kefka

Yeah, primarily, OpenBazaar did it a way, and the #ipfs team in freenode isn't sure if that's the best way.

It primarily has to do with Kadmelia and DHT. How does one consider an adapter or transit to IPFS as a "secure don't leak other addresses"? Does one run a secure IPFS for Tor and I2P? Should it be integrated with a flag on those interfaces?

The IPFS team wanted to get everything else settled, protocol-wise before going down the idea of secured, and hidden protocols, given IPFS's propensity of splattering all interfaces through it (even unroutable internal network addresses).

> I wish machine learning research didn't respond so strongly to trends and hype,

It's really because nobody actually understands what's going on inside a ML algorithm. When you give it a ginormous dataset, what data is it really using to make its determination of

[0.0000999192346 , .91128756789 , 0 , .62819364 , 32.8172]

Because what I do for ML is do a supervised fit, then use a next to test and confirm fitness, then unleash it on untrained data and check and see. But I have no real understanding of what those numbers actually represent. I mean, does .91128756789 represent the curve around the nose, or is it skin color, or is it a facial encoding of 3d shape?

> I'm still wondering what, if anything, is going to supplant deep learning.

I think it'll be a slow climb to actual understanding. Right now, we have object identifiers in NN. They work, after TB's of images and PFLOPS of cpu/gpu time. It's only brute force with 'magic black boxes' - and that provides results but no understanding. The next steps are actually deciphering what the understanding is, or making straight-up algorithms that can differentiate between things.

It already does. Check out OpenBazaar's patches that include Tour and I2P functionality.

Doubling the cube was being ridiculous to prove the bad language to explain the problem.

If it really meant doubling the volume of a cube of X unit size, then absolutely it's (2 * x^3)^(1/3)

>• Stupid Question 3: Double the cube.

     (X^3) * 2  -- Done.

>• Stupid Question 4: Square the Circle.

     r is known. X is not.
     pi * r^2 = X^2
     sqrt(pi * r^2) = X , for positive X

oh, geometrically? No. Algebraically works cleaner, and for any arbitrary positive solutions for r.

>Its central dogma is thou should prove everything rigorously.

That's not a dogma. Its a proof because anyone, no matter whom, no matter when, or where in the universe, can duplicate these results and show they are logically true. Or they can show the results are logically false, no matter the inputs given.

It's not "dogma", as some high edict by a Pope or something. A rank amateur could further the field by proving a new theorem - because the person doesn't matter. The soundness of logic does.

It is effectively uncensorable because the world is not 1 government, but 200 something. And no matter how much kicking and screaming the US does, not every country will comply.

It also uses the fact that the IPFS cache is also used to deliver content to others, similar to the way Bittorrent allows downloading and uploading based on blocks of content.

There still has to be someone hosting it initially to spread. But even that can be done over Tor, given the patches from OpenBazaar and IPFS.

> The US has a history of settling refugees here.

Oh please. You don't know your history then.

We also refused Irish during the Potato Famine. This time it was because they weren't "healthy" - aka, no damn Mics.

After a campaign of anti-Irish sentiment, the Italians came here. We have a racial slur for them - fops. They were turned out en masse.

We denied the Jews coming here in '36. Didn't like Jewish - they kill and eat children! (Yes, this is in the US National Holocaust Museum as example of propaganda.)

We denied the Jews again in '46, AFTER knowing the atrocities they suffered in Europe. You know, those damned Jews.

In the 50's, we laid heavily into the Slavic and Baltic countries... Those damned Commies. Oh you were leaving because of humanitarian crisis? LIAR.

That's just a few examples. This whole Muslim ban has been done before with nations, politics, and religion (Irish, Communist/Socialist, Jewish respectively). Most populist "leaders" will garner support by singling one group out and attacking. Just like Hitler did, and following in the footsteps, Trump.

For me, I've always liked highlighting the problem at hand. It can be multi-faceted with different actors wanting mutually exclusive things - where the resolution is violence.

