xv6 is an amazing teaching OS - it is very simple to dive into and play around with. A while ago I wanted to explore some filesystem/permissions stuff and use xv6 to play with some concepts (see http://sarahjamielewis.com/posts/file-system-permissions-and... - still lots I want to play around with there when I find some time) - If you are at all interested in OS dev it is a great gateway.
One of the reasons for the relative expense is the heavily-subsidised corn (and a few other) industries which pretty much all goes to animal feed.
That being said, my food costs were easily cut in half when I went vegan (and now, they are about 1/4 after some fine tuning of some other recipes) - I mostly get protein from chickpeas, kidney beans and lentils - which are all super-cheap compared to meat. I also eat a fair bit of tofu (which is very low in fibre and which is also very cheap compared to meat). Tempeh is another option, but I don't tend to make it often. We generally cook a big batch of food at the beginning of the week - which means time to prepare is amortized nicely (and frying tofu is very quick also)
I will admit that processed vegan meat-alternatives do tend to be more expensive than their animal derived counterparts, and not the healthiest - so I tend to avoid them - most of the expense is due to small production runs and limited quantity - and the extra processing.
> Maybe you can explain to me then how it is that this makes a significant difference in global warming. The carbon that is released by cows and humans after consumption of plant matter was derived from said plant matter. The carbon in those plants came from the air. Hence, this is a closed system where carbon is taken from the air by the plants, consumed by the animals, and then put back into the air by the animals. There cannot be a net gain of carbon from this.
Instead of the energy taken to grow those plants going to feed people - they are used to grow animals. This takes an enormous amount of input energy from farming the plants, to transporting them to the animals. Not forgetting water transport also. Then there is the energy that is taken to manage the huge sums of waste that these animals produce (most of which is stored in huge silos or pits, which ends up leaching into ground water - but that's another thing). Then there is the energy to transport, kill, transport, package, transport and eventually sell - so the energy / calorie of animal food is no where near efficient as it is for plants and beans. Basically, it is not a closed system - we input so much energy into sustaining our meat habit (as well as the ethical implications of killing 100,000,000-500,000,000 sentient animals a day - including fish and the resulting bycatch)
I think we agree when it comes to the impact of a solution - there needs to be a HUGE concerted effort to even make a dent - people can't immediately change the nature of the worlds largest companies - but I believe that our only hope is to promote local change (to get people to commit to a lifestyle change that has to happen one way or another) - and push for governmental reform - will it be perfect? no. Will it be easy? nope. But we have to start somewhere - and I think diet and local economies might be a good first step.
One of the (many) reasons I went vegan was to cut my impact on the environment. I don't own or use cars. Where I can I walk, where I can't I take public transit. I've made considerable changes to what and how I buy, to source food with less of a total impact. I've started to look at alternative clothing and technology strategies to reduce my environmental impact there too.
I know there are plenty of geeks who have done similar things. The truth is that a new tech or more companies aren't going to solve this problem - the problem is we (who live in large economies) now live in a world which is completely separated from the daily realities of where our stuff comes from. We have spent the last 50 years enabling large mono-cultures and promoting specialization - which has done amazing things for food availability - at the expense that now a single plate of food easily contains ingredients from every continent - at a huge environmental impact. Similar trends have happened in manufacturing, textiles and practically every other industry.
Trends in tech that might help us:
* Hyper-local agriculture
* Locally-efficient down-cycling / recycling programs - for clothes, tech...pretty much everything.
* Teaching people how to buy and cook produce.
But the truth is that every individual needs to make a transition in how they live - that means eating less (hopefully no) meat and animal products, repairing instead of buying new, developing ethical supply chains (starting by knowing the supply chain is a good start!)
And yes, companies need to change and adapt too...that means more environmental regulation, more incentives to develop and adopt renewable sources of energy - how we structure those is completely beyond my expertise though...and I don't have much hope there.
No it isn't accurate for hidden services. See https://www.torproject.org/docs/hidden-services.html.en - hidden service communication some some level of encryption end to end (whether that is sufficient or requiring another layer - say TLS - is a matter of usecase and threat model).
Pinning necessarily has to restrict the times a certificate can be changed because otherwise we have to solve a different problem "How can I tell this new certificate is a good certificate".
You have proposed a solution to that second problem, let's look at the threat model:
You adversary is:
* Capable of forcing or otherwise being able to create valid certificates.
* Has the capability to MITM nodes in a network.
