[00:13.650 --> 00:21.430]  At this point, I'd like to welcome Dan and Lucas to present, My Call Sign is My Passport.
[00:25.610 --> 00:32.110]  Thank you, thank you. So, thank you everyone for coming to our talk. My Call Sign is My
[00:32.110 --> 00:36.730]  Passport, Responsible for Testing and Disclosure of Ham Radio Websites.
[00:38.230 --> 00:44.870]  So, I'm Dan Nort. I'm a Senior Security Consultant at NetSpy. I've got three years of experience,
[00:45.090 --> 00:50.170]  a little over three years of experience doing web application penetration testing, X-PEN,
[00:50.170 --> 01:01.450]  Cloud-PEN, API-PEN, so a wide skill set there. I've been licensed for six years and I now
[01:01.450 --> 01:04.510]  have my amateur extra as of May, so.
[01:06.750 --> 01:12.330]  All right, I'm Lucas Scaler. Ten years in InfoSec, did some digital forensics, sensor
[01:12.330 --> 01:18.130]  response, pen testing, phone management, now I run a security operations team. Licensed
[01:18.130 --> 01:21.270]  for 14 years, amateur... what is up with it?
[01:21.270 --> 01:22.210]  It's a bad one.
[01:22.210 --> 01:22.650]  Yeah.
[01:22.650 --> 01:24.250]  Yeah, it's a little jiggly.
[01:24.410 --> 01:26.170]  We don't want to talk about wires here.
[01:26.330 --> 01:29.830]  No. Maybe we'll just skip the mic.
[01:29.850 --> 01:30.710]  Yeah, skip the mic.
[01:30.710 --> 01:36.890]  Yeah, all right, we'll talk loudly. Yeah, so licensed for 14 years, now amateur extra,
[01:36.890 --> 01:45.070]  GLARD V. So start off with the usual disclaimer. Dan and I are doing this on our own volition.
[01:45.070 --> 01:51.850]  It's not anything from our employers. And there is some propensity for getting in trouble
[01:51.850 --> 01:56.350]  if you were to do some of this, so don't necessarily do what we did. Be careful if you decide to.
[01:56.470 --> 01:58.350]  It's not our responsibility if you do.
[01:59.870 --> 02:02.170]  This is how we pota in Minnesota.
[02:04.930 --> 02:10.270]  We're out on a frozen lake, it's zero degrees out, and miserable fun is what we like to do.
[02:10.270 --> 02:12.230]  Miserable fun is the best fun.
[02:13.090 --> 02:20.310]  And if you have an FCDX10 and you like the little protection rails, it's on Thingiverse, he designed them.
[02:23.670 --> 02:26.110]  So this is actually my home QTH.
[02:27.810 --> 02:31.890]  I'm technically portable during the summer. I go and I set up in the backyard.
[02:33.130 --> 02:34.390]  This is how I operate.
[02:34.390 --> 02:40.410]  Well, last year I wanted to be able to operate inside during the winter, because as you saw from our pota slide,
[02:40.410 --> 02:43.110]  in Minnesota it gets cold. I don't know if you guys know that.
[02:44.590 --> 02:49.670]  So Lucas came over, helped me install a ground rod, we got everything grounded, bonded,
[02:49.670 --> 02:54.050]  everything's done right, but that's what hams do. Hams help hams.
[02:55.010 --> 02:59.870]  And the water bottle trick in order to put a ground rod works great.
[03:01.610 --> 03:02.670]  Five minutes?
[03:02.670 --> 03:03.390]  Five minutes.
[03:03.390 --> 03:04.510]  It was amazing.
[03:06.170 --> 03:09.070]  So, how this all started.
[03:09.430 --> 03:11.730]  I accidentally found a vulnerability.
[03:13.130 --> 03:16.170]  I don't know if you guys know this about me, I'm kind of lazy.
[03:16.250 --> 03:18.970]  So I happen to be on my favorite ham radio website.
[03:18.970 --> 03:21.370]  Listening to the radio in the backyard.
[03:21.710 --> 03:23.790]  And I hear an interesting call sign.
[03:25.110 --> 03:27.730]  I'm not going to use the search bar, I'm lazy.
[03:27.870 --> 03:30.830]  So my call sign was already in the URL.
