dlitz · HackerTrans

dlitz

no profile record

Submissions

Today Is Burn All GIFs Day (1999)

1 pointsby dlitzvor 10 Jahren0 comments

Dan Bricklin invented the spreadsheet–but don’t hold that against him

2 pointsby dlitzvor 11 Jahren1 comments

comments

vor 3 Monatendiscuss

> My ISP changes the prefix on a regular base (and on request)

I found this was the case (with Telus) until I reconfigured the DHCPv6-PD client on my gateway, mainly to stop it from sending DHCPv6 Release messages and to have it explicitly request the prefix I was previously assigned.

OpenWRT in particular seemed to be built not to save any dhcp client state in non-volatile memory, resulting in a lot of unnecessary address and prefix churn when rebooting the router. I've had the same stable prefix for over a year now, using systemd-networkd with the following configuration (the important parts are SendRelease=no, RequestAddress= and PrefixDelegationHint=; the rest of the options are just insurance):

https://gist.github.com/dlitz/487d733140aa784559d73e4cd6f723...

vor 7 Jahrendiscuss

I don't believe rms is seriously in favor of child sexual exploitation, but that's a red herring.

The concern for me is has been the accounts of far more directly-relevant behaviour, such as (iirc):

  * repeated phone calls to someone from different phone numbers

  * leering

  * breaking the ground rules for an event, and justifying it on the basis that he's personally exempt from any rules

  * singling out a teenage girl attending one of his talks (as in "oh wow, a GIRL")

  * single her out again while telling his questionable 'EMACS virgins' joke

  * saying in an interview that he didn't know any women who have contributed to GCC, when there had been at least 4

It all adds up to several accounts of people saying they've left the free software movement (or avoided it entirely) because of his behaviour combined with his stature. As a community leader who supposedly leads by example, he needs to do better, and if he doesn't, the community needs to hold him accountable. That's happening now.

Personally, I think this is a good thing, and I'm glad that he's made the decision to step aside (even if under pressure) rather than fight bitterly and see the community divide along these lines.

It also seems like a good opportunity for him to pass the torch and see what happens, or at least take a long hiatus to get some caring advice and to sort himself out, like Linus did last year. The FSF will eventually need to become an institution that can carry on its mission without him, and this will be a good test of that. If things go off the rails, he can pen another manifesto and I'm sure a bunch of us will read it.

vor 7 Jahrendiscuss

Well, a compromised google.com main page could return malicious search results for certain queries. How many Windows sysadmins install PuTTY by googling "putty", and then installing an executable from whatever site shows up in the first couple of results?...

vor 7 Jahrendiscuss

The important thing is that tags are signed and up-to-date, like how git tags work or how Debian signs its entire repository as a unit (via the Release file) rather than having developers just sign individual packages. Otherwise, even if it's signed, it's subject to downgrade attacks.

Installing known-vulnerable old versions of legitimate software can be just as bad as installing custom malware.

vor 7 Jahrendiscuss

I think yall are using the terminology differently from each other in this thread. "Checksum" historically did not imply resilience against intentional modifications.

Nowadays, it's arguably a best-practice when designing a new protocol or storage format to simply make all checksums cryptographically strong unless there's a reason not to. I think that might be where the confusion is coming from.

vor 10 Jahrendiscuss

Just fix it in the parser. ;)

vor 10 Jahrendiscuss

It'll be great precedent for when Iran, China, Russia, etc. want to do the same thing.

vor 10 Jahrendiscuss

Yes, apparently Canada has something called the Patented Medicine Prices Review Board:

http://pmprb-cepmb.gc.ca/about-us/frequently-asked-questions

vor 10 Jahrendiscuss

Yeah, Matthew Garrett also gave a pretty detailed talk about it Linux.conf.au 2012, which reaches a similar conclusion: https://www.youtube.com/watch?v=V2aq5M3Q76U

vor 10 Jahrendiscuss

Foreign journalists? Glenn Greenwald and Laura Poitras are both American.

vor 10 Jahrendiscuss

The "auto" in "autopilot" stands for automatic, not autonomous. Autopilot systems have existed for decades, and they've always referred to systems that automate the most tedious parts of operating a vehicle, while still requiring a human operator to handle new/unexpected situations.

vor 10 Jahrendiscuss

I'd like to see a good CLI design involving sandboxing-by-default, and handling object-capabilities (e.g. file descriptors) as first-class objects.

Right now, "convert a.jpg b.png" passes the strings "a.jpg" and "b.png" to ImageMagick's convert command, but that command is free to open whatever files it wants, since there's no distinction between strings vs resources such as filenames, network sockets, etc.

You can do this with pipes in simple cases, and bash has some support for this, but it's very primitive and the syntax is cumbersome.

vor 10 Jahrendiscuss

I live in Canada. AS6939 is Hurricane Electric.

vor 10 Jahrendiscuss

You do when you work at a job that doesn't offer flexible hours.

vor 10 Jahrendiscuss

Error 1005 Ray ID: 2bc55074399a2a5b • 2016-07-02 21:50:36 UTC Access denied What happened?

The owner of this website (www.fas.org) has banned the autonomous system number (ASN) your IP address is in (6939) from accessing this website.

vor 10 Jahrendiscuss

You also want the passphrase to be easily changed, separately from the master key (because changing the master key is slow and resource-intensive).

Even if you have a strong passphrase, there's some probability of leaking some number of bits of it via side-channels every time it's entered (e.g. surveillance cameras, fingerprints on the screen, shoulder surfing, vulnerable code, TEMPEST, etc). Plus, people often keep a backup copy of their passphrases (unique, strong passphrases are hard to remember), so there's also a cumulative risk of the backup leaking over time, as well.

Long-term confidentiality is just surprisingly hard in the real world.

vor 10 Jahrendiscuss

Is there any way to see exactly what this system does, aside from faking a suicidal episode on my timeline and getting friends to report it?

I've heard that early versions of this system basically inserted barriers between suicidal people---who are already overwhelmed---and their support networks.

Considering Facebook's poor track record when it comes to handling vulnerable populations (nym policy, location support in Messenger, etc.), I'd strongly discourage anyone from using this reporting system without a complete understanding of what it actually does.

Heed should also be paid to the effect of having more than one of these systems being triggered at the same time. The last thing I need when I'm feeling overwhelmed is a dozen apps on my phone suddenly changing their behavior.

vor 10 Jahrendiscuss

How does this guarantee a secret ballot, i.e. that voters remain unable to prove to a third party that they voted in a particular way?

Low-value elections don't necessarily need secret ballots, but it's important for high-value elections, like selecting the POTUS.

vor 10 Jahrendiscuss

The problem is harder than it sounds when you're talking about something as high-value as a national election (especially in the US).

Have you read "Reflections on Trusting Trust"?

vor 10 Jahrendiscuss

I don't see the big problem. Lots of other libraries already work this way. Perhaps most of them.

If you're shipping binary packages, you need to build them in a clean chrooted environment anyway (such as pbuilder/sbuilder/docker or a VM) or you're going to end up with binaries that depend on the latest glibc point release that happens to be installed on your system.