FredericJ

Just a quick warning though. A lot of those flights are not originating from the city or main airports. For instance, the "Brussels" flight they suggest taking is from an airport that is one hour away from Brussels (in Charleroi). It means that you will need to spend some more money to get to the city centres. These additional costs from "low cost" airports to the cities do add up to a significant amount on that entire itinerary. Just something to keep in mind.

If those kind of devices interest you, I'm quite intrigued by the IDQuantique ones that are based on quantum physics to generate randomness. They have a USB product that has a random stream of 4Mbits/sec and is used by lotteries and gambling sites.

http://www.idquantique.com/random-number-generation/quantis-...

It was originally going to be called "Whisper" (by Open Whisper Systems) ==> https://whispersystems.org/blog/a-whisper/

The name was changed after Whisper was launched https://whisper.sh/

This issue is intrinsic to the security model of Android before Marshmallow.

If an app is going to be able to send a contact, share a location, make a phone call ... all these permissions need to be demanded upfront, which I understand can be scary.

You also need to keep in mind that nobody is going to use "secure messaging" if it's a pain to use. You obviously don't want to be copy pasting contact information in the app for instance.

I'm glad to see that Android is following iOS's permission model where permissions are only asked at run time.

Isn't it ironic to see so much inline assembly while Apple is telling third party devs that they can't distribute binaries on WatchOS and that iOS apps are moving towards Bitcode too?

Apple's crypto people definitely know that assembly is key in performance and side-channel resistance of cryptographic implementations. They use it constantly. I guess at some point they will just ask 3rd party devs to call corecrypto methods if they want to use encryption in Bitcode apps.

But this means that you'll have to wait for Apple to implement whatever primitive you need for your app. Good enough in most cases but encryption apps with special needs will find this annoying.

Especially since a few implementations are actually borrowed from open-source projects. The 25519 implementations are from DJB's supercop for signing and Adam Langley's Donna for ECDH, both available online with open source licenses.

Important: The headline was modified since I submitted this. Apple didn't actually open-source the code. They give you a 90-day licence to read the code.

> Apple grants you, for a period of ninety days from the date you downloaded the Apple Software, a limited, non-exclusive, non-licensable license under Apple's copyrights in the Apple Software to make a reasonable number of copies of, compile and run the Apple Software internally within your organization only on devices and computers you own or control for the sole purpose of verifying the security characteristics and correct functioning of the Apple Software;...

In this specific case, DMCA doesn't apply. But it's interesting to read GitHub's policy about taking down forks.

> GitHub will not automatically disable forks when disabling a parent repository. This is because forks belong to different users, may have been altered in significant ways, and may be licensed or used in a different way that is protected by the fair-use doctrine. GitHub does not conduct any independent investigation into forks. We expect copyright owners to conduct that investigation and, if they believe that the forks are also infringing, expressly include forks in their takedown notice.

https://help.github.com/articles/dmca-takedown-policy/

The issue is that you're not Google's client. Maybe buy something from them (a large amount of ads), then try to get support?

For those not familiar with Craig Murray:

- former British ambassador to Uzbekistan

- he accused the Karimov administration of human rights abuses, which he argued was a step against the wishes of the British government and the reason for his removal.

- complained to the Foreign and Commonwealth Office that intelligence linking the Islamic Movement of Uzbekistan to al-Qaeda was unreliable, immoral and illegal, as it was thought to have been obtained through torture

- was subsequently removed from his ambassadorial post on 14 October 2004

Source: https://en.wikipedia.org/wiki/Craig_Murray

Edward Snowden had predicted a radicalization of a class of professionals. We're coming to the point where, similarly to nuclear physicists after Hiroshima, we decide as a community to not let our skills be used for unethical purposes.

Aren't Google Zurich employees payed in CHF?

And paid $99 to distribute it.

That doesn't matter. You can generate a new Curve25519 identity key per connection.

It's important to note that this consensus model only works if all nodes are honest.

Hey, I'm the co-lead developer of Signal. We're looking for help with translations, help us out to bring Signal to as many people as possible: https://www.transifex.com/projects/p/signal-ios/ We also pay per commit if you want to help on Open Whisper Systems projects: http://bithub.whispersystems.org/

Source: https://github.com/xdamman/ReplayLastGoal

It's based on vulnerabilities disclosed in Stefan Esser's iOS security workshop.

Source code available at: https://github.com/xdamman/ReplayLastGoal

Code available at: https://github.com/xdamman/ReplayLastGoal

I wrote a post about what happened: https://medium.com/@FredericJacobs/the-reuters-compromise-by...

MAC addresses are heavily used for routing purposes on a link layer. [Ethernet, WiFi ...]

Anyone has other good crypto handbooks? I would be interested.

And for watching FoxNews?

If you don't know about Namecoin here are too additional ressources you might want to check out: "OkTurtles + DNSChain" (working Namecoin + DNS implementation): http://okturtles.com/ and "Providing better confidentiality and authentication on the Internet using Namecoin and MinimaLT" : https://github.com/FredericJacobs/safeweb/blob/master/paper....

Context: "How Facebook is destroying history in the context of the Syrian Civil War" http://brown-moses.blogspot.co.uk/2014/02/how-facebook-is-de...

Alghayma is free and open-source software: https://github.com/Alghayma/Alghayma

Hey, I was one of the movies.io guys. We did remove the torrenting part of the website more than a year ago.

Before that, you could indeed pick a film, download the torrent in the cloud and directly stream it from our web interface.

Good old days but we all moved on to new challenges.

Related must-watch: http://www.youtube.com/watch?v=4kuM_NTTxAc

Do you know what has been compromised?

How do you store the Buffer passwords? SHA1(password+salt)?

As long as cold boot attacks are an issue, physical security is a big win.

But promising research might make it a thing of the past. http://privatecore.com/vcage/