But in talking of these, I see it more akin to the way Open Source software is up front and public about it - with the idea that enough eyeballs, these problems can be worked with. Being able to even frame the question, with politically charged areas like this, is a step in the right direction.

And no single person is expected to figure it out. But a thousand of us could.

My comment was too long, as deemed by HN. So I posted it here.

https://pastebin.com/hLBbqk24

Then lets be blatant and straightforward then.

"If you're rich and willing to spend, we want you. If you're average or poor, fuck you."

I flagged it because I saw this as a hand-wavey "magic code" combined with a website filled with market-ese. I've been long enough in this industry to smell this at a distance. But I see the [DEAD] was rescinded. Ill be willing to rescind my flag since a rep of the company is here (you).

_________________________________

> Yes, I can understand your skepticism, and that is a good sign that you don’t believe whatever folks are just saying. That is particularly good in the cybersecurity field as claims that are unsubstantiated are often made.

It really has to do with multiple things here. First, is a new crypto implementation. That sets of major alarms with me, no matter who writes it. Especially so being infrastructure, this should be open source and publicly accessible for review.

Secondly, you're using a new IP protocol. Full stop. This should be absolutely IETF standard, reference design, full engineering review, kind of code. I see none of that. I would get not having gone this route if you're trying to get a new protocol spun up with a reference design. I'm thinking of IPFS, where everything's open and done in public on GitHub and IRC. In my opinion, they're going on the route of getting an IETF standard in a different way (of utmost transparency and collaboration).

_________________________________

> The problem with cybersecurity is that you can’t prove a negative proposition. That is, it’s not possible to prove that a system will never be hacked. That said, there are ways of increasing the cybersecurity of a system to the extent that a compentent attacker, i.e. a nation-state actor, will need to commit significant time, personnel, and resources to attempt to mount a serious attack. Most likely they will look elsewhere to attack rather than the network interface that our product protects.

You want to play this game? Sure, I'll bite. How do you know you don't have a protocol error baked in at the definition of how your stuff works? Sure, you all were smart enough to build it, and some pentesters you hired said it was OK. The basic idea with RFC's was that everyone, collectively across the world could collaborate on how a protocol would work, or not. Failure domains could be identified and caught before a full standard was made. Have there been errors in these base protocols? Sure have. But they collectively have been fixed.

How do you plan to have peer review of your protocol, let alone your implementation? Hope and prayer, I guess. And when it comes to infrastructure, that's nowhere near good enough for me. I need an open, peer reviewed protocol with a clear reference example. You can build your middleware and I'd consider purchasing that for value-add. But "No Way" with regards to the actual protocol.

_________________________________

> As to your specific questions: 1) The only way to evaluate the cybersecurity of a system is through penetration testing. We’ve had several highly competent teams evaluate our technology and have failed to defeat it in any way. You should have your own penetration test teams test all of your systems before you put them into production, and then periodically continue to test them for vulnerabilities. That said, no system is perfectly secure. But, we’ve been accepting systems with poor cybersecuity for quite a while, it’s time to raise the bar on what is acceptable cybersecurity.

Absolutely NOT. The other way to prove cybersecurity of a system is to prove it. For example, I can write functions in Erlang that I can prove are mathematically correct. I can show any input and its related output. I can probe the state of the system and inspect it at any time. And I can functionally understand it from a formal aspect.

Your claim is "Oh just pentest it". That's what you have to do for a black box, but that only _delays_ major problems. For example, there's controllers on Hard Drives. Only the HD makers know about them, so nobody can do anything, right? Wrong. Enter Sprite_TM http://hackaday.com/2013/08/02/sprite_tm-ohm2013-talk-hackin...

This person figured out how to control all 3 ARM chips, with unknown instruction sets, from just probing, hacking binaries, and poking at stuff. Black boxes like what you're peddling WILL get hacked. And if they're white hats, they will likely tell you. Or, exploits will end up on random Tor auction site.

The middle ground is a published protocol and reference code to bootstrap. It doesn't have to be feature-laden. But its the foundation of proper Networking code. And instead, hand-waviness is claiming "We hired some hackers, so we're good". That doesn't cut it, especially for critical infrastructure.