[03:31.170 --> 03:37.410]  So I went ahead and just typed in the interesting call sign in the URL.
[03:38.610 --> 03:39.950]  Next slide.
[03:43.010 --> 03:49.730]  Now, this is what we call an insecure direct object reference, or IDOR for short.
[03:50.890 --> 03:53.970]  It seemed like there was some sensitive information.
[03:53.970 --> 03:58.550]  By the way, all these slides are completely faked because we'll go into that later.
[03:59.010 --> 04:05.790]  But it seemed like there was some sensitive information here that I should not be able to see on someone else's profile.
[04:07.690 --> 04:08.870]  And that's why it was an IDOR.
[04:08.870 --> 04:11.930]  Now I wasn't sure if it was an IDOR or if this was intended functionality.
[04:12.830 --> 04:14.970]  Now we get to kind of the big problem.
[04:15.430 --> 04:16.370]  What do we do?
[04:16.370 --> 04:19.750]  So here's the problem with trying to disclose something.
[04:20.810 --> 04:25.230]  There are many incidences of where it did not go well for the person trying to disclose it.
[04:25.230 --> 04:27.030]  Someone trying to do the right thing.
[04:27.150 --> 04:32.750]  And him and I went back and forth on this for quite a bit before we decided what is the right thing to do in this case.
[04:32.750 --> 04:39.290]  There was the F12 incidents where, hey, you use dev tools, the governor now says, you're a hacker.
[04:39.430 --> 04:42.430]  And it's like, well, if he's a hacker, I want to hire him.
[04:42.710 --> 04:45.310]  But there's other cases.
[04:45.310 --> 04:48.510]  Four students arrested for disclosing a vulnerability.
[04:48.510 --> 04:51.790]  And they were strip searched for disclosing a vulnerability.
[04:51.790 --> 04:52.990]  That's how bad it goes.
[04:52.990 --> 05:01.410]  And when I was looking for these things, it turns out I actually found like an open source project that is tracking this sort of like occurrences.
[05:01.410 --> 05:06.910]  And the fact that there needs to be a project of that scale tells you just how bad of a problem this is.
[05:07.030 --> 05:08.410]  And so it's like, what do you do?
[05:08.410 --> 05:11.010]  Do you do the right thing and disclose?
[05:11.730 --> 05:15.290]  Or do you just say, yeah, it's not my problem?
[05:15.510 --> 05:16.610]  Well, we're hams.
[05:17.430 --> 05:18.690]  So it's Dan.
[05:18.690 --> 05:20.290]  So of course, he's going to full send.
[05:20.290 --> 05:21.570]  And it's me, I'm going to full send.
[05:21.570 --> 05:23.630]  A disclosure to the site owner.
[05:23.630 --> 05:29.350]  So at this point, I emailed the site owner asking him, hey, is this intended functionality?
[05:30.030 --> 05:34.710]  Here is seven steps to replicate this exact behavior.
[05:38.730 --> 05:41.610]  But hey, everything turned out okay.
[05:41.790 --> 05:43.590]  He confirmed it was a problem.
[05:43.590 --> 05:45.210]  Was very, very grateful.
[05:45.550 --> 05:48.070]  Remediated it within just a few days.
[05:48.070 --> 05:51.010]  And then asked me to validate that it was actually fixed.
[05:51.550 --> 05:53.450]  Can't get better than that, right?
[05:53.450 --> 05:55.310]  Didn't go to jail, didn't get strip searched.
[05:56.430 --> 06:01.970]  Now, we were wondering, hey, why did this go so well for me?
[06:02.790 --> 06:05.930]  Obviously, the professional reporting, I write pen test reports all the time.
[06:05.930 --> 06:08.070]  So it's kind of like within my wheelhouse.
[06:08.650 --> 06:13.550]  I believe it might have been because I asked, hey, is this actually a problem?
[06:14.490 --> 06:16.610]  Because I didn't want to assume anything.
[06:16.610 --> 06:22.950]  But the thing that him and I identified, we think, was why it went okay.
[06:22.950 --> 06:25.370]  Because we were licensed, or I was licensed.
[06:25.430 --> 06:28.150]  And so, he comes in later on this.
[06:28.150 --> 06:29.950]  I was licensed, and so it was...
[06:30.650 --> 06:34.530]  The license kind of like gives you a little bit of trust with other hands.
