Pages: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
| sureanem |
Posted on 19-09-10, 19:49 in Mozilla, *sigh*
|
|
Stirrer of Shit
Post: #621 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Posted by CaptainJistuce Well, while it's regrettable, that is the way things work anyway, so then it only makes sense that this should be made a basic underlying assumption and worked with from there. I mean, who the hell is too poor to afford anything but a PowerBook 190? Poor people use low-end/used/old smartphones, and they handle the Modern Web™ just fine. Why does it need to be made sure that newer browsers exist for older systems? In theory, there is nothing preventing anyone from making or backporting a browser if they feel the existing alternatives are inadequate, and in practice, Vista and below are exceedingly rare nowadays - heavy enough of an edge case that anyone using XP as a daily driver certainly knows what they're getting themselves into. Also, there's a financial incentive to NOT change the DNS infrastructure. ISPs use their status as "your DNS server" to serve ads on failed lookups instead of returning an error. Commercial filter software relies on DNS being transparent. I won't deny they don't line up 100%, but they're far closer to perfect than they have ever been in the past. ISP money from DNS hijacking and commercial filter software are pennies on the dollar compared to the economic might of CloudFlare/Google. Sorry, but nope. There ought to exist a mechanism right now to tell my network "this domain is untrusted and nothing on my network should be allowed to connect to it", and... oh, wait, such a mechanism does exist, and it is local DNS entries. How can Firefox tell it is really you, the user, of which it is the agent, though? Such cases are a hundred to one compared to corporate/national attacks. You could rewrite the sentence as such, and it would still make as much sense; There ought to exist a mechanism right now to tell my country "this domain is terroristic and nobody in my country should be allowed to connect to it", and... oh, wait, such a mechanism does exist, and it is local DNS entries. DNS does not exist for the sake of censorship, it exists to provide name resolution - arguing its raison d'etre is that it should exist to do poor name resolution seems like a queer idea. If such bad actors do concern you, the proper course of action is an IP block. Instead, Firefox and Chrome want to block websites based solely on Google's "dangerous website" list. And we've already seen how THAT works. How much worse will it be when Google has the power to be overtly malicious instead of overtly inept and subtly malicious? Google already has the power to be overtly malicious, so there is no scenario in which this changes anything. That Firefox implements their blocklist is regrettable, but as the saying goes, he who pays the piper calls the tune. With that said, what does Google have to do with DoH? They run 8.8.8.8, and I would imagine they can run a DoH server too, but by my understanding so could I if I were so inclined. I do agree that the CA-DNS cartel is a bad idea which relies on outdated technology, and it will probably never be fixed, but since it will never be fixed I can't see any additional harm in letting the CA/DNS people control CA/DNS. Personally, I think it's a moot point in the long run. For applications requiring privacy, Tor is the only suitable option, and for anything else privacy is irrelevant and perhaps even undesirable. As a corollary, relying on clearnet for privacy would be like relying on UB. It would be much easier to deal with this type of matters if this were the official position of everyone, since it would follow from it that no users suffer from Internet censorship and thus the issue could be disregarded without harming anyone's privacy. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-12, 21:49 in N64 emulators vs. "PJ64 v1.x" emulators
|
|
Stirrer of Shit
Post: #622 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
And then there is the 'interesting' aspect of having to find out how their keys are numbered, and how to enable the more obscure features like mouse input. From a pure UX perspective, Project64 1.6 over Wine/PlayOnLinux is the best. Install and go, no harder than Windows. Runs like natively, fast, nice UI. Emulates all released games (correct me if I'm wrong) given the right plugin set, and even emulates some games more modern emulators won't take too. Provided you have no philosophical qualms about emulating an emulator, what's not to like? There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-12, 21:58 in Computer Hardware News
|
|
Stirrer of Shit
Post: #623 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Posted by tomman Because this is a non-issue, as per the efficient market hypothesis. You could go buy all the puts you want, but the market simply does not care - neither did they for MELTDOWN or SPECTRE or CASINO ROYALE or whatever. You can reason about this backwards: if the market did react to announcements of security vulnerabilities, a lot of money could be made from announcing them while shorting the stock. Since you don't see too many of these announcements, not a lot of money could be made from announcing them, thus the market does not react strongly to them. The disclosure was on September 10, and the stock did enjoy a drop of 1.74% after what I assume was the disclosure before rebounding. So it's not as if the traders didn't know about it. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-12, 23:05 in Mozilla, *sigh*