_________________________________

> 2) You are free to choose open source or any product. The problem with current technologies is that they were designed before the kind of high-level cybersecurity we expect today was understood. These existing technologies are wed to their current protocols which can’t be patched to make them more secure. Only a redesign from scratch will do that, which is tantamount to abandoning their current protocols.

https://xkcd.com/927/

Oh, also, MQTT specifies absolutely nothing about payload type. Technically, a publish to a MQTT broker can be a cryptographic payload, a DVD image, a boolean, or anything. The spec allows anything to be put in as a publish. From there, it would be trivial to extend MQTT to require a cryptographic signature. Mosquitto supports plugins that could verify data authenticity.

And there's also RabbitMQ (AMQP) with forward-and-store. Similar extensions to it are available as plugins. What I see here, is a strawman of "Something something security" and pushing an untested, unfounded, unknown protocol for IoT and industrial devices, and operating on the "Hope and Prayer" principle.

_________________________________

> In a sense, cybersecurity is a conspiracy of trust. Without trust there is no security.

I disagree with this as well. I shouldn't have to "Trust". That's what "Proof" is about. Proof would allow me to accept the code, even if you are a bad actor (I don't believe you are, I only think your goals are misguided). If the foundations are solid, it wouldn't matter what you say, if anything.

Wow. This is a 30 day trial offer over supposed "hardened controls". Pardon my skepticism, but proof or GTFO.

I already have access to ZeroMQ, RabbitMQ, Mosquitto, Californium, and plenty more. And they all are open source under reasonable licenses.

So can someone please tell me:

     1. Why should I trust your claim of security?
     2. Why your product is worth money when I can go Open Source for free?
     3. Why should I deal with Vendor lockin?
     4. Why should I trust you?

Well... The obvious answer is that it's not worth it, at any cost.

EDIT: I flagged it. I would encourage others to do the same. This is bad, horrible, no good junkware.

Hmm.. Randomly generated real-world traffic based from traffic sensors and cameras. The key here is, if they use the same data and feed every car the same, then it can be easily gamed with overfit techniques.

The better question is, what happens if you give the AI car a no-win situation? How does it handle it? The Kobayashi Maru can be looked at as a way to detect outliers and failure modes... even if the game is rigged.

Seriously? Wow, well fuck that. If I buy a VPN, I expect data_in = data_out , not sanitized(data_out)

Is this a joke? Because this is already added to password crack dictionaries now...

If it is a joke, then they need something to indicate that, and very blatantly at that. Because there's a great deal of people who'd see that and not give it a second thought to use it.

Yeah. I spent about 20 minutes mulling over how to respond, and instead opted not to. But yes, you hit it in 1.

Maybe the conservatives have their own. Pretty sure they do. Ive seem some kicking and screaming with Christianity, but even in Indiana, apathy with regards to religion seems to be taking more of a hold. And there's that Starbucks cup thing.. I'm 100% sure that was social media "fake news". I never saw anyone in real life actually complaining about that, other than for a week or 2, it was bandied around everywhere.

Then again, the ones who've consistently yelled and screamed and flailed around are the special snowflake extremist liberal SJWs over perceived and non-existent slights. And yes, I'm a liberal complaining about how extremists are ruining liberalism, because what they want freedom for you to comply with them.

And add in the fact, that until recently, insurance was available for only specific destitute or employees whom worked at jobs that provided insurance.

And we have a party that wants to dismantle everything, including Social Security.

Well, point made.

I've seen a bit of these types, but usually they wore iron cross rings, or white robes (KKK). Even some of the more extremist Christians I know haven't acted quite like that. Yes their preference is very much against homosexuality and more liberal policies of "Do what you want as long as you don't harm others", but I haven't seem them go out of their way like the extremist liberal ones do.

I've even been screamed at by some extremist liberal woman because I (a male <shudder>) dared to walk through a door and hold the door open for her, err, hir, err, "it". And note, even if you can't see it, am a bisexual male.