The solution you have provided adds an additional hurdle for the adversary:
* must also be able to subvert your CA (or more generally, a specific CA - it doesn't actually matter if you or someone else controls it - what matters is it is a specific root certificate).
So the browser, now TOFU'ing the initial certificate makes a note of the current certificate (and pins it) as well as the secondary signing CA (and also pins that).
When you want to rotate certificates you have your new cert signed by the two CA's, one of which has to be the pinned CA.
I actually think this is a fairly elegant solution (for the operator), although it does come with some fairly large assumptions:
* If your adversary is large enough to be able to corrupt multiple CA's (say a federal government) - then they are powerful enough to corrupt all your CA's (even you - although, to be fair, if the can force you to do anything then the MITM capability is less interesting). So while this scheme benefits the operator, it provides negligible benefit to the client.
* You are reliant on the secondary CA to remain static (or having a backup CA) - this is the same problem as the original simply shifting the capability up one level - maybe this is OK.
Overall, this approach does provide more flexibility to the operator of the site - but provides no to negligible additional security on the client side (it upgrades the capability from being able to mimic any CA to being ale to mimic a specific CA), and may even put clients at greater risk - since there is now an additional avenue of certificate rotation which means extra code, extra verification to mess up etc.
These were a few thought that jumped into my brain - I would like to see a more detailed threat model / paper exploring some new schemes as I think there are wins in this space that haven't been realized yet - and there maybe improvements / clarifications which can improve this model further.
A few ideas from a quick brainstorm, none of them are perfect, but neither is the centralized server solution:
1. Bookmarklet - In a similar vein to the way some password managers work you could construct a bookmarklet that the user can click on to make a site do the right thing - there are some security configurations depending on your threat model - however this does require user interaction.
2. Browser plugin - like #1 but obviously with the pain of writing and maintaining a browser plugin.
3. Bake the site determination into the flow - so instead of a 1-click retweet it becomes a 2-click retweet with the second step requiring the user to provide the site where they want to retweet - again some security implications and breaks the regular flow (although you could get around this by doing it once and storing the value in a cookie)
4. Have a local app listening on a specified port (so retweets get POSTed to 127.0.0.1:7000 for example) and then from there onwards - requires extra setup, makes the system less portable (can't just throw it on a hosted server). Like #2 but more annoying.
Some of the technical points of this article are simply wrong...
> The exit node IP address of the user was easily obtained using the two different methods discussed briefly above.
This is really not a vulnerability but simply how tor, and the internet at large, works - hidden services by design protect the service not the user (the user is protected by tor by default) - what the author actually did here was "leak" their non-hidden services IP.
> and true external IP address (see partial data example to the above). And to answer the second question, “no”, this did not involve the placement of malicious malware. Read on…
The author then goes on to state that they gave the users malicious malware to run which revealed their ip address. They justify that this was not malware by stating:
> It should be noted that this was not malware per se. It did not replicate and was run voluntarily by the user. The user was notified that a “security scan” was going to be run on their machine and they freely chose to run the scan.
The author then goes on to publish a list of tor exit nodes with tor user agents...which they could have gotten directly from the tor directory services...
And, as pointed out by others, the author never really goes on to state why they think Tor is the devil - they built a honeypot and were disgusted by the flies it attracted....I'm not really sure what they were expecting...
If you want to dive deeper then there is Tails: https://tails.boum.org/ - an OS which is designed with privacy in mind.
https://prism-break.org/en/ has a lots of links to various tools be they operating systems, messengers, browsers etc.
None of these tools are a silver bullet - most require some level of effort or perseverance to use and none of them will protect you against every attack imaginable. However, they will make it more expensive for an adversary to target you.
I remember reading about Bitcoin a couple of years ago and expressing disbelief that many of the major advantages being heralded were little more than fantasy, these were:
* Micro-transactions.
* Replacing practically everything related to money in developing countries.
From this thread it is clear that many of those dreams are still very much dreams - the ever growing energy and resource requirements to participate significantly in the network is staggering, the amount of storage required for the blockchain is a burden to even tech-aware users (unless of course one would want to trust a third party...), and now it would seem that there are minimum bandwidth requirements which sit outside what is possible in even modest parts of the USA - impossible to achieve in places where the main link to the internet is a satellite.
If I was feeling particularly optimistic I would say that Bitcoin has been shown to be unscalable in it's current form. Further, the network itself tends towards centralization because of the ever growing storage, processing and bandwidth requirements.
I look forward to seeing where the future of crypocurrencies leads us- there is so much promise.