|
|
Stirrer of Shit
Post: #624 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Posted by CaptainJistuce Well, I get it in theory. But I can't say I know of anyone actually using these extreme legacy devices. The poor people I know either use old Android phones with cracked screens and whatever, or old laptops with the "free" upgrade to Windows 10. To my knowledge, Windows 10 runs on pretty much anything that Vista does, to varying degrees of performance. The things you can do on the internet with a little pocket computer datatablet are not actually the same as the things you can do with a desktop or laptop computer, unless your use of computers begins and ends at "surfing". Also, vision-impaired people can't see them tiny screens. People with motor disabilities can't touch them tiny screens with remotely the necessary accuracy. "Poor people should just get a cheap smartphone" is not actually a solution. No, it's not a solution all right, but it is how most poor people I know go at it in practice. The things of value I can do on the Internet - sign contracts, access my bank, interact with the government, talk to people - them I could do with a smartphone too if I were feeling masochistic enough. Lots of young people have never used a computer in their lives and just use smartphones/tablets. They're blazing fast at it too, they probably get the same WPM as I do on a proper keyboard. I don't know just what level of poor we're talking about here, but something like a used Chromebook should hardly break the bank even for the most destitute of people. If we are talking about literal homeless people, then I don't think they have anywhere to store a laptop anyway - I'd think they use public libraries or something. And you don't just get to say "it's regrettable, but that's how it is" while proselytizing for the changes that MAKE it the way it is. Well, how exactly have these things broken? I wouldn't think it's due to the security theatre. Moore's law is a far more probable explanation. If I want to log in to my bank, doing this in an old browser which doesn't support JavaScript is not possible either. Without DoH, we would still have the problem of "legacy devices are legacy for a reason," so it can hardly be blamed for this development. Perpetually freezing web standards at 1995 levels because of alleged poor people who are stuck on Windows 95 is absurd, although I personally would be pleased for other reasons if that were the case. Windows XP has 2.8% market share, which is more than Vista. Hell, it is more than ALL Linux(except Android). This includes Micky Mouse places like China and Africa though. If you just look at civilized places it's practically zero. The SHS for instance puts XP at <0.10% while Linux clocks in at 0.80%. Consider that Steam also has a lot of people from those places, and the real ratio probably turns out to be 20 to 1 or something like that. And it's indeed true supporting Linux makes no financial sense - if you want electronic identification here (which you do need unless signing physical papers and sending them back and forth by mail is your idea of fun) you need to own a non-Linux (except Android) device. I'd reckon it's only a matter of time before I can't even log in to my bank without pulling out my smartphone, and it's only because it's extremely expensive for them (like $0.1 per login expensive) that they bother handing out physical security tokens. I would also like to point out that Linux obeys the standards of the web and runs modern browsers, unlike Windows XP, and having your website support Linux often requires no additional effort - good luck running Ubuntu Warty in 2019. See also: enterprise usage, ISP backend upgrades. Pennies on the dollar. DNS intentionally provides a multi-tiered system where a local DNS server can override a remote one. It has ALWAYS been intended that you can specify your own name resolution. Yes, and SMTP was originally intended to be anonymous because that's how post offices worked. That didn't turn out too good and now we're layers and layers of bandaids in, with the end result being that you now have a few 'good' mail providers who authenticate you via cell phone and chuck all the rest's into the spam folder or even kill them silently. Far better then to rip off the bandaid and kill the archaic service that is DNS. "DNS can be censored, so we need to change the internet so the only way to censor the internet is through Google's blacklist"? Well, yes. I'd rather we got rid of both, but the net result from removing one source of censorship is always positive. Translation: Privacy doesn't exist. What do you mean? Tor is plenty private, and many websites which have trouble with clearnet already today find themselves with no other choice but to use it. If censorship/snooping continues it seems as if this development too should continue, but that hardly means privacy is dead. Let's go through a list of problems with regular HTTP over clearnet * ISPs can see your traffic * ISPs can see who you're connecting to * ISPs can edit your traffic * ISPs can block websites entirely * This also goes for whoever runs your network * DoS mitigation providers' consent is needed to run a website * * DoS mitigation providers with controversial customers lose peers * DNS providers can make it impossible to use said websites * ISPs or various other attackers can manipulate DNS HTTPS doesn't even fix half of these, although arguably the worst flaws. Now