chflags · HackerTrans

chflags

no profile record

comments

10 years agodiscuss

I agree with the distinction you make between targeted and non-targeted. But I think being able to easily accomplish targeted attacks on SSL/TLS is a cause for concern -- and indeed that's what I'm thinking of. My thought is that it should not be possible for users to place such trust in something that is so easily subverted. As for DNS, I see no reason why one cannot encrypt DNS packets to prevent tampering. If users ignorantly want to use third party caches (which opens up more problems than just the one you mentioned), even when it's so easy to run a local cache, then we see arguments for another "trust model", e.g., DNSSEC, etc. Same problems.

10 years agodiscuss

The traffic between the attacker and the private network would have been properly encrypted.

Assuming they chose a sensible cipher suite, where is the "crypto flaw"?

Maybe the problem is not the crypto but the strange system devised for authentication of an endpoint.

I call this x509. In my opinion this bizarre^1 "trust model" dating back to a long past era in computing is one of the reasons why MITM on SSL/TLS^2 in today's world of computing is so easy. The other reason is the trust placed in domainnames over IP numbers. Both are systems that delegate "authority" to third parties.

1. https://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt

2. Or perhaps an attack like the one here.

OpenSSH can use x509 for authentication but by default it does not. It uses host keys. Maybe it's not even a "default" but it is the traditional usage.

CurveCP also uses keys instead of certifcates.

The big difference in my view is that x509 relies on the idea of a "certificate authority" or "CA" that "issues" certificates for users.

Host keys require no such authority -- users generate their own.

With x509, there is a reliance on third parties that somehow are deemed "trusted". Host keys require no third parties and therefore no added layers of trust.

Certificates are a business^3. Host keys, to my knowledge, are not.

3. This is starting to change so that certificates can be "free" like host keys. I'd argue it is still a business however, due to the third party involvement in the process.

The widespread use of "self-signed certificates" seems to be an illustration of the desire by users to use certificates like host keys -- i.e., without needing a third party "authority" to "issue" them.

10 years agodiscuss

"... breaks the trust model of SSL/TLS,"

Certainly some of the encryption one can get via SSL/TLS is worth something. (But then one could use that encryption outside of TLS, too.)

And maybe some elements of the protocol are worth something.

But on the open internet is the "trust model" really worth anything?

It is so ridiculously easy to subvert. Cloudflare does it on a mass scale.

But one does not need to be Cloudflare to do it. The "incovenience" of subverting SSL/TLS is minimal.

Any website who is delegating their DNS to some third party is potentially vulnerable not to mention any user who is delegating their DNS lookups to a third party. Those are very large numbers.

Note I said open internet. I am not referring to internal networks.

Also - Question for the author: Was the archiving of dnshistory.org successful? Did they recently shut down and use Cloudflare to block ArchiveTeam?

10 years agodiscuss

Does RT still use mrsync? Great program.

10 years agodiscuss

Boots from SD card. Uses U-Boot for bootloader. Hardware support in two BSD projects as well as Linux.

Godspeed.

10 years agodiscuss

That's why I'd prefer a search engine that was not using AWS, or Yahoo. Too many needless dependencies.

Out of curiousity I'm starting a counter today. Will post something when this IP addr fails. Feel free to take a guess how long it will be used by DDG.

And when it does change, if ever, I have a one line shell script that uses ed to remove entries from files, so all it takes to add a new IP addr to HOSTS is typing

    ed-script-name domain-name /etc/hosts
    echo aa.bb.cc.dd domain-name >> /etc/hosts

In my opinion, the usefulness of a website is inversely proportional to the frequency with which it changes IP addresses.

For example, the IP address for HN rarely changes.

But feel free to keep looking it up in DNS every day. Just in case.

If there are problems with DNS, most users will probably not remember the IP address for HN and will not be able to read the stories.

Meanwhile, the user that stores IP addresses as a backup will have no such problems.

10 years agodiscuss

Why do they say "duckduckgo-owned"?

It appears they are using AWS. Who really owns the server?

   echo 50.18.192.251 duckduckgo.com >> /etc/hosts

Avoids needless DNS lookups; saves DNS logs from your footprints.

10 years agodiscuss

So it's not possible to log on without enabling Javascript?

I guess that's one way to coerce the user into enabling Javascript, at least temporarily.

