Asdfbla

It's possible to write provably correct code, though. At least then you reduce the problem to the issue of correctly specifying what the code is supposed to do. Certain classes of contracts might be small enough to do that.

Granted, the requirement for NASA-level code correctness would make smart contracts expensive to develop and put them out of reach of average developers.

Always surprises me a bit because it seems to me like those large corporate players don't necessarily need all the features offered by Ethereum (or Bitcoin), especially proof-of-work, since there's enough non-adversarial cooperation between them that a simple distributed ledger with traditional (efficient) consensus mechanisms would suffice for most of their applications. They wouldn't have to deal with the drawbacks of Ethereum's very strict threat model.

I'm curious what applications they have in mind, or if they maybe just participate to get in on the hype and explore their options.

Well, there's the simple fact (or what seems to be a fact at least, might not be true) that the reality of physics confines us to this rock, more or less. We don't travel faster than light, so at best we can achieve a Mars colony dependent on Earth supplies.

So yeah, I'd rather just focus on developing survival strategies for our rock. But the whole discussion is maybe a bit off topic here too.

While this would certainly be a blow for science in general, I don't understand why people are so enamoured with human space travel and think it's a realistic avenue for humanity to get out of the responsibility we have for Earth (there's the strange defeatist sentiment on the internet that we have to leave this planet in the foreseeable future).

Fact is, the laws of physics probably dictate that we won't ever leave the solar system and in our solar system there's not much we can work with to make the other planets habitable. It's comparatively soooo much easier to simply make life sustainable on Earth and then figure out space travel in the thousands/millions of years we have left until some external disaster (asteroid, exploding sun, whatever) threatens us. In the meantime, we can explore space efficiently with robots.

I always wonder where the upvotes for those posts that simply plant a link to highly specialized lectures/books that likely take months to work through (given a sufficient mathematical background) come from. Especially since the material at hand isn't relevant unless you work in certain specialized subfields.

Don't get me wrong, the resources posted here are often good and learning is great, but I doubt anyone who sees them here actually follows through and starts studying.

The problem is such traditional calculus doesn't apply anymore in cyberwar.

For one thing, your big "guns" weaken your own infrastructure, since you use about the same technology that your adversary uses too. Secondly, your guns can be copied without many problems and then suddenly they are directed at you and your weakened infrastructure.

What's the justification of traditional providers to charge for the certificates? Do they offer services or extended certificates that "Let's encrypt" doesn't or is it just a matter of "no one tried to offer it for free before"?

Never really thought of Apple as a defender of user privacy, but it does make some sense. They aren't in the market for ads, so there's no reason for them to make their users the product.

I think it shouldn't be surprising that Google acts like this. It seemed likely from the start that their ad blocking effort is mostly an attempt to preserve the ad industry and eliminate third party ad blocking not under Google's control.

Interesting, thanks for the tip! I will check it out.

I remember that only a few years ago, in a computational statistics class I took the lecturer mentioned how SVMs (and Random Forests) have largely replaced neural networks. How things can change so quickly...

I always liked SVMs for the elegance of the kernel trick, but I guess choosing the right kernel functions and parameters for them wasn't that much easier than training a neural net either.

My takeaway from this post kind of is that there are probably too many variants and derivatives of SHA-3. Then again, these days normal developers should probably use some recommended interface of mature crypto libraries anyway and shouldn't play around with cryptographic primitives directly, so maybe more choice for the library devs is good.

Since questions about crypto came up, here's a summary paper by Daniel Bernstein about it:

https://eprint.iacr.org/2017/314.pdf

Symmetric cryptography would be safe even with quantum computers (they just half the effective bit length of the cypher with Grover's algorithm, which can be compensated for by increasing the key length). Classical asymmetric cryptography would be in danger, but there are alternative systems for which no quantum based attacks are known. They can be a bit unwieldy to use and have much larger key sizes than what we currently use - but methods that are hopefully quantum-proof may exist. The Lamport signature scheme is probably one of the methods that is the easiest to understand.

Not all hope is lost for cryptography even with quantum computers.

Thanks for your analysis, seems like a realistic reading ​of the situation.

I wonder if the threat of the net going dark is really anywhere as bad as the intelligence agencies pretend, considering that there is more information available than ever before outside of those encrypted messaging apps.

I'm surprised the EU hasn't acted against Google already. Remember when they (rightfully) went after Microsoft and forced them to offer a browser choice? And that wasn't even the peak of the Internet Explorer monopoly.

And yet it's allowed that like 80% smartphones sold in Europe come with Android versions that basically lock the user into the Google ecosystem, else you can't use the default store.