[06:34.530 --> 06:38.270]  Because, I mean, hey, we all care about the call signs.
[06:39.830 --> 06:41.730]  Ending in Lima, come back, you know?
[06:41.730 --> 06:43.110]  We've all been there.
[06:43.110 --> 06:47.430]  So this is great.
[06:47.430 --> 06:55.550]  We helped, at this point, we helped one of my favorite ham radio websites.
[06:55.670 --> 06:57.970]  And we improved their security posture.
[06:57.970 --> 07:02.370]  And we got rid of a vulnerability that actually would impact other users and their data.
[07:02.370 --> 07:04.810]  It wasn't extremely sensitive.
[07:04.890 --> 07:09.530]  But it was still things that I felt were like, people shouldn't be able to see that.
[07:10.890 --> 07:13.630]  But we wanted to be able to do more, too.
[07:13.830 --> 07:15.730]  So Dan and I talked about it a little bit.
[07:15.730 --> 07:20.870]  We decided to approach the owner again and say, hey, what if we do a full assessment of your site?
[07:20.950 --> 07:24.470]  Let's look around for other stuff beyond just what we've stumbled on.
[07:25.190 --> 07:27.230]  We're hams. Here's our call signs.
[07:27.490 --> 07:29.350]  Here's what we're thinking for a scope.
[07:29.350 --> 07:31.410]  We're going to do manual testing only.
[07:31.410 --> 07:34.670]  We're going to keep within these certain testing windows.
[07:35.190 --> 07:37.570]  We're going to not do destructive testing.
[07:37.870 --> 07:40.190]  We're going to provide a report back with the findings.
[07:40.490 --> 07:43.510]  We're going to not disclose specifics prior to remediation.
[07:43.510 --> 07:47.570]  And we're going to de-conflict by, here's the IP addresses we're coming from.
[07:47.570 --> 07:49.290]  Here's the testing windows. We're going to do it.
[07:49.690 --> 07:55.010]  So this way, if anything went wrong, he at least can go like, oh, it wasn't actually them that caused that problem.
[07:55.010 --> 07:59.030]  Because it's like, hey, here's our de-confliction.
[08:00.210 --> 08:03.550]  But yes, absolutely no scanning. It's prod.
[08:03.970 --> 08:05.110]  It's prod.
[08:05.230 --> 08:07.430]  So he was 100% on board.
[08:07.430 --> 08:10.130]  He was very excited to get some more attention on it.
[08:10.130 --> 08:17.950]  So in summary, what we ended up finding, six high vulnerabilities, three mediums, three lows, and one informational.
[08:18.130 --> 08:21.250]  And this was done over a little more than 12 hours of time.
[08:21.450 --> 08:24.250]  Spread out over a couple weekends, an hour here and there.
[08:24.810 --> 08:28.250]  And that's an actual photo of us doing the assessment right there.
[08:29.170 --> 08:31.310]  I think that was weekend two.
[08:31.670 --> 08:38.790]  But yeah, so the important thing is, that was 12.5 hours between two of us, spread over several weekends.
[08:38.790 --> 08:42.910]  It was not any sort of big commitment for us.
[08:42.910 --> 08:45.710]  We weren't burning up our weekends or anything like that.
[08:45.710 --> 08:49.870]  It was, hey, we got a little bit of time, let's send some help.
[08:49.870 --> 08:50.790]  Full send.
[08:52.670 --> 08:55.750]  So you can't come to DEF CON without showing the hacks.
[08:56.930 --> 09:04.030]  As I mentioned earlier, I can't actually show you the real hacks, but we got a mocked up version of the hacks.
[09:04.030 --> 09:09.790]  As we said, don't disclose anything that the owner isn't comfortable with you disclosing.
[09:09.890 --> 09:11.570]  We're here to help.
[09:12.190 --> 09:18.150]  So, I don't know if you know this about hams, we love logs.
[09:19.590 --> 09:21.930]  Yeah, okay, so that tracks.
[09:22.730 --> 09:26.410]  So, obviously most websites you can upload your logs.
[09:26.410 --> 09:29.530]  The other thing we love to do is brag about our logs.
[09:29.530 --> 09:34.010]  I personally like to do a handwritten log and then later upload it.
[09:34.670 --> 09:39.470]  So, now I'm looking at someone else's log, which is intended functionality.