let's compare this to Tor * ISPs can only see that you're using Tor, if even that (see: bridges) * ISPs can't edit your traffic * ISPs can (maybe) block Tor entirely, but it's all or nothing and you know what's going on if your connection cuts out * DoS attacks on the network level are impossible * There is no such thing as DoS mitigation providers * There is no such thing as DNS providers * It is not possible to manipulate DNS as names are cryptographically verified It seems like a sensible solution to the problem to me. Posted by tomman Good. Relying on the OS for cert store has caused all sorts of issues, far better if all applications statically link in DoH support. - There is also no support for D'OH on DHCP, unless someone comes up with a extension field and manages OS to support it. Good, ISPs should not handle DNS. - Deploy D'OH at home? You can do it, but you now have to either wait for your applications to add support to it, or the whole IT industry to get their act together and bring OS-wide support. Good luck getting Troo UNIX® Way nerds and systemd fanboys on board (the former will reject it because it's too complex, the latter will came with systemd-doh which will be buggy and create more defectors to the BSD camp, where I guess there will also be plenty of bikeshedding over the matter). Also: dealing with certificates. Yuck. This is a feature, not a bug. OS-wide resolvers cause all sorts of issues, whereas a tiny outbound TCP connection to port 443 is almost always OK. I agree that certificates are bad, we should use blockchain to do away with PKI. - Your legacy boxes are not welcome to the party. Why do my boot ROMs need networking at all? Updates? - The idea of D'OH is not to bring security (wasn't DNS-over-TLS the standards complaint way to do so?) or privacy AT ALL, but to strip you, the luser from being the owner of YOUR devices, because that's how IT rolls today, in the smartdevice era. If the CIA/NSA/FSB/China/Jeff Bezos' secretary want to spy on your DNS queries, they will still be able to do so anyway. They're taking advantage of the fact that normies and millenials don't give a fuck on anything regarding being in control of their goddamned devices because that involves, y'know, learning. And "learning IZ HARD, oh, the Kartrashians are on TV!!!". DNS-over-TLS is made to be easy to be blocked. Here's what Paul Vixie has to say on the matter: Posted by Paul Vixie Posted by Paul Vixie Posted by Paul Vixie Posted by Paul Vixie Does this sound like a man you trust with making your standards? I'm not going to call into questions Mr. Vixie's allegiances here, but I will say that if I were tasked with writing satire to make DoT proponents look bad, this is exactly what I would write. Financially, I think it's closer to that Google reasons that they gain next to nothing from ISPs/enterprise controlling DNS, while they lose out on some amount of ad money from people browsing the Internet less while at work. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-13, 23:47 in Mozilla, *sigh*
|
|
Stirrer of Shit
Post: #625 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Posted by Screwtape Well, look at it from the opposite perspective here. Say we introduce an eight party, Bob here from in off the street, who gets as much power as all the other parties. Clearly this would be a bad move, and we'd be in a worse position. So I wouldn't think it's a matter of "is this party less trustworthy than the other ones," but rather that removing one means of control decreases the total amount of such interference. Case in point here, I can't think of any large-scale cases of the browser or OS outright tampering with pages. As for other applications, well just don't install them. #5 and #6 are obviously regrettable, but for them there are other technological solutions. (e.g. Tor) So far as I can see, there's a few ways this could go: Well, #3 is what I believe in English you would call a chimera. As for the other two, I think your analysis is spot on. Posted by CaptainJistuce And what are the odds of these people being computer enthusiasts vs. ghetto dwellers? You can look at the stats here - we are talking about something like 0.1% of the population. This is not a tenable position to take - far more than 0.1% of the population have the sort of issues DoH would solve. Nearly all countries of note have DNS level blocking (you have ten seconds to name one which doesn't). There's maybe a million XP users (excluding China et al), while the EU alone has a population of 513 million, or around 513 times more. Moore's law is not why internet development has moved away from backwards-compatibility and graceful failure and on into "require the latest of everything to do anything online". Well, we are dealing with theoretical examples aren't we? I get the virtues of reverse compatibility, but there is something to be said for having a uniform platform to develop for. And while I would rather have this be something uniform and stable (say Windows 7 1080p 64-bit, no high dpi or other nonsense), in the event that this is not possible it is clearly preferable to assume that users are using a supported setup. Clearly, Moore's law is what's been driving the shift into slower and slower websites, although for security it cannot be blamed. Legacy devices are "legacy" because they are no longer for sale. Sometimes not even that. RS-232 is a "legacy port" and it is still in widespread use today. OK, s/legacy/systems so old nobody can be bothered to compile a browser for