bcaa7f3a8bbc

The article didn't mention that the development board costs 1000 USD and the expansion board costs another 2000 USD, and it's only a barebone system, a full system comparable to a high-performance PC would require another 500 USD. At this price level (~3000+USD), one can almost purchase an OpenPOWER-based workstation (as we already have seen, the crowdfund campaign for Talos Secure Workstation failed due to its price, https://www.phoronix.com/scan.php?page=article&item=talos-wo...). So no, I still don't think RISC-V is as usable as a PC for an average user at its current shape as a prototype for developers.

When I saw the title, I thought a silicon chip in Xerox Alto has stopped functioning due to electromigration. Fortunately it was a macroscopic electromigration on its backplane and has an easy fix. I wonder if it could become a serious issue on computer history preservation in the future. Can a 7nm chip today survive an uptime of 30-50 years? Once it burns out, there would be no replacement... Or is this problem negligible compared to EEPROM losing critical firmware and data if you have proper core voltage and cooling?

There is a GCC plugin that can automatically calculate the cyclomatic complexity for programmers, and it has been built into the Linux kernel source tree. I don't know if there is any public statistics, but it would sound great for code reviewers.

I think the test works by testing querying an authoritative server with EDNS on, and see if the request times out. Naturally, there will be false positives due to random packet loss on the Internet.

It means the authoritative servers of your domain simply does not support EDNS (a 20-year-old protocol...), but it doesn't falsely advertising EDNS support, which is what the Flag Day's targeting, so your situation is good.

Flag Day means a software change that is not backward-compatible, especially in a network system where upgrade is scheduled early and everybody must deploy upgrade at (before) the date, or the system will stop working. It came into use when a change was made to the definition of the ASCII character set during the development of Multics. The change was scheduled for Flag Day (a U.S. holiday, https://en.wikipedia.org/wiki/Flag_Day_(United_States) ), June 14, 1966.

See Jargon File.

http://www.catb.org/~esr/jargon/html/F/flag-day.html

Just my two cents.

To most people, it's not the "domains" that should be checked, but DNS servers and DNS resolvers, both the authoritative and recursive type. If you are using a major DNS provider for your domain, no action is needed, but just to be sure, use the test tool on the webpage to see if your provider has broken EDNS, and do check your local recursive server.

Classic DNS messages carried by UDP were restricted to 512 bytes, EDNS boosted this restriction and also introduced some flags, and it has been enabled by major DNS servers since 1999. But in practice, many deployments on the authoritative servers are broken, they signal EDNS support, but EDNS replies are silently dropped, due to broken DNS servers, misconfigured router, broken NAT, broken ISP installations, or broken firewalls or other middleboxes.

Previously, various DNS resolvers contained a workaround that disables EDNS as reaction if a DNS query timeout is detected. Now the workaround will be removed. If a DNS resolvers has EDNS but it's broken, it will be marked as a dead server.

C99 has complex, too. I think most competitive programming contests are now using C99, finally.

> Anyway, do competitive programmers tend to program everything from scratch, or is there another reason they don't just use GMP?

I think directly using algorithms and programs implemented by others would be considered cheating (and these libraries are not presented on the server which checks your answer anyway). In competitive programming, participants compete their own ability and knowledge to implement algorithms.

> At quantity 200, you could have simple boards like these assembled for about a buck a piece.

I don't think PCB assembly would be that cheap, especially for a board with lots of SMT components. What I understand is that SMT manufacturing has a high startup cost, you need to supply the factory with full tapes of parts, and the factory needs to program the assembly line, often a factory is reluctant to take any offer below tens thousand boards because its high overhead. Even for service providers specialized in prototyping then, I don't see many provide QFN and BGA packages as options.

What have I missed here?

Does a higher degree of globalization lead to a higher degree of stability and peace? This is a classical and interesting discussion. The world before World War I was arguably highly globalized. I failed to find a comprehensive summary of the arguments and counter-arguments, but here a few links:

“The First World War in the History of Globalization”

https://www.etown.edu/offices/president/2014-11-14-WW1-Globa...

The world today looks ominously like it did before World War I

https://www.washingtonpost.com/news/wonk/wp/2016/12/29/the-w...

Globalization = No War? Does an increasingly economically interconnected world cut the chance of war? Maybe, but it doesn’t eliminate it.

https://thediplomat.com/2011/08/globalization-no-war/

We mustn’t fall for The Great Illusion again

https://www.telegraph.co.uk/news/worldnews/asia/china/955570...