[09:40.890 --> 09:43.610]  Now what happens if I try to upload something to my log?
[09:44.130 --> 09:44.930]  Next slide.
[09:47.090 --> 09:49.530]  So, got a flex of the FT5D here.
[09:49.570 --> 09:56.030]  So, there's my call sign, because it's going to say, hey, it's going to go to my log.
[09:56.350 --> 09:58.910]  What happens if I just go ahead and change that?
[09:58.910 --> 10:01.530]  Does anyone remember the vulnerability from earlier?
[10:02.130 --> 10:04.690]  When you find one, there's usually more.
[10:04.930 --> 10:07.270]  So, what do we have? This is an iDoor.
[10:07.510 --> 10:08.550]  Next slide.
[10:09.450 --> 10:11.990]  Boom, now I'm uploading to someone else's log.
[10:11.990 --> 10:16.210]  I just put him into this very interesting person's log.
[10:16.290 --> 10:18.590]  Not a real call sign, at least I hope not.
[10:19.290 --> 10:21.210]  Don't know, should have checked.
[10:21.570 --> 10:22.790]  Next slide.
[10:22.870 --> 10:25.530]  So, now let's go a little bit further.
[10:25.530 --> 10:32.890]  Instead of actually just uploading a legitimate log to someone else's log,
[10:33.180 --> 10:38.070]  what if we put a cross-site scripting payload into there?
[10:40.570 --> 10:47.310]  And now we have stored cross-site scripting with an iDoor on someone else's log.
[10:48.470 --> 10:50.870]  What can I say?
[10:51.950 --> 10:53.810]  Ham websites need some help.
[10:53.810 --> 10:56.970]  If you've got the skills, volunteer.
[10:59.290 --> 11:00.210]  Next slide.
[11:01.070 --> 11:04.970]  Now, you may have noticed there was an informational finding.
[11:05.730 --> 11:09.810]  You know, we had, what, three highs, three mediums, something like that.
[11:09.810 --> 11:11.190]  But there was one informational finding.
[11:11.190 --> 11:13.310]  I don't know if you guys know this about me.
[11:13.490 --> 11:14.190]  Probably not.
[11:14.190 --> 11:15.730]  I hate TLS findings.
[11:16.570 --> 11:18.130]  My side of the house hates them.
[11:18.130 --> 11:19.310]  His side of the house hates them.
[11:19.310 --> 11:20.950]  Everybody hates TLS findings.
[11:20.950 --> 11:23.070]  This is not your normal TLS finding.
[11:23.570 --> 11:31.190]  So, the TLS certificate in use had an annual cost of over $200 for this website.
[11:31.190 --> 11:35.610]  So, we all know everyone's always asking for donations and donations and donations.
[11:35.610 --> 11:37.610]  Here's another way that we can make an impact.
[11:37.810 --> 11:39.850]  That's why we included this.
[11:40.070 --> 11:43.510]  We recommended that he switches to Let's Encrypt.
[11:43.510 --> 11:53.290]  But then, we also provided the correct installation instructions for the architecture and infrastructure that was in use.
[11:54.390 --> 11:57.670]  And that's just a big impact of saving $200 for that website.
[11:57.670 --> 12:00.850]  That's $200 less in donations that they're going to need.
[12:02.450 --> 12:04.190]  But, how do you feel about TLS findings?
[12:04.190 --> 12:05.210]  I also don't like them.
[12:05.210 --> 12:06.650]  Yeah, everyone hates TLS findings.
[12:06.650 --> 12:08.350]  I hate fixing them because they come back in a month.
[12:08.350 --> 12:10.550]  The second you remediate it...
[12:10.550 --> 12:11.010]  They're bad.
[12:11.010 --> 12:12.550]  There's another bad cipher.
[12:13.430 --> 12:21.010]  So, this got us thinking about, alright, so this one website's like this.
[12:21.010 --> 12:21.930]  How prevalent is this?
[12:21.930 --> 12:25.450]  How common are these kind of things across amateur radio websites?
[12:25.750 --> 12:27.510]  So, we did some research.
[12:28.550 --> 12:32.670]  Turns out, it's a pretty common kind of thing going on.
[12:33.310 --> 12:38.550]  So, 40% of them we found had what we considered to be an excessive number of services open.
