bcaa7f3a8bbc

> I blame 8080. It's not accessible. Is it technically more advanced? Perhaps.

I think blaming 8080 is extremely inappropriate here, as it is historically inaccurate. Intel 8080 is a preliminary microprocessor (and usually even not considered a x86 processor at all), it was designed in the early 70s, it was very accessible. Arguably, it was the processor that created Altair 8800, which was the ancestor of the entire lines of home computers in the 80s. The original Microsoft BASIC interpreter also targeted Intel 8080 and Altair 8800, the BASIC interpreter would later be licensed to all the other home computer manufacturers including Commodore. The derivative of the Intel 8080, Zilog Z80, was used on Sinclair and MSX computers, particularly, ZX Spectrum is the British-equivalent of Commodore 64, and MSX is the Japanese equivalent (also made and sold in some European countries) and introduced a generation to programming.

With the correct historical background in mind, you better to blame 8085, 8086 or 8088. It was those processors that established the x86 architecture and the IBM PC, leading us to desktop computing as we know it today.

Long words short, 8080 gave us home computers. 8088 gave us desktop computers.

Thanks for the interesting link, good to know! So we are in fact, pretty close to a monotonically-increasing, TAI-like Unix clock.

The original article said,

> Each Unix day has the same number of seconds, so it can’t just add an extra second – instead, it repeats the Unix timestamps for the last second of the day.

Your POSIX link says,

> As represented in seconds since the Epoch, each and every day shall be accounted for by exactly 86400 seconds.

I'm not a expert on timekeeping, but it appears the only problem here is that the Unix time is bounded by a 86,400-second day, which I guess was meant to make a Unix day predictable, so we still have to double count or skip seconds. It seems the only thing we need to make Unix time monotonic is simply removing the 86,400 seconds Unix day from specification.

On the other hand, it means a Unix day would be unpredictable and it would be impossible to calculate a Unix time without a database, and difficult calculate future Unix time using calendar time. So TAI doesn't automatically solve every problem, everything comes with a tradeoff.

But I think a unpredictable Unix day should be fine for purpose of an internal system clock, so perhaps it's still not a bad idea.

It's understandable to flag mails from reputation domains as spams if there's no SPF and DMARC, but there is. It's totally unreasonable.

> The filtering is schizophrenic.

The unfortunate result of machine learning? I guess Google's spam filter has lots of pattern-matching and heuristics that don't follow "the rules of E-mails" exactly. Anecdotes in the comments I linked says Google's spam filter has became more aggressive in recent years, I suspect it must be ML.

I hope other HN readers can give a more informative answer to your post, as a sender, I'm having the same problem, it's two sides of the same coin...

Related, a description of the problem, but not a solution:

* Google Is Eating Our Mail

https://news.ycombinator.com/item?id=19756125

My personal mail server has all the industry-standard SPF, DKIM, and DMARC records. But Google still randomly eats my mail, and the system gives no explanation, sometimes it was my kernel patches submitted to the Linux maintainers, yikes! Weeks of time wasted.

Another problem of the present-day WWW is, even archiving all the data is far from enough to preserve the history! That's because the Web has a dual-role, (a) as a protocol, or a medium of communication, and (b) as the software, or the user-interface.

A good history preservation should allow you to somehow "browse" it, as if the historical system is still alive. How the website worked, how it was used, that's all parts of the history. If old operating systems and programs are preserved, there is no reason not to preserve websites in this way.

Back in the old days, many systems are federated and/or distributed, which means the software and the protocol are two separate entities. You use a newsreader, which talks the NNTP protocol to obtain news from a Usenet newsgroup. If you want to preserve history, you can (a) archive the newsreader program with source code, and (b) archive all the data on the NNTP server. That's exactly what has been done already, if you load a Usenet archive to your newsreader, pretty much you would have the experience similar to how Larry Wall browsed the Usenet back in the late 80s, at worst you need to rewrite a compatible "mock" server, but that's all. On the other hand, little of the early BBS systems have been preserved, once the server is gone, everything is gone.