The Great Illusion

https://www.nytimes.com/2008/08/15/opinion/15krugman.html

IMHO, the argument is partially true. But on the other hand, it increases the complexity of the system, and makes many otherwise unlikely "failure modes" possible.

Or perhaps RoughTime when security is needed?

https://roughtime.googlesource.com/roughtime

Thanks for reminding me. If a mobile basestation is not usable, it seems to me that the best way is trying a WWVB-disciplined oscillator. Shortwave is certainly not available indoor, but longwave reception is possible. Hopefully it won't be killed by NIST due to the funding issues...

Unfortunately, having more Stratum-1 servers does nothing to help clueless device manufacturers who hardcoding the IP address of an individual server, and damaging the community service. But yes, when we talk about the NTP community in general, we certainly needs more Stratum-1 servers. Nowadays, running a Stratum-1 is easy, the hardware is cheap, a single broad computer w/ time source from a shortwave radio or GPS. And if one loves electronics, one can build a precision oscillator (evem a Rubidium standard can be used for 300 USD), or go straight to make a GPSDO to achieve highly-reliable timekeeping.

Nevertheless, there are two practical difficulties.

1. Static IP addresses are unavailable in most home connections. And many home broadbands throttle UDP traffic, dropping them when the pps rate is high. It makes one's home unsuitable for hosting a NTP server.

2. Unlike Stradium-2, you cannot simply use a "cloud" service for your dedicated server. To run a NTP Stratum-1, you have to physically host your server with the customized hardware in a datacenter, which costs 100 dollars/month in my city, not including network transit and bandwidth. I really want to run one, but I cannot afford it.

3. Shortwave / GPS reception is usually not available in a datacenter, and an antenna installation is usually not allowed. You can be creative, a good way is using the time provided by mobile basestations. But it needs experience.

It usually goes like... If you have an AS number, then you have a public presence on the Internet, now you apply/purchase your own dedicated IP addresses, and get them assigned to your AS number, finally broadcast your route in BGP. Practically, you own a portion of the Internet, and you own the IP addresses. You can set redirection, AnyCast, CDN...

NTP itself is not decentralized, but the largest NTP provider is the NTP community pool, www.pool.ntp.org. The pool is operated by MANY PEOPLE IN BASEMENTS AROUND THE WORLD, using DNS to distribute the traffic. It's practically pretty robust for most purposes.

However, people just go to a list of NTP servers, then copy a few into the code, instead of using the distributed pool. Then it's not a surprise that the NTP in a product is going to stop working, meanwhile a one very overwhelmed guy who happened to run one of the server is going to have serious troubles, see https://news.ycombinator.com/item?id=18753835.

I do agree. A complete solution is designing a new generation/revision of time protocol with accountability and anti-misuse as parts of its design, just like how people are implementing ASLR and NX in C programs and starting to use memory-safe languages. Or just see how TLSv1.3 removed all unsafe algorithms, so it will be little damage even under the worse case scenario.

Also, I think NTP needs more publicity. We need people to be aware of it before we could get feedback. The community then can have a watchdog team that spots misuses and publishes alerts.

In short, if you are ever going to make an embedded device, or an operating system distribution, or anything with NTP default on, please make sure,

1. NEVER, ever hardcode an individual NTP server (in form of a IP or domain). DO NOT just go to a list of NTP servers, then copy a few into your code. DON'T ping pool.ntp.org and get its IP address written down. DON'T DO ANY OF THESE! PLEASE!

2. DO NOT use Stratum 0 and Stratum 1 servers. Please use Tier-2 and lower. Practically, if you follow Rule No.1, then you are always following this rule.

3. If the scale of your system is small, in hundreds, or in a few thousands, PLEASE USE pool.ntp.org, this is the NTP community cluster backed by DNS load balancer. Always request the DNS, and make sure the IP is not cached locally for too long. If you need more than one servers, use 0.pool.ntp.org, 1.pool.ntp.org, 2.pool.ntp.org, etc (3 is often enough).

4. If the scale of your system is large, such as tens of thousand, or you are making a new system, you SHOULD request a customized prefix from pool.ntp.org, such as debian.pool.ntp.org, it helps the community to manage the traffic. If your system is a large commercial one, you ARE REQUIRED to donate some servers to the NTP Pool to compensate the community. Another option is running your own private NTP cluster. The policy is here: https://www.ntppool.org/en/vendors.html

5. If possible run a standard NTP implementation, like NTPd, chrony, or something else as long as it's written professionally. Nowadays even lightbulbs run Linux, then why don't you run a standard NTPd?

