alethiophile

...So people experienced a feeling of a presence behind them... when something behind them touched them?

That would seem to be pretty robust evidence of a presence behind someone, really.

(the bit with the sensorimotor lag is necessary for this, of course; it's pretty obvious that the brain accounts differently for sensory input that it can directly correlate with its own actions and that it can't. But I bet that you'd also get a feeling of presence if the robot was touching someone on an autonomous program, which would be just as completely unsurprising.)

I mean, that's true, but it's also very limiting. Everything is a tradeoff between security and functionality; the only perfectly secure computer is one turned off and embedded in a concrete block.

In particular, a whole lot of people want to be able to use cloud storage for the synchronization/offsite benefits, yet not expose all their data to $ARBITRARY_CLOUD_HOST.

Fair.

But most schools aren't, and they aren't going to roll out those procedures unevenly.

In most any kind of disaster, secondary effects kill way more people than primary effects. Even if it seems silly, taking effective measures against the secondary effects is very worth doing.

(Also, for nuclear bombs specifically, hiding under the desks keeps kids out of view of windows, and hence not vulnerable to being blinded/burned by a flash.)

This is pretty classic nuisance extortion through the courts. What were the oil companies meant to do in order to avoid this lawsuit? Shut down their entire businesses? So that instead Oakland could sue the new oil companies that would inevitably spring up, since our entire civilization still runs on the stuff?

Also, though the article doesn't say it outright, it looks as if there's not even given any evidence of current damages, just hundred-year-out projections. (And the record of long-term predictions in this domain is certainly not precise enough to base legal arguments on.) So they're meant to pay now for hypothetical damages that may happen later, as punishment for providing the energy that runs our whole society. Okay?

This kind of thing is good, but I would definitely characterize going all-in on walled gardens and creating ecosystems where only approved code can run as "evil". That certainly characterized Apple/iOS when last I looked, which is why I dropped them. (What's the status of the latest iPhones for that? Can they be jailbroken at all?)

In practice, you'd have techies with the bit between their teeth passing magnet links around, and media companies playing whack-a-mole with anyone who hosts it too visibly. Meanwhile, anyone who makes a modest effort can get a DRM-free pirated copy without trouble, and the 95% of people who don't bother will continue paying for their Netflix subscription.

If you're paying that particular nanny for exceptional value that is provided on the basis of her individual relationship with you, that's great and a good idea.

If you're paying it to whoever the nanny happens to be because you feel guilty about being rich, that's got less of a rationale behind it.

Do Google ad tracking cookies actually live on the google.com domain? Seems like an ethical violation of some kind if so.

She's presumably paying the nanny some kind of market rate. If instead she were to bump the pay up well above market rate, she would either attract significant competition over that particular nanny job (presumably not the goal), or be effectively giving a large cash handout to someone basically on the basis of happening to be around at the time. It doesn't seem obvious that this is a useful or desirable course of action, either on the basis of addressing inequality in the economic system or optimizing your interpersonal relationships.

(Also, I feel like I may have some kind of disconnect here, because I'm not anywhere near those income levels, but $6 bread doesn't scan as horribly unreasonable to me.)

The same temperature is far less tolerable indoors than out. Particularly in modern buildings, which are designed for total reliance on central air systems and so don't have organic airflow. (Which also has advantages, mostly better use of space; but it introduces a pretty hard dependency on operating in those buildings for long.)

The exact same set of moderation actions will look like a necessary and correct restriction on bad actors to one group, while looking like a choking echo-chamber imposition to another.

The reality is that any social space needs to have a set of norms, including ideological norms, that are enforced to a degree to ensure they're followed. The idea of purely "open discussion" is a fantasy; if you ever have something that feels like that, it's because the participants have internalized the enforced norms sufficiently that they never run into the enforcement.

The difficult problem is picking out a set of norms that successfully produce the quality of space you want. Sometimes that is an outright ideological echo chamber. (In fact, it almost always is, to at least the limited degree that there is some ideological position that would be rejected without consideration by the participants and met with hostility. This is a good thing.) Any talk of "open discussion" must always the include the important context of "within what boundaries".

I'm as happy as anyone to screw over Facebook, but this is actually really bad.

I run a forum with ~1000 users. It costs us ~$60 a month and the corporate infrastructure is me and one other guy. If we were vulnerable to actually being sued for an infringement on a user's part, we would probably just have to shut down; neither of us is up for running a legal battle.