The transformation to the web, means now the platform (a web community) = protocol (backend database format) = user interface (HTML/CSS), they're all tightly coupled together. It creates several problems:

(1) The "internal state" cannot be archived. A website is a system with constantly updating parameters, and often they are not stored. Simple examples: (a) On Hacker News, I cannot see what was shown on the frontpage yesterday retroactively, (b) A user changes his/her avatar, now we had no idea how the old avatar used to look like, and (c) an early user has been banned from the forum, now his/her personal profile is inaccessible, (d) on some social media platforms, sometimes a old post may be raised from the dead by renewed interests (look, how stupid this comment was!), and now suddenly it's flooded by new posts, leaving no trace of how it used to look like.

(2) The "reader/user interface" cannot be archived. You must have seen something like this: You changed the website frontend, superficially, lots of "conservative" users complained, but the point is: now the old frontend and its "look-and-feel" is lost. If it was a simple CSS file, there are chances to bring it back, but if it was a major rewrite of frontend code, now history is gone forever. And in the lifetime of a website, the design and architecture is likely to be changed many times.

As a result, even if a website and all its content is still alive, it may already be a shadow of its past for a long time, don't even mention to preserve it! And currently, there are two ways to archive the web, both are flawed:

(1) Preserve the HTML at the surface. It's good for single pages, but you cannot browse a website in this way at all. None of the button on the website would work.

(2) Preserve the database. For example, using the API to save posts, or dumping the database - the frontend and reader are not preserved. Using Hacker News as an example, now every single post is archived, but it's far from a full experience, at least you should be able to click someone's username and see all the posts.

Now more and more websites are powered by JavaScript, makes the problem even worse. You are now literally running a program on your computer without any control over it. Once the platform is gone, no archive can save you.

What is the solution? I guess there's no full solution, but there are some possibilities:

(1) Wikipedia-like websites already have builtin version control, but it's very difficult to browse the historical version of the entire website. Systems like this can improve the frontend / user interface to allow a user to "lock on" a historical date.

(2) When building an all-Javascript website, spend some energy to build a plain HTML version as well, it may help avoiding the upcoming digital dark age.

(3) If you are going to close a website, perhaps it may be a good idea to make your internal backups of database and codebase at different years publicly available with sensitive information removed, and allow everyone to setup and run a replicated version. It's infeasible for a big website, but it may be a workable idea for a small community.

And I can imagine the archeologist from the 22th century digging into the old backup tapes of Reddit and attempt to rerun the system.

But ultimately, it's a problem that is needed to be addressed by the protocol and software with archive and preservation in mind.

---

BTW: A few weeks ago, I've written a lengthy comment on the fundamental conflict of history preservation and personal privacy, using the Usenet as an example, you may find it interesting.

* https://news.ycombinator.com/item?id=19562650

It has nothing to do with my argument, there could be awareness, to the extents that Unix architects had seen it in the news, but still, it was not considered. I don't believe support of leap second was built into Unix and honored properly until 1990s, when NTP became prevalent.

Also, the fact that Unix time starts before leap seconds were introduced made timekeeping in TAI an even stronger point. And I'm waiting for some insights on why it's not being done.

The original purpose of Unix time was decoupling local time representation and internal timekeeping of the system. Unix time could be the "One True Time" of the system, it always increases monotonically. When you need local time, all the tricky and nasty details, including DST, mandated calendar changes, etc, are processed by the tzinfo system library/database. If the calendar has changed, at least in principle one does not and should not have to update the system clock or most unrelated applications, simply update tzinfo and you're done.

Unfortunately, Unix time did not consider the effects of leap second, which broke the very foundation of Unix time and nullified all the benefits it had. A UTC change (leap second) will force you to update the system clock.