> Do we want to be in a society where only things deemed non-offensive are protected?

Well, offensive to whom? There's obviously "Nigger"... But wait. It's offensive if a white person calls a black person that. But many a time, blacks will call each other that to 'own' the word and reclaim its power. So we have an immediate example of an offensive word that isn't offensive in many cases.

Or in recent years, simply asking "Are you a man or woman?" is offensive if they pull the 'not gender binary'-card. Yeah, we can ignore the fact that you either have sperm or eggs, or genetic anomalies that have interesting medical conditions.. But the question in certain groups is "Offensive".

Then there's the last group of people who are, what I call, professional victims. I've not seen a conservative one of these yet. They primarily are in the extremist liberal camps, and the smallest innocuous things will set them off in tirades. To them, everything they don't do is "Offensive". And this "Offensiveness" changes as per person. I usually treat these people by ignoring them. You cannot win. (An example of one of them is demanding to have others use some pronoun like hir or zir or zem. And they will get angry if you ask, don't ask, use a different one around other people or... )

Edit: I try for a variant of the Robustness Principle. Unless someone is intentionally mocking me, if they get some term wrong or use no longer "politically correct" terminology, I try to look past that for their underlying idea.

Yep, pretty much. It really reminds me of this: https://xkcd.com/1200/ for obvious reasons.

The only ways I can think that would be able to prevent this are:

     1. Physical non-networked device password manager
     2. Really creative usage of SELinux
     3. QubesOS

And in reality, #1 is kind of how RSA tokens are used. Of course, physical can be lost, stolen, and all that. QubesOS takes a ton of resources to run effectively, given everything is VM'ed and contained with a capability system.

In all honesty, I could see buying an Android at a Pay as You Go place, and repurpose it to be a offline password manager. Never connect it to wifi, BT, cell. And any APK's you need you load via microSD card and USB.

My comment on checksums was a overall comment of shoddy and embarrassing hacked crap they call Ethereum.

They claimed again and again that the code is the contract and vice versa. That was proven not true by the VIP() function.

And seriously, if this protocol was given proper due diligence, there would be no reentrant attack on this. But that points back to amateur hour. And a lot of people here have money in ETH and can't come to understand this due to the extreme cognitive dissonance.

(The premise of Ethereum really is amazing. Too bad it wasn't given the same diligence as Satoshi gave it.)

That's primarily because Ethereum is pure amateur hour. When Bitcoin had built in checksums on addresses, Eth Dev's just said "watch where you send money". They ended up having to later add in a capitalization scheme to serve as a hash.

I have no clue how they managed to fool so many people with poor and shoddy work. But they have so far. And they've fooled everyone that this is a 'hack' even after saying time and again "The code is the contract, and the contract is the code"... Unless lead devs lose money.

Well, if they're tech, you can use HN to name and shame. If they're elsewhere, you use Twitter.

It's the new "Fedex to CEO" solution, where now everyone sees dirty laundry regarding grievances. And the companies what these things to disappear quick. Lingering issues = bad press.

I mean, look at the last dumpster-fire here, FireBase. That was a travesty on how crazy and stupid that was. But they ghosted him, and it took Medium/HN to actually get a response.

> Uh, that's the entire premise behind the free market. Money decides who is right and who is wrong. The Invisible Hand doesn't have morals.

Yeah, free market. Like "I have more money, and I dont like your face, so I nuisance sue you until you're bankrupt." free market?

That's not a world I want to be part of, continue, or assist in any way.

Lets be serious here. This is a standard "I'm wrong, but I have more money so Ill exhaust your resources to get what I want."

There's no trademark devaluation. There's no copyright infringement. There's no patent infringement. This is straight up First Sale Doctrine stuff. And even if there was the above 3, SCOUTS ruled those rights are exhausted on sale recently.

This is directly an issue of "More Money = Better Legal Justice". And that should be very worrying.

