adrtessier

If that's the case, Roger Dingledine is probably the one that should become a non-US person, given he is still leading the technical side of things from what I can see. He could be NSL'd just the same. At the end of the day, Tor is an American project, and still has to play to some extent by American rules. Doing that above board is really all they have.

I agree with you 100% that Tor has its problems, and that it is a research project. It is not, and I do not believe it is, a panacea for strong anonymity on the web, and it is not intended to provide protection against a lot of things people think Tor provides protection from.

However, I disagree with your statement that Tor is not worth continued support. Even with its imperfections, I believe the Tor Project community is still working toward useful and productive goals on anonymity research, and is still a flagship of that to the greater public that is interested in protecting their privacy online. Maintaining a basic level of support for these ideals is parallel to Tor, but Tor in many ways is also a representative outlet for them.

Regardless of Tor's actual effectiveness, Tor's current profile is likely to make it the first anonymity tool of its kind to get attacked in the courts, especially if someone can do more than pretend there is a link between Tor and Islamic terrorism. How the Tor Project handles the litigation and political process that will stem from this heat will probably set case law, and with it court precedent, for other anonymity tools that come in its future. In that regard, Tor could become the PGP of the so-called second crypto wars.

Ack. If you need bindings in iOS, just use libsodium?

As far as I am concerned, everything about this is a little scary. Some guy like tptacek will come in here and school me (please do, senpai), but even a crypto novice* like me can see there are a thousand ways an API this low-level can go wrong. Some off the top of my head:

1. ECB mode might as well not be implemented. It sucks in a thousand ways, only one of which is the one displayed in the talk. ECB is half of the time the first crypto mode a novice implements (IV? What's an IV?) and using it over the wire is an instant replay attack vulnerability.

2. There is no sane default to AEAD of any sort, and modes like GCM do not even appear to be supported, per this talk. CBC is malleable [1]. Both BEAST and POODLE attacks were on TLS CBC.

3. DES? Seriously? Can we not deprecate this in new libraries, or at least make it a forced add-on to the library vs. an easy to choose built in?

Way too much is left to the developer, all of which are easy ways to shoot one's own foot. I hope you get your KDF right. I hope you get your cipher mode right. I hope you generate IVs from a proper, cryptographically secure random source and don't reuse them.

Low level crypto libraries like this are danger and death, and what someone with half the ability to implement a Swift-only library like libsodium should roll in here real fast, and save the Swift community from this mess before people start mucking around with all of these primitives in their production code. It's only a matter of time if this gets a lot of airtime without an easier solution. Instead, we'll probably end up with a few "secret messengers" that use "industry-standard Apple CommonCrypto library" and a string of primitive names.

These things are effectively an insecure default to publish these as the standard library. Wrappers on this stuff should probably be the default and the best practice from those writing language standard libraries should probably develop those the moment they have primitives available. To use a non-crypto analogy, think of using SimpleHTTPServer instead of socket in Python. We should have SimpleCrypto, with sane, secure defaults and standard primitives. It's a damn shame only a few people are pretty much qualified to audit and write this type of thing these days.

[1] http://cryptopals.com/sets/2/challenges/16/

* The entirety of my cryptographic knowledge comes from Katz, Schneier, reading a bunch of IACR papers, watching the Crypto conferences, and doing all the crypto challenges I can find online to solve. I believe that I know enough to be dangerous, and that is enough to know I wouldn't fucking touch this in a production app.

I feel as you do. As much as I am loathe to accept anything coming out of one of these organizations as an open-source project, I think it may actually do us more harm than good by attacking this project out of protest for the way they use their tools.

We can be as negative as we wish towards these agencies, but rejecting any and all attempts at communicating with the open source community is a strong way to reinforce their already insular culture. Embracing these projects in some way or another can possibly work as positive feedback toward greater organizational transparency, if not by the brass, than by the developers and engineers that work in these organizations.