There is a way out: we should stop keeping time in UTC, instead, we do the timekeeping in TAI. And we provide a system-wide facility called "utcinfo" database to handle TAI-UTC conversation. Just like tzinfo, but much easier, it only needs to store all the leap-second events. All problems solved! I'm aware that the leap second still causes some issues: the kernel still has to be notified for the upcoming leap second for its UTC APIs, but still better.

The question is, why don't systems and libraries treat TAI as the first-class citizen of timekeeping? Why aren't we doing it right now? Because it's incompatible with Unix time, or it's something else?

From what I was told, around 2014 in China, there used to be a responsible-disclosure platform called WooYun that existed for a while (some of its articles has submitted to ~100 upvotes on HN). It was similar to HackerOne, and attracted a significant number of infosec researchers to hunt bugs and report it to the vendors.

Until 2016, when the government arrested its founders.

* WSJ: China’s ‘White-Hat’ Hackers Fear Dark Times After Community Founder Is Detained

https://blogs.wsj.com/chinarealtime/2016/08/01/chinas-white-...

* China Arrests 10 White Hats from WooYoun Ethical Hacking Community

https://news.softpedia.com/news/china-arrests-10-white-hats-...

> I'm much more likely to lose a random keycard

On this example, I don't think it's a problem as well. First, the keycard has a PIN. After 3 failed attempts, it would either self-destruct the private key or lock itself down until a secret recovery code is provided. Second, private keys on keycards that are reported as lost can be revoked immediately.

Good to know, thanks for the info.

I know blackhats and grayhats must have been doing it for years. But I'm not aware there's any bot that acts in a whitehat manner to disclose it to affected parties and conduct public researches, is there? I mean, something like those RSA keys crawling projects by cryptographers that have discovered several types of non-random keys with zero security.

My first submission on Hacker News was the link below, 2 years ago. It didn't receive any upvote.

Click and see, it's fascinating.

* GitHub commit search: “remove private key”

https://news.ycombinator.com/item?id=14262124

Although most keys removed are just useless automatically generated test keys, but genuine keys do exist. Someone should write a crawler to monitor these commits, creates digital signatures from private keys to prove the leak, and notify the CA issuer to revoke them automatically.

> Investigators concluded that one of its pitot probes used for reading the aircraft's speed and angle of attack (AOA) became blocked, causing the Watchkeeper's onboard flight control logic to enter an erratic series of climbs and dives until it stalled itself and flopped into the sea.

Unbelievable!

The real question is, if the common wisdom is to ground the chassis when possible, and even the induced voltage on the chassis is harmless, they are seen as a widely recognized annoyance. So, my (Question 1) then why does the hardware designers keep using ungrounded design in the first place? Just because they think the output through a isolated transformer is safe enough (also can meet safety regulations), so they want to then omitting the Protective Earthing to simply make the power supply smaller and they think it's okay to give the users some small shocks? Or it's something else?

And here's another question I don't understand. When a piece of electronics don't have a Protective Grounding connection, the common explanation is: the low voltage is created by a SMPS, and an isolation transformer at the output side of the SMPS makes the voltage no longer being Earth-referenced, so in the worst possibly scenario, if a grounded person touches the "hot" output wire, nothing would happen. But if you ground the chassis to the Protective Ground (often the ground of the PCB is connected to the chassis), the output becomes Earth-referenced again and loses the protection of isolation. This is why an isolation transformer has a unconnected Protective Ground at its output side, and many SMPS-based appliances don't use the Protective Ground.

So my Question 2, according to the common wisdom and many regulations, most appliances should be grounded, but from the principle of isolated power supply, it should not be grounded. And in real life, we clearly see lots of laptops use DC power supply without the ground connector, and others with the ground connector. And to further complicated the issue, some DC power supplies only use the ground internally for the EMI filter circuity and/or its own enclosure, but the DC output itself is isolated and is not ground referenced. Then how can an isolated power supply with the ground plug help stopping the induced voltage on a laptop's enclosure, if the output is isolated? Something related to the leakage current of the X/Y capacitors? It seems there's lots of inconsistency here. Just why?