But If you can't, then make sure...

(a) implement NTPv4, DO NOT use NTPv1.

(b) Read the new SNTP RFC if you are implementing an SNTP client. http://www.faqs.org/rfc/rfc4330.txt

(c) DO NOT synchronize time on the beginning of an hour, or 00:00 UTC! Select a minute in a hour randomly for synchronization.

(d) Use an exponentially-increase retrial interval, DO NOT keep retrying when the server is unreachable, you are launching a DDoS attack!

(e) Support Kiss of Death packet, your client should immediately stop requesting a server, cease and desist, once a KoD packet is received.

(f) Make sure the client will stop requesting the builtin list of servers, once an alternative server is set by the user.

These should have been written in all textbooks related to practical networking lectures, but apparently, there aren't. People don't even realize that their actions are harmful, and we have all the problems...

--------------------------------

The NTP community is a complete tragedy of the commons. Even many government institutions cannot keep up with the abusive traffic, and stopped providing public NTP servers.

Today, if we don't count Microsoft and Apple's NTP, almost all public NTP servers are provided by the volunteers from https://www.pool.ntp.org. By using DNS, it forms a NTP cluster to distribute the load. These people provide time for the entire Internet, and they are the people who withstand all the abuses day by day.

People just assume they are some random super servers that always work, without being responsible for their actions, such as hardcoding IP addresses, writing abusive retry code (without exponential increment of timeout), and making a cronjob that initialize a synchronization exactly at midnight (without randomization), effectively a DDoS.

Usually, if a device comes with hardcoded NTP addresses, it, in fact, usually indicates their program is poorly-written, and the manufacturers are irresponsible. Those devices have the worst homebrew NTP implementation on the planet,

1. They send ancient NTPv1 packets, while the latest version is NTPv4.

2. They synchronize their time on the beginning of an hour, effectively making a flooding attack. Another larger flooding attack starts at 00:00 UTC.

3. They retry interval is around 3 minutes, if fails to reach the server, make even more traffic to the server, rather than an exponentially-increase interval.

4. They still try to talk to the default hardcoded servers, even if an alternative server list is set.

5. They don't support the Kiss of Death packet, nothing can stop them if they became wild.

Stratum 0/1 servers are the most vulnerable: they have highest accuracy, with reference clock. Despite the acceptable usage of ST-1 is only passing time to downstream, or for scientific purposes, since there's only a handful of them and often listed publicly, they are often spotted by those manufacturers, and put in their devices by default.

Stratum 0/1 are usually provided by universities, or unpaid volunteers for the public good of the Internet. If a single server got hardcoded in those mass-manufactured devices, serious consequences can happen, the volunteer may literally bankrupt: your whole institute/school will be kicked out from the Internet [0]; when you came to the manufacture asking to pay the damage they are responsible for, you are threatened by a lawyer from California. [1] The whole Internet community should honor the spirit of self-sacrifice of these NTP volunteers.

The NTP community pool is Stratum 2+, suitable for general use. It has similar issues of abuses - once you're in and became well-known on the net, there's no way out and you keep receiving bad-traffic, because some clueless people have hardcoded your IP address, or has put it in a cache that never expires. Fortunately given a reasonable bandwidth, it is often a negligible issue and safe to ignore. But there are exceptions. [2] One of my NTP server became DDoSed one day, because an ISP cached the IP address for pool.ntp.org with a large TTL, and the IP address happened to be mine! The traffic was 40 Mbps...

In contrast, NTPd has proper rate-limit mechanism built-in, such as KoD and good pooling interval, blocking NTP does NOT causes more user traffic. What increased is the abuser traffic. The damage caused by a standard NTPd and silly sysadmin is much less significant and is negligible compared to the Internet of Scary Things.

By the way, not only hardware devices can contains dangerous NTP code, but also software.

As long as manufactures still write broken code and unaware of the proper way to use NTP, nothing can be done to solve this issue. Many involved in these misuses and abuses are totally unaware what they are doing. The proper way to use NTP should have been written in all textbooks related to practical networking lectures.

[0]: Flawed Routers Flood University of Wisconsin Internet Time Server http://pages.cs.wisc.edu/~plonka/netgear-sntp/

[1]: Open Letter to D-Link about their NTP vandalism https://web.archive.org/web/20060423012837/http://people.fre...

[2]: Recent NTP pool traffic increase https://mailman.nanog.org/pipermail/nanog/2016-December/0895...

