benmmurphy

sshuttle as described sounds like a normal CONNECT proxy which this is able to detect: https://sshuttle.readthedocs.io/en/stable/how-it-works.html

like its similar to connect or socks proxy except it is using SSH as a transport layer instead of TCP as a transport layer and its doing it transparently without having applications to be written to use the proxy. but if you are just converting TCP packets into a datastream and then sending them somewhere else where you convert them back to TCP packets then this is what this TCP RTT strategy is fundamentally meant to detect. i suspect the TCP only RTT thing works because of the delayed ack behaviour of most operating systems and this will still happen with sshuttle unless you are explicitly using quick-ack. also, quick-ack just works around the TCP-RTT issue and not the differences in timing between TCP and TLS or other higher protocols. i think if you are testing for other RTT differences then quick-ack would make them more obvious.

on the server side sshuttle just uses normal tcp sockets and nothing magic (https://github.com/sshuttle/sshuttle/blob/master/sshuttle/ss...)

also, if you have an sshuttle proxy this site cannot detect it may be due to how close the server is to the client. i have a CONNECT based proxy it is able to detect around 5% of the time (maybe only that often due to a bug) but this is because there is probably less than 10ms latency between the proxy and the client and probably around 50ms latency between the proxy and the server for some reason (?).

That reminds me of an old cold war joke. In China you are free to criticise western governments on Weibo. What is the problem?

i would say the c-code is broken because the queue push method has undesirable behaviour when capacity is reached. for example if you push onto a full task queue then it just leaks a task without any feedback to the caller that something very bad has happened. you don't even need to look at the method body to see there is something weird going on. because its a fixed size task queue with a void return on the enqueue method. though, i guess its possible the task queue could be resized in the body.

probably, the push method should return a boolean indicating whether the task could be enqueued and if the capacity is reached then the task is not enqueued. but this is c so its very easy to write buggy code :) also, in this case the caller has no obvious safe way to check whether the queue method is safe to call so the author can't claim its up to the caller to verify some pre-condition before enqueuing a task.

or try to travel to an islamic country with an Israeli stamp on your passport or an Israeli passport.

agreement on raising the minimum wage is suspect because its a controversial econ position and presumably some form of UBI or 'negative income tax' is a much better alternative which would have the redistributive effects of a higher minimum wage without the 'tariff' downsides. like we have recently heard why its a very bad idea to artificially raise prices but apparently we are unable to extend this analysis to the minimum wage.

I suspect the commit to fix is:

https://github.com/facebook/react/commit/bbed0b0ee64b89353a4...

and it looks like its been squashed with some other stuff to hide it or maybe there are other problems as well.

this pattern appears 4 times and looks like it is reducing the functions that are exposed to the 'whitelist'. i presume the modules have dangerous functions in the prototype chain and clients were able to invoke them.

      -  return moduleExports[metadata.name];
      +  if (hasOwnProperty.call(moduleExports, metadata.name)) {
      +    return moduleExports[metadata.name];
      +  }
      +  return (undefined: any);

I think sortition is a great idea but you would probably need a constitutional amendment if you wanted sortition in Congress or the Senate. I think the State's have some discretion over how elections are run but I don't think its enough discretion to allow appointment by RNG. I think the strongest argument you could make is its an election where everyone is forced to vote for themselves and tie-breaks are chosen by RNG but I don't think that would be valid because I assume the courts would demand electors execute some agency.

The text of the constitution for electing congress says:

> The House of Representatives shall be composed of Members chosen every second Year by the People of the several States

and there is something similar for the Senate after the 17th amendment. I think pre-17th amendment States may have been able to use Sortion to appoint Senators but it would not have been legally enforceable. The State legislature could pre-commit to elect Senators by Sortition but then they could bail out and just decided to choose who they want when it came to the actual selection.

sortition is just democracy but with a weird probabilistic form of voting

my guess is something like detailed in this article: https://meaningness.com/geeks-mops-sociopaths

aws has security groups as well. using NAT for a firewall is overkill.

if the government wasn't incompetent in how they are handling certain immigration issues the anti-immigration parties would not have any momentum. for some bizarre reason the government is pursuing a course of action that is poisoning the well when it comes to immigration in the UK. i think immigration can bring a lot of benefits to the UK but by bringing in poor performing migrants into the UK it can end up turning the public against all immigration.

the gateway endpoints are free (s3 + dynamodb?), but the service endpoints are charged so that could be a reason why people don't use the service endpoints. but there doesn't seem to be a good reason for not using the service gateways. it also seems crazy that AWS charges you to connect to their own services without a public ip. also, i guess this would be less of an issue (in terms of requiring a public ip) if all of AWS services were available over ipv6. because then you would not need NAT gateways to connect to AWS services when you don't have a public ipv4 ip and I assume you are not getting these special traffic charges when connecting to the AWS services with a public ipv6 address.