"during a meeting with FBI and FSB, a Russian official came to a member of the Dutch police team, pointed at someone from the FBI and said "he is copying your data". An investigator went looking and saw that indeed the American had a thumb drive in a police laptop and was copying Dutch information"

Funny, but slightly depressing too. I wonder how it's like for security professionals working internationally when you always have to consider that your international partners are likely looking to stab you in the back. Would probably be too frustrating for me.

While I don't really believe Apple will not also eventually succumb to the idea of making more money by incorporating tracking and selling out users, I really liked their initiatives for privacy-preserving data collection like the differential privacy approach they promised last year.

I hope they publish more in that direction.

Interesting, I didn't know that homomorphic encryption was already advanced enough to be feasible for actual computation. Years ago I just read about the proof-of-concept systems that worked but were too slow.

I'm still doubtful if the specificity of such pre-crime systems will be high enough that only a negligible number people will be wrongfully investigated. After all, the prevalence of terrorism is extremely low in any population. I guess if you trust law enforcement enough to escalate the investigation slowly and carefully (instead of putting a suspect on a no-fly list immediately) it can work.

Also, with regard to the audits by NGOs or government watchdogs: I suppose you would also need the auditors to cryptographically sign the version of the software they audited so that users can check that a trusted surveillance system was deployed.

I don't seem to get the efficiency table (or how efficiency is defined here?). Since Base65536 encodes 16 bits, why can't it encode UTF-16 with 100% efficiency? It says the efficiency is 64% instead.

I'm sure it's true, just curious why.

I suppose Samsung tuned the system to avoid false negatives, which might be difficult in all the lighting conditions that might come up in real world use. It's a device for the mass market and average user after all.

Might be that they did a bad job with the Iris recognition, but why not give them the benefit of the doubt and consider that they were aware of the trade-offs involved?

>Iris recognition may be barely sufficient to protect a phone against complete strangers unlocking it

I suppose that's the attack scenario those systems (at least in phones) are supposed to protect against, to be fair. Suppose the alternative might be that some users use a predictable pin or none at all. Fingerprints or the iris sensor is an improvement for them because they are quick and easy to use.

Of course it's still good to deflate the hype around Iris scanners a bit and demonstrate that it is currently a very limited technology after all. Especially considering their remark that iris scanners spread to other devices too.

I guess it will unfortunately take a long time for the world to realize that the rules of "cyberwar" are different from the conventional military. (Of course, there's a lot of literature from security and cyberwar researchers, but that doesn't seem to reach the politicians.)

You can't just pour money in offensive capabilities of your intelligence agencies, as is currently done in most countries, and hope to "win". Your exploits and zero days will be stolen, your critical systems will be weaker (because you intentionally weakened them or didn't disclose vulnerabilities) and you simply can't control the weapons you created. Worst of all, the weapons developed by state actors will fall into the hands of ordinary criminals, which makes for an even more complicated world.

One of the side effect if states participate in the proliferation of offensive tools. Won't be the last time state-sponsored tools, exploits or backdoors fall into the hands of interested third parties.

I think collateral damage like that is way underrated by politicians all around the globe that call for their respective intelligence agencies to build up offensive capabilities to be able to conduct cyber warfare and whatnot.

I have the same problem on Firefox a 2560x1440 monitor. (Still very nice presentation though.)

If only intelligence agencies spent as much money and effort on securing its critical systems as they invest in sabotaging other countries' infrastructure. Maybe putting defense first would be helpful, especially considering how easy the proliferation of offensive tools is.

While probably not wrong, such lists about how to optimize my lifestyle make me anxious if anything. It kinda suggests if I don't start my fitness diary, self-improvement plan and life goal milestone list right now, I'm wasting my time.

It's very telling and somewhat disappointing that the Deutsche Post (not a traditional car maker) can get a fleet of electric cars up and running while traditional German automotive industry is still delaying as long as possible, showing off futuristic (and ugly) design studies instead of putting electric cars on the road.

You say that as if everyone had the ability to changes ISPs freely. Consumer choice is irrelevant if there's nothing to choose from.

At least consumers still have https going for them I suppose? Or maybe ISPs are now more motivated to man-in-the-middle those connections to get to the data, under the guise of security or something?

I morbidly curious how many terrorist attacks we are away from actual laws that will attempt to outlaw encryption as used by WhatsApp (even if it wouldn't make sense to do that). Resistance against such measures outside of the tech scene would probably be low. The "I've got nothing to hide" mentality is actually quite widespread among the population, so I don't even think it would be a risky move politically.

Well, the Pirate Bay probably never really caught the interest of totalitarian states that really wanted to suppress its existence.

Now, the UK isn't at that point obviously, but if they really wanted to use draconian measures against encryption, it probably would be somewhat effective.