malloc2x · HackerTrans

13 years agodiscuss

Is there a Free software package that does something like this today?

13 years agodiscuss

To decrypt after-the-handshake bytes I think you're right, they would need a leaf private key.

However, they absolutely can mount a MITM with the CA root.

EDIT: Further, if they can compel a master key then they can also compel a copy of all the private keys the CA generates.

malloc2x

13 years agodiscuss

You must assume that the NSA already has master keys for all domestic CA root certificates, and given how many were hacked recently, foreign ones too. In which case SSL traffic is effectively the same as plaintext to them.

The solution could be a distributed CA system like http://convergence.io/

malloc2x

13 years agodiscuss

The biggest problem faced by organizations collecting this type of data is sorting the signal from the noise.

Unfortunately, until real encryption is the norm, using this font or other means to hide your communications is like giving the NSA a free "this bit is particularly juicy, have a human read it" flag.

malloc2x

13 years agodiscuss

An interesting idea.

s|movies, games, music|games/software| and it might be more plausible. (.mkv, .mp3 or even the .rmvb that's weirdly popular in China are hardly common attack vectors.)

However, if we're talking about China, and the demographic of employees that get sent for international matters, then we're definitely not talking about people that can't afford their own computers. I would posit this holds for nearly any country (except North Korea?)

Taking your argument as just "a culture of grabbing untrustworthy software from anywhere is the reason", it becomes more persuasive to me.

malloc2x

13 years agodiscuss

More testing:

* On Chromium 25 and Chrome 26 the first two issues do not exist.

* More playing with FF20 and it seems this is actually tied to CTRL+B, not any other shortcut. At least initially, clicking the "Bold" button also has no effect. Possible explanation: In FF CTRL+B opens the Bookmarks pane by default, in practice certain focus combinations do open this pane. This explanation would seem to require the Bold widget to be generating a keypress under the hood, though.

* The codes issue is tricky, but one way to see an example on Chrome/chromium browsers is:

  1. refresh page
  2. select pre-existing "Go ahead..." text
  3. type "this is bold and this is not"
  4. select "this is bold" and make it bold
  5. place cursor at start of " and this is not"
  6. type "so is this", text is bold
  7. hit enter and type "but this isn't", it isn't bold

The original issue I saw was similar, but related to numbered bullet lists. To reproduce the third issue on FF follow the same steps, except a) one must first mash about on CTRL+B and/or the Bold button until they start working, then follow same steps. Result: you get the inverse, text in 6 is not bold, and text in 7 is.

Sorry, don't have domain knowledge about keybinding.

malloc2x

13 years agodiscuss

But does it work?

A couple minutes of basic usage (FF20, Linux) have me in pain:

- CTRL-B (and presumably other shortcuts) doesn't always take effect immediately. Sometimes there is delay, sometimes it seems necessary to let go of CTRL for the event to get flushed, sometimes nothing ever happens at all. Multiple hits without letting go of CTRL also behave erratically.

- Focus stays on formatting buttons and requires manual click to get back to text widget. Several times I wondered where my text was, only to realize focus was on wrong widget.

- By far the worst thing: the way formatting codes are handled leaves me crying for WordPerfect's Reveal Codes. Make some text bold, unbold the text after it, type something right after the bolded text, it isn't bold, hit enter for new line and type something, now it became bold again. Argh!

I like the idea of this, but presently there are some rough edges.

malloc2x

13 years agodiscuss

Don't know what jurisdiction you're in, but fraudulent transactions[1] == "theft" in the colloquial/moral sense where I'm from. Malice is not requisite to defraud.

[1] I charge you for services but do not provide them.

malloc2x

13 years agodiscuss

s/politics/<reason_of_the_day>/

To me the point is that when you start arbitrarily enforcing rules against some people (small guys) and not others (big guys) it smacks of hypocrisy. Maybe you can explain how it was just blind process -- it still stinks.

malloc2x

13 years agodiscuss

Treating the big guy one way and the little guy another may be "pragmatic" but that's not upstanding in my book. Sure, it's within their rights to do business with whom they want, but it doesn't mean we can't call a double standard when we see one.

malloc2x

13 years agodiscuss

generally an honest and upstanding ad network

Unless you happen to be a small guy and fall on the wrong side of their political beliefs: https://news.ycombinator.com/item?id=5438797

malloc2x

13 years agodiscuss

If you read some of the comments, essentially: a) looking for resistors that could be placed in multiple positions on the board and b) following the traces from the resistors: going to GPU? probably not what you want. Going to PCIE interface? Probably correct.

malloc2x

13 years agodiscuss

Ah, sometimes that's a hard line to draw since often the people that know enough to understand not to take it literally don't really need the pointer in the first place. :)

I enjoyed your list.

malloc2x

13 years agodiscuss

If that's an issue (I've never met a server like that, not to mention one like that and I couldn't change the setting) then wouldn't you rather use this?

  while [ true ]; do sleep 1000; done

Just using:

  sleep 1000; exit

means you can't make new connections after 17 minutes.

malloc2x

13 years agodiscuss

Better to use, e.g.:

  ssh -fN -o ServerAliveInterval="240" -R 2222:localhost:22 example.com

(And on example.com ssh -p 2222 localhost)

This lets you easily keep the tunnel open long-term. Why?

  -f    Background the ssh process (don't need nohup)
  -N    Don't run any command
  -o... Make ssh do the work of keeping the session alive forever