them/g. Find me a genuine reason a device shouldn't be supported beyond "Oh my god, that is, like, soooooo old! Why don't they buy a new computer already?!?!" The devices already are. Debian runs on pretty much everything, and Windows 10 has quite low system requirements (2GB RAM, 1GHz CPU, 800x600). I would argue the browser makers are in the wrong here - even at just 0.1%, it should be no tremendous effort to at least do half-baked support for Windows XP. Furthermore, nothing prevents them from making the required alterations and compiling Firefox for their machines themselves. To claim that websites shouldn't adopt new technology (insofar as it is good) because browser makers don't feel like supporting legacy users is an absurd argument. The point is that these machines are being artificially kicked off the internet because no one wants to compile a browser for them(solely due to laziness) and internet people no longer believe that compatibility is a good thing. Compatibility is unprofitable, so it's hardly a matter of belief. Oh, it only hurts the blacks and yellows and barely touches real white people? Well that's okay, then! If you try to make decisions based on statistics from those places you'll end up with completely lopsided results, unless you have a very special demographic target. My interactions with Chinese people living in China pretty much stretches to GitHub because of GFW or such, and I can count on one hand the amount of posts (1; a guy in I think Kenya) I have seen from users in Africa (excluding SA, their northern neighbor, and the Maghreb). If you're developing software for third world countries you should probably try to optimize around feature phones and such because they are mobile-majority, but this makes absolutely no sense in the West. It's not a moral judgement, just a question of efficiency. You really don't understand the difference between a web browser and an operating system, do you? XP doesn't NEED to support web standards, because the BROWSER is responsible for that. XP needs to support APIs, and it presumably fails to uphold that end of the bargain. Again, if your point is that browser makers shouldn't cut compatibility so easily, that would be reasonable, but they do, and to then argue that you should design around people using unsupported browsers is a bad idea. Spam filters that can't be disabled and eat far more real e-mails than they do spam. And are you seriously suggesting that e-mail accounts should require identity verification? No, they do right now already (in some countries you could go buy a SIM card+burner, but that's mostly of theoretical interest), but a Hashcash-like system would have solved it just fine. Obviously with the issue of reverse compatibility. If this is ripped off, a lot of security issues big enough to drive a truck through could be fixed properly instead of duct-taped over. Right, keep telling yourself that a networking scheme designed by the US government in the twenty-first century is unmonitorable. Whatever helps you sleep. That the US government made it is not all too relevant here - the purpose was to help their CIA spooks communicate easier with HQ, as well as to facilitate fomenting color revolutions in the second world. To try and put backdoors in it would have been like drilling holes in your gun in case someone else steals it - not exactly ideal. That's me [operating my network]. And if I want to block a website, I think I'm allowed. You, and your ISP, and a few layers upstream. How can a browser know who is controlling them all? This is a catchphrase, not an argument. Touché. I did give a rationale for my reasoning though. Said no sane person ever. It solves exactly all the problems DNS/PKI has, while introducing no new downsides. For currencies, volatility is a bit of a problem, but if DNS renewals go between $1 and $100 a year it's not really the end of the world. Also, blockchains do solve the problem of "with what do we replace briefcases of unmarked $20 bills in the 21st century," it just doesn't solve the similar but related problem of "how does Alice send money to Bob for legitimate transactions". I think this is a very important distinction ot make. I dunno, he sounds perfectly sane and reasonable to me. There are extremely valid reasons for blocking sites from a network. DoH IS a big F.U. to all network operators. Sure, but who exactly is a network operator? The clearest definition I can get is "some bozo you have to trust by virtue of being a captive audience" - it could be anything from you to your ISP to your work to your country. I am begrudgingly okay with trusting some of these, but hardly all of them in all cases unconditionally. Posted by tomman The two have nothing to do with each other - cash will die along with its users, who aren't exactly on the bright side of the actuarial tables. I only use it for cash-only businesses and contractors who give you cash discounts, and pulling out physical money in public tends to get you funny looks. Bitcoins have already triumphed in the sense that I can send nearly unlimited amounts of money from point A to point B without much fuss. Many politically controversial persons who otherwise could not receive bank transfers rely on it every day. There is not much to wait for, other than the government to go all-in and regulate cash/crypto, after which this will not be possible anymore. DoH is not a computationally expensive technology - if we were discussing JavaScript madness you'd have a very good point, but opening up a SSL socket and sending some HTTP really does not break the bank for any computer made on this side of the Clinton administration. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-14, 20:08 in Mozilla, *sigh*