It is hard for me to come up with a better strategy for a Tor executive director, than to hire someone who is both a proven electronic civil liberties activist and a competent attorney to lead a project that has already been feeling the heat. Unfortunately, Tor likely will be publicly thrown to the angry mob by an ignorant representative the moment it is politically expedient and be seared on the grill of neocon pundits, all while the USG continues to push it covertly in places where American influence cannot as easily penetrate due to network censorship.

Steele has a long road in front of her, but she seems to be a great person to lead this project to success. Congrats to everyone working on the project; it is truly necessary in places like Iran to see a neutral Internet.

> I'd like to see an investigation, however, why a perfectly working truck was shipped overseas and left the American market.

There is a massive amount of used cars in the US, and historically a large demand for these types of vehicles in Africa and the Middle East, where import taxes are lax and it's far easier to register a gray market vehicle than it is in the States. Trucks like this can fetch a much greater premium in those areas, and it is profitable for import/export companies to ship them there.

Assuming Turn2U Inc is legitimate, I'd gladly offer some of my time to work on programs like this as well.

If you don't mind me asking, in which city do you live?

What about anything else where you are paying for the experience? While not a perfect analogy, Walt Disney World comes to mind: it's a place you take your family, and you are subject to potentially spending tens of thousands of dollars there, in the parks and the hotels, on food and attractions. Amusement parks, like casinos, are labyrinthine and optimized to take your money, and food/drinks are usually extremely overpriced for the quality. Leaving souvenirs aside, is this, too, something you are against?

I'm quickly understanding that I need to learn to be more specific as to what the premise of my statement is before I comment here.

I agree with your point as to fixing all holes; I was making the point more toward people freaking out that these AV systems are inserting the certificates and inspecting the traffic in the first place. Sorry for the confusion.

Given Drupal's highly-modular architecture, React and a manager like Redux makes the most sense IMO.

Building the Drupal module frontend as React Components seems like it would be easy to add on as a toggleable layer. You push state into the global Drupal root and mimic the module tree in the state store, and then reduce based upon a dispatch from individual modules somewhere in the document tree.

It's a very clean fit into Drupal's legacy architecture and easy for a Drupal developer to wrap their head around, as it's all one-way.

I don't think that is his point; that's not what Harley does, at all.

H-D markets themselves as a "lifestyle brand". You don't just buy a motorcycle and you're done. You are aggressively marketed toward for a bunch of different pieces of clothing, spare parts, co-branded partnerships with automobile companies, et cetera, ad nauseum. You are effectively buying into a subculture.

Furthermore, Harley-Davidson has been known to use almost identical sales tactics. IIRC and I can't find it now, but sometime last year a sales guidelines book was leaked that actually did things like put attractive models at gas stations to tell the prospective buyer "nice bike" or the like on their test rides.

> You had the education and the know-how to be able to learn to defend yourself from ads, and out of some sense of modesty, you're going to keep it to yourself?

I'm unsure how it is that you draw this as the conclusion. What am I keeping to myself? The OP's argument is about banning specific types of games because some people can't control themselves.

I believe there is a strong difference between asking the government to ban an action versus sharing information on the risks of an action. I've generally nothing against the government issuing required warnings on vices, assuming the information is scientifically accurate (e.g. the warnings on tobacco boxes, etc.)

I don't believe that the original author is making the argument that "marketers sometimes do shady things with data." From its title and lede to the end, I read it as "some of these games are manipulative and use manipulative tactics and mechanics to suck money out of people, sometimes to their own demise. The government needs to regulate this industry to protect people from themselves and ban these mechanics." This is roughly as simple to regulate and ban as it is to ban any other type of mechanic. It is what leads to weird laws such as some of California's casinos having weird bingo-based slot machines, or pachinko machines in Japan needing you to trade a pseudocurrency for goods.

The point I'm trying to make is that it is impractical, costly, probably impossible and dangerous to attempt to limit the mechanics the OP is really pissed off about in a way that does not also impinge upon the freedom of the majority in order to protect those with poor impulse control.

