erhardm

You have to be willing to pay the price. If you want privacy for your users from $E_CORP then you have to protect yourself from becoming the $E_CORP.

How can you say "Privacy is important! $E_CORP is tracking you! - btw, here run this script so I can track you"?

"We build open-source mobile operating systems that respect users’ data privacy." yet your website pulls gstatic.com.

How can I trust the project when I can't even visit the official website without being logged by the biggest company of online tracking?

Actually, if Apple were to stop selling MacBooks next year it could be the downfall.

How do you think that the iPhone & iPad ecosystem is sustained? Through developers (most of whom are) using MacBooks.

They have to port XCode to Windows, which means they don't get to have the lock-in they have now. If there's any flop for the iPhone for 2-3 years, the cost to jump ship isn't that high anymore.

But if those keys represent Person A at Company X then who owns them? Can the company use them if they don't represent the truth anymore?

Who's responsibility is it to guard/change/dispose them?

I'm wondering if destroying the signing keys will have legal consequences. Are signing keys considered company IP when their identity is "fused" with the main developer?

Reading online posts it seems that the community is trusting the developer, not the company behind him.

Actually that's the property of xor, not randomness. Data xor uniform distribution -> results in uniform distribution. It doesn't have to be random.

This is like saying North America and Europe don't have freedom because you're not free to kill/abuse/take advantage of the others however you like. Freedom doesn't work like that.

The GPL restrictions are for keeping the freedom equal for all parties involved.

By using the DB you have to deal with the company.

By giving a grant to a company that is (apparently) more ethical will signal what kind of behavior you encourage, hence choosing to work with MariaDB over OracleDB.

"...shit mediocrity, inflict misery, lie our asses off, screw our customers and make a whole shitload of money..."[0]

0 - https://www.youtube.com/watch?v=-zRN7XLCRhc&t=2147

I searched through the schedule and didn't find State of the Onion. That's unfortunate.

Security Nightmares seems to be still going. That's always a good talk.

M1: Each CPU has four memory channels, each node has 16 DIMMs (8/CPU, 2 DIMMs/channel) which means that you can use 1 DIMM per channel -> maximum memory bandwith and speed with RDIMMs. Using 64GB or 128GB LRDIMMs with E5v4 CPUs won't affect your bandwith or speed as long as you populate all the channels.[0]

Your memory options are:

1TB - 16x64GB / 8x128GB

2TB - 16x128GB

[0] - SuperMicro X10DRT-PT Motherboard manual page 35(2-13).

"... Upon the insistence of the US, the documents are not transmitted any more as electronic or even printed documents.[5] They are only made available [to authorised readers] in secure rooms at the European Commission HQ in Brussels, in a number of US embassies,[5] and at the offices of member states' trade ministries.[61] In all these secured rooms phones or other types of scanning device are forbidden.[5] Blank sheets of paper, marked with the reader's names, are provided on which visitors can jot down their notes.[61]..."[0]

How can my representative be really productive in analyzing such a deal? Why all the barriers to understand the document?

I didn't find out the time it's supposedly be public for debate, but if you're doing a deal for the people, you want people to negotiate, not just accept the deal as it is, which, as history taught us, it will be a really tight timeframe for debate and it's approved few days before a major holiday when people are distracted.

Our representatives must have our [all citizens] best interest at heart. I don't see how this is in our best interest.

And I didn't event talked about the deal itself, only the procedure which seems flawed.

[0] - https://en.wikipedia.org/wiki/Transatlantic_Trade_and_Invest...

What really bothers me, as citizen of an european country, why is it possible to have secret deals? If I don't know about such deals how can I call my representative to oppose them? Or encourage them to take the deal if it's a good one.

AFAIK, TTIP was leaked and that's the only way european citizens knew about it.

Why is it legal? Because all I see is corporations trying to make a sweet deal with governments, and the loosing side is always the people.

That's the only incentive I see to make deals secret.

Same, but I'm using Open vSwitch[0] to tag internet traffic which goes to the router VM. I was using IOMMU but on non-Intel NICs the interupts were killing the throughput in OpenBSD.

[0] - http://openvswitch.org/

Just because you won't outrun your chain, doesn't mean you're not a slave. Maybe a happy one, but still a slave nonetheless.