10 years agodiscuss

"We started out collecting this information by accident, as part of our project to automate everything, but soon realized that it had economic value."

Is he saying the end results of the project to [insert stated project purpose here], e.g., "to automate everything", "to organize the world's information", etc., did not have enough economic value to sustain the project... and hence founders were "forced" to collect data as a means to generate value?

Here's another version: pre-Google search engines realized they could sell ad space, i.e., paid placements, e.g., to auto manufacturers.

Once the advertising industry became involved, then collecting data about the network's users, if one could do it, was a no-brainer.

"... really it's just the regular old world from before, with a bunch of microphones and keyboards and flat screens sticking out of it."

Not sure that young people who worship Silicon Valley want to believe this, and why should they?

The author always makes a good case for the potential long term consequences of the so-called "changes to the world" that many programmers are adamantly pursuing.

Maybe these programmers are not changing the world. Maybe they're just doing what others already did in the past, on a smaller scale, without the benefit of cheap electronics.

10 years agodiscuss

Stallman's writing is reminiscent of The Jargon File or FOLDOC. There are many "silly" terms like the ones you mention in those collections. (More on textfiles.com.) Stallman was a part of that era. Maybe he's just an original 1970's "hacker" trying to stay true to his ideals. They liked to create their own counter culture vocabulary.

Then you have Zuckerberg who puts some blurb in Facebook's first SEC filings that his website^W company will follow the "hacker" ethos. What was he doing there, using that term? He sure has a lot of corporate sponsorship for a "hacker".

Imagine Stallman and Zuckerberg in a certain American game show that ran for several decades. Hint: The game's title relates to honesty.

"Will the real 'hacker' please stand up?"

10 years agodiscuss

"...I'm not sure if you are trying to imply that Stallman brought us the Internet..."

No. The opposite. I'm trying to draw attention to the fact that besides free open source software, improvements in the network allow companies like Facebook to grow as big as they are.

Before clang, FreeBSD used gcc. I'm actually not a GNU/Linux user; I wish BSD did not have to use gcc, but for as long as I've been a user, release engineering has always used gcc. I would personally prefer to use something like pcc as opposed to clang.

Today, lots of companies use GNU software, when they could just as easily use BSD. And many BSD users still need gcc to compile their OS. Not how I expected things to turn out but attacking Stallman makes little sense at this point.

Instead, maybe we should be thanking him.

Companies like Facebook offer very little while taking all our personal information for their commercial use, while open source projects like BSD and GNU continue to offer a great deal, without requiring so much as an account or password, much less tracking our every move.

10 years agodiscuss

I'll bet Zuckerberg and countless Facebook employees have used software written by Stallman.

At the risk of being wrong, I'd even go so far as to say they need this software.

But does Stallman ever need to use software written by Zuckerberg or Facebook employees?

Personalities and errors in judgment aside, give respect and credit where it is due.

I have never needed Facebook's software. And I doubt I ever will.

From a purely utilitarian viewpoint, my gratitude goes to Stallman and the people who brought us the internet. I'm not sure what I could thank Facebook for.

If Zuckerberg had failed to be in the right place at the right time, there would always be a substitute.

But if there was no Stallman back in the 70's and 80's, would we still have gcc, gdb and so much free, open source software?

10 years agodiscuss

OP: "... cemented them as assholes in my mind."

That's "name-calling".

But I understand the need to detach the silly hyperbolic responses my comment triggered. I was not expecting those.

Please accept my apologies for any incomvenience I may have caused.

10 years agodiscuss

"... linux laptops were being reformatted to run windows."

Microsoft/Windows is a cancer. Ballmer once said Linux was a cancer. He later retracted, after it was well-known Microsoft itself uses Linux.

There's nothing more pathetic than when you see Microsoft's businesspeople or lawyers at conferences all faithfully using Windows, as if there was no other choice, and rambling on about how their products can solve any problem. These are not stupid people, but they are blinded to independent reasoning about computer software.

And then there are the people at Microsoft Research. What a waste (not for them -- they probably get paid handsomely). It is like MS is keeping these minds locked away, so the zombie-like adherence to Windows can persist. Keep the monopoly going.

Microsoft is a cancer on the brain. It creates a zombie-like, tunnel vision of computing. Everything must pass through Redmond.