I am capable of going to a casino and walking out of there without losing my shirt. I am equally as capable of going to have a few drinks at a bar without becoming an alcoholic, or to have sex with somebody and not turn into a raging sex addict. Should my ability to go to casinos, drink, or sleep with people be regulated too, just because some people's lives are ruined by these things?

You can project this argument into a thousand different things just because people like them. For example, I spend an absolute eternity on the Internet. The vast majority of my life is spent reading, writing code, or doing other coder-type things. Because of this, I have also had to eat the opportunity cost involved; I have missed out on some social gatherings, I have lost friends and also lost any and all experience I would get otherwise. It's safe to say, by some general decree, that I'm addicted to what I do. I'd argue I'm passionate. Should my work and passions be regulated because there is an opportunity cost to me doing so? Should I not be allowed to have the Internet at all because someone else has racked up inordinate amounts of debt at World of Warcraft?

I don't believe it is the fault of the mechanic that these people have poor impulse control, for some reason or another, and I also don't believe it's fair to limit the existence of these types of games because some people are incapable of walking away from them. If we should do anything regulatory down this path, it is building in proper harm reduction systems for these things versus taking a puritanical "ban it" approach to them.

> "We need to reign this stuff in. Its not just psychological warfare, but warfare where you, the customer, are woefully outgunned, and losing. Some people are losing catastrophically."

I strongly disagree with this statement. I am very aware of the psychology behind marketing and advertising, and anyone with half an interest in it has probably read Vance Packard's The Hidden Persuaders, which was released, oh, 58 years ago. People know what pushes their buttons, too, and we have a name for it: interest. Not "manipulation". Certainly not "psychological warfare".

Marketing and advertising might seem to be refined in this dopamine-heavy, short-attention-span social gaming age, but this shit has been around as long as humanity itself has existed. Some people have better impulse control than others; it's not the state's job to regulate the impulses of their populaces, or regulate systems that know how to manipulate them. It's a slippery slope that would take down the entirety of marketing and advertising as an industry, an industry which is pretty much necessary for the vast majority of the citizenry to even know what is out there to purchase.

Furthermore, how would one even decide where the line between manipulative consumption and social signaling is? Some people want to own all the capital ships; they have some social hierarchy in some subculture standing upon it. Should I regulate that, too, and force them to have the same consumption values and preferences that I do? Should we take this a step further and ban all vices? Let's see how fast American society would fall apart if we banned alcohol again.

FWIW, I hate consumerism and advertising. I block ads everywhere, I hate big branded items, I don't know the last time I bought something from an ad. Just because I feel this way, I don't go around trying to violently force that opinion upon others by begging the state to do it for me.

On one hand, I am happy that Telegram exists; its founding story, homebrew crypto, cute marketing and "not-American" position has made it a shit magnet for a lot of people that don't know what makes things secure, and are convinced by some Zuck-esque figure's charisma that he knows what's going on encryption-wise. It makes it a lightning rod for this type of press, attracts the idiotic bits of Daesh, and keeps this press-fueled, IC-backed anti-crypto heat off of other systems that actually work to keep people secure.

On the other hand, some others inevitably become collateral damage, using Telegram's (entirely) insecure defaults and thinking they have "secret" messages, or worse yet, enabling MTProto and believing they are safe in high-risk environments. Given this latest PR stunt, though, I think the benefits of Telegram's existence seem to outweigh its costs.

Avast is not the only antivirus program that does that these days; ESET does it, and Symantec's Norton products do as well IIRC. As everything moves toward TLS, this is pretty much a required step on the client for "Internet Security", and the average person doesn't know or doesn't care.

Largely, you probably should not either if you are trusting the AV client with the rest of your computer. Yes, it can be fucked up and break TLS, but there are a thousand other ways a privileged executable like an AV program could fuck up a lot more of your system. For example, a bunch of CVEs were found in Kaspersky's product by Tavis Ormandy in September, and it appears that a few found in Avast have been made public within the past few days. [1]

[1] https://code.google.com/p/google-security-research/issues/de...

Well, it's good to know that I basically got it right. I don't work in incident response, so I had to make an educated guess at what signatures I'd assume IR people would use to respectably say "this is a nation-state."