|
|
Stirrer of Shit
Post: #626 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
The real question is who runs Firefox for enterprise. The model worked well for Lua and SQLite - in Lua's case, they essentially said, "hey, I don't take donations, but I do run a consulting company - fork over the dough and I'll do real professional paid work on your issue of choice, or if you just want to donate tell me to pick one I feel like doing". As for SQLite, forking over money to get your very critical databases working properly seems like a fair bargain, especially when it's far cheaper and better than hiring a 'database guy' to work full-time. OTOH, they do sell proprietary extensions. Another issue is that they're extremely tiny and the examples seem to imply good for the users and scalable are mutually exclusive. I'd estimate annual turnover for SQLite at maybe $1m and Lua to about the same modulo cost of living, which is peanuts in comparison. But Firefox? Why would you want to run a browser that can pretty much only compete on privacy and other stuff which is decidedly irrelevant to business? If you don't care about that, then Chrome is superior: far better integration with Google Apps, better performance, and I think better enterprise integrations. Add in Google pulling "reverse integrations" with Firefox (as they say, there are no mistakes, just happy little accidents), and you don't end up with a browser that's exactly competitive. Also, Hr. Hipp (the SQLite guy) looks really badass in the image on his Wikipedia page, like the villain in an anime series or perhaps a Bond movie.  My suggestion is that they try to find a non-hostile financier who has a vested interest in Firefox gaining market share against Google. I have yet to hear any good arguments for why they shouldn't. They have two strong bargaining chips here: * extreme amounts of cash for whoever takes the deal (although there is only really one possible buyer, so they better act fast before they're going at it from a position of weakness) * complete independence from antitrust rules and can do stuff that Chrome, being a direct subsidiary of Google, can't without getting curb-stomped by the regulator They could use this to secure privacy online (which would also be helpful to reinforce the second point) as well as a hefty paycheck ($1-5 billion at the bare minimum). Simply put, it would give them a very good club with which to bludgeon websites into submission, noblesse oblige style. They could even go for financial independence like the Nobel Foundation (lol who am I kidding). 75% savings rate gives 7 years, but if the cash flow cuts out halfway through they could probably cut expenses by 50% easy if they didn't have to earn money while doing so. In fine, let us recognize that the adoption of my advice will leave us each citizens of a free state, and as such arbiters of our own destiny, able to return good or bad offices with equal effect; while its rejection will make us dependent on others, and thus not only impotent to repel an insult, but on the most favourable supposition, friends to our direst enemies, and at feud with our natural friends. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-15, 08:39 in Mozilla, *sigh*
|
|
Stirrer of Shit
Post: #627 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Posted by wertigon This is FUD posted by the VPN companies, and not only this but also old FUD. For instance, opening pdf files in Tor Browser is as I recall it perfectly safe, so this must have been before pdf.js was ubiquitous. All the other stuff save for perhaps HTTPS is common sense. Maximizing the window leaves you open to a fingerprinting attack, but it's hardly instant deanonymization. More importantly, using Tor for onion browsing doesn't have these pitfalls. Everything goes end-to-end through the network, so all the exit node stuff is a non-issue. As for VPNs, they provide only extremely weak security: now the VPN provider can do active/passive MITM, and unlike the exit node, they know exactly who you are and where you're connecting from. Furthermore, there are a ton of technological issues with the whole idea of forwarding an entire interface. For instance, you can still be tracked through port numbers, and you cross-contaminate all your identities since the whole OS goes through it. VPN is good if you're an American using BitTorrent, and that's about it. It makes absolutely no effort to deal with linkability or media files, so it's hardly more secure or reliable than Tor. Just downloading TBB and using it is still going to be safer than using a VPN and your regular browser, no matter the mode of usage. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-15, 20:57 in Mozilla, *sigh*
|
|
Stirrer of Shit
