cypherpunks01

Nice! With a denser 256 bit card you could store an entire age secret key, and so encrypt any amount of data directly to metal key asymmetrically, only needing the public key at encryption time (keeps metal key safer).

Then thresholding can be done with "sops" (which uses the Hashicorp vault shamir implementation) against groups of age keys. Making it so M of N metal backups are required to decrypt the nuclear codes you're storing.

Signal is licensed under GNU AGPLv3 - think there will be any action against the company for license violations? I suppose it's the least of their liabilities, but just wondering.

Thanks for the info!

For anyone considering, here are the 3 opt-outions that appear after you email verify:

1. Just remove my email address from public search

No one using the public HIBP search feature will be able to see your email address in the results. You’ll still be able to search your own address through the notification service, which verifies that you control the email before showing any results. If your email is part of a domain monitored by someone else (e.g., your employer), the domain controller will still be able to see it in domain-level searches.

2. Remove my email address from public search and delete the list of breaches it appears in

Your email address is no longer searchable — neither through the public service nor by you, even if you verify ownership — because the associated breaches have been deleted from the database. However, your email address is still retained by HIBP to ensure it is excluded from any future breaches and not added to your record.

3. Delete my email address completely

The record containing your email address will be completely deleted, meaning it will no longer appear in search results — for you or the public — at the time of deletion. However, if your email address appears in future data breaches, it will become publicly searchable again, as the opt-out record itself has also been deleted.

Yes I agree! OSS package management ecosystems are a great idea, but allowing submissions without any review or vetting is just asking for supply chain attacks.

npx

Run a command from a local or remote npm package

Description

This command allows you to run an arbitrary command from an npm package (either one installed locally, or fetched remotely), in a similar context as running it via npm run.

Thanks for the tip!

I've had the Device approval setting on, and wished there were more robust lock features, but not enough to want to run my own coordinator. So Tailnet lock seems like a good security upgrade.

Are there any private note solutions that can encrypt all markdown files against your own Yubikey-generated privkey?

You can do this with SOPS and age encryption and it's amazing, but can't view/edit notes outside a terminal or on mobile very easily that I've found.

Looking for a new solution like this, or maybe obscure configuration for an existing notes app that can support this workflow.

All of the "end-to-end" solutions seems like they just store your encrypted keys somewhere with the application files, sync them around to different machines, etc, and decrypt key with a password. But web frontends can be compromised and the master password intercepted, so I'd like to require a Yubikey touch for each document decrypt, which would make exfiltrating multiple documents more difficult.

Most biometrics aren't easily hidden from your environment, everyone's constantly leaving fingerprints and handprints all over everything, shedding skin cells and other DNA material, face and irises can be easily photographed.

So it's kind of cool that a theoretical biometric could be stable over time and not easily leaked, that could take time to produce. Like some sort of cold storage biometric in the far future once certain biometrics become less useful after they're too easily lifted and replicated with new technology. Sort of like deprecating obsolete cryptographic protocols once they're too easily broken.

Any US banks support TOTP or Yubikey/U2F requirements for login yet?

I've seen a couple consumer fintech products that support TOTP, still not many, and no banks I'm aware of.

Like the old saying goes,

"It is difficult to get a researcher to stop P hacking, when his career depends on his not stopping P hacking."

Just recently learned I should be installing mac apps into my home directory Applications, not the system Applications (as every single app installer suggests). Of course, only makes sense for a single-user machine.

If I downgrade myself to a non-admin user, and install apps into my home Applications, then I'm not bothered by permissions requests from apps to update themselves. Almost all of them can just do it, on their own, with non-admin permissions. The only exceptions I've found are Tailscale and other stuff that needs higher level OS integration.

Edit since upvotes: Non-admin user operation was recommended by the Pareto Security app, see info on this specific item: https://paretosecurity.com/mac/checks/not-using-admin

All Pareto security checks: https://paretosecurity.com/mac/checks

App: https://paretosecurity.com/mac and https://github.com/paretoSecurity/pareto-mac

That's so cool to hear! Thanks for sharing

Has he been doing well?

I'd read he met Ross Ulbricht in USP Tucson when they were both serving life without the possibility of parole. I hope they can reconnect now that they're both free.

This system prompt that was posted interestingly includes the result of the US presidential election in November, even though the model's knowledge cutoff date was October. This info wasn't in the anthropic version of the system prompt.

Asking Claude who won without googling, it does seem to know even though it was later than the cutoff date. So the system prompt being posted is supported at least in this aspect.

For "Most Obvious Pulitzer Prize" I would nominate:

Breaking News Photography: Doug Mills of The New York Times

For a sequence of photos of the attempted assassination of then-presidential candidate Donald Trump, including one image that captures a bullet whizzing through the air as he speaks.

I appreciate the reply and link to your paper, that's very interesting and helpful! Thanks!

Can anyone explain a bit more about how this actually works in context here?

Do you hand your full PII "private key" or equivalent, to Google, or does any of the proving happen on your own device?