Sure, some particular DDoS campaigns can be seen as a sit-in protest and personally I'm not personal objective or supportive to these campaigns, but under the current architecture of the Internet and World Wide Web, DDoS cannot be prevented, and as a vulnerability, it not only enables "sit-in protest", but essentially enables a mechanism of censorship, especially after the rise of these "DDoS as a service" vendors, they are effectively a "Censorship on Demand" service. Any self-published speech on a personal webserver now can be kicked out of the Internet by anyone. For example, during the Hong Kong Occupy Central protest in 2014, some news websites experienced a government-sponsored 500 Gbps DDoS attack. The recent example was Krebs On Security blog, which has been a target for blackhat groups and hit by a 1 Tbps attack.

The World Wide Web was supposed to be a (to some extent) permissionless publishing platform, that means if you are already connected to the Internet via a commercial ISP, as long as the content is legal and the law of your jurisdiction protects the freedom of speech, you don't need anyone's particular approval to run a HTTP server. But now under the threats of DDoS attack, no independent webserver can survive, the only solution is utilizing a centralized CDN / reverse-proxy, and accepts EULA of their choice and theoretically they can modify and censor your traffic arbitrarily. I think decentralized systems such as ZeroNet or IPFS may be a solution, and I hope they can be integrated into a web browser one day.

I'm familiar to this paper because I was using eMule. eMule has a direct citation to this paper in its "help" window, otherwise, the decentralization of eD2k would not be possible. The protocol is old, but still impressive.

The year 2000 is special, within the same year, Gnutella, eDonkey and Freenet were all released its initial version, as if the P2P network "emerged" from the Internet. By 2004, eMule, I2P and BitTorrent (and BTW, Tor) were all here. At the very beginning, the first generation of P2P, Gnutella was suffering from its scalability problem - its simple unstructured, flooding protocol needs a number of O(n) queries, and becomes unstable once the users exceeded millions.

Then, Kademlia almost saved P2P. BitTorrent, I2P, eD2k and many other P2P protocols are all Kad-based. For example, in eD2k, Kad allowed it to have P2P resource discovery, and also an efficient decentralized keyboard search engine (although there is spam, but mostly works, and in BitTorrent we still don't have it), all with only a O(log(n)) query, The P2P mechanism of I2P is also exclusively based on Kad.

The authors of this paper are the few people who have made great contributions to the Internet.

MIPS is mature, all the toolchains are here. It's simply that most vendors are too incompetent to care, as it doesn't affect their revenue in any way.

> Security and Hardening by Steven Barth - OpenWrt Summit

> Introducing new and ongoing security improvements to bleeding edge OpenWrt. This talk describes the new default toolchain featuring musl libc, enabled hardening including ASLR, SSP as well as OpenWrt's novel jailing (jailfs and seccomp) and package signing features (based on Curve25519).

> https://www.youtube.com/watch?v=DNYvIrI5Bbs

On the other hand, OpenWrt implemented full system-wide ASLR recently. NX and jailfs is still a WIP.

I must mention "D0x3d!", which is also inspired by "Cards Against Humanity", but with a network security theme.

http://d0x3d.com/d0x3d/welcome.html

https://github.com/TableTopSecurity/d0x3d-the-game

The beginning of a new class of user-interface attack?

It was the old Creative Commons v3 license. At that time, people thought, in addition to the "international version", it would be good idea to write many localized licenses for each country, so that people from each country can use the license in their native language and the legal experts can take special cares to make sure the license is completely valid under the copyright laws of a country, and the courts can understand it easily.

But people eventually decided that localized CC licenses were "considered harmful" - The biggest problem is that you can never be sure whether all the localized licenses are equivalent. It makes things very complicated when you want to create a derivative work of a project, even under the same conditions, if the work released under another localized version by the author. Also, it creates lots of ambiguity in a international community project. Finally, it was difficult to maintain, they need legal experts from all the countries if the license needs changes.

So localized CC licenses have been abolished when Creative Commons v4.0 was released, v4.0 only has the One True Version, the international version, it was made to be a perfectly valid license for all countries that signed Berne Convention, I believe.

The entire infrastructure of P2P Foundation Wiki was from 2008, and nobody bothers to rebuild, I believe...

Like today, there were a handful of providers of anonymous hosting and domain service. Satoshi registered the domain and hosted the website via anonymousspeech.com. So no, it's not possible to obtain his identity directly from the domain name.