Luckily we're US, not EU, but presumably there are small forum/blog operators in the EU as well.

If the original files weren't under the control of the adversary, that's a preimage attack, not a collision attack. No hash that's ever used for file authentication, even MD5, is vulnerable to second preimage.

If they were, then first off you should have been more careful about putting untrusted data on the same drive as anything actually important, but secondly it's usually obvious when a file is constructed as part of a collision attack, and there would be no good reason for the government's exhibits to show those markers.

Really, this whole discourse is silly anyway. In accordance with the usual XKCD, if the government really wants to railroad you, they won't bother with cryptographic vulnerabilities; they'll just lie and/or plant evidence. Creating and exploiting a hash collision isn't something you do by accident; it's conscious, outright evidence manipulation, and if they're willing to do that they can do it much easier ways.

I am also not a lawyer, but if the government really just wanted their conviction of this one guy, the obvious path seems to be to abandon the court order to decrypt the drive, and just move forward with trial based on the forensic evidence from the system root. Slapping him with contempt on this, and continuing to sweat him out in jail while he files higher and higher appeals, is the government's decision.

Getting the Supremes' opinion on this is kind of a superposition of states: if they decide in favor of right-to-encrypt, that's great, as suddenly the government will (presumably) stop using these kinds of court orders; but if they find against, then it's worse than the current uncertain situation, as orders to decrypt will then become an accepted tool. If the Supremes would find in favor of compelled decryption, then I'd prefer it never go to them, and remain in the current legal limbo.

If it's a hash without known collision vulnerabilities, then it's 2^80 proof at least. This is definitely "beyond a reasonable doubt".

Even if there were, what's the threat model? "Government creates colliding images one CP and one not, seeds the non-CP versions widely in torrents or something, then uses the hash collision to accuse anyone who downloaded of CP"? That's way more roundabout than governments will bother with; a dirty prosecutor will just fabricate evidence entirely, or have witnesses lie. (Plus, just producing the innocuous colliding image and demonstrating the collision would be an easy and ironclad defense.)

This whole endeavor was fairly ill-starred from the beginning. Looking at their list of arbiters, they're pulling in places like Politifact whose bread-and-butter is in parsing out politicians' statements themselves and ranking them N pinocchios, or whatever.

This kind of "fact-checking" is inherently political, since everything depends on exactly how much charity you grant the speaker for simplifications that may or may not convey an accurate picture of reality, or out-of-context presentations of true facts that don't have the implications a naive audience might draw. Therefore, all such attempts will have a necessary and massive credibility problem; it's very easy for non-mainstream elements to simply paint the fact-checker as biased. See, for instance, the alacrity with which Trump and his supporters turned around the label "fake news" itself as an insult against the mainstream organizations they feud with.

Meanwhile, there's the separate issue of clickbaity news stories that describe events which simply never happened, presumably for the ad revenue. Unlike political stories, these can generally be quickly and objectively categorized as such; however, Facebook also has the incentive to keep these on their platform to drive more engagement with Facebook, and so it's near-certain they won't be productively addressed, despite being a problem that everyone can agree on.

If they've linked specific hashes to known CP content, then presumably they have those files available. They can still present that as evidence, then have the experts testify that those specific files are known to have been on the drive.

Going to the Supreme Court specifically on the forced-decryption issue sends a pretty strong signal that that's what they actually care about.

This is interesting, because the case is clearly being structured (intentionally by the government, one presumes) to force the test case of "is compelled decryption legal" onto the most unsympathetic possible defendant.

If the government "knows beyond doubt" that the encrypted drives have CP on them, then they have everything necessary to move forward with a trial without decrypting the drives at all. That satisfies society's legitimate interest in suppressing child porn, while also not trampling all over the legal right to use encryption. Choosing to structure the case in this way, with an appeal to the Supreme Court over a matter that's a technicality in the original case, clearly shows that the goal is to get a precedent for forced decryption, not merely to jail one child porn possessor.

I feel like this entry should have a different title. I passed it over at first because it looks like it's just a primer on how to implement ls -v, or something, when it's much more interesting.

How would it ever work any other way?

Someone needs to run the trunk lines, and you will always need to talk to these people to get yourself connected.

Web code is only allowed to send TCP packets (websockets go on port 80 by default, just like HTTP). It also doesn't allow crafting special packets. pwnat's method relies on being able to send ICMP and UDP, which the browser won't.