Then proofs are constructed to 3rd parties, proving certain properties of your data without revealing the underlying data? Are they live/interactive proofs or can static proofs be constructed for these type cases?

What is exactly being proved? Proving that you/Google knows a "private key" that can be found in a particular set of public keys published by the issuer? Or something like that?

For fun I tried syncing over Tor as well. It works impressively well! Amazingly tight sync considering the latency is 3 random hops around the world.

Absolutely! Silent disco still requires impractically expensive rental hardware to work well as far as I know. A lot of them run off FM radio, since it's the simplest way to go, but nobody owns portable radios anymore.

An OSS app with the ability to sync everyone up over mobile or wifi, on Android or iOS with BYO headphones, would be incredible. This should be a thing :)

I've had similar breakthroughs in the pet-project department lately too.

Normally I'd never write small projects in languages I'm unfamiliar with, or learn how to do Android app development just to fix a minor issue with an open-source app, but pair coding with claude code has made these things much more achievable. Vibe coding quickly goes off the rails towards garbage outputs of course, but I've found actually reviewing and guiding the quality of the work piece-by-piece can work with the right effort.

There was a very cool small hardware project posted here some time ago, I forgot what it was, where the creator admitted that he had almost no prior experience doing hardware design/build, but pushed through it solo with LLM assistance far enough to get some pretty impressive outputs.

Well, I think it'd be pretty irritating to see the message "3 messages remaining until 6PM" while you are in the middle of a complex coding task.

Claude Pro and other website/desktop subscription plans are subject to usage limits that would make it very difficult to use for Claude Code.

Claude Code uses the API interface and API pricing, and writes and edits code directly on your machine, this is a level past simply interacting with a separate chat bot. It seems a little disingenuous to say it's "hostile" to users, when the reality is yeah, you do pay a bit more for more reliable usage tier, for a task that requires it. It also shows you exactly how much it's spent at any point.

Harvard Medical School?

Ah yes I've heard of that, it's one of the "Programs with Egregious Records of Antisemitism or Other Bias" which most fuels antisemitic harassment and reflects ideological capture!

Another good one, "Reforming Programs with Egregious Records of Antisemitism or Other Bias .. The programs, schools, and centers of concern include:"

> Harvard Divinity School

> Graduate School of Education

> School of Public Health

> Medical School

> Carr Center for Human Rights at the Harvard Kennedy School

> Harvard Law School International Human Rights Clinic

(partial list)

I must have missed the time when the Medical School racked up a record of egregious antisematism.

Harvard said most of the demands were not actually about antisemitism.

> Although some of the demands outlined by the government are aimed at combating antisemitism, the majority represent direct governmental regulation of the “intellectual conditions” at Harvard.

Hey this Chomsky guy seems pretty smart! Would be great to get him on mainstream media sometime.. hah

The first sentence explains what the rest of the article is about:

"A sweeping crackdown on posts on Instagram and Facebook that are critical of Israel—or even vaguely supportive of Palestinians—was directly orchestrated by the government of Israel, according to internal Meta data obtained by Drop Site News."

The government of Israel does not want anyone to see photos of war victims, yes that's correct.

> Human Rights Watch also found repeated inaccurate application of the “adult nudity and sexual activity” policy for content related to Palestine. In every one of the cases, we reviewed where this policy was invoked, the content included images of dead Palestinians over ruins in Gaza that were clothed, not naked. For example, multiple users reported their Instagram stories being removed under this policy when they posted the same image of a Palestinian father in Gaza who was killed while he was holding his clothed daughter, who was also killed.

> While “hate speech,” “bullying and harassment,” and “violence and incitement” policies[74] were less commonly invoked in the cases Human Rights Watch documented, the handful of cases where they were applied stood out as erroneous. For example, a Facebook user post that said, “How can anyone justify supporting the killing of babies and innocent civilians…” was removed under Community Standards on “bullying and harassment.”[75] Another user posted an image on Instagram of a dead child in a hospital in Gaza with the comment, “Israel bombs the Baptist Hospital in Gaza City killing over 500…” which was removed under Community Guidelines on “violence and incitement.”[76]

"If you rode the Black Shadow at top speed for any length of time, you would almost certainly die. That is why there are not many life members of the Vincent Black Shadow Society."

- HST

From "Song of the Sausage Creature" (for Cycle World magazine, March 1995) mentioned there, definitely worth the quick read!

http://www.latexnet.org/~csmith/sausage.html

I linked this page in another comment:

Deconstructing Brian Eno's Ambient 1: Music for Airports https://reverbmachine.com/blog/deconstructing-brian-eno-musi...

It's not exactly for 1/1, but scroll down to "Deconstructing 2/1" or "Deconstructing 1/2", then down to the music staves section - Hit "Start All", then roll the dice, and it will randomize the loop times! With a little javascript hacking I'm sure you can add more control over the loops and such.

He has some samples for 1/1 tracks too, those could be looped or fed to some AI music software I'm sure to come up with some interpolated result too.