But there is a potential flaw - anonymousspeech.com used to accept cash-in-mail, but stopped for a while, then started accepting cash again. It is unclear whether Satoshi used cash, or credit card/bank transfer. If he used the latter one for payment, the government can just subpoena all the financial records. But there are evidences to believed he used anonymous deposit. So the answer is still no.

IMHO, by today's standard, Satoshi Nakamoto's anonymity is flawed. A large portion of the infrastructure for anonymity and privacy (Bitcoin!!) didn't exist back to that time, in addition, he didn't demonstrate the extreme rigorous practice of operational security similar to underground blackhat hacking groups, for example, he was using GMX as his main mailbox, which was not known for its security, and obviously it was eventually hacked, etc.

In conclusion, he did enough to obtain a reasonable degree of 2008's anonymity. But his anonymity is saved only because it wasn't/isn't illegal so he wasn't a target in the beginning, and by now time has buried all the traces. It probably won't survive a coordinated takedown by multiple law enforcement agencies (something you can accomplish with a fair chance of success today).

Just come here, not to debate, but to add some background information about its public perception.

The Cancer Center and other departments of the Second Hospital of the Armed Police Beijing Corps were actually outsourced to the operation of the Putian network, the latter has a long history of false advertising of various ineffective medical treatments.

Basically, the general public believes Baidu was the largest supporter of the Putian network, and Putian hospitals may have contributed 12 billion RMB (1.8 billion US$) of the total of 26 billion RMB (4 billion US$) in ad revenues reported by Baidu that year.

https://www.straitstimes.com/asia/east-asia/the-putian-conne...

https://www.whatsonweibo.com/behind-baidu-scandal-baidu-puti...

Anyone who have spent some time on the social media in China interacting with people from the IT sector would know, the petition is clearly genuine, not propaganda.

Currently, Google's launch of Dragonfly creates an interesting disagreement in public opinion. In the U.S, the opinion in the "technosphere" is overtly negative, due to its implication of supporting censorship and oppression of the general public.

But in China, the public opinion from the "technosphere" is completely the opposite. The dominate search engine, Baidu's reputation has became notorious after the death of Wei Zexi, the 21-year-old cancer patient, after finding misleading treatment information on search engine Baidu. Citizens on the social media became aware of the existence of Putian Medical Group, a special interest group in the profit-driven healthcare market for its questionable medical treatment. Baidu was believed to be the largest supporter of the multi-billion-dollar industry, they may have contributed 12 billion RMB (1.8 billion US$) to Baidu's ad revenues. (See this article for the background: https://www.whatsonweibo.com/behind-baidu-scandal-baidu-puti...)

But it's not the only scandal. Baidu is known for its predatory and invasive advertisements, including consumer support fraud, visa fraud, medical fraud. Most of the time, entering any common keyword, people are confident to say that the first three results of the search list are the ads, and highly likely to be frauds. The daily victims of these ads is likely to be hundreds, if not thousands. Baidu is doing little, if not actively supporting the false advertising.

The public opinions of the IT workers in China, in my own words, is basically: if Google is a criminal, then Baidu is a maddog. The politics is authoritative, changing it is out-of-question. Then at least you can replace a wild maddog with an ordinary megacorp, which at least has a well-defined bottomline and more or less under the public supervision of the citizens.

I don't know what to say. On one hand, censorship and oppression surely causes long-term damage, but on the other hand, the damage of victims by these frauds is also a large number. Even if I take an utilitarianist approach, then what is valued greater?

u(free from censorship and oppression) x Google's contribution?

                                           ^likely small

or

u(free from ubiquitous frauds from Baidu)?

I think the visual and audio effects are implemented by reusing the test programs. Just like late 80s home computers and today's microcontrollers, a basic visual and audio demo was pretty common on large computers back to those days. But yeah, it still may have taken days or at least hours.

Seriously, how long has he been online as an "ethical hacker"? For everyone who has the experience of looking for some texts should know that there are millions of this type of websites out there, the spam farms. Many of these sites don't even have the files (a common tactic is putting the links to your spamsite in a PDF, and name the PDF as some other documents people are looking for but you don't actually have, to disguise your spam as a file, polluting the search result for everyone, bastard!), and are just making the visitors to click ads, or scamming people to enter personal information, to pay for another related service or a premium account, and they can probably make more money. And some other websites are even distributing malicious software.

Meanwhile this website is actually an "honest" one that works for the visitors as advertised! I think it would be great injustice by selectively just enforcing the copyright laws by seizing this individual websites and its income. After all, 30% of the websites on the entire Internet are like this. I don't think the blog post really have a point.