Post: #628 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Posted by Nicholas Steel If you're running maximized, you'll always have the same resolution unless you change screen/OS/whatever. So maybe 1080p w/ Windows window decorations is fine, but if you can see that there's someone with their browser at 2556x1414 (2560x1440 - 4x26) that's fairly unique, and if you see it several times it's probably the same person. Posted by wertigon Just what 'university' did the supposed 'expert' go to, and why does he not know how to spell the name of the technology he is allegedly hacking? Nobody would run random .exe files they got through Tor Browser and there's a giant warning if you try to do it. But for instance PDF files are A-OK. By observing basic precautions it is possible to reach an extremely high level of security with Tor, while this is completely impossible with a VPN. As an aside, I am tired of this, not to say worship, but taking seriously of people ('experts') for the sole reason of having thrown their time away on an education. If you're just doing it to get a job, sure do whatever you have to, but to claim that there's some actual value in it is plainly absurd. There was a tradition in the temple of Dodona that oaks first gave prophetic utterances. The men of old, unlike in their simplicity to young philosophy, deemed that if they heard the truth even from ‘oak or rock,’ it was enough for them; whereas you seem to consider not whether a thing is or is not true, but who the speaker is and from what country the tale comes. This is not to say that it's impossible to become an expert through organized studies and that such should be trusted, but the inverse obviously doesn't hold - for the extreme example, look at exercise science. I would much rather get my advice from the biggest guy in the gym, provided he isn't on gear, than the alleged experts in the newspapers who discuss for days on end which machines should be used and quizzes anyone who disagrees about to what school they went. Posted by tomman No, it's from legitimate security researchers. As I recall it, it's plagiarized from an official list of "stuff you shouldn't do with Tor" from a few years ago, back when they were still using check.torproject.org and Disconnect. Posted by CaptainJistuce No, I was thinking of the whole "evil reflection" thing, like Rosenberg from El Cazador or Kurama from Elfen Lied.  And as for Bond villains:   There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-16, 17:17 in Mozilla, *sigh*
|
|
Stirrer of Shit
Post: #629 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Posted by https://2019.www.torproject.org/docs/faq.html.en#WhyCalledTor Did you learn everything you know about Tor from news articles wertigon? Posted by CaptainJistuce Navy made it, but the main beneficiaries inside the US government sure are the CIA. It does not follow. By that line of reasoning AES and the like should have backdoors too since it was standardized by the US government, not to talk about Bitcoin. Historically, the US government's backdoors have only been of the kind that they were damn sure an adversary couldn't exploit, so something of the public/private key kind (e.g. Dual_EC_DRBG) would have been their only choice. And as for that, it's hardly the dried-and-shut case of "NSA uses their superior cryptography skills to hide invisible backdoors in every single cryptography algorithm freely available on the open market" - people knew something was up even in the early 2000's. IBM got some mystery meat S-boxes for DES from the NSA, and everyone thought they were backdooring it, but they were actually making it more secure: Controversies arose out of classified design elements, a relatively short key length of the symmetric-key block cipher design, and the involvement of the NSA, nourishing suspicions about a backdoor. Today it is known that the S-boxes that had raised those suspicions were in fact designed by the NSA to actually remove a backdoor they secretly knew (differential cryptanalysis). However, the NSA also ensured that the key size was drastically reduced such that they could break it by brute force attack (the computing power to brute force DES however did not exist in 1975). (As an aside, it must be a very painful position to be in to have everyone accusing you of introducing backdoors when you were actually trying to help them stay safe but being unable to tell them because you would endanger them) The US government has realized extreme geopolitical gains from the Internet in general and Tor in particular, and this alone pays for it a thousand times over. No serious nation-state actor would have the precise combination of greed and stupidity required to pull off such a suicidally risky 'keep the cake and eat it' move. The US is already an open society, and as such the damage from even perfect cypherpunk-style anonymity is negligible, especially when compared to what that might do to China/Iran/Russia, and what it already has done to a whole host of countries before. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-16, 19:42 in Mozilla, *sigh*
|
|
Stirrer of Shit
Post: #630 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
It's not as much of an insult as it is pointing out the failure to observe a useful shibboleth. Wild guess here, for which I have absolutely no proof, these are people who learned Lua through the U of Life because they wanted to actually make something - presumably for video games - and are not all too interested in hearing about useless academic concepts like "higher-order functions" or "lambdas". Whereas, for Tor, the opportunity of "learning by doing" is quite limited (what people in the AI business would call "one-shot learning"), and as such one does indeed need to read quite dry technical documents to understand how it works. In other words, as the project themselves observe, it's a much more useful nitpick, like when Mr. Schmidt pronounced it "Thor," as in the Norse god of thunder. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-19, 20:16 in delta patching, bsdiff edition (revision 1)
|
|
Stirrer of Shit