[12:38.550 --> 12:40.530]  In many cases, what seemed to be unnecessary.
[12:40.530 --> 12:47.450]  Things like FTP, DNS, RPC, RDP, R-SQL, I mean MySQL.
[12:48.710 --> 12:53.450]  If your SQL server is exposed to the internet, it's not MySQL no more.
[12:53.510 --> 12:54.810]  It's R-SQL.
[12:55.570 --> 12:58.510]  You know, banner grab suggesting versioning was often behind.
[12:58.510 --> 13:00.830]  There's caveats around the accuracy of banners, right?
[13:00.830 --> 13:06.690]  But, it's still pointed to a pattern of, hey, there's probably some patching that we're deficient on here.
[13:06.690 --> 13:12.770]  And then, just seeing a SQL server on there is telling you that you have a database function running on a web server.
[13:14.830 --> 13:17.030]  So, what can we do about it?
[13:18.290 --> 13:27.410]  If we look at the Venn diagram over here, we can see there's a large overlap between InfoSec enthusiasts and licensed amateurs, right?
[13:27.610 --> 13:31.390]  That intersection point in the middle is why we have a ham radio village at DEF CON.
[13:31.390 --> 13:35.010]  So, that's basically you, right there.
[13:35.010 --> 13:41.970]  So, if we were able to do this, why can't other hams in InfoSec do the same thing, right?
[13:42.570 --> 13:48.750]  You know, verifiable identification can go a long ways, right, towards establishing trust.
[13:48.850 --> 13:53.910]  Call sign happens to be a very easily identifiable and verifiable piece of information that we all have.
[13:54.390 --> 13:59.630]  You know, many of these sites are being run by hams as a DIY side quest, right?
[13:59.630 --> 14:02.450]  They're just trying to make a little piece of the hobby work.
[14:02.950 --> 14:04.810]  They need all the help they can get.
[14:05.030 --> 14:11.670]  So, what we're advocating is to reach out to the sites that we care about and that we use, identify yourself as a ham,
[14:11.670 --> 14:16.390]  provide your call sign, and request permission to utilize your skills in whatever way they need.
[14:18.310 --> 14:24.510]  So, to that end, put together some kind of simple general guidelines on how to start, right?
[14:24.510 --> 14:26.290]  Keep this simple, right?
[14:26.290 --> 14:28.430]  Get permission from the site owner.
[14:29.630 --> 14:34.790]  We don't want to be, you know, pushing on stuff that isn't necessarily what they're looking for.
[14:34.790 --> 14:38.730]  Don't go looking for a vulnerability before you get permission.
[14:38.970 --> 14:43.810]  I happened to accidentally stumble upon one, and that's what led to this.
[14:43.810 --> 14:46.890]  But don't start looking until you get, like, permission.
[14:47.590 --> 14:50.510]  So, FriendDA is kind of the name of the game here, right?
[14:50.790 --> 14:54.650]  Honor the scope and constraints that you agreed to originally, right?
[14:55.050 --> 14:59.250]  Because there's still no legal protections here. We still have the CFAA in force.
[14:59.750 --> 15:01.710]  You know, avoid the destructive testing.
[15:01.970 --> 15:04.030]  It's fraud. It's fraud. It's fraud.
[15:04.070 --> 15:07.230]  And, you know, don't disclose the stuff you've been asked to keep private, right?
[15:07.650 --> 15:11.030]  We've built trust around our call sign, so let's keep that trust going.
[15:12.310 --> 15:17.590]  So, really trying, too, to focus on identifying issues and recommending solutions, right?
[15:17.590 --> 15:19.730]  We're just trying to start at a ground floor here.
[15:20.390 --> 15:26.270]  You know, offer to help with fixing if you're inclined, but really we're looking at remediation as the bonus.
[15:26.270 --> 15:30.950]  We just want to identify the problem so that they can figure out where they need to go next with it, right?
[15:30.950 --> 15:34.710]  Many sites are going to have limited resources to be able to actually remediate things.
[15:35.110 --> 15:38.770]  We're really trying to position this in the spirit of amateur radio licensing.
[15:39.490 --> 15:41.650]  How we conduct ourselves, right?
[15:41.830 --> 15:45.390]  Really fostering a collaborative dialogue instead of an adversarial one.