First, the title of the article is typically from Quanta Magazine, which often uses editorialized clickbait titles to popularize scientific topics. Today, even Nature Communications seem to do it occasionally. If these claims are not directly from the official project, I don't see any red-flag here, it's an legitimate research project on formal verification.

On second thought, I think deliberately releasing a PR advertisement which claims a system is "unbreakable" can be a good way to receive free security audits.

So perhaps EverCrypt as a free and open source project who understands this point, the developers deliberately allowed Quanta Magazine to use this title, and so far, it has successfully received the attention of at least 5 HN users...

This is the problem.

I've mentioned on multiple occasions that the current post-Snowden security and privacy movement is creating a serious threat to the Internet history preservation, and to some extents, threat the understanding/insights of the human civilization in the digital age.

My personal interest is Internet culture and communities. And I'm not amused by this comment, let me talk about the problem briefly.

Online communication from 1970 to 1995 was almost completely public, archived indefinitely. You can still read every single comment by every hacker from the late 80s in Usenet archives, sometimes even back to the ARPAnet era. There are a million posts to read and no spam and low-effort posting at all (by modern standards, even many flame wars seem to be high-quality). You can easily lost days, months or even years in the Usenet archive.

Records like these are often the only remaining records of the online communities, a snapshot of great historical and cultural value. To me, even the controversial political flamewars are interesting as they reveal parts of the history I would not know otherwise (I guess if someone rereads Reddit threads about Donald Trump today in 2055, he/she may have a similar feeling).

On the other hand, you also have names, addresses, and even phone numbers of almost everyone posted on Usenet. It was not a big problem when the access to Usenet/Internet was exclusive to members of the academia, and at a time when there was almost no systematic, organized abuses of the personal information. But today's different, we have big and little brothers who have "Collect Them All" as their slogan, and they are actively trying to exploit the information available to the maximum extents.

What is the response then? People (at least many in the hacking community) start to prefer private, semi-private, or in-group communities over public communication, often protected by cryptography. Some people also actively erases/purges their footprints, for example, some would delete every single post when they left a community, no matter how insightful they are, others may even deliberately insert misleading or false information. And we have something roughly similar to Vernor Vinge's True Name (describes an underground hacking community in the cyberspace). Good, now personal privacy and security is more or less protected by using the cryptographic barrier.

But what is it doing then? We are now creating a unprecedented, HUGE GAP of information in history, within our life time, we are now entering a new digital Dark Age where no one has seen before.

Centralized and/or proprietary services often delete information when they go out-of-service, too, so we need to archive them, desperately. You can't imagine how many resources/memories that are extremely valuable to members of some communities exist solely on a single web server/service provider. I remember reading a post from Schneier's blog that says a website contains numerous posts of wine culture were gone forever when the hard drive failed, and one commenter said that he uses w3m/lynx CLI browsers, and records everything he reads to his hard drive so he would never lost a single piece of information he has seen.

Is it an act of little brother surveillance? Arguably, it can be seen as one. But is it justified? I would say yes, and even say we need more people doing this, systematically. Naturally, archive.org was born in this way.

But then it faces the same issue. On one hand, many archived information can be abused, on the other hand, the more archive-refusing people we have, the more damage to historical records is made.

I don't know how to solve this problem.

The only way I can think of, is (1) Cypherpunks were correct. Anonymity is crucial in the information age, and we should have more of it: never use True Name and reveal personal information unless absolutely necessary, use an anonymous network (e.g Tor) if possible, discard identities periodically (but if you delete posts, it still reverts to the original problem...), (2) Encourages further developments and applications of anonymity, and (3) Training people to assume every piece of information published publicly cannot be removed, may be abused, and they should be able to withstand all possible consequences of it. But now, "life" and "information" simply become inseparable, if you are active in a community you have to post something...

I don't know the solution.

