micro_softy · HackerTrans

micro_softy

no profile record

comments

il y a 10 ansdiscuss

On the notion of "unhackable" I commented here: https://news.ycombinator.com/item?id=12671744

il y a 10 ansdiscuss

"What's important is hackable by who, and in what way."

I strongly agree with this statement but my explanantion of it may be somewhat different.

Hackable means controllable.

Hack = control.

A computer, including a small form factor one called a "mobile phone", should be hackable by its user. Freedom to tinker.

A user can then, if so desired, set up and use the computer in such a way as to be less hackable by others. There is nothing more discouraging for an attacker than a highly idiosyncratic, non-standard system.

A user cannot protect a computer over which she does not have meaningful control. This is common sense. Mobile phones are just computers... with a lot of unneeded complexity. And third parties such as telecoms and search engine companies have greater control over them than users.

Trying to protect a user's computer by delegating control to a third party or combination of third parties, while denying control to the user, is an exercise in futility.

A computer that is sealed shut, with a locked bootloader and which can only use a narrow choice of OS, etc. is not hackable by its user.

It can be secured against users perhaps, but it cannot be secured in any meaningful way against third parties that truly benefits the user.

This is because the user does not have the most control over the computer.

It does not matter how much effort the user wants to make including how much money they are willing to spend in order to protect the computer because the user is not allowed to have as much control as various third parties.

A $5-$25 credit card-sized development board is easier to protect than a mobile phone.

Because it is "hackable" by it user.

il y a 10 ansdiscuss

"Now, it's been a few years since gcc has been able to produce a real listing..."

Can you share with readers the version number for the last gcc that can do this satisfactorily?

il y a 10 ansdiscuss

The author argues DDoS causes centralization because it's "just too easy to knock unprotected websites offline" and so they need to pay some organization that makes money from centralization for "protection".

This assumes that the centralized topology and usage of the internet as it is implemented will never change, despite the fact that by design an internet can be decentralized and therefore resilient. Isn't that what Paul Baran thought made it a useful idea?

Imagine for a moment that the internet really was like a mesh net instead of several lengths of heavy rope frayed at the ends. Imagine it looked like Paul Baran's sketches.

True or false:

If there was not such reliance on "backbones" and "ISPs" then knocking some endpoint offline would not necessarily threaten the connections of others and would not be costly to anyone except the target. DDoS would only affect a small portion of the network mesh. There would be multiple ways for point A to reach point C besides going through B.

True or false:

If internet users demanded peer-to-peer connections instead of accepting firewalled, calf-cow access to "websites" then there would be no need for DDoS protection, because knocking a website offline would not stop people from getting the served content from other endpoints. The attacker would have to knock offline every supernode that an endpoint could possibly access or every node listed in a distributed hash table.

il y a 10 ansdiscuss

No. But they could theoretically kill the "big guys" internet.

If a company controlled search, blogs, video content distribution, email, web browser, mobile phone OS, regional internet access, etc., and that company derived 98% of its revenue from ads, then ad blockers could theoretically kill its business.

The question is can the "little guys" internet survive without relying on handouts from the "big guy"?

philipkglass answered this question at least with respect to the www part of the internet.

History shows a noncommercial internet and then a little guys web predates the big guys internet.

A more intriguing question is whether the big guys internet can survive ad-blocking. The big guys internet relies on little guys all coming to the big guys for handouts. The big guys internet produces no content of its own. It simply acts as middleman for the little guy and sells ads.

il y a 10 ansdiscuss

Avoiding DRM is easy. Avoid corporate-sponsored browsers.

Writing programs that download files is not beyond the capabilities of average programmers. And internet users have ample access to open file formats and source code to read and write them.

Who controls media formats? Who controls media players? "Browser"? What is that?

A program to "browse" hypertext has evolved into something with far more functionality than is actually required for digesting media. As this complexity grows the notion of the "browser" will continue to be used to the greater advantage of corporations engaged in commerce, not users.

Proprietary browsers, or ones that are too complex for ordinary programmers to compile from source, can be the equivalent of proprietary media formats and proprietary media players, in effect.

The greatest opportunity to avoid DRM is in choice, not steering committees. Choice, as in, choice of what software to use. And that includes "browsers".

Think outside the browser. Thank you.

il y a 10 ansdiscuss

I have a similar issue.

Sometimes, but not every time, when I turn on a particular halogen lamp using the same outlet as a particular computer, it triggers USB detection and I get kernel messages on /dev/console as if I was plugging in a USB device.

This is a BSD kernel.

il y a 10 ansdiscuss

He is suggesting something much easier and different from DNS.

WHOIS is one of the simplest internet protocols. The RFC is beautifully short. Unlike DNS, there's no rules on sizes of requests or responses, and it uses TCP by default.

His suggestion deserves an upvote for its simplicity, elegance.

il y a 10 ansdiscuss

Any plans to include i386?

il y a 10 ansdiscuss

"... we have not forced anybody to use it."

What kind of an argument is that?

Send everybody a binding agreement that allows the company to collect data and use it for commerical purposes. Let the users decide whether to sign it.

Surely, if the above is a solid argument, then most everyone would sign it.

"Yes, we held out a carrot, but we did not force any rabbits to take it."

il y a 10 ansdiscuss

Why not have a competition to see who can produce an alternative? Similar to the competitions between ciphers.

Any language should be allowed. The problem is not necessarily the language.

