irl_

In general, this isn't the best idea. If you force all your traffic through Tor you increase the chances that you're going to have an opsec fail. Loads of stuff talks to loads of other stuff in the background all the time. Checking your email or refreshing your social media feed or whatever.

When you use TAILS, only applications that are aware of Tor will be using Tor and other applications just go nowhere.

Tor Browser is a great example for explaining the separation between application layer and network layer anonymity. The tor client gives you network layer anonymity while Tor Browser gives you scrubbing of cookies and anti-fingerprinting. Using another browser, or other applications in general that do not try to provide application layer anonymity, with Tor wouldn't protect against all the application layer attacks and so you end up with less (or no) protection.

Debian doesn't actually have anything against sysvinit or OpenRC. Those are just not the defaults. Both sysvinit and OpenRC are available in Debian.

It probably would be easier to have a non-systemd system were the Devuan developers to upstream their packaging and patches to Debian.

As Devuan has a stated goal of not using systemd though, I would guess they take the easy route of not maintaining systemd compatibility. The longer it remains a fork without effort to upstream changes, the more it would diverge and the more work it would be. It would also be more work to keep the fork going, so I guess at some point it would either have to be a hard fork or it would die.

If we remembered there was more to the "web" than HTTP, this would be a thing.

I remember Tim had a diagram that showed "links" between all different systems, all addressable by URI/URL.

URLs are addresses. For web, we messed up and URLs became part of the UI. It shouldn't be necessary to use URLs in most cases though. e.g. imagine using IMAP URLs to read your email.

I can understand it not doing interplanetary directions, but it doesn't have any public transport data at all for any planet but Earth. ):

As far as I can see, there's no Orbot integration. ): Optional support for that would be a killer feature.

Took me a while of reading here to realise, there's no git here. This is a seperate thing that cannot be integrated with your existing stuff, if you're already using Git.

I'd like to have the option of Word documents in Git but I don't want a whole other system just for the special snowflake that is Word as I'm already using Git for managing LaTeX documents and doing that entirely on my own infra.

The Debian Med project is working towards packaging software that is useful, including working with proprietary equipment.

https://www.debian.org/devel/debian-med/

There was a Microsoft Research project that made it possible to run Windows XP (or Server 2003, I don't remember exactly) as a PV guest.

That was really cool, but the whole project disappeared.

If it had been open source, I bet it would still be actively maintained to this day.

Edit: Found the paper https://www.microsoft.com/en-us/research/wp-content/uploads/...

What about all the other patches they're holding back? This can't be the only security issue they've only selectively distributed patches for.

If you want to try out JMAP on a provider that is not FastMail, you use a proxy:

https://proxy.jmap.io/

I've not seen it deployed anywhere else yet as a production thing, and I don't know how much progress has been made on standardisation of it, but it does seem to offer vast improvements over IMAP.

This is also as I understood it. It is possible to have a single hop circuit to an exit, but I don't think you can do single hops to hidden services yet. The hidden service would also have to be explicitly configured to be a single hop hidden service (where it acts as its own rendezvous point).

I don't see any strong evidence that the box itself must be a high speed relay, and in fact, I believe that it is his service that chooses the 3 hop path to the rendezvous point and his Tor daemon that cryptographically verifies that path.

This is the second time in a week now I've seen this guy talking about Tor on HN. He just seems to not understand Tor.

> He's exploiting a vulnerability in the Tor daemon

This is a vulnerability present in literally any proxy and is a limitation of the operating system. If you open more sockets than you can open, you can't open any more. You can not have anonymous unlinkable connections and have tracking psudeonyms together.

If you wanted to scale, try OnionBalance.

https://onionbalance.readthedocs.io/en/latest/

> The TorStatus page has no country associated with the ASN information

I know that for atlas.torproject.org we use the MaxMind GeoLite GeoIP service. If this is not listed here, no information will show. This is more common than you would think, especially for Tor relays which are commonly hosted on smaller ASs than MaxMind care about.

> We aim to be compatible at least with VT100. All the programs (emacs, ssh, vim) should work as expected.

At work, I use a VT100 cartridge for my Atari ST. It's not entirely VT100-compatible but I know for a fact that the vast majority of ncurses applications (not even to mention tmux) don't work and cause the terminal to be so corrupted as to be unusable.

Many applications rely on specific behaviours of newer terminals, so a better target would be xterm (or similar) compatibility. No one is targeting VT100 anymore.

Also me, so I wondered what experience he could have had to lead him to this conclusion. I found this:

> His research focus on anti-anonymity technologies combines fields as vast as ergonomics and child development to artificial intelligence and theoretical biophysics.

(http://www.hackerfactor.com/about.php)

Browser fingerprinting is not new.

See also: https://panopticlick.eff.org/

"Panopticlick will analyze how well your browser and add-ons protect you against online tracking techniques. We’ll also see if your system is uniquely configured—and thus identifiable—even if you are using privacy-protective software."