Post: #631 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
What about using something like a rolling hash to find overlaps? Far simpler to implement, fast, and it should find them all. Rsync uses it, and they presumably know what they're doing, as do you, so I must be missing something. You take the file, and iterate over it in rolling n-byte windows. When the hash of the window ends with k zero bits, you append that position in the file to an array a, whose first element was set to 0 and whose last element gets set to the index of the last byte in the file. For a hash function you can either use a rolling hash, or just use a fast constant-length hash function and apply it n times with shifts - it wouldn't be too slow with AVX anyway. You then for both files iterate over the array a, hashing slices of the file from a[i] to a[i+1] while i < the index of the last element in a, and add the found hashes into a set. You then compute the union of the two files' respective sets. You then go back and expand the overlapping regions using some kind of linear search, also checking for false positives. If you're interested in finding regions for which the 'subtract' operation is appropriate, an optimization is to use AVX-2 intrinsics, assuming a fairly recent processor. To be more precise, do rolling XOR starting working forwards and backwards from the overlapping region, and keep moving for as long as popcount(a^b) (e.g. the Hamming distance) exceeds some arbitrary value c. Since there is no _mm512_popcnt_si512 intrinsic, you will have to compute e.g. horizontal_add(_mm512_popcnt_epi64(_mm512_xor_si512(a, b))) > c, but an alternative might be to simply compute something like _mm512_cmp_epi64_mask(_mm512_popcnt_epi64(_mm512_xor_si512(a, b)), _mm512_set1_epi64(c/4), _MM_CMPINT_LT). Comparing with zero is a bit tricky, though. You have _mm256_testc_si256, and that would work, but you need to either split your _mm512 up or do the whole process on _mm256 registers. Anyway, you now have a list of matching blocks for each file, and you can define 'matching' as pretty much whatever you want due to the linear search. The only false negatives are the common chunks smaller than (on average) n*2^k. For values of k = 0 and n = 32 (256/8), we are talking ~10 cycles per hash, so ~320 cycles per 32 starting bytes. Then moving a number into RAM, that's limited by mem b/w but otherwise caps at a 1/16 cycle to move a uint16_t, assuming proper batching etc. The fastest and easiest way to do set intersection is probably to sort both hash arrays and then just iterate over them both; whenever a 'gap' is found 'fast forward' the other sequence, and if you get two matching ones you put them in the new set. This is all O(n) for hashes, but trying to count the cycles is folly because of all the cache effects and whatnot. It still should be quite fast though if you do something like radix sort. Maybe there is a better data structure to get the intersection of two sets as well - I know C++ has something. Since the location also is needed, you might as well use 64-bit ints and mask them before checking equality; even if it's wasteful it's not exactly a tragedy to waste a few megabytes of ram. For a memory-constrained application, you can get away with around 4*log2(file size) bits of memory per byte of input data in largest file, possibly shaving off or adding a few bits depending on the false positive rate tolerance. But for bigger files, you can always increase the value of k - I can't imagine trying to find matching 32b chunks in an 8GB file to be a very productive nor space-saving endeavor. The downside is that it locks you to specific CPU setups, and if you want it to be fast actually quite recent ones. Am I missing something else? There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-20, 12:26 in delta patching, bsdiff edition
|
|
Stirrer of Shit
Post: #632 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Posted by funkyass By my understanding, both bsdiff and beat use suffix arrays. I am curious whether it were possible to use hash sets instead - by my understanding, it should be faster and easier to implement. After all, tools like rdiff-backup use this same algorithm to encode a delta between two (big) files, so shouldn't it work for smaller ones too? There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-21, 23:14 in delta patching, bsdiff edition
|
|
Stirrer of Shit
Post: #633 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Posted by Kakashi They do do delta patching, so that is indeed the case. Posted by CaptainJistuce I'm afraid I can't find anything about it online - do you have a link? Posted by Screwtape Isn't it? You're dealing with ROMs the sizes of which number in the low megabytes; you can afford to be lavish with RAM if it's just for a few seconds. Your hash size should be roughly log2(rom size in bytes) bits, no matter how big the window (assuming you don't get collisions in the actual hashed data) - that uniquely identifies a position. So for a 512 KB ROM, that's 19 bits per byte, 2.4 times larger (1.2 MB) than the source - smaller than suffix arrays' 4B/B. For practical purposes I'm assuming you'd however want to round it to 64b/B, so that's 4 MB. Still no big deal, but I might be missing something. I wouldn't think the small matches are all too useful - even if you can copy 4 bytes from offset X rather than writing them out as immediates, you'd likely have spent more data on encoding the offsets than you'd have just copying them straight out. If