Sometimes it is the programmer, or more often the programmers. What happens when there are too many cooks in the kitchen.

il y a 10 ansdiscuss

You want enhanced privacy, control and transparency?

Use a less complex program to retrieve web pages, with less features. (Or to post data.)

Then use another program that cannot commmunicate with the network to view them. Remove all networking code and recompile.

The complexity and feature set of the second program is up to the user.

I find that many of the features of Chrome, Firefox, etc. are ones I do not need on a daily basis.

As radical as this might sound in contrast to the conventional wisdom, if I had the influence of an organization such the ones producing Chrome or Firefox I'm quite sure that I could convince other users that they really don't need these features either. Such features usually come with an undisclosed or downplayed cost.

il y a 10 ansdiscuss

"I feel like a broken record..."

But it needs to be said.

No one is going to ever say it, but SSL/TLS can be used to better hide the fact that companies like Microsoft and Google are siphoning off quantities of personal data from people using their browsers.

Sometimes a user wants to "MITM" themselves, i.e., set up an HTTPS proxy, to see what's being sent from their devices. That should always be an option available to the user.

The motives of any company that starts making that more difficult to do should be questioned. These companies are legally obligated to put their interests first, not the user's interests.

They can spin it to make it sound like they are advancing everyone's interests at once. But if they are not advancing their own interests first and foremost, then they are not doing their job. Users need to be more active in protecting their own interests.

Fundamental to those is the ability to monitor one's own traffic, e.g., outgoing data.

Any option that cannot be turned off ceases to be an "option".

The recent story with Lenovo's BIOS favoring Windows 10 by not letting users disable a certain power management setting is another example.

il y a 10 ansdiscuss

"... remove the Phone from the iPhone"

I read a comment on HN that said AppleTV is what you describe.

The author seems to be ignoring the Mac G3/G4/G5/Pro computers.

Apple is still in the pro audio market, aren't they?

il y a 10 ansdiscuss

Here's an interesting retweet from ProDOS's author last month.

   @JBrooksBSI
   [59]Aug 17
   Was MS-DOS copied from CP/M? 
   [60]embedded.com/electronics-bl...

   60. https://t.co/mOR5mLBHwC

http://www.embedded.com/electronics-blogs/say-what-/4442498/...

il y a 10 ansdiscuss

"Slack for everyone".

(After paying some registrar and ICANN gets its 13 cents or whatever.)

Pay to play DNS aside, this is really what the "web 2.0" should have been.

IMHO, an IRC channel has always been more functional than a "website".

It makes peer to peer easy.

il y a 10 ansdiscuss

There are other ways to block ads besides this one solution. The web ad delivery mechanism is brittle.

But when will this game end?

Advertisers should just pay consumers (users). Why bother with a middleman?

Request for Project (RFP): Let all users sign up to be paid by advertisers. (This is not a new idea.) Sign up with enough advertisers and one can have "universal basic income".

Users should not be giving away their time for free. Every time a web advertiser distracts a user, they are "stealing" the user's time.

Advertisers pay for this privilege. But they do not pay the users. They pay off someone -- you know who -- to help them steal users' time.

Just pay the damn users. Enough of this silly game.

Added benefit: It would open up the search engine market and social networking (photo database) market to competition and innovation.

il y a 10 ansdiscuss

You never tried NetBSD?

If you are suggesting NetBSD has more things enabled by default than OpenBSD I would bet that is incorrect. I have tried a lot of different projects and NetBSD is the best I have seen for not enabling anything. It forces you to figure things out.

Whenever I read OpenBSD mailing lists or blogs, they often seem more aggressive in trying to make their users adhere to the default system provided. That's fine, but NetBSD generally does not do this. Users are not assumed to be idiots and are not discouraged from experimentation.

The BSD projects share more similarities than differences. None of them require anyone to use the entire base system or the defaults. Users can compile their own kernels, write their own configs e.g., based on examples provided, and cherry pick utilities.[1] In my opinion this is made just a tad easier than with Linux.

1. But if you do this with OpenBSD and advertise it, I think you may draw some criticism. Frankensystem, etc. They are not encouraging experimentation, they are encouraging conformity.

il y a 10 ansdiscuss

Is "Analyzing Sun Networks" out of print?

I remember this book as being quite good.

So many of those "old" Sun ideas are still around today, in one form or another.

il y a 10 ansdiscuss

Do web developers find ways to create work for themselves?

You allude to it below when you say "zillions of hours".

There is a significant amount of money moving through the "web development industry".

People are getting paid to write things that suck.

The internet actually has made leaps and bounds in terms of what can be delivered over it to the masses.

But the "web" has become a cesspool of redirects, overstuffed headers and pages crammed with beacons, ad server links and ad-related Javascript, accessible through ad-sales-company-sponsored software ("web browsers") to run the ad-related Javascript.

If and when users grow tired of web advertising, the entire system is a risk of a serious correction.

Again, significant and increasingly larger sums of money are moving through the web ad and user data collection cesspool so no one really cares how poor the quality of the "content" becomes.

And you want to learn to orient your mind to this "new way of thinking"?

Maybe you are not resisting change. Maybe you are resisting stupidity. Your time may be better spent focusing on backend development. Today's "backend" may be tomorrow's frontend.

All that "content" can easily be delivered without a single line of Javascript and without using search-engine-ad-sales-company-sponsored software.