> I work with one of the people interviewed in the article, we've been having some fun on Slack with it

Ooh boy. I don't think there's much you can do about something like this other than laugh it off, and also maybe recognize that hey, you're probably doing something of influence. (And probably make lots of jokes about APTs.)

Attribution is generally hard in these types of things, and some guy with IR experience can probably explain more than I can.

However, some of these attack groups follow specific patterns, use specific IP addresses, domains, emails, etc. because there is no real consequence to them doing so. Kaspersky, Mandiant et al [1] often have great writeups on these types of things that are often posted to their own blogs and to netsec-related mailing lists that show some of these common attack patterns.

On top of this, Twitter could have been tipped off by law enforcement or intelligence.

[1] http://www.mandiant.com/apt1

Yeah, somebody had fun with that article. It's one of my favorites on Wikipedia.

It seems that working publicly on information privacy tools (and especially the Tor Project) increasingly makes you a target for nation-state-level adversaries. I'm very curious who the actor was, and what they expected to gain of value from Twitter accounts.

I find it extremely unlikely for this attack to have been perpetrated by the United States; after all, Twitter is an American company and a three-letter could just NSL them for the data they wanted on these "activists".

If there is one place in the American government where "checks and balances" have become a farce, it is in the sheer amount of things the executive branch can get away with by EO. I will be very interested to see what, if any, effect they can have on actual gun control with an Executive Order, and just how fast the Judicial Branch strikes this down.

It is far easier for us to vilify guns and maintain the status quo versus recognize and fix what is actually causing all of this violence: the quickly widening cultural polarity between Americans. An actually united populace and culture does not often shoot itself to death. There's too much money to be made by making people pick sides instead of join on a common one, and until that changes, I don't think America will ever solve its violence problem.

I think there is a distinction to be made between surveillance and data, and I do not necessarily think you need to go full cypherpunk to make a meaningful difference. The cat is well out of the bag on data collection and analytics and it will be that way forever.

However, people working within institutions that contain sensitive data can help affect positive change from the inside as well as the outside. Be a voice for the security of user data within your organization, and do what you can to meaningfully contribute to methods that increase user anonymity and business models that do not require being excessively intrusive into the personal details of others. There is something you can do everywhere, and it is far better to have people privacy-minded even inside of the classical "surveillance" companies than having these companies run recklessly without a voice for the user. In fact, it may even have more impact than yet another frontend for yet another OTR implementation.

I'm very curious as to what the reaction was of the first pilot that was shot at. My guess is he was probably be thinking more "Wow, what an asshole," than he would be thinking that the aggressor's action makes sense in the context of war.

Have you continued the things that have worked? I have never been to Switzerland and know little about its medical care, but I can't imagine there is not someone there that can help you with this given how advanced the society is.

> It's shocking to me how inconsiderate the Japanese are of suicide and grieving.

Eh, I think it's a different perspective. Simplifying things greatly, Japanese society is a collective one, and one could argue that suicide is a selfish decision that damages the collective by removing any possible utility you may be giving it for the sake of yourself. As even small transgressions of this nature are frowned upon in Japanese culture, it's not surprising to me that the bigger transgressions have these reactions.

Is it even possible for an expat to become a Shinto priest?

It's extra funny when you read this sentence, understand how business goes on in China, and then read Li Gong try to backpedal from the fact that everybody knows what is really going on here, saying "We carefully chose to incorporate in Hong Kong instead of the US, or mainland China for that matter, because we foresee geopolitical factors that may impact our global business down the line."

Yep, sure. I'll choose to follow the money over the rhetoric.

It might be best, then, to speak to a psychiatrist versus a therapist, if therapy is not working well for you, especially with an ADD diagnosis.

It sounds like you may be best off seeing a psychotherapist that may be able to help you better understand and control your novelty-seeking. Your pattern sounds self-destructive and it is obviously causing you distress.

Also: have you considered contract or consulting work? If you have the freedom to travel around for work, it can be more dynamic and rewarding than your current pattern.