That is an awesome tool, but it requires a cooperating server inside your NAT; for security-breaching purposes, if you've got code execution on a machine inside the firewall, you've already won (against the firewall, anyway).

The default configuration for many firewalls (software, at least) approximates "allow all outgoing connections but no incoming". Assuming all your connections pass through the same box (which they usually will, for a home network), there's no reason why it shouldn't have such a firewall even if it's otherwise a router that doesn't do NAT.

Denying the ISPs trivial inspection into the structure of home networks, OTOH, is a major benefit and maybe a concrete downside to adopting IPv6 locally.

It would certainly be interesting to hear some evidence or justification for this position, given that the record of governments with respect to privacy over the Internet era (at least) has been uniformly dismal and getting worse.

It certainly seems like the positive statement "government is not motivated to protect individual privacy and will not effectively do so" is well-supported by current experience.

Innovation in specific areas slows or stops all the time. The general run of technical progress in a specific area shows an S-curve, in which initial discoveries are made slowly, later progress accelerates as synergies are exploited and greater investment is made, and finally innovation decreases as low-hanging fruit is exhausted and the shape of available technology matches that of the problem domain. For an example of this, see aerospace; it took around sixty years to go from the field's inception to the moon landing and the Concorde, and in the fifty years since we've made mostly incremental progress over the technologies involved in both.

It seems that we're currently approaching the top of the S-curve for computation via integrated circuits; further increases going forward are likely to be incremental and margin-focused, as opposed to paradigm-shattering. Maintaining the 1950-2010 rate of productivity improvement will require new paradigm-shattering advances in some other field (machine learning? Internet of Things stuff?). It's possible that these are indeed forthcoming, and we can continue our absurd growth levels for another fifty years. It's also possible that we're nearing the edge of the problem space and we won't have any more easy order-of-magnitude productivity boosts. If the latter is true, then our economy will inevitably collapse with enormous collateral damage. As an economic system, this seems unstable at best.

See also, the related phenomenon of a company introducing a new, notionally superior product line at a higher price than the original, then somewhat later discontinuing the original, while never reducing the price of the new one. This results in the cheapest available product becoming more expensive, without this appearing in inflation statistics.

I have the most exposure to this in the realm of medical products. A family member has Type I diabetes, and so must continually buy insulin and blood testing supplies as an everyday expense; several times, he has been forced to switch products (between varieties of insulin, from purely chemical test strips to ones with an electronic reader, &c.) by the discontinuance of the older product. The new one is always much more expensive, and never reduces in price to match the old; this has resulted in a significant increase in his expenses for these supplies, despite nothing ever occurring that would appear in inflation statistics.

This doesn't prove that it's sustainable in principle, only that the time to inevitable collapse is greater than the ~80 years since it's been widely implemented.

In practice, ever-increasing debt absolutely requires ever-increasing growth in order to service it. We've so far been lucky, in that the period during which we've used this policy has coincided with the enormous productivity gains that came with the computer revolution. But rearranging our economy so that it's dependent on continual windfalls from external sources merely to stay afloat seems reckless at best.

One of the major underlying issues people are calling out with the indictments of "smartphone culture", and trying to fix by going offline, is a sort of progressive shrinkage of the attention span. It involves progressively less continual attention paid to progressively more individual topics or items; the (current) apotheosis of this paradigm might be Twitter, where you read a constant feed of conceptually disconnected 140-character messages, and any longer-form thought needs unnatural gyrations of the underlying technology to express. Web surfing, or news reading, encourages this style of interaction, with the surfeit of links away to tangentially-related content that is usually not of a form to encourage deep immersion in a single piece.

Books, meanwhile, are of a form to encourage deeper immersion in a single input. Generally speaking, the obvious mode of interaction is to read a single book from start to finish, taking at least hours during which you remain focused on that topic. This kind of long-term focus is required to actually accomplish anything; therefore, a mode of information absorption that trains long-term focus is more effective of personal cultivation than one which encourages mayfly attention-hopping.

Nothing about this necessarily disparages the Internet; it's quite possible to focus on long-form pieces that are Internet-published, or to hop from topic to topic using offline media. But because friction costs encourage longer-term focus when offline, going offline is one effective way to incentivize it.

This is pretty wrong. Hierarchical relationships exist all over the place, and it's still generally fine to trust your boss, or your teacher, or whatever. And in fact you can't run any kind of large organization without hierarchies, and if everyone defaults to not trusting anyone with power over them these organizations would all fall apart.