PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/MJSGGS/ HIP - Track 1 - Room 5 Camilo PUBLISH N7V3XL@@pretalx.c3voc.de -N7V3XL Takeaways from the crypto-mines en en 20221228T123000 20221228T131500 004500 Takeaways from the crypto-mines It is useful to separate the economics and scams that surround cryptocurrencies from the systems being built within their auspices. This talk will provide a survey over the distributed systems and cryptographic advances over the last couple years that you may have missed within the hype. On the systems side, we’ll look at advances in byzantine consensus, practically resilient gossip networks, and Distributed Hash Tables. On the cryptography side, we’ll survey recent developments in zero-knowledge proof systems, multi-party computation, and merklized data structures. All 6 of these areas have applicability beyond blockchain construction - with value to p2p and distributed networking, and also in better securing and communicating user data. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/N7V3XL/ HIP - Track 1 - Room 5 will scott PUBLISH YKXPH7@@pretalx.c3voc.de -YKXPH7 Librevents: “liberating” data from Big Tech en en 20221228T133000 20221228T140000 003000 Librevents: “liberating” data from Big Tech *Fediverse: a federated network of free libre and open source alternatives to Twitter, Facebook, Youtube. The networks within the Fediverse communicate together through the ActivityPub protocol. In 2021, we have been developing Mobilize.Berlin, an event platform based on Mobilizon, intended for the club and music scene in Berlin. In 2022, we have kept improving Librevents within our Mobilize.Berlin community, organizing two hackathons at the c-base hackerspace in Berlin. In this talk we will present the browser extension Librevents, available to download and allowing any user to scrape and republish themselves events onto a Mobilizon instance. Our goal is to grow our community of developers, event organizers, and Mobilizon instance administrators in order to improve Librevents, to promote Mobilizon and the Fediverse, and make data liberation happen. keywords: Fediverse, Mobilizon, data liberation, adversarial interoperability PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/YKXPH7/ HIP - Track 1 - Room 5 Joseph P. De Veaugh-Geiss Claudio Agosti PUBLISH PFUWNJ@@pretalx.c3voc.de -PFUWNJ Finding (state) malware: methods and tools for civil forensic analysis en en 20221228T143000 20221228T160000 013000 Finding (state) malware: methods and tools for civil forensic analysis Not only since the Pegasus Project, which exposed the surveillance of numerous activists, journalists and opposition figures by the NSO Group's Pegasus state malware, state malware have posed a threat to the privacy of those affected and their contacts. In order to make such attacks visible and provable, analyses are needed using methods and tools similar to those used by security agencies, but which should be open source and adhere to ethical standards of consensual forensics. In our workshop we want to give an overview of what approaches, methods, and tools are suitable for these analyses to best perform forensic data extraction in a civilian context and present what tools and scripts we have developed ourselves. We all work in civil forensics ourselves and want to share our experiences on what has worked for us and what has not. The presented tools are of course not only suitable for the search of state malware, but also for any other malware such as stalkerware or ransomware. Topics and tools we present are: **Collecting data:** * Android/iOS: Mobile Verification Toolkit (MVT), android-qf. * HDD/SSD Image: guymager * Windows/Mac: pc-qf **Evaluating data:** * Indicator of Compromise (IoC) Management (MISP). * Mobile Verification Toolkit (MVT) * Sysdiagnose exports: analyze processes * PCAP evaluation (TinyCheck) For these steps and typical attack patterns we explain reasonable approaches and what has been proven in our work. PUBLIC CONFIRMED Talk/panel 75 min + 10 min Q&A (85 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/PFUWNJ/ HIP - Track 1 - Room 5 Viktor Janik Besendorf Niclas Schwarzlose PUBLISH ZGJVPF@@pretalx.c3voc.de -ZGJVPF Reviving open-source projects: at the example of OpenTracks en en 20221228T161500 20221228T164500 003000 Reviving open-source projects: at the example of OpenTracks What makes an open-source project successful? How does a hands-on lifecycle of an open-source project look like? How can we ensure that an open-source project stays meaningful over several years? In 2016, Google decided to sun set MyTracks, which was a very successful Android application for GPS tracking. Back in 2019, I forked Google's MyTracks and re-branded as OpenTracks. In this talk, I will present the hands-on lessons I learned in the subsequent 3 years of ongoing development. PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/ZGJVPF/ HIP - Track 1 - Room 5 Dennis Guse PUBLISH FB78TC@@pretalx.c3voc.de -FB78TC Subdomain takeover, the use after free of the internet en en 20221228T170000 20221228T173000 003000 Subdomain takeover, the use after free of the internet On a boring evening, I thought of playing around with automated scanning using long bash one-liners. The next morning, a one-liner consisting of 17 pipes was born which found a few hundred valid subdomains prone to subdomain takeover. This wasn't really complicated, but by automating such a process, I had the chance to dive deeper into the whole topic and found quite a weird ecosystem. This talk is there to give you the whole context: from the basic "what is subdomain takeover?" to further "well how can it be found?" until the essential "well how do we solve this once and for all?". PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/FB78TC/ HIP - Track 1 - Room 5 hanemile PUBLISH PYSPFN@@pretalx.c3voc.de -PYSPFN Introduction to Reverse Engineering with Frida en en 20221228T190000 20221228T194000 004000 Introduction to Reverse Engineering with Frida This talk provides a short overview on Frida capabilities and how to use them, including live demos. Frida supports various operating systems, including Linux, Windows, macOS, iOS, Android. You will be able to use this knowledge to get started with reverse engineering on your own :) PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/PYSPFN/ HIP - Track 1 - Room 5 jiska PUBLISH XLTFWL@@pretalx.c3voc.de -XLTFWL Why YOU should write a wayland compositor! en en 20221228T200000 20221228T210000 010000 Why YOU should write a wayland compositor! Hi! My name is Victoria and I have worked on a wayland compositor library called "smithay" for the past 5 years. Right now I am working for system76 on their new desktop environment, I am member of wayland-protocols and have been contributing to the wider ecosystem. So if you even wanted to learn about the wayland ecosystem and linux desktops, I can and will try to do my best to explain. Even better, I want to give you reason to use this technology for your projects! The Talk is roughly divided into two parts: First off the background, to get everybody on the same page - What exactly is wayland? - How is it different from X11 in the most important ways? - Technical details! Or how a modern