[15:46.630 --> 15:50.050]  So, going along with that, it's important we've got to know our limits, right?
[15:50.590 --> 15:53.610]  We're trying to help, not create more stress for the site owners.
[15:54.170 --> 15:56.810]  So, the key there is to stick to what you know, right?
[15:57.030 --> 16:00.750]  Everything here, we've got to be treating like prod under SLA, right?
[16:00.750 --> 16:01.730]  Because it is prod.
[16:03.150 --> 16:03.830]  Yeah.
[16:05.490 --> 16:08.170]  Probably not the place to try out your new techniques, right?
[16:08.170 --> 16:12.710]  Work on those in your lab and then come back later and do the things that are familiar to you, right?
[16:12.710 --> 16:16.290]  You know, probably skip a little bit of Ion Cannon here as well.
[16:16.430 --> 16:18.090]  Likewise, knowing when to stop, right?
[16:18.090 --> 16:21.970]  There's a very big difference between pulling a random exploit from ExploitDB
[16:22.510 --> 16:28.870]  and reading a banner and looking at the version and looking at vulnerabilities that apply to that one.
[16:29.070 --> 16:34.630]  Because, again, it's really not hard to get in trouble with the CFAA if you're kind of going outside the bounds.
[16:35.490 --> 16:37.970]  Because there's no legal protections and it's prod.
[16:38.830 --> 16:45.710]  So, kind of going back to those common themes before and some examples of ideas we can give as recommendations, right?
[16:45.910 --> 16:50.430]  Limiting attack surface, turning on a firewall, shutting down services you don't need, right?
[16:50.730 --> 16:52.910]  Segmenting those logical functions out.
[16:53.130 --> 16:56.810]  Just getting those databases down into a database tier away from the DMZ.
[16:56.930 --> 16:58.710]  Patching systems, right?
[16:58.710 --> 17:00.670]  Like, even the app stuff, right?
[17:00.670 --> 17:02.610]  Use the OLAF Secure Coding Guide.
[17:02.610 --> 17:06.370]  Applying OLAF, this is all pretty basic stuff to a lot of the industry.
[17:06.370 --> 17:11.550]  But for HAMS, it appears to maybe be an area we can go back and kind of get back to the basics of.
[17:11.550 --> 17:17.510]  Because it's a hobbyist thing and while they... they're running as a DIY side quest, basically.
[17:17.510 --> 17:20.010]  And they need help.
[17:20.470 --> 17:23.770]  So who can help?
[17:23.790 --> 17:26.390]  Cool thing is there's something for everybody, right?
[17:26.390 --> 17:30.370]  As we thought about this, pen testers can go looking for vulns like they usually do.
[17:30.370 --> 17:33.050]  Usually breaking stuff. Try not to do that here.
[17:33.390 --> 17:39.310]  App dev, right? Look for OLAF's top 10 or even just get more involved in some of the open source projects in the HAM community.
[17:39.970 --> 17:42.310]  General tech, they're going to need help with remediation.
[17:42.310 --> 17:44.290]  They need to understand how infrastructure works.
[17:44.490 --> 17:46.990]  How best to apply some of this stuff, right?
[17:47.110 --> 17:48.610]  Even somebody in audit, right?
[17:48.650 --> 17:52.470]  Is going to be able to map against one of the common frameworks that are out there.
[17:52.470 --> 18:01.270]  And the great thing is, if you're new to IT, some of this makes for very good ways to get bullet points for the resume.
[18:02.050 --> 18:11.010]  Hey! I mean, like, if I see a bunch of accepted pull requests on your GitHub, I'm saying that's pretty impressive.
[18:11.490 --> 18:13.330]  It helps, yeah.
[18:13.570 --> 18:17.770]  So, we're really just trying to start a conversation here, right?
[18:17.770 --> 18:19.890]  We've obviously identified a need.
[18:19.890 --> 18:24.170]  But beyond that, this is still a relatively fresh idea, right?
[18:24.530 --> 18:27.530]  You know, some things we're kind of noodling on yet.
[18:27.530 --> 18:30.190]  How do you handle the sites that don't want help, right?
[18:30.190 --> 18:33.770]  And the ones that are unmotivated or not really looking for help, right?
[18:34.030 --> 18:39.330]  As we think about where the industry was 20 years ago with responsible disclosure on its own.