It's the similar power arrangement when an employee has legitimate grievances with their employer. Individually, they are a speck. Nothing. They can be gotten rid of like the chattel they are.

However, when Unions show up, they are the equal and opposing force that keeps a company in check with regards to their employees. Some have issues with Unions, as some of them are significantly corrupt. But by and large, unions are the equal and opposite force.

What protects small companies from large companies? In reality, nothing. That's what allows fake-patent shakedowns like the "SSL Patent", or others. And that's by exploiting protections in law... But what happens when one side has *10000 the resources? You capitulate and go bankrupt due to legal fees, legal harassment, and a continual defense against a legal monied attack.

In the end, there's fuck-all you can do. Well, other than whatever the monied plantiff wants.

Gotta love capitalism, eh? Just like votes, more money = more protection.

This certainly wasn't a trademark issue. Trader vs Pirate. There was no question this store wasn't run by Trader Joes/Aldi North. They were buying in bulk to stock a store where they couldn't normally get the goods. Reselling should be 100% A-OK. Any trademarks go along with the products. And as far as I would guess, the grocer certainly wasn't tampering with anything - if (s)he was, they'd go out of business quick.

This is just normal SLAPP-style punitive legal actions that a large monied corporation can do to stop the little guy from doing legal behaviors that they don't like.

> Why make the printer "think" it's printing. Why not just literally measure and record the pulses sent to the actual print heads?

That's what my shim would do, is record the signals to the ink solenoids. The reason to make the printer think its printing, is primarily because of all the DRM lockout crap all manufacturers use. Ideally, I'd even let it print so that when the firmware sees ink levels going down, nothing on the firmware side would look amiss.

> The "yellow dot" method would be picked up pretty quickly by the yellow being triggered while printing entirely B&W documents.

Indeed. However, its old hat about the yellow dots. I know they've moved on to something much harder to detect, and also likely scan and reprint resilient. What is this new type? No bloody clue. I'd assume a bad actor using heavy stego on chip. And if I were designing it, I'd watch for things like test images coming through and not mark them.

My first attempt would be with a high res 100$ bill scan. I betcha that'd trigger something interesting.

> Things like dithering, if they encode things like printer serial numbers might be catchable by printing an identical set of documents across two examples of the printer.

Yeah, I figure there's a serial number, time/date, hostname, IP, logged-in username.. All sorts of data. This is also corporate espionage area as well as national security, so I'd figure they would put out all the stops to catch, if they can't prevent the print itself.

Just chalk it up to me, and my paranoid mind. Still doesnt mean they arent out to get you!

The root problem here is , that Amazon Glacier is as opaque as mud about pricing. Or did the words "Starting At" not pique your buzzword bullshit detector? It certainly did mine.

Pricing means sifting through a legalese dense block of text to try to come up with even a way to estimate the costs. That is a problem. I should be given a rough cost expectation up front. Sure, it's not going to be exact and all, but This article is about a cost factor of *180.. That's the difference between an iPad and a Ferrari.

Other places of varying types of backup systems are a lot more clearer to tell how much I should be expected to pay. Or at least, I get within +/- 10%. Glacier? "Yeah, Don't worry about it till we bill ya!" That's the scam with all these cloud services really. Once we have your nuts in a vice, we can squeeze and extract, cause you don't have any other choice, now do you?

Before you mention "Cheap options" and Amazon Glacier, read this: https://news.ycombinator.com/item?id=10921365

"How I ended up paying $150 for a single 60GB download from Amazon Glacier"

> If you’re retrieving more than 5% of your stuff, expect to pay a fee, “starting at $0.011 per gigabyte”.

Key words here is "starting at". as in, no cap on how much they can and will charge you for your data. Cause you know, 60GB is realllly expensive to transfer :(

_______________________________

What Glacier seems to be for, is more like compliance paperwork and other "We are required to save this for X years" kind of paperwork. Because most of those types of documents, you don't care about and only legally have to keep available. And if a court case comes along, the Glacier retrieval price can just be added on top of court fees (which in that case, Glacier is probably a pittance even at the $10k level).