They gave permission to Google to store, parse, tag and understand 16 years worth of family photos of themselves and others so that Google can more accurately present them (and by extension the other people in their photos) with adverts that they believe will result in a higher conversions for their customers - the advertisers.
> Should I be worried?
That really depends if you think the benefits of giving Google such information outweigh the negatives. I personally think that they do not (but then again, I'm not much of a photo person).
> Should my family and friends [be worried]?
We still live in a world where it is socially acceptable for people to take, upload and publish pictures to a variety of 3rd parties without the consent of the subject - even in what would typically be classified as "private" events. I've seen some movement in the direction of explicit consent or "you can take the picture but don't upload that to X" but the truth is that most people don't think too far ahead and frankly probably don't care - should they be worried? Again, that really depends on what they think of Google.
This is great news. With the fall of advertising publishers will have to find new ways of paying for content production and selling produced content - there are a few options in this area - subscriptions are one, micropayments are another, crowdsourcing payment upfront like kickstarter/indiegogo is another - and all of those have a complex ecosystem of models to try.
The reliance on advertising revenue has resulted in a race to the bottom in many areas - it is no longer about the content but about the views to that content (see: the influx of # ways to <something> <something>)
If this report is accurate consumers don't want advertisements which is probably an uncontroversial statement to make - it may take a while for consumers to get used to paying for content but I think as more effort is spent in the space and the friction barrier lessened I would hope to see more sites adopting a paid format (for those who require adverts to operate - there are plenty of sites out there which don't require ad money which are doing just fine - or are run with no expectation of profit).
Reading over some of the specifications - I really like this approach - I think this is probably the closest I have seen to a truly distributed approach to IM at the protocol layer.
If anyone would like to try the chat interface my address is ricochet:qn6uo4cmsrfv4kzq
"My doctor has told me I should not take in as much potassium as I have been so I am reducing my consumption of legumes" and "I have an ethical objection to killing sentient creatures so I restrict my diet in ways that minimize such killing"
Are both sound, rational judgements which do not require a peer reviewed paper.
>You(sic) vegan foodstuff also require the killing of sentient creatures - to grow food we have displaced a lot of animals from their habitats. Sometimes quite forcefully. So yeah - you probably have fewer animals on your conscience , but you have some.
I agree with you, completely - it is an uphill battle. It is very difficult to not directly compensate the killing of creatures in a world that considers it moral to kill 50+ billion animals every year (not including marine life) - but my ethics require that I at least try.
I will agree that there is much ignorance in the world surrounding what we eat and in science in general - however, as I said, when I talk to people who have dietary restrictions they tend to have a sound, rational basis for them.
> That will push you only to vegetarian. To go vegan you need more reasons.
There are no animal products which do not involve the killing of sentient creatures (if you doubt this I would suggest learning about the process by which milk or eggs are farmed).
> It seems like every single young woman has bizarre food taboos that are based on no rational basis.
I'll ignore the blatant sexism.
As a young woman, although admittedly not single, who happens to be vegan I really don't understand the point you are trying to make here.
I am vegan because I would rather not have had a sentient animal purposely killed for my meal - and it is a decision I came to after years of thought and consideration.
And yes, there is a growing trend of people caring what they put in their bodies - whether it is noticing that caffeine after 2pm disturbs their sleep, or that as they age they need to consider an increase in b12 or vitamin D - the majority of these choices are very rational ones - I have yet to meet a person whose diet choices fall out of the range of rationality - except, perhaps, the excuses people give me for not cutting down the amount of <insert foot they acknowledge they eat too much of> in their diet.
The message here is avoid low-level crypto - if you find yourself having to mess around IV's or choosing modes and padding then you are far more likely to screw something up.
NaCl/libSodium provide higher level interfaces where the underlying primitives are removed from the developer which makes it much more difficult to implement bad crypto (at least as far as the individual constructs go...protocol design may still get you)
> Even RSA which has stood the test of time since 1977, is only considered 'safe' in so far as there's no algorithm better than brute force for factoring products of large primes
* Trace the execution of one of the user land programs (e.g. ls) to see how it uses the syscalls.
* Add a new syscall - there are a few open-courseware labs online which have this as in introductory exercise (e.g http://moss.cs.iit.edu/cs450/assign01-xv6-syscall.html)
* In a similar vein - find some other labs for other courses using this - and follow them.
* Read through the companion book (can be compiled from the source or downloaded pre-compiled) and follow it through the source code.