To be clear, NSL are anti-democratic and wrong.

But it looks like they put themselves in that position. Either by voluntary working with the FBI and allegedly taking a $1M grant, and/or doing unethical research by doing it on the live network.

You can search for cards that use this chipsets[0].

[0]http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/...

Yes, it's possible. You run tor under its own user and block all ingress/egress traffic except from tor's user. You talk to the outside world proxying through tor.

If you want to see up to date information about RDS IPv6 adoption divided by county in Romania: http://labs.rcs-rds.ro/

It also includes speed of each county.

Ex-US agent seems kind of deliberate distancing. He was an agent when he did the deed and the title should present that accordingly.

Edit: ninja'd by meric

I think that's the Kerckhoffs' principle[0].

Regarding to state actors who have the resources to attack any system, I think it's important to make it as hard as possible, even if it's "known" they will find a way. Why?

Because it will drive the costs very high with years of R&D having as result that they'll only use new attack techniques on high-level targets and that means risk of revealing attacks goes up(assuming high-level targets are more sophisticated and spill the beans - as in Kaspersky case[1]).

[0] - https://en.wikipedia.org/wiki/Kerckhoffs%27_principle

[1] - https://securelist.com/blog/research/70504/the-mystery-of-du...

Welcome to the new world of closed ecosystems. May be a wakeup call for others who think they can directly compete with those who actually pull the strings of the ecosystem.

When the TA from my university told us updates for the laboratory will be on facebook, I told him I want them on email. Everyone in the room looked at me like I was a dinosaur who doesn't have a facebook account.

TA was surprised too as well, until I asked rhetorically "why facebook? Why not Google+, LinkedIn, Twitter, Snapchat, Kik, DropBox etc?". The TA then understood my point and updates were sent on email.

Although Meerkat vs Periscope is not exactly the same thing, but its problems are from the same reasons, open vs closed ecosystem.

I like OpenBSD. I like the spirit of the developers, which don't compromise on security. I like the simplicity of the OS, very good documented and very robust. They are prepared to break a ton of software to advance the state of security/correct code.

I would like to have OpenBSD on all my machines, but unfortunately their license don't have the "infectious" effect of GPL. From my limited understanding, their license[0] is not a philosophical license like GPL. Linux popularity spread because of the distributed development style(everyone developed in their own tree, Linus decided if it had enough value to get in his tree) and GPL.

Even if you don't care on the philosophy of GPL, you can't deny that it helped make a lot of vendors to publish(even if half-hearted) their code which eventually after some cleanup(3rd party or themselves) got into the Linus tree.

If OpenBSD would be GPL licensed, I could see a BSD which would be have all the bleeding edge features, but Theo's tree was separate, conservative on features but not lacking on drivers. Men can only dream.

I realize that FreeBSD is the bleeding edge of BSD land and I'm not trying to start a license flamewar, but a lot of companies, i.e. graphics, wireless cards, laptop manufactures don't have (good) working drivers for BSD land, at least not published code which goes back to the community.

[0] - http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/share/misc/lice...

Doesn't matter. The condition will short-circuit at murder:)

@ghostly_s

I don't see this as the roadblock. They (the experts) could bill by the hour. The most intensive period is the initial specification/design/architecture. After the burst period they just have to review the commits for security pitfalls and merge them if OK. The community could have some volunteer reviewers for triage.

I have no idea if this actually works and I also didn't heard anything like this done before, so take it with a grain of salt. That's why I asked more knowledgeable people how feasible this could be.

If only the design/architecture would be contracted to experts and the actual implementation be written by the community how expensive would that be?

The experts shouldn't write any line of code, use the community as code monkeys, only accepting pull requests and merge them in the project(basically what Linus does this days). Would that not be feasible?

OpenSSL is not the work of the OpenBSD team. They work on LibreSSL[0] which is a fork of OpenSSL.

[0] http://www.libressl.org/

Probably because it's not from the U.S. I encountered a lot of startup descriptions like european based startup, german/berlin startup, etc. The place isn't that important, but some think that it's mention worthy if it's not from a startup cluster.

PHP hammer[0] made using the specification[1]

[0]https://secure.flickr.com/photos/raindrift/sets/721576294929... [1]http://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/#a...

A good developer uses the best tools available, because she/he knows the value of using them.