Tor bug #6119 (https://trac.torproject.org/projects/tor/ticket/6119) talking about using this tool specifically for Tor browser. There are also continuous efforts in Tor Browser to remove fingerprintability (e.g. #22127 - https://trac.torproject.org/projects/tor/ticket/22127).

I have a Sun workstation that seems to be no longer supported by Oracle (Sun Ultra 24 with a Q9300). I guess I'll just be vulnerable forever.

I don't really know what AMT does, but this has me thinking, if AMT is provisioned while a machine is used inside a company and then that machine shows up on eBay still provisioned, is it going to be phoning home and still be remotely manageable? How many of these machines have what are essentially persistent rootkits managed by large corporations that have had large fleets of laptops/desktops deployed that are then sold on?

I really hope things like this do not lead us to a mentality that anything that isn't the Latin alphabet is malware or spam. There are people in the world using non-Latin alphabets and allowing them to have domain names in their native alphabets is a good thing, we just haven't worked out how to do it securely yet.

Disabling the rendering of punycode is actually not helpful in cases where you wanted to visit a domain using the Cyrillic alphabet which you want to be sure of, and someone registered some similar looking domain which looks equally like a bunch of gibberish to the one you're looking for.

Some suggestions, maybe good, maybe bad:

* It may be as simple as adding a character set into the address bar

* Flag a warning if the domain name alphabet doesn't match the page content (as would be the case in this example) or maybe something else

Does any know if the sources for Dmoz are available? I found http://www.dmoz.org/docs/en/cmbuild.html but couldn't find anything beyond that. While a global directory of the Internet may not be too useful and have largely been replaced by spidering and search, I think specialised directories still have a place and it would be cool if communities could reuse the existing code for that.

If the dependency can be satisfied by systemd-shim, the package will depend on "systemd | systemd-shim". This means that if you have neither installed, systemd would be installed. If you have systemd-shim installed then it's fine with that.

There are packages that really do depend on systemd, and so they would not have their dependencies satisfied.

If you really hate systemd that much that you want to put in effort to keep it out, I would seriously suggest putting in some contributions to alternative init systems and patches for software that requires systemd to have fallbacks to work on those init systems.

If you're desperately trying to keep systemd out of your system then maybe you shouldn't upgrade your system (think LTS releases) until you've figured out how your applications work with systemd.

systemd is not going away, posts like this are OK for those who have been hit with surprises, but anyone that thinks this ignoring systemd is a viable long term fix is delusional.

Now that we have faster moving packages and especially where we have packages that depend on external systems (like cloud services), I think more and more Debian Developers need to be making use of backports to ensure that stable versions remain up to date.

I've heard time and time again that there are issues with Debian's version being out of date, but this doesn't have to be this way, at least not by policy. If there is a backport maintainer (doesn't even have to be the same person working on unstable) then the latest version can be installable within a stable system giving you the latest and greatest of the applications that need it with a stable base underneath.

As a Debian Developer I often find myself throwing away the upstream Debian packaging and starting from scratch. It's not that it doesn't work but that it doesn't fit with Debian policy and so is not easily included or modified without basically starting from scratch anyway.

In the cases (which happens more than you might think) where an upstream developer has actually got really good packaging, I've usually taken the approach of tidying up the last few details and committing back and then mentoring them for a while with them doing the majority of the work and I just double check and upload it.

The level to which people are willing to work on it varies from accepting patches that affect the distribution package version (e.g. hardcoded paths or porting issues) to actually doing the packaging.

If you're interested in helping out with Debian: https://www.debian.org/intro/help

If you're an upstream developer and you'd like your package to be in Debian: https://wiki.debian.org/UpstreamGuide

As a scary thought, all those databases kept by intelligence services that store connection "metadata" have the clear possibility of storing cookies, and being able to hijack eBay sessions on demand based on having the stored cookie.

  #!/usr/bin/ex -u
  smile
  quit

Alias all commands to this script for unlimited fun.

(Edit: HN syntax)

For voice I've found it to be quite stable, the video features a little flaky though. Sometimes it would work, sometimes it just wouldn't.

The DHT system for identities is cool, but the thing that gets me is that they don't have support for SRTP with ZRTP, only SRTP with SDES. There's no perfect forward secrecy, and a bunch of other features that ZRTP has.

https://www.silentcircle.com/products-and-solutions/technolo...

On the topic of ICRs in the Investigatory Powers Bill, I liked this from the House of Lords debate:

> It is not for me to explain why the Government want in the Bill a power that currently does not exist, because internet connection records do not exist, and which the security services say they do not want but which the noble and learned Lord says might be needed in the future. It is not for me to justify this power; I am saying to the House why I do not believe it is justified. The noble and learned Lord and the noble Lord, Lord Rosser, made the point that this is an existing power, but how can you have an existing power to acquire something that will not exist until the Bill is enacted?

https://hansard.parliament.uk/Lords/2016-10-19/debates/E4882...

Copyright is one thing, patents are another. I'm very glad we don't have software patents as a concept in Europe.