linux desktop is build! - We'll be talking about the "Direct Rendering Manager", "EGL", "libinput", "Client-side-decorations?", "nvidia?!", "WSL?!?" You name it! - Feel free to bring some own questions as well. THE Showcase! Hopefully you'll understand a lot about the stack now, but you have no idea what to use it for or feel like nothing of it is relevant for you work? Don't be deceived, people use wayland in embedded and automotive applications, for automated testing and continuous integration, for virtualization, XR Applications, Game streaming, Remote Computing, ...! Let me show you, what weird things did people build with it and lets unlock more of it's potential together! PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/XLTFWL/ HIP - Track 1 - Room 5 Victoria Brekenfeld PUBLISH MDNR83@@pretalx.c3voc.de -MDNR83 Zapps and Warping and Forging -- building towards portable, composable un-distros en en 20221228T213000 20221228T222000 005000 Zapps and Warping and Forging -- building towards portable, composable un-distros nil PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/MDNR83/ HIP - Track 1 - Room 5 Eric Myhre PUBLISH PEAQU9@@pretalx.c3voc.de -PEAQU9 Never Mind the Gigwork - here's the Coffeebots en en 20221228T230000 20221229T000000 010000 Never Mind the Gigwork - here's the Coffeebots “Never mind the gig work… here’s the Coffebots!” is a marionette puppet extravaganza full of robots, coffee, and algorithmic capitalism. A punk rock space opera! It is the reconstruction of the filmed version of a puppet play that was never performed. The completion of a work long in the making, and it turned out to be a movie, in the end. Follow our brave little coffeebots and their struggle against the system. Fly with us to the end of the universe to fight the big bad endboss. Our play will use the language of the Internet: Easy English with heavy accents and lots of technobabble. Trailer: https://www.youtube.com/watch?v=GvfJ3_a-lKA PUBLIC CONFIRMED Talk/panel 75 min + 10 min Q&A (85 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/PEAQU9/ HIP - Track 1 - Room 5 e-punc, c-atre collectivdrama PUBLISH SRYJMG@@pretalx.c3voc.de -SRYJMG How my video game project is helping me learn tech and conquer my mental health en en 20221228T130000 20221228T142500 012500 How my video game project is helping me learn tech and conquer my mental health I always liked coming up with creative stories. It was fun to create characters and have them experience interesting stories. Not surprisingly when I was a teenager and life threw mental health issues at me, I decided to deal with it in a creative way, so I made a character and made him go through some stuff. A short time later, I had a handful of characters and idea: How about I make a video game out of this? How about I make it about hackers? A few years and a few semesters of video game art studies later I am here with a project that so far has helped me with those mental health issues, taught me a lot about video games and has gotten me more into technology and I now have a small team of friends who are helping me. The plan for the project is to have a video game about hackers that is part story based (and your interactions with the characters influence this part) and part CTFs. I have gotten lucky and found a few friends to be willing to help with this project including Dario, who will be giving the talk with me! We want to release it for free and make everything open source. I hope that our journey (so far) can teach you some cool stuff as well! -yvmqznrm Just so you know: The video game is still in development, so we will not be able to show a fully finished game during this talk, but we will do what we can to be able to show a small demo! PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/SRYJMG/ HIP - Track 2 - Room 2 yvmqznrm DarioACG PUBLISH UCQTY9@@pretalx.c3voc.de -UCQTY9 Exploring social media reactions to conflicts in 2022 en en 20221228T150000 20221228T160000 010000 Exploring social media reactions to conflicts in 2022 2022 brought conflicts worldwide. The ongoing war in Ukraine, the Tigray war, the ongoing Yemeni civil war, the recent unrest and protests in Iran are just a few of them. These conflicts are different in their nature, but they are also marked by one common denominator - the employment of social media. In this talk we will use topic modeling and social network analysis to explore public usage of social media and reactions to different hostilities. The first approach is a machine learning technique and is used to cluster, discover latent topics, and thus better understand text data. The second one is a toolset to extract nodes and edges from the specific data, in order to analyze and visualize a social network to highlight relationships. Social media reactions are captured in tweets about the war in Ukraine, the Tigray war, the Yemeni civil war and the Iranian protests. The tweets will be scrapped for all the major dates of the conflicts' timelines, where a topic analysis will be performed afterwards. Social network analysis will be performed with an emphasis on a subset of relevant government, institutions, media and activist twitter accounts. This talk also aims to be a brief guide on how to perform twitter scraping, basic topic modeling, as well as creating and visualizing social networks using python on your own. Here you can find the repository containing the slides and further relevant files: https://gitlab.com/bi3n3k3rn/conflicts2022/ PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/UCQTY9/ HIP - Track 2 - Room 2 Bi3n3 Sabina PUBLISH CZCABY@@pretalx.c3voc.de -CZCABY (mostly) homebrewn metal AM en en 20221228T161500 20221228T174000 012500 (mostly) homebrewn metal AM After a short introduction into FFF/FDM and the basics behind sinter based FFF/FDM metal additive manufacturing this talk offers a complete overview on the procedure, the benefits and the limits compared to other well established procedures as well as the obstacles that need to be overcome when using it. PUBLIC CONFIRMED Talk/panel 75 min + 10 min Q&A (85 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/CZCABY/ HIP - Track 2 - Room 2 Klapauzius PUBLISH GDZNLP@@pretalx.c3voc.de -GDZNLP IT Security for Activists en en 20221228T180000 20221228T190000 010000 IT Security for Activists I already held the talk in German at this years Bits und Bäume conference in Berlin. Parts of it are already contained in my It Security Training Video for Fridays for Future: https://www.instagram.com/p/CXx9M3eIl16/ PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/GDZNLP/ HIP - Track 2 - Room 2 Viktor PUBLISH ECDJ3H@@pretalx.c3voc.de -ECDJ3H IKEA & pallet hacks! en en 20221228T193000 20221228T200000 003000 IKEA & pallet hacks! From regular furniture to geodesic domes. Pallet furniture and other upcycling projects. Best practices and how-tos concerning working with pallets and IKEA resources. How to hack your rental apartment deposit free. With an extra of: why you shouldn't repair your ceiling for free (and I did it anyway) PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/ECDJ3H/ HIP - Track 2 - Room 2 Bart PUBLISH DC8TQG@@pretalx.c3voc.de -DC8TQG Connecting Networks in Global Maker Movements: the Africa Europe