---

Appendix 1: what you can see in an Usenet archive.

You can see people's reactions to the rumors that Apple would release new 68000-based machines, how Larry Wall was releasing patch-2.0, the debates about the audio fidelity of vacuum tube/transistor amplifier, how /bin/sh on System V was having a problem with "CFLAGS=-g make", the first hand perspective on the impact of Great Renaming, Richard Stallman announcing the GNU project and Linus's flamewar on microkernel with Tanenbaum, early Sci-Fi fandom culture posted from a 4.3-BSD machine (beta version!) and how it influenced the hacker culture, how the anti-spam movement gained momentum due to its intellectual challenges, raw discussions of fringe political movements (some interesting ones related to tech include the Cypherpunk movement, and Exopian, an early sect of transhumanism), FAQs on almost every subjects written by the active participants of the community who have probably spent hundreds of hours, some weird "emergent" memes/phenomena created out-of-nothing from the collective community, and also have a laugh on thousands of forgotten Internet memes, like alt.religion.kibology, Usenet Oracle.

The only downsize is: no external resources is accessible, and nobody is going to reply you. It feels like Otomo Katsuhiro's animation Memories, the protagonists in trapping inside a 3D Hologram simulation of the past, created by the supercomputer in the abandoned space station.

> Each team can then prove it is backdoored by providing (a significant part of) the plaintext.

Some backdoors are asymmetric backdoor, so the original designers can decrypt anything at will.

But some others only hide a trick that reduces the computation complexity to, say, 2^80. Unless you are a nation-state, you cannot use the backdoor. And the other type of backdoor only increases the susceptibility to implementation vulnerabilities (cache-timing attacks, invalid curve attacks), mathematically speaking they're still secure, but too difficult for most people to implement it perfectly.

A escrow process would be better.

To me, merely encrypting the transport layer via SSH is far from secure, especially when the network is used by "hackers" and "freedom fighters". Today, if a network wants to be immune from tracking by design, it should officially support to be accessed from anonymous networks. The UUCP protocol is perfect for relatively high-latency, low-bandwidth anonymous network, like Tor or i2p (Particularly, i2p by itself is a great project, the only issue is the latency of the network is too high for HTTP), it would be great if some Tier 1 hosts can be accessed from Tor/i2p via a raw TCP socket (without SSH, since it's unnecessary and increases overhead in these networks). Illegal content and spam can be a problem, only peering to reputation hosts can solve the problem at large.

I think you've missed my point. I'm not saying that Shii was a wizard, oracle or prophet, and we should find the next one to predict the future for us. When looking back, things are often pretty straightforward and clear, hindsight is always 20/20.

Instead, what I'm saying is that, he preserved an important segment of the history for us by creating his personal knowledge base, especially that, it was written by someone who was an Internet-native, worked extensively on Wikipedia at its early time, and credited as one influential figure who shaped early 4chan. So we can use the material from his knowledge base to gain some insights about some parts of the undocumented history.

And I think it's another advantage of an knowledge base - it can provide a good record of history from a personal perspective, more comprehensive than a blog or diary.

It reminds me of Shii's wiki, too. Shii's wiki is not only a personal knowledge base, but also a piece of important documentation of Internet cultural history.

Unlike the pre-2000 Usenet era, Internet culture today (e.g. those on 4chan) is no longer systematic documented, and for better or worse, it has a significant influence to the "cyberspace" as a whole. But when people started to realize the existence of something, it's already too late to understand it, original records have been all lost... And people started shouting, "what the hell is going on?"

Written documentation like Shii's wiki is the rare treasure of a time capsule, a snapshot of the time. At Shii's wiki, 2006 never ends.

I'm particularly interested in the history of online culture of obscure political movements (including those crazy conspicary theorists and nationalists). It'n not that I'm morally approving their actions, but to me, they seem to be a new type of social organization in the information age. From Shii's wiki, written by a intelligent person who's observing and thinking about these topics, you can see many indications in 2006 about the status of things and how it's connected to the present day.