[18:39.330 --> 18:42.810]  I say just pass on them and just help someone that wants help.
[18:43.050 --> 18:46.730]  And we can circle back to the difficult ones later.
[18:47.430 --> 18:52.610]  Yeah, I mean, should your kind of standard responsible disclosure timelines even apply here?
[18:52.750 --> 18:56.210]  Is the data on these sites even important enough to warrant it?
[18:56.310 --> 19:02.570]  I have my opinions at an ethical level, but I think that's a broader question than just what I think.
[19:02.570 --> 19:09.630]  And then as someone from my side of the house, if you find something that's critical, you're going to have to push it.
[19:09.630 --> 19:14.470]  But I don't believe we're going to find too many critical things that are that bad.
[19:14.470 --> 19:20.790]  And we really should just don't go adversarial, keep it as a collaborative thing.
[19:20.790 --> 19:25.630]  But that's my opinion. But this is going to have to be a discussion we all have someday.
[19:26.330 --> 19:32.150]  So kind of looking down the road, some other areas we're interested in trying to dig a little deeper into, too,
[19:32.150 --> 19:35.610]  is seeing if we can carve out some legal perspective for this, right?
[19:35.610 --> 19:39.430]  And finding some ways to make this a little bit easier, right?
[19:39.430 --> 19:43.470]  Some kind of sow-like paper trail would be really beneficial for being able to say,
[19:43.470 --> 19:46.350]  this is what we're up to, here's what we're doing, right?
[19:47.310 --> 19:51.910]  So if there's any attorneys out here, love to hear from you. Got any ideas?
[19:52.270 --> 19:54.250]  An attorney that has a license.
[19:56.750 --> 20:02.450]  You know the idea of a bug bounty, right? We kind of got to stay away from money when it comes to amateur radio.
[20:03.090 --> 20:08.990]  But people love to chase paper. Is there some kind of thing that can get tied into that, right?
[20:08.990 --> 20:12.090]  With how we look at bug bounties normally operating.
[20:12.390 --> 20:13.730]  Found all bones.
[20:18.010 --> 20:20.890]  Develop a community source testing methodology as well, right?
[20:20.890 --> 20:25.230]  Kind of come up with, here are the ten things that the hobby should be looking for, right?
[20:25.450 --> 20:30.710]  You know, standardized community reporting templates, any other supporting reference material we want to come up with.
[20:31.430 --> 20:33.670]  So it's kind of a wide open thing, right?
[20:34.490 --> 20:39.030]  It's a thing we kind of stumbled into and curious what the rest of the hobby thinks.
[20:39.030 --> 20:40.910]  Well that's the thing, hams help hams.
[20:40.970 --> 20:45.810]  So there's a couple of our references.
[20:48.490 --> 20:50.150]  Contact info for us.
[20:50.750 --> 20:53.730]  And we'll put these slides up on github here in a little bit.
[20:54.110 --> 20:58.710]  At least you can find us on QRZ and our proton addresses there.
[20:58.890 --> 21:01.010]  Yeah, I guess I'll update my QRZ.
[21:02.390 --> 21:02.990]  But...
[21:04.950 --> 21:09.230]  So I'd like to, first and foremost, I'd like to thank
[21:09.350 --> 21:13.430]  a very special ham radio website owner who I cannot name
[21:13.430 --> 21:16.270]  because we decided
[21:17.010 --> 21:21.690]  together that we couldn't actually name them yet.
[21:21.730 --> 21:24.810]  But thank you very much, you know who you are.
[21:25.070 --> 21:28.850]  So thank you. I really wish I could.
[21:28.850 --> 21:33.090]  But you know, I just can't. But anyhow, it was wonderful.
[21:33.090 --> 21:36.730]  Thank you to the ham radio village for having us. Thank you for everyone who came up.
[21:36.730 --> 21:39.970]  Big thank you for Ferris for coming and filming. Thank you.
[21:42.730 --> 21:45.510]  We'll be around for questions if there's any after.
[21:46.790 --> 21:48.850]  Come on, give a shout out to your daughters.
[21:48.850 --> 21:50.350]  Come on.
[21:55.410 --> 21:56.830]  Oh, and if Kenwood
[21:56.830 --> 22:00.930]  wants to send us a 75 to test out for security.