Maker Innovation Ecosystem en en 20221228T204500 20221228T211500 003000 Connecting Networks in Global Maker Movements: the Africa Europe Maker Innovation Ecosystem The participating networks all support spaces and makers in Africa and Europe, through them we want to promote Open Hardware and the Internet of Production. mAkE is a trans-disciplinary approach to connect European and African Digital Innovation Hubs, EU funded through the Horizon 2020 programme. PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/DC8TQG/ HIP - Track 2 - Room 2 aprica PUBLISH DPLEXN@@pretalx.c3voc.de -DPLEXN Lightning Talks Day 2 en en 20221228T213000 20221229T000000 023000 Lightning Talks Day 2 Lightning Talks Day 2 -- limited to 15 mintues PUBLIC CONFIRMED Talk/panel 75 min + 10 min Q&A (85 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/DPLEXN/ HIP - Track 2 - Room 2 tig3rch3n PUBLISH 39AJEL@@pretalx.c3voc.de -39AJEL Of someone who went forth to find a flat in Berlin. An automation-drama in three acts — Act 3: In ultimate consequence de de 20221228T120000 20221228T121700 001700 Of someone who went forth to find a flat in Berlin. An automation-drama in three acts — Act 3: In ultimate consequence The princess realizes that she must move to Berlin when she sees a banner reading "An artist who does not live in Berlin is no artist" at an exhibition in Leipzig. Luckily she meets Kasperle while looking for an apartment, who introduces her to the Wohnungsbot at its launching exhibition. The Wohnungsbot is a free, open source bot (software) that offers a fully automated flat application process in Berlin [Download and more info at wohnungsbot.de] and was launched in Act II “The bot’s promise”. But although the Wohnungsbot has already freed countless people from the symptoms of rent madness, this mission plunges the Wohnungsbot into an existential crisis: A lessor-bot was created which rejects all applications of the princess because her net income is too little. In the final monologue, the Wohnungsbot (transformed into a physical figure) recognizes its failure and reflects on the impossibility of technological solutions to social problems. The software Wohnungsbot was published as an apparent "technical fix". It promised the visitors to be able to escape the rent insanity in a growing Berlin. But afterall the promise of the bot will burst. For now, the Wohnungsbot functions, but the third act "In ultimate consequence" anticipates what must come to happen: the lessors or the housing platforms will react with counter-automations and thus lead to an ever further accelerated and mechanized housing search automation spiral. This will hardly end in favor of the tenants. The "small automation theater" uses its own medium of automated puppet theatre to debate, already today, how we want automation to shape our lives in the future and how we want apartments in our cities to be allocated. with Kasperle Prinzessin Krokodil Wohnungsbot spoken by Monika Freinberger (Kasperle, Prinzessin, Krokodil) Marlene [AWS Polly] (Wohnungsbot) Copy editing Christopher Heyder Production Ortrun Bargholz Premiere 2020-01-17, ZAK Spandau, Berlin PUBLIC CONFIRMED Music/Performance/Art/Other Cool stuff https://pretalx.c3voc.de/hip-berlin-2022/talk/39AJEL/ HDMI (room 3) Clemens Schöll PUBLISH TCTYUW@@pretalx.c3voc.de -TCTYUW Binary Exploitation Beginner Workshop en en 20221228T143000 20221228T163000 020000 Binary Exploitation Beginner Workshop This workshop aims to introduce beginners to basic 20th century exploitation techniques. Participants will exploit their first buffer overflow, their first oracle attack and their first ROP chain. All challenges are designed for self learning and come with optional hints. Throughout the workshop, at certain intervals, challenges will be solved together by explaining the solutions on stage, so that everybody can follow along and get help if needed. PUBLIC CONFIRMED Workshop (longer than 90 minutes) https://pretalx.c3voc.de/hip-berlin-2022/talk/TCTYUW/ HDMI (room 3) Daniel (D_K) Felipe (localo) Nils Ole Timm PUBLISH RTYQRS@@pretalx.c3voc.de -RTYQRS Programming Games in Go for Pretty Much All Platforms en en 20221228T170000 20221228T200000 030000 Programming Games in Go for Pretty Much All Platforms Over the past couple of years, I've grown a new hobby of programming retro puzzle games in the Go programming language. This led to my first commercial puzzle adventure game, Dr. Kobushi's Labyrinthine Laboratory, being published on Nintendo Switch while being written fully in Go! But isn't Go a network applications language? Can you really have fun creating all sorts of games in Go? Not only is the answer a resounding "yes", but you can then easily compile your game to ship it for Windows, Mac (including notarized, Universal apps), Linux, iPhone, Android and even Nintendo Switch! In this workshop, we'll create a simple arcade game together using Go and the Ebitengine game library for Go. Basic knowledge of the Go programming language is recommended, but not much else! PUBLIC CONFIRMED Workshop (longer than 90 minutes) https://pretalx.c3voc.de/hip-berlin-2022/talk/RTYQRS/ HDMI (room 3) Nadim Kobeissi PUBLISH 7NLVUF@@pretalx.c3voc.de -7NLVUF Designing and making stencils en en 20221228T203000 20221228T220000 013000 Designing and making stencils Stencils are a great way to cover things (walls, pavements, cars, whatever) in paint. I couldn't find a good beginner tutorial for making them, and thus this talk was born. I assume that you: - know nothing about stencils - are not artsy - have a bare minimum of manual skills. (just like me a year ago) All you need is a computer, and access to a laser/vinyl cutter (don't bring yours to the workshop, we'll provide one). PUBLIC CONFIRMED Workshop 90 min https://pretalx.c3voc.de/hip-berlin-2022/talk/7NLVUF/ HDMI (room 3) Marcin PUBLISH 8TQBMA@@pretalx.c3voc.de -8TQBMA Learn to Solder - Digital Music Synthesis workshop with ArduTouch music synthesizer kit en en 20221228T140000 20221228T163000 023000 Learn to Solder - Digital Music Synthesis workshop with ArduTouch music synthesizer kit This workshop is for '''''total newbies''''' to learn to solder by making their own ArduTouch music synthesizer.<br> We will also learn how to generate sound, music, and noise with computer chips. [https://cornfieldelectronics.com/cfe/projects.php#ardutouch ArduTouch] is an [https://github.com/maltman23/ArduTouch open source] Arduino-compatible music synthesizer kit with a built-in touch keyboard, and with built-in speaker/amplifier.<br> The ArduTouch comes pre-programmed with a way cool synthesizer. And I will show you how to re-program it with other way cool (and totally different) synthesizers.<br> Participants will all learn to solder and make an ArduTouch music synthesizer from a kit. I guarantee it will work when you're done!<br> The ArduTouch comes pre-programmed with a really nice music synthesizer (a 4-voice sawtooth waveform generator) -- called "Thick", that makes super phat sounds.<br> An ArduTouch Arduino library is available for programming in more super nice synthesizers, with lots and lots of features. The library also comes with many way cool example synthesizer sketches that also serve as a tutorial for making your own ArduTouch synthesizers (which are Arduino sketches).