For example...

* How the Web was Lost

http://shii.bibanon.org/shii.org/knows/How_the_Web_was_Lost....

This 2006 article describes the upcoming demise of Internet utopianism. The massive commercialization was transforming the Internet to just another TV, telephone, or a shopping mall. It also mentioned how giving everyone access to information can have the side-effect of disintegrating information authority and good writing, and causes the polarization of extremes in politics.

> Will we ever have another Thomas Paine standing in the street, telling us common sense that changes our lives? Those are rhetorical questions. The answer is no. There will be no more shots heard round the world, no more revelations shocking the whole nation at once. The Web is a difficult freight train to turn around, and it will likely destroy those lines of communication.

These topics/issues are NOT identified and explored by the Internet personalities/analysis/mass media until recently.

For example, this article Why isn't the internet more fun and weird? (https://news.ycombinator.com/item?id=19038327) was only posted on HN, two months ago. And What the Hell Is Going On? Effects of Information Abundance. (https://news.ycombinator.com/item?id=19413852) was only posted on HN, 7 days ago.

Another example about politics.

* Project for the New American Century (http://shii.bibanon.org/shii.org/knows/Project_for_the_New_A...), Ron Paul (http://shii.bibanon.org/shii.org/knows/Ron_Paul.html), and NAFTA (http://shii.bibanon.org/shii.org/knows/NAFTA.html).

Before Donald Trump gets popular in 2016 on the Internet, this trend can be traced back to (1) free trade and globalization, (2) September 11th, (3) hatred of neoconservatism online, which caused (4) many to support Pon Paul, (5) whose supporters were later disillusioned. Then the (6) Great Recession and (7) Obama occurred. It was a very complicated chain of events, which were all partially documented in Shii's wiki.

The bottom-line is, I think Shii must have gained some deep insights about everything by reading through the endless shitposts on 4chan. I wonder if Donald Trump never ran for the president, it may take another 10 years for the common people to realize these issues.

If you are involved in some online community, please consider to create your personal knowledge base. 20 years later, it may become the only historical records of something.

I agree.

The problem here is my choice of an ambiguous word, "security". Formally speaking, the "security level" or "security claim" of a cipher is defined by the computational complexity (time/memory) of breaking it, often represented as the number of bits. so the Biclique attack indeed reduced the "security" of AES to 25% of its original claim. "Security" in a broader sense can be roughly understood as "how well a system is practically protected, under a specific threat model", in this case, the underlying details, such as this minor reduction to a cipher's security claim hardly matters.

I should have edited my comment to use a better word, but now it already became permanent.

Moreover, a Biclique attack against AES exists, by saving some meet-in-the-middle computations, it has already reduced the full 10 rounds, 128-bit AES to "just" 126-bit (25% of 128-bit) of security. Is it a clever attack? Yes. Does it mean the security of AES has been reduced to 25% of the original security level? No. Does it practically matter? No. This is exactly why 128-bit security is seen as a minimum standard in cryptography - it can provide a more-than-adequate security margin which renders all minor speedups in cryptanalysis irrelevant.

If the 64-bit random serial number has already provided an adequate security margin, it should be that no action needed for all existing 63-bit certificates. But it seems the choice of 64-bit here is arbitrary without good justification...

I tried...

    $ python3
    >>> # not using os.urandom to save a import...
    >>> rng = open("/dev/urandom", "rb")
    >>> "{0:08b}".format(rng.read(1)[0])

And act accordingly, soon the correct rate approaches 50% as expected.

I like the opening of this aricle. It almost mentioned all the interesting books about the folklore history of computing. All the books mentioned in this article are worth reading.