in the cloud you should be able to turnkey this quite easily. i think in a DC this can be a bit more tricky because you will still be getting traffic from the DOS to your network interface after you have flipped the switch to cloudflare. This traffic will cause both you and your provider a problem. but i think the idea is you would have two sets of IPs one for the normal public hosting, and one for cloudflare proxy then when you become under DOS attack you have a process in place for BGP to stop advertising the normal public hosting IPs and you switch to cloudflare. i presume if BGP stops advertising the IPs then eventually you will stop getting the DOS traffic.

databases also solve this problem by allowing the read only transaction to see a consistent snapshot of the data at some point in time. so the reader can do its work without needing a logical mutex.

it could be most people pause writes because its going to create errors if you try and execute a write against an instance that refuses to accept and writes, and for some people those errors might not be recoverable. so they just have some option in their application that puts the application into maintenance mode where it will hard reject writes at the application layer.

unless you know the target and trust the people asking you to do the 'prank' this is not a harmless 'prank'. if they thought they had rehearsed with the target then i think they have a strong defence but i think they were extremely lucky to have avoided a murder conviction. what they were doing is assault even if it was not poison unless they had the consent of the target.

it does seem like the audience the article is explicitly targeted for is an edge case. people who understand enough to be writing an exploit but are somehow unaware of their target architecture works.

but i guess the real target audience is probably people that are just starting out on CTFs and just trying to string stuff together without a proper understanding of the fundamentals. everyone has to start somewhere and i guess if people are just using packers and tools to generate exploit code then its quite easy to use the wrong flags and not know what is going on.

I would be very surprised if taxes on tobacco did not cover the increased costs to the State from tobacco users. When I last looked at it tobacco users were dying early before they imposed huge costs on the State during their old age years and this produced an enormous saving to the State. This was ~20 years ago and we might be much better at keeping people alive and this has changed the calculus.

> it’s pretty inhuman as a society to leave people to suffer and die because they can’t afford healthcare.

this is mostly about drawing a line between the tradeoffs of costs and the benefits of increased lifespan and better quality of life. almost no-one actually believes all of societies resources should be committed to healthcare to achieve some small marginal health gain. claiming people are inhuman because they want to draw the line differently is messed up.

if you are a dissident it probably makes more sense to use servers in a different country. for example if you are US dissident it would make more sense to use EU servers or Chinese servers. its kind of suspicious when a country says they need their own servers to protect their own people.

it seems like a failure of journalism that the guardian didn't try and reach out to the airline to find out why this guy's flight was cancelled. if the guardian did do this and didn't find an adequate explanation then they should say this in the article. this just seems to be this zero-value-add reporting where reporters are served up information but then don't do any extra work to find out what the fuck is actually going on. its totally possible this guy is being persecuted by the TSA. there was the quiet skys program which i think is for domestic flights and is meant to have been abandoned but presumably there is something else for international flights where the TSA or homeland security can persecute people they don't like.

i can definitely see someone stalemating with the rook-queen then claiming its actually a rook so its not a stalemate.

it used to possible to execute redis commands against localhost from the web browser using domain rebinding. but i think redis did something to the protocol to fix this. also, this is only really relevant for developers.

Comey was also involved in the Flynn setup. If Comey is convicted of procedural crimes it will be difficult to feel sorry for him when he used those or similar statutes to pursue other people.

I don't understand how people are able to work in the UK illegally without employers already breaking the law. Employers are required to pay payroll taxes for their employees and you need a national insurance number for the employee to do this. I'm not sure how this fixes something that should already be fixed.

Maybe not Aussie bartender but even a lot of typically 'white' Europeans have very different cultures than English and Australian. For example when it comes when it comes to punctuality or queuing. Even stuff like how contracts are treated can be very different depending on the culture. DHH is Dutch and maybe closer to English culture than Italian/Spanish/French.

EDIT: removed unnecessary trailing inflammatory comment

I think democracy and the market are amazing tools. We can strongly disagree with people but are able to peacefully choose how we are governed without resorting to violence and then we are able to peacefully trade and exchange with people we otherwise hate to our mutual benefit. This is an amazing piece of technology that makes the world a much better place but people seem very determined to throw it away.

i was thinking if you were doing some string operations like `indexOf` then maybe that could be an issue.

are there security issues with no schemas + callback stubs + language on the server with little typing. for example with this `hello(name)` example the server expects a string but can the client pass an callback object that is string-like and then use this to try and trick the server into doing something bad?

The supreme court punted with Murthy vs Missouri (https://www.supremecourt.gov/opinions/23pdf/23-411_3dq3.pdf) but it would be harder for them to use the standing excuse in this case. Also, Alito and Gorsuch were dissenting in this case so presumably you would hope that if a similar case appeared they would be consistent and side with the plaintiffs. I think for those in favour of a free speech ruling there is real hope for a positive outcome.