Microsoft continues to remain dangerous to the future of computing, because they continue to work dilgently to effectively quell all independent thought from being implemented and made accessible to users.

Intent, malice, etc. is irrelevant. Regardless of why they do it, the end result is suppression of non-Microsoft software.

And now hardware.

10 years agodiscuss

In the late 1990's when they started, around the same time as Metafilter, maybe Google was honestly trying to rank websites based on href's, as some perceived indicator of website popularity.

But over time how much has Google itself influenced the product of its own "Pagerank" algorithm?

If Google places a website as a first search result for some frequently searched term(s), even if by accident, then that website is going to become very popular, very quickly.

Opinion: Google determines the popularity of a website.

In the early days we believed they were presenting results based on the relative popularity of websites. At some stage Google itself became the determinant for the popularity of websites.

Stories like this one support this idea.

One could argue Google is running what amounts to an online version of the Yellow Pages where the ads can be changed or rearranged hourly, daily, weekly, etc. Instead of calling a telephone number to place an ad in the Yellow Pages, one has to enter an opaque Adwords auction for words instead of ads.

But for the small business, especially those who do not bid on words, it gets worse. A business listing in the search results will likely never been seen if it is not in the top 10, i.e., on page 1.

Imagine if this were true for the Yellow Pages, which is organized alphabetically. Businesses with names beginning with numbers or the letter "A" would receive a grossly disproportionate share of calls, because no one would ever get past the first page of listings.

As crazy as it sounds, I think there's an argument Google and not the user is effectively doing the choosing. Whether it's intentional or not is irrelevant. The way the system is implemented and used, this is the effect. And this only benefits Google.

10 years agodiscuss

Well said.

As a result of advances in technology, news, scholarly research, books, music, film, etc. can all be created and distributed by _anyone_, because it can be done at lower cost. This is bad news for some old school money-making schemes, but good news for consumers.

Perhaps consumers on the web are getting accustomed to "free" without any focus on quality. The classic arguments that lower cost means lower quality may be weakening.

Poor analogy: The computers we use today are less expensive than the ones we used in the 1980's. But who argues that they are lower quality? (I am not suggesting whether they are or not, just pointing out the arguments that people make.)

10 years agodiscuss

The way they word these releases certainly makes it sound like they have users' best interests in mind.

But honestly, as you have highlighted, these announcements should be insulting to users' intelligence.

"Dear Users: Please allow us to store copies of all your sensitive data, including every email ever sent or received, in perpetuity. In return, to the extent the law permits us to do so, we'll let you know (_ex post facto_) when some other third party is having a look at it."

The solution to the problem if indeed there is a problem here is not going to come from Google.

The problem _is_ Google.

The only parties who need a copy of an email are the sender and the recipient. If you really care about privacy, security, whatever, then "store and forward" and "POP" via some third party (Google, etc.) is not the proper way to implement email.

Hypothesis: Google does not charge for Gmail because, quite simply, no one would pay.

10 years agodiscuss

Page looks great in my text-only browser (no ad-blocker needed). Thank you AdTech Operator, even if it was not intentional.

10 years agodiscuss

Do you think there could be any bias when the newspapers, or for-profit search engine projects, who rely on selling advertising "space" as their "business", report on the practice of filtering out advertising? Not me. These folks epitomize the highest standards of integrity.

If www search engines and "journalists" are being paid primarily by advertisers, and not readers, then we have the best system for "news" that has ever been created. And we can be proud of their achievement, and how they are using the latest communications technology and the public resource of internet bandwidth for its highest and best purpose. Everyone in the ad sales industry should pat each other on the back. You have provided readers with so much greatness. You have earned your success.

As readers, we should be thankful for these heros for making the internet and mobile carrier networks work so smoothly and keeping us so well informed, at such low cost to readers. Everbody wins. Brilliant.

10 years agodiscuss

"This is cool."

Not just cool, but useful. "UEFI" should have been a Forth-like REPL like Sun, FreeBSD, OLPC, etc.

The output of rappel reminds me of an "assembly level debugger" I used for many years called "ald". Maybe I am just stupid, but when I'm writing assembly I like to verify the contents of registers as a program executes.

From user.h: "Fuck computers, multiarch is bullshit."

Agreed.

I need something that compiles easily on NetFreeOpenBSD x86. Mo multiarch bullshit. Meanwhile I will stick with as, objcopy and ald.