> Extant histories of the internet favor either heroic or deterministic narratives. On the determinist side, we have Paul Edwards’s The Closed World (1996), Fred Turner’s Democratic Surround (2013) and From Counterculture to Cyberculture (2006), John Markoff’s What the Dormouse Said (2006), and others that describe the internet as the result of collisions between large-scale Cold War policies or zeitgeists. With some variations, these narratives portray the digital revolution as born from the improbable marriage of countercultural hippie experiments and the military-industrial complex.

> On the heroic, individualist side, we have Steven Levy’s Hackers: Heroes of the Computer Revolution (1984), Katie Hafner and Matthew Lyon’s Where Wizards Stay Up Late (1996), Michael Hiltzik’s Dealers of Lightning (1999), Walter Isaacson’s Innovators (2014) and Steve Jobs (2011), Leslie Berlin’s Troublemakers (2017), and Adam Fischer’s Valley of Genius (2018), whose titles speak for themselves. Histories in this genre extoll the whimsical personalities and talents of digital entrepreneurs and inventors, of whom Jobs is the prime exemplar. Some do acknowledge the contingencies that facilitated the rise of these digital “geniuses.” But overall, they tend to represent Silicon Valley as a titanic battleground that proved the superior mettle of its winners. Both extremes are tempting in their clarity; both make for a gripping story. Occasionally—as in Liza Mundy’s Code Girls (2017) or Margot Shetterly’s Hidden Figures (2016)—a simultaneously individualist and Marxist approach unveils underappreciated digital counter-heroes.

Related: I don't recall it was djb or Bruce Schneier, but I remember, after Snowden's revelations, one of them criticized the NSA/NIST was using a "denial-of-service" technique to push flawed standards. That is, it's relatively easy to draft a protocol but hard to analyze them. You would publish a dozen of ciphers and protocols at once, then the cryptographers would busy working on some of them. Eventually, flawed standards went through without being noticed...

I don't see any GCM ciphers nor ECDHE/DHE key exchanges deployed on this site, so forward secrecy and authenticated encryption are not implemented and supported by the Not Quite So Broken toolchain? It would be a project of great value if those are implemented, plain RSA and CBC is pretty much dead in TLS nowadays...

> Not that there was an inherent flaw in CBC itself.

But if history shows it's difficult to implement something without creating vulnerabilities, and there are alternatives which are less prone to mistakes, it should be retired and discouraged to be implemented.

Also, CBC itself is not an actual problem, but CBC in TLS is authenticate-then-encrypt, which is how the vast majority of problems are created.

CBC mode in TLS SHOULD NOT be used in any new systems.

Repost Moxie's The Cryptographic Doom Principle, again...

https://moxie.org/blog/the-cryptographic-doom-principle/

In addition, we can ask some more serious questions.

Freedom was the ideal behind the advent of personal computing and Internet. Quote John Barlow,

> "We are creating a world that all may enter without privilege or prejudice accorded by race, economic power, military force, or station of birth. We are creating a world where anyone, anywhere may express his or her beliefs, no matter how singular, without fear of being coerced into silence or conformity."

And people believed, once you have the Internet, it will be an inherently platform of democracy and equality, which empowered the individuals to be free from the social and political establishment. However, this narrative from the 80s has been proven to be partially correct, partially wishful thinking.

It appeared to be true, because it coincided with the economic boom of 80s neoliberalism until ~2010. When middle east politics started to become destabilized, people celebrated because the revolution was liberal, there was even the "cute cat theory of digital activism", which says when there are funny memes involved, people are more likely to join the political protest of Internet freedom. And it was seen as a good thing - a faceless dictatorial government was overthrown by lolcat. Isn't it the miracle of the postmodern Internet?

But it has been clear that ANY idea, can by popularized and supported by a free Internet. Now in the current age of deglobalization and political and economic failure, naturally, conservative, nationalistic, or even racist and fascist ideas are getting more and more support. Suddenly, the same medium (Like the social media, or the political memes) are being called hate symbols and should be banned by major platforms. It has been clear that the Internet can surely empowers "individuals to be free from the establishment", it is very true, but unfortunately, any ideas, not only ideas of "democracy and equality", as long as long as it has support, can be empowered by the Internet. Not even needed to be popular support, support from a portion of people with shared identity is enough.