<br> ArduTouch currently has 9 totally different synthesizers available! Synth sounds include way beautiful to metal to noise to drones to psychedelic, and also a drum/bass machine sequencer. For those who want to learn more, the documentation teaches the basics of Digital Signal Processing for audio generation.<br> This workshop is for '''''total newbies'''''! PUBLIC CONFIRMED Workshop (longer than 90 minutes) https://pretalx.c3voc.de/hip-berlin-2022/talk/8TQBMA/ Soldering Workshop Room Mitch PUBLISH ADCSSQ@@pretalx.c3voc.de -ADCSSQ CubeR - Mondforschung und –Erkundung und modularen Nanorovern de de 20221228T160000 20221228T163000 003000 CubeR - Mondforschung und –Erkundung und modularen Nanorovern Mit dem visionären Ziel der europäischen Raumfahrtagentur ESA, bis 2040 eine bemannte Basis auf dem Mond aufzubauen, rückt der Mond mehr und mehr in den Fokus von Industrie und Forschung. Die Entwicklung von Nanosatelliten für den Erdorbit, sogenannten CubeSats, hat in den letzten Jahrzehnten eine Revolution in Sachen Zugang zum Weltraum bewirkt. Ziel der 2020 von *Irene Selvanathan* gegründeten **NEUROSPACE GmbH** ist die Erweiterung dieses Wandels bis hin zur Mondoberfläche. Dabei gilt es zu untersuchen, in wie weit bestehende CubeSat-Technologie für den Einsatz in der doch sehr ähnlichen Umgebung geeignet ist. Mit Hilfe eines offenen Standards für die Entwicklung lunarer Rover will NEUROSPACE bewirken, dass zukünftige Missionen sich mehr auf den eigentlichen Anwendungsfall fokussieren können, anstatt auf die Entwicklung und Zertifizierung benötigter Komponenten. In diesem Vortrag wird das von Neurospace entwickelte CubeR-Konzept vorgestellt und eine Einordnung der zukünftigen Bedeutung robotischer Systeme für die lunare Erforschung vorgenommen. Dabei wird auf die besonderen Herausforderungen, die es bei der Entwicklung derartiger Systeme zu überwinden gibt eingegangen und unser ehrgeiziger Plan beschrieben, wie eine Vielzahl von CubeR-Robotern auf dem Mond die Arbeiten der Astronautinnen und Astronauten übernehmen kann. PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/ADCSSQ/ c-base mainhall Maximilian von Unwerth Igork Kolek PUBLISH 37WZQY@@pretalx.c3voc.de -37WZQY DNS over CoAP: Securing Name Resolution in the Internet of Things en en 20221229T120000 20221229T123000 003000 DNS over CoAP: Securing Name Resolution in the Internet of Things I present the design, implementation, and analysis of DNS over CoAP (DoC), a new proposal for secure and privacy-friendly name resolution of constrained IoT devices. This protocol is currently discussed within the Internet Engineering Task Force (IETF), a standardization body for Internet protocols: https://datatracker.ietf.org/doc/draft-ietf-core-dns-over-coap/. We implemented different design choices of DoC in RIOT, an open-source operating system for the IoT, evaluate performance measures in a testbed, compare with DNS over UDP and DNS over DTLS, and validate our protocol design based on empirical DNS IoT data. Our findings indicate that plain DoC is on par with common DNS solutions for the constrained IoT but significantly outperforms when additional, CoAP standard features are used such as block-wise transfer or caching. You can find my slides here: https://blog.martine-lenders.eu/static/slides-hip22-doc.pdf PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/37WZQY/ HIP - Track 1 - Room 5 Martine Lenders PUBLISH QM8CSR@@pretalx.c3voc.de -QM8CSR Das ist globales Hardware Hacking in Parallel de de 20221229T130000 20221229T140000 010000 Das ist globales Hardware Hacking in Parallel Ich bin beim Verein Global Innovation Gathering (GIG) aktiv, wir sind sozusagen ein globaler Erfahrungsaustauschkreis, ein Netzwerk von Hacker*innen, die größtenteils aus dem ‚globalen Süden‘ kommen. Letzte Woche haben wir uns mit einigen Mitgliedern des Netzwerks Offene Werkstätten getroffen und es fiel der Satz „Ich habe noch nie darüber nachgedacht, dass es auch Makerspaces im ‚globalen Süden’ gibt – aber klar, dass es die gibt!“ Ich möchte euch in diesem Vortrag einige davon vorstellen. Großartige Menschen und Initiativen, die an verschiedenen Orten lokale Probleme lösen und dabei Teil einer globalen Gemeinschaft sind, Open Source Hardware nutzen und dazu beitragen. Sie bauen Mikroskope in Nigeria, entwickeln Hilfsmittel gemeinsam mit Menschen mit Behinderung in Nepal, Trinkwasserfilter in Kenia oder urban Gardening in Brasilien. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/QM8CSR/ HIP - Track 1 - Room 5 aprica PUBLISH GRBLDD@@pretalx.c3voc.de -GRBLDD Are you old enough to buy this? (Zero-knowledge age restriction with GNU Taler) en en 20221229T143000 20221229T153000 010000 Are you old enough to buy this? (Zero-knowledge age restriction with GNU Taler) Privacy in e-commerce is currently a sad story, especially with respect to age-restriction and -verification. Existing commercial solutions are mostly implemented by identity verification. Even privacy-friendly approaches, using attribute-based credentials, anchor on an external, higher authority which verifies the identity of the consumer before issuing a certificate. The [principle of subsidiarity](https://en.wikipedia.org/wiki/Subsidiarity) suggests that the appropriate level of authority to set age restriction is the level of parents and caretakers - not merchants, banks or governmental institutions. Our design for an age verification scheme fully aligns with this principle. The design is presented as an extension of [GNU Taler](https://taler.net), a privacy-friendly payment protocol. The extension augments the protocol with a zero-knowledge scheme for age verification that cryptographically augments coins for this purpose. Our scheme enables buyers to prove to be of sufficient age for a particular transaction without disclosing the age. The modification preserves the privacy and security properties of GNU Taler, in particular the anonymity of buyers and unlinkability of transactions. We show how our scheme can be instantiated with various cryptographic signature schemes, how it is integrated with the GNU Taler payment system and what work is left to do. This work is funded by the project [_Concrete Contracts_](https://concretecontracts.codeblau.de) by the [German Federal Ministry of Education and Research](https://www.forschung-it-sicherheit-kommunikationssysteme.de/projekte/concrete-contracts). PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/GRBLDD/ HIP - Track 1 - Room 5 oec PUBLISH BGH3BG@@pretalx.c3voc.de -BGH3BG From idea to KiCad & beyond: How to design & build an LED project en en 20221229T160000 20221229T164500 004500 From idea to KiCad & beyond: How to design & build an LED project Soldering a Neopixel LED strip to an ESP32 or Arduino to make it glow can be a fun start for building LED projects. But how do you actually make an LED project that looks and feels like a professional product? **Join this talk and learn:** - how to easily plan and design a product, with its unique case design, PCBs with all the components you need and which fit perfectly into the case - how to design LED projects to be not just repairable, but also easy to modify and extend - or in other words: maker friendly - how to have fun exploring and combining all the various PCB types, components, and materials for making LED projects - how all of this is a lot easier than you expect **About the speaker:** Marco (nickname "glowingkitty") is creating open-source LED lamps and development kits, to get more people excited about creating their own LED projects and getting interested in industrial design and electronics. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/BGH3BG/ HIP - Track 1 - Room 5 Marco PUBLISH WJBNAN@@pretalx.c3voc.de -WJBNAN A beginner's guide to unexpected input 🧨 en en 20221229T170000 20221229T173000 003000 A beginner's guide to unexpected input 🧨 I somehow can't stop myself from talking about emoji at conferences. And I don't even use those things that much. Well, I don't use them that much for what they're for. I generally put them in places where they are unexpected and watch stuff break. However, I don't only want to be "that emoji person", so for this talk, I want to start with some info about emoji, and some developments that have happened since my [talk at this year's GPN](https://media.ccc.de/v/gpn20-6-breaking-things-with-emoji-), but then move on to some more advanced topics like SQL injections, XSS and buffer overflows. All of that explained on a somewhat surface level so that people who don't know much about hacking can still follow and get some value out of the talk. PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/WJBNAN/ HIP - Track 1 - Room 5 dysphoricUnicorn🪿 PUBLISH CLCACQ@@pretalx.c3voc.de -CLCACQ B3 - BuntesBugBounty - den Hackerparagraphen Hacken de de 20221229T174500 20221229T184500 010000 B3 - BuntesBugBounty - den Hackerparagraphen Hacken Sollte ein:e Sicherheitsforscher:in aktuell eine Sicherheitslücke finden und dabei ggf. auch noch über ein Datenleck stolpern, entstehen eine Reihe von Fragen: * Habe ich mich strafbar gemacht, wenn ja wie dolle? #Hackerparagraph * Wem melde ich die Lücke? * Wem melde ich das Datenleck? * Kann ich das ethisch vertreten? * Wie viel Arbeit wird das? Die Arbeit von ehrenamtlichen Sicherheitsforscher:innen wird von den Organisationen, deren Systeme betroffen sind, nicht notwendigerweise positiv aufgenommen - siehe CDU Connect-App [1]. Auch kann das Melden von Sicherheitslücken bei Bekanntwerden der meldenden Person für diese zu Repressalien führen wie der Fall der log4j Lücke gegenüber dem Unternehmen AliBaba [2][3]. Ebenfalls ist nicht immer einfach erkennbar, wem eine Lücke und ein entsprechendes Leck zu melden sind: * der Organisation, die die Software einsetzt? * der Organisation, die die Software anbietet oder entwickelt? * Was ist zu tun, wenn es keine security.txt gibt? * Wendet sich eins an die Adresse im Impressum? * Im Falle eines Datenlecks, welcher LfDI ist zuständig? * Der des Landes der Filiale, die im Impressum steht, der des Bundeslandes, in dem die Firma ihren Hauptsitz hat? * Was passiert, wenn das Datenleck an den falschen LfDI gemeldet wird? * Wieso wollen BfDI und LdDIs wissen wer ich bin? * Wie kann ich sicher sein, dass das BSI aus der Lücke keinen Staatstrojaner macht? etc. etc. Wie das aus Sicht von Sicherheitsforscher:innen funktioniert, haben Zerforschung und Linus in dem Vortrag: “Deine Software, die Sicherheitslücken und ich” [5] dargestellt. Damit sich das bessert wollen wir - als konstruktiven Beitrag zur Debatte um Sicherheitsforschung auf Bundes- [6] und Europäischer Ebene [7] - dem Bund vorschlagen, dass er Sicherheitsforscher:innen einlädt, ihn und die öffentliche Hand im Allgemeinen zu Hacken. Dies durch das Ausloben eines “Bunten Bug Bounties” und das Einrichten einer one-stop-shop Meldestelle für Sicherheitslücken und Datenlecks. Vorbilder gibt es genug, die Bundeswehr [8] und die Niederlande [9] machen das schon. Die Bundeswehr verspricht Sicherheitsforscher:innen sie nicht anzuzeigen, die Niederlande garantieren, dass die Meldung veröffentlicht werden darf und es gibt ein T-Shirt [10]. Die EU zahlt mit EU-Fossa [11] sogar Geld für Fixes von Lücken in relevanten Open Source Frameworks. Ziel des Projektes ist es herauszufinden: * Wie könnte ein entsprechender Prozess aussehen? * Kann das rechtssicher gestaltet werden? * Wie passt das mit dem Cyber Resilience Act der EU [12] zusammen? Im Vortrag wollen wir den aktuellen Stand des Projektes vorstellen und die Community zur Diskussion einladen. Weiteres Demnächst unter: www.inoeg.de/b3 [1] https://www.zeit.de/digital/datenschutz/2021-08/cdu-connect-app-it-sicherheit-lilith-wittmann-forscherin-klage [2] https://winfuture.de/news,127162.html [3] https://www.scmp.com/tech/big-tech/article/3160670/apache-log4j-bug-chinas-industry-ministry-pulls-support-alibaba-cloud [4] https://securitytxt.org/ [5] https://media.ccc.de/v/rc3-2021-xhain-278-deine-software-die-si [6] https://netzpolitik.org/2022/hackerparagrafen-sicherheit-fuer-die-sicherheitsforschung/ [7] https://www.ccc.de/de/updates/2022/zero-day-schwarzmarkt-trockenlegen [8] https://www.bundeswehr.de/de/security-policy [9] https://www.government.nl/topics/cybercrime/fighting-cybercrime-in-the-netherlands [10] https://medium.com/pentesternepal/hacking-dutch-government-for-a-lousy-t-shirt-8e1fd1b56deb [11] https://joinup.ec.europa.eu/collection/eu-fossa-2/about [12] https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/CLCACQ/ HIP - Track 1 - Room 5 Little Detritus PUBLISH A3ULZV@@pretalx.c3voc.de -A3ULZV No Fuzzer has been there yet: Finding Bugs in Linux Wireless Stacks en en 20221229T190000 20221229T200000 010000 No Fuzzer has been there yet: Finding Bugs in Linux Wireless Stacks This talk introduces how (kernel) fuzzing works and how our fuzzer for Linux wireless interfaces works specifically. I will show some issues we stumbled upon and how we solved them. Finally, I discuss some of the vulnerabilities it found and will provide some insight into the disclosure process. This talk is beginner-friendly: If you have never heard of Fuzzing or do not have any pre-knowledge regarding security, don't worry but please come and you will learn something new and interesting. :) PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/A3ULZV/ HIP - Track 1 - Room 5 Sönke PUBLISH KJMMUB@@pretalx.c3voc.de -KJMMUB Open Source und Cloud Native - Die Zielarchitektur der deutschen Verwaltungscloud de de 20221229T201500 20221229T211500 010000 Open Source und Cloud Native - Die Zielarchitektur der deutschen Verwaltungscloud Die Strategie ist auf Public Money, Public Code ausgerichtet. Sie ist aber auch Cloud Native, wenn auch in Private betriebenen Multi Clouds. Implizit verlangt sie DevSecOps, GitOps und auch Agilieierung. Was bedeutet die Strategie für Anwendungen in der Verwaltung? Der öffentliche Sektor ist KRITIS, können die Sicherheitsanforderungen erfüllt werden? Ist Security by Design in dieser Umgebung möglich? Lässt sich damit die viel beschworene Souveränität wieder herstellen? Wie stellt sich sich das ganze technisch dar? Wir gehen durch https://www.it-planungsrat.de/beschluss/beschluss-2022-47 PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/KJMMUB/ HIP - Track 1 - Room 5 Thomas Fricke PUBLISH JBU3JC@@pretalx.c3voc.de -JBU3JC Aktuelles zur Chatkontrolle de de 20221229T213000 20221229T223000 010000 Aktuelles zur Chatkontrolle Die Pläne der EU zur Chatkontrolle, die