I ever write another BPS patcher, I'll start with a suffix array, and see if I can figure a way to get, say, 10 near-matches rather than the algorithmically "best" match. Because of the way BPS works, a not-quite-optimal match nearby can actually be more efficient than a slightly longer match further away. I still think there's a lot of room to make even more-efficient BPS patches. How do you mean 'further away' and 'nearby'? Do you mean like optimizing for "longest common sequence, regardless of whether it's perfect or not," rather than "longest exactly common sequence, or if no such, longest almost common sequence weighted for X"? I mean, if you have a list as such, Then isn't it a solved problem to determine which combination of overlaps yield the smallest patch? I think it should reduce to the knapsack problem, except for the part where you can break items into two at will with only minimal loss. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-22, 19:32 in delta patching, bsdiff edition
|
|
Stirrer of Shit
Post: #634 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Posted by Screwtape Right, but this should - correct me if I'm wrong - be an issue with nearly any patch creation tool unless there is some other very clever algorithm to it. If the memory usage scales O(n), then you've got yourself a problem when n is too big, no matter the coefficient. At least with the 'leading zeroes' approach, you can get as much mileage out of a given amount of RAM as possible. Whereas, with suffix arrays, again correct me if I'm wrong, that 4n memory usage would make 4TB of RAM a hard requirement to patch it. How do you mean 'further away' and 'nearby'? Well, isn't that just traveling salesman? Even if it takes 4 bytes to encode any address and 0 to encode the optimally chosen address, that seems like it easily gets dwarfed by the savings from having a 4 byte longer run and thus saving 4 bytes of literals. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-22, 19:32 in Anticipating near future [politics]
|
|
Stirrer of Shit
Post: #635 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Iran did it and they are heroes for doing so. Even if you don't trust the Americans on this, who else? It's way too expensive for a false flag, and the Houthis couldn't have pulled it off. This logically only leaves Iran, no? Personally, I don't get why the West went along with all of this Micky Mouse country stuff after the death of the Soviet Union - what possible reason is there to internalize an ideology that was explicitly designed to harm you? And if they wouldn't have, they wouldn't have been having nearly any of these issues we are seeing today. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-22, 21:51 in Anticipating near future [politics]
|
|
Stirrer of Shit
Post: #636 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Russiagate is dead and buried, and hardly anyone is arguing his presidency is illegitimate anymore. So yes, they did get him exonerated, regardless of what Mueller claims. As for my prediction about 2020: because the Dems are fielding such rubbish candidates I am going to change it to "Trump will win again," but they are going to win every election after that. However I would have thought they'd field Sanders or Harris, and Warren comes completely out of left field. I suppose she wins by default though, with Biden being too senile and all. Personally, I think they're stupid for going with a woman, especially after the last debacle. 2020 will be a lot less fun than 2016 so I wouldn't think it's worth following anyway. Hope I'm proven wrong though - not a lot going on right now. Calm before the storm? There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-22, 22:06 in Anticipating near future [politics]
|
|
Stirrer of Shit
Post: #637 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
Well, exonerated in the public sphere then, but that's all that matters, so you might as well just say exonerated. They said he wasn't guilty, nobody has been talking about the Russians for a long time now, and in exchange he's been playing along. What more is there to it? There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-22, 22:09 in Internet numbers bragging thread
|
|
Stirrer of Shit
Post: #638 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
If he'd have been born ten days sooner he'd have a way cooler number to brag about, but I digress. There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-22, 22:22 in Anticipating near future [politics] (revision 1)
|
|
Stirrer of Shit
Post: #639 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
This is not a matter of personal opinion, but rather one of objective fact. Searches for "trump russia" are at ATL since the election, and you could probably find similar statistics for news headlines. MSM has dropped the subject, and as such it is a non-issue. EDIT: CNN hasn't published anything under the tag "Trump-Russia Investigation" [sic] since 17 April There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
| sureanem |
Posted on 19-09-22, 22:40 in Anticipating near future [politics]
|
|
Stirrer of Shit
Post: #640 of 717 Since: 01-26-19 Last post: 1547 days Last view: 1545 days |
So then what? We have the hard numbers right there - are there any others to contradict them? There was a certain photograph about which you had a hallucination. You believed that you had actually held it in your hands. It was a photograph something like this. |
Pages: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