When we've realizing an free and open Internet does not necessarily support liberalism, or democracy, or equality, the next question naturally arises - when the central argument for Internet freedom, that it brings democracy and equality, no longer works, should the Internet be free and open? And should we even have the right to free speech anymore, at all? I believe the answer must be yes, including those unpopular ones.

But the media, as I see it, just blindly discredit the trolls, and only solution they purposed was "don't feed the trolls", or Twitter and Facebook should ban "hate speech" and "fake news". If the mainstream cannot actually to study and understand its mechanism, and the underlying social-economical basis this conflict, of this new online anti-establishment trends and trolls, and to provide a social solution, I don't think the problem is going to be solved at anytime, and the answer to free speech, and a free, open Internet is going to be "No" soon.

Previously, I've been following /pol/ on 4chan for some years. What have impressed me is not the content itself, but its organization, the social structure, the creation of memes, the evolution of fringe political/identity movement that is unimaginable before the Internet. To understand its associated problem with it, it's crucial to establish a solid understanding of the underlying mechanism, the underlying social and economic factors that contribute to the problem of trolling.

This is why I'm quite disappointed about the mainstream media. For example, what are the social and cultural basis of Gamergate/Dark Enlightenment/incel movement? If you can't understand the underlying social basis and mechanism, and just blindly discredit them it as "far-right troll campaign", then it is parts of the problem, not the solution.

I've said repeatedly online - this kind of cultural issue is NOT about "the liberal media", "antifa", "SJWs", "trolls", "incels", "alt-right", "fake news", or "Donald Trump", these are just the "first-order" effect - what most people have easily observed. But the underlying issue - how Internet works to produce these ideas, the larger social problems behind them, can only be understood by looking at it from a higher perspective, as a postmodern phenomena, and to study it faithfully and carefully by the best sociologists and psychologists, and by the people who understand these online community and technology, and can analyze it in a neural way, just tell us how the system works, without preexisting bias or political stance. So we can finally have some ideas to solve it. Unfortunately, the number of people who are doing academic studies on these subjects, is almost nonexistent.

Personally, I'm only aware of the following people who are studying it.

o Book: Epic Win for Anonymous: How 4chan's Army Conquered the Web, by Cole Stryker. This is probably the earliest and the most well-known one. However, its ~2007 narrative of 4chan and its politics is out-of-date, but it still covers how an online platform can popularize a radical social movement.

o Book: This Is Why We Can't Have Nice Things: Mapping the Relationship between Online Trolling and Mainstream Culture, by Whitney Phillips, published by The MIT Press. This book explores history of trolling, and studies it from a cultural and social perspective, and identifies some of the underlying mechanisms.

o Talk: The dark side of free software communities, by Morgan Gangwere, at LibrePlanet 2018. The talker discovers the fringe tech culture on the wild Internet, on 4chan/8chan, characterized by hatred - where RMS was the official mascot, and quite a few people (possibly basement dwellers) who believes the Internet is controlled by the evil monopolists/Freemason/Jewish/capitalist conspiracy, free software is not an exception but it's still a powerful tool against their rule, and how SJW is undermining it. Unfortunately, the talker's research focused on building a good community, not a detailed study of fringe tech culture.

o Book: Kill All Normies: Online Culture Wars From 4chan And Tumblr To Trump And The Alt-Right, by Angela Nagle, focuses on the history of the current cultural war online. I haven't read the book yet, so I'm not sure what is the perspective of book.

It seriously deserves more complete study from more people, I'm more interested in an ethnography-based approach. However, I don't have any background knowledge on sociology to make any insightful commentary on it... Seriously, reading /pol/ has almost made me wanted to change my major from software engineering to sociology, just to study it and trying to understand how the counter-cultural fringe politics works online, however, it's an unlikely career for me to pursuit.