im konkreten Entwurf auf das Auffinden von Material der sexuellen Ausbeutung von Kindern und Jugendlichen sowie sexuellen Annäherungsversuchen durch Erwachsene beschränkt bleiben, sehen unter anderem vor, dass Kommunikations- und Hostingdienste zum Scannen sämtlicher Inhalte verpflichtet werden können. Nicht nur soll dabei auch mittels machine learning bislang unbekanntes Bild- und Videomaterial gefunden und gemeldet werden, sondern auch Textnachrichten analysiert und nach verdächtigem Verhalten gesucht werden. Verschlüsselte Kommunikation ist nicht ausgenommen, so dass eine Umsetzung der Pläne einen massiven Angriff auf Ende-zu-Ende Verschlüsselung darstellt und zur umfassenden Verbreitung von Client-Side-Scanning führen wird. Dass der Einsatz dieser dystopischen Überwachungsinstrumente mittelfristig nicht auf Missbrauchsdarstellungen von Kindern und Jugendlichen beschränkt bliebe, liegt auf der Hand. Nachdem die EU-Kommisson im Mai ihre Pläne vorgelegt hat, beschäftigen sich nun die zuständigen Ausschüsse des Europäische Parlaments sowie des EU-Rates mit dem Thema. Dabei stoßen die Pläne zwar auf Skepsis einiger Abgeordneter, aber insbesondere die Regierungen der meisten Nationalstaaten unterstützen diesen Angriff auf vertrauliche und sichere Kommunikation. Aktuell läuft die Positionierung der deutschen Bundesregierung, die einen entscheidenden Einfluss im Rat hat. Um die Pläne noch zu verhindern müssen wir jetzt aktiv werden. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/JBU3JC/ HIP - Track 1 - Room 5 khaleesi Konstantin Macher Tom Jennissen PUBLISH MBJW9Z@@pretalx.c3voc.de -MBJW9Z Masking Threshold en en 20221229T230000 20221230T003000 013000 Masking Threshold Masking Threshold is a 2021 English-language Austrian horror film directed by Johannes Grenzfurthner, and produced by art group monochrom. A skeptic IT worker tries to cure his harrowing hearing impairment by conducting a series of experiments in his makeshift home lab. The film combines the style of a chamber play, a scientific procedural and the aesthetic of unboxing or DIY YouTube videos, with body horror elements and techniques known from experimental film. Grenzfurthner sees the film in the tradition of extreme cinema, but presents elements of psychological horror. https://en.wikipedia.org/wiki/Masking_Threshold_(film) Trailer: https://www.youtube.com/watch?v=c8ciPdXC6BQ& PUBLIC CONFIRMED Music/Performance/Art/Other Cool stuff https://pretalx.c3voc.de/hip-berlin-2022/talk/MBJW9Z/ HIP - Track 1 - Room 5 e-punc, c-atre collectivdrama PUBLISH JBSLXU@@pretalx.c3voc.de -JBSLXU An ontology of hope: cognitive and blind en en 20221229T110000 20221229T120000 010000 An ontology of hope: cognitive and blind When bad things happen some people come up and say we should remain hopeful. Even if everything looks black and depressing and they can't really justify why—they still claim we should be hopeful. Let's call this blind hope. Other people critique blind faith (and possibly blind hope?) as part of a middle ages style demeanor. Doesn't blind hope imply blind faith, which, in its turn, imply messianism and lack of ideology critique? How can we remain hopeful, then, if hope doesn't make sense? This is what we attempt to address in this talk. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/JBSLXU/ HIP - Track 2 - Room 2 Theodore Keloglou PUBLISH LSVHXN@@pretalx.c3voc.de -LSVHXN An Introduction to Scientific Journalism en en 20221229T133000 20221229T142500 005500 An Introduction to Scientific Journalism Scientific journalism (not to be confused with 'Wissenschaftsjournalismus') is essentially the application of the principles of the scientific method to the process and presentation of journalistic work. This presentation will further define and recall the history -- from Philip Meyer's precision journalism, to WikiLeaks -- of the concept, how it has been practiced in the past, and how it could be practiced in the future. I will also outline my own model of revision-controlled journalism (RCJ) as a further extension that draws on the benefits of open-source intelligence and version control systems. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/LSVHXN/ HIP - Track 2 - Room 2 Janine PUBLISH UGZJMY@@pretalx.c3voc.de -UGZJMY eduroam - eine Reise durch die Technik hinter der Föderation de de 20221229T164500 20221229T181500 013000 eduroam - eine Reise durch die Technik hinter der Föderation Fast alle Studis kennen es: Das Hochschul-WLAN eduroam . An fast jeder Uni oder Hochschule in Deutschland kommen Forscher:innen und Studierende damit ins Internet. Aber wie funktioniert das ganze eigentlich? Wer trägt was dazu bei? Dieser Vortrag soll all das klären. Zunächst wollen wir uns die Geschichte des föderierten Internetzugangs und die Anfänge von eduroam anschauen. Als nächstes wollen wir uns mit der Technik und den Protokollen beschäftigen. Was geschieht, wenn ich mich an einer anderen Einrichtung einlogge? Woher wissen die Komponenten, wer jetzt für mich zuständig ist? Da bei eduroam viele Einrichtungen beteiligt sind, muss der Login-Vorgang aber auch abgesichert werden. Wie funktioniert die Sicherheit im eduroam? Was muss ich beachten und was hilft mir dabei? Abschließend wollen wir uns mit der Zukunft beschäftigen. Wo geht die Reise hin? Wo kann eduroam weiterentwickelt werden? Für wen vorher eduroam eine BlackBox war, der hat nach dem Vortrag hoffentlich ein etwas besseres Verständnis. Und wenn das eduroam mal wieder nicht funktioniert, dann wisst ihr hoffentlich danach etwas mehr darüber, was alles schief gegangen sein könnte. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/UGZJMY/ HIP - Track 2 - Room 2 Janfred PUBLISH WRVZVZ@@pretalx.c3voc.de -WRVZVZ Lightning Talks Day 3 en en 20221229T201500 20221229T211500 010000 Lightning Talks Day 3 Lightning Talks Day 3 -- limited to 15 minutes https://wiki.hip-berlin.de/index.php?title=Lightning_Talks The Lightning Talks will evolve into the Powerpoint Karaoke later in the evening depending on how many Speaker we'll get https://wiki.hip-berlin.de/index.php?title=Powerpoint_Karaoke PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/WRVZVZ/ HIP - Track 2 - Room 2 tig3rch3n PUBLISH JCTRHC@@pretalx.c3voc.de -JCTRHC Powerpoint karaoke en en 20221229T211500 20221229T221500 010000 Powerpoint karaoke Whitfield Diffie entwickelte einst den Prototypen der Software, deren Siegeszug seit den 90er Jahren seinesgleichen sucht. Optisch nicht immer vollkommene Powerpoint-Präsentationen mit oder ohne Nutzwert sind inzwischen zur allgegenwärtigen Gewohnheit geworden - kein Vortrag, der noch ohne die unvermeidlichen Folien auskäme. Von den vielen Milliarden Präsentationen pro Jahr haben wir einige hundert ausgewählt, denn die zuweilen kulturzersetzende Wirkung von Powerpoint kann auch ihre lustigen Seiten haben. Die Berieselung wird so zur Performance. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/JCTRHC/ HIP - Track 2 - Room 2 PUBLISH XTKQMU@@pretalx.c3voc.de -XTKQMU Introduction to the Hare programming language en en 20221229T121500 20221229T134500 013000 Introduction to the Hare programming language Hare is a systems programming language designed to be simple, stable, and robust. Hare uses a static type system, manual memory management, and a minimal runtime. It is well-suited to writing operating systems, system tools, compilers, networking software, and other low-level, high performance tasks. PUBLIC CONFIRMED Talk/panel 75 min + 10 min Q&A (85 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/XTKQMU/ HDMI (room 3) Drew DeVault PUBLISH AFGUPH@@pretalx.c3voc.de -AFGUPH OpenCloudTiles - Free vector maps for all en en 20221229T160000 20221229T163000 003000 OpenCloudTiles - Free vector maps for all placeholder PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/AFGUPH/ HDMI (room 3) Michael Kreil PUBLISH SP7XTF@@pretalx.c3voc.de -SP7XTF Understanding Attacks On AI en en 20221229T183000 20221229T193000 010000 Understanding Attacks On AI The field of AI security, or more specifically ML security, is only just developing. Although a growing number of attack types on ML training data, training, models, and deployments have been discovered, there is no agreement on a clear taxonomy yet. In this workshop we will look at different ML attack types and try to come up with a systematization and a mapping to cyber/infosec attack types and tools. PUBLIC CONFIRMED Workshop 45 min https://pretalx.c3voc.de/hip-berlin-2022/talk/SP7XTF/ HDMI (room 3) David (0xdhf) PUBLISH MRWKCB@@pretalx.c3voc.de -MRWKCB Impostor Syndrome en en 20221229T193000 20221229T203000 010000 Impostor Syndrome 70% of all people experience "impostor syndrome" at least once in their life. In this workshop we will explore the phenomenon and the feeling in ourselves and in group setting by discussing and trying out some of the techniques that have been found useful in countering the paralyzing effects. PUBLIC CONFIRMED Workshop 45 min https://pretalx.c3voc.de/hip-berlin-2022/talk/MRWKCB/ HDMI (room 3) PUBLISH WYQF7K@@pretalx.c3voc.de -WYQF7K Future Proofing my Printer with Reversing en en 20221229T213000 20221229T230000 013000 Future Proofing my Printer with Reversing I have only started reversing the original driver and trying to piece together some proof-of-concept replacement. I still have no idea how to write a PAPPL, but I've learned so much on the way, maybe you want to learn this to and help me? A small warning though: You'll be the person everyone asks on how to setup printers from then on :'-D * https://codeberg.org/ljrk/ricoh * https://support.ricoh.com/bb/pub_e/dr_ut_e/0001294/0001294697/V10_22/r75383L2.exe This is a PE32.exe but you can simply unzip it and get an RPM file which you can extract using rpm2cpio from rpm-tools and cpio. See more: https://wiki.hip-berlin.de/index.php?title=HiPoCrypt#Future_Proofing_my_Printer_with_Reversing PUBLIC CONFIRMED Workshop 90 min https://pretalx.c3voc.de/hip-berlin-2022/talk/WYQF7K/ HDMI (room 3) ElleJay (LJ) PUBLISH MVZST3@@pretalx.c3voc.de -MVZST3 LED Strips Everywhere for Everyone! en en 20221229T140000 20221229T153000 013000 LED Strips Everywhere for Everyone! Learn how to light up LED strips with a cheap Arduino, and make your life trippy and beautiful! For total beginners -- no knowledge needed at all. LED strips have become really inexpensive. Lots of people have created inexpensive methods of controlling their color and brightness. This workshop shows one way to control LED strips, to make them do what you want. We will use a very cheap Arduino clone. I'll show you everything you need to know to use existing programs -- as-is, or to hack on -- to control the colors in your world with LED strips. == Workshop Itinerary == * Intro to Red-Green-Blue (RGB) LEDs<br> * Brief intro to Arduino<br> * How to use an Arduino to control an LED strip<br> * Some demos of programs you can download PUBLIC CONFIRMED Workshop 90 min https://pretalx.c3voc.de/hip-berlin-2022/talk/MVZST3/ Soldering Workshop Room Mitch PUBLISH G9K7L8@@pretalx.c3voc.de -G9K7L8 Beginners workshop - How to plan & build your own LED project en en 20221229T173000 20221229T193000 020000 Beginners workshop - How to plan & build your own LED project Are you curious about playing around with LED strips and building your own LED project? But you don't know how to get started and don't have much experience in electronics and soldering? Then join us at our beginner's workshop! PUBLIC CONFIRMED Workshop (longer than 90 minutes) https://pretalx.c3voc.de/hip-berlin-2022/talk/G9K7L8/ Soldering Workshop Room Marco PUBLISH FCWFK9@@pretalx.c3voc.de -FCWFK9 "That wasn't me, my phone was hacked!" - Should evidence from phones be permitted in court? en en 20221229T170000 20221229T180000 010000 "That wasn't me, my phone was hacked!" - Should evidence from phones be permitted in court? From a technical perspective the integrity of data on a device can not be trusted if 1. there are known vulnerabilities to a device and 2. an attacker is assumed that is capable of covering their tracks after gaining full system access The more is known about the internals of a device, the easier it is to detect traces of manual changes of data and configuration on the device. But how does that look like with smartphones? Should data extracted from there be admitted in court? In this talk I first give some fundamentals of smartphone forensics, zero day markets and smartphone security to then analyze what this means for the admissibility of smartphones evidence in courts. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/FCWFK9/ c-base mainhall Viktor PUBLISH 7NUB99@@pretalx.c3voc.de -7NUB99 abdoccungccecuencen - c-lang, die cprache einer raumstation de de 20221229T183000 20221229T193000 010000 abdoccungccecuencen - c-lang, die cprache einer raumstation die c-base ist eine rückwa:rts gefallene raumctation unter berlin-miTe. mit eigener c_rift. und wenn du diesen tecst lesen kannst oder nicht? ist dieser vortrag genau richtig fu:r dich. oha. es geht um c-lang, die geschriebene sprache der c-base, ganz nah nebenan. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/7NUB99/ c-base mainhall nerdbeere PUBLISH W7XRGH@@pretalx.c3voc.de -W7XRGH Eigenform (live) en en 20221229T220000 20221229T225000 005000 Eigenform (live) Eigenform is an electronic music and multimedia project, started by programmer and musician Artem Popov in Berlin. In his music he combines dark beats, synths, and field recordings, mixed and played with grid controllers, often using DIY synthesizers and sequencers. PUBLIC CONFIRMED Music/Performance/Art/Other Cool stuff https://pretalx.c3voc.de/hip-berlin-2022/talk/W7XRGH/ c-base mainhall Eigenform PUBLISH NUAUJG@@pretalx.c3voc.de -NUAUJG Decentralised social media has a moderation problem en en 20221230T130000 20221230T134500 004500 Decentralised social media has a moderation problem Decentralised social media services after spending decades in obscurity, are finally seeing mainstream adoption. While they offer the promise of a communication platform without a corporate overlord, they struggle to be a safe place for many users. In this talk, I explore the ways that decentralised social platforms struggle with moderation and harassment in a way that many previous platforms didn't. This talk explores what moderation looks like on centralised social services like forums, mailing lists, and corporate websites then shows the additional challenges that come when managing a decentralised service. Particularly, how to protect users from spam and harassment. I explore how past platforms tried to address these problems, and the ways these past approaches are and are not applicable anymore. I focus on the ways things like Mastodon struggle to protect its users from harassment, though the criticism is equally applicable to any other server implementing a similarly decentralised protocol offering similar affordances. I'll discuss what people are doing there now to deal with these problems, focusing on both technical and social conventions that have evolved over the years. Finally, I'll give a broad overview of the possible solutions currently being discussed and explored. These solutions ranging from secondary services federating moderation decisions between instance operators to whole new protocols designed to address these concerns directly. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/NUAUJG/ HIP - Track 1 - Room 5 zaxtax PUBLISH DYW8MV@@pretalx.c3voc.de -DYW8MV What if XSS was a browser bug? en en 20221230T143000 20221230T153000 010000 What if XSS was a browser bug? We’ll talk about mXSS and HTML parsing as background and then also explain why the XSS Auditor didn’t work (as a prime example of a browser-controlled XSS mitigation). Using examples from recent mXSS attacks against sanitizers, we are explaining the root cause of these issues and the solution: Parsing needs to be done within a context-element. Then we will explain how a built-in Sanitizer API can fill the existing gap and what it can and can not protect against, looking at more recent attacks like DOM Clobbering and script gadgets. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/DYW8MV/ HIP - Track 1 - Room 5 Frederik Braun PUBLISH 9FESXJ@@pretalx.c3voc.de -9FESXJ HiP Review & Closing en en 20221230T173000 20221230T180000 003000 HiP Review & Closing Review & Closing done by crew PUBLIC CONFIRMED Talk/panel 30 min https://pretalx.c3voc.de/hip-berlin-2022/talk/9FESXJ/ HIP - Track 1 - Room 5 cven pandora PUBLISH BLQWGL@@pretalx.c3voc.de -BLQWGL The Mandelbot Ecotech Project and Ancientscan en en 20221230T110000 20221230T120000 010000 The Mandelbot Ecotech Project and Ancientscan Two presentations by inventor, artist and independent researcher, Scott Beibin Part One - Mandelbot Ecotech is a project and design philosophy that focuses on developing ecological sustainable machine design primitives that value self-sovereignty and communitarianism. The presentation will feature tasty 3d printed vegan snacks on the latest prototype, The SURFA2 (Scalable Universal Robotic Frame Assembly co-designed by Scott Beibin and Mike Taylor of Uncanny Technologies. Part Two - Ancientscan is a new project created by Scott Beibin and Liz Cole that focuses on documenting ancient archaeological sites and artifacts in order to examine engineering anomalies of the past. Through the use of LiDAR, high resolution photogrammetry, spatial audio and spectral analysis the main goal of the project is to better understand and reverse engineer the technologies of antiquity. The presentation will feature Scott's latest LiDAR scans of tool marks at sites in Egypt. PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/BLQWGL/ HIP - Track 2 - Room 2 Scott Beibin PUBLISH SVJY9M@@pretalx.c3voc.de -SVJY9M Weaving, Old and New Technology: from Design Concept to Diva Fashion en en 20221230T123000 20221230T133000 010000 Weaving, Old and New Technology: from Design Concept to Diva Fashion This will be a presentation documenting the process of creating a high-end designer scarf with mathematical patterns, from concept design to final product. The journey will take us from pencil, paper, and computer design, to spreadsheet assisted dyeing of yarns, to the preparation the loom, to the weaving process itself, and the final finishing touches to arrive at the beautiful finished product. Hopefully it will familiarize the uninitiated with the processes involved in creating a real world woven object. I also hope that this discussion will inspire collaborations for future work involving computerized looms, computer-assisted weaving designs, new tech-enhanced fibers, and anything else that could extend the possibilities of weaving. Maybe next conference we will have a working computerized loom! PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/SVJY9M/ HIP - Track 2 - Room 2 chris lombardi PUBLISH FRLYBH@@pretalx.c3voc.de -FRLYBH die Physik der Musik de de 20221230T140000 20221230T144500 004500 die Physik der Musik Musik berührt. Musik begeistert. Musik macht traurig, fröhlich, melancholisch und manchmal nervt sie vielleicht auch einfach. Eins ist aber klar: Musik ist Kunst. Und zwar eine, die unsere Hörgewohnheiten sehr stark durch unsere Geschichte und Kultur geprägt hat. Es gibt wohl kaum einen Menschen, der keine Form von Musik mag. Aber wodurch kommt das? Was ist diese Musik eigentlich? Und warum gibt es Klänge die uns zum weinen vor Schönheit und andere zum Fußnägel hoch rollen bringen? Ist das nur Kultur und Gesellschaft verschuldet oder steckt da noch was anderes hinter? Ich, als leidenschaftliche Musikerin und begeisterte: „Aber warum genau ist das jetzt so?!?“ Fragerin habe versucht dem einmal vom Grund an nachzugehen. Und Überraschung, wir landen bei grundlegenden Physikalischen Konzepten. Von diesen aus ergeben sich fragen, angefangen bei: Was ist eine Klangwelle?, über: Wieso nehmen wir unterschiedliche Intervalle verschieden wahr?, oder: Wie können wir eigentlich verschiedene Instrumente unterscheiden?, bis hin zu: Wie kommt es, das Dur eher als fröhlich und Moll ehr als traurig wahrgenommen wird und was hat das mit diesen ominösen Obertönen zutun? Das ganze kann in kompliziert aussehender Mathe Sprache erklärt werden, oder durch graphische Darstellungen, die uns zeigen, das böse Matheformeln im Grunde etwas wunderschönes verstecken. Ich versuche mich an zweiterem und da sich Musik nicht ohne eben diese erklären lässt werden auch die akustischen Beispiele nicht fehlen, sodass außer dem eigenen Gehör und ein Bisschen Forschergeist keinerlei Vorkenntnisse benötigt werden. Aber auch jenen, die auf den einzelnen Gebieten gut bewandert sind, werden aus der Verbindung aus beiden noch so ihren Spaß ziehen können, denn was gibt es schöneres, als Gegensätze zu vereinen? PUBLIC CONFIRMED Talk/panel 45 min + 10 min Q&A (55 Minuten) https://pretalx.c3voc.de/hip-berlin-2022/talk/FRLYBH/ HIP - Track 2 - Room 2 Emilia Lilu Steinhauser PUBLISH Z8FRRX@@pretalx.c3voc.de -Z8FRRX Get started with hacking the badge en en 20221230T130000 20221230T143000 013000 Get started with hacking the badge So you have this powerful tool on a lanyard around your neck but no clue how to change it to something more useful, or even more beautiful? Come to this talk/workshop and we will set you up. You will need a badge (naturally), a laptop with (ideally) linux on it, and a USB cable to connect the laptop and the badge. This workshop is also an opportunity to exchange ideas and other wisdom around this device. Whether you know all or nothing -- come as you are, and show us your amazing hacks and ideas on the badge. Let's get the energy flowing in preparation for the summer camp. PUBLIC CONFIRMED Workshop 90 min https://pretalx.c3voc.de/hip-berlin-2022/talk/Z8FRRX/ HDMI (room 3) gooniesbro