lfam

It's true HTTPS traffic can be blocked (at least partially) by revoking certificates, but is this worse than the censorship opportunities offered by unauthenticated HTTP?

Whether the traffic is authenticated or not, ISPs block sites when instructed by government orders. And that is much harder to work around than a revoked TLS cert (although a revoked cert does mean "totally blocked" for almost all users).

These are not purely technical challenges, but rather political issues that must be addressed as such. We will always lose to our governments if we focus only on technical solutions to censorship.

I'd like to add that the USA government, for the most part, does not accept an absolute right to private communication. The possibility of ubiquitous end-to-end encrypted communications with tools like TLS and WhatsApp is not something we should take for granted. The USA matters here because we are the powerful nation with the strongest legal and cultural commitment to freedom of speech.

Is corruption really uniquely American? Every country and institution that I've studied seems to suffer from corruption and my intuition is that corruption is a universal element of human behavior.

It's better to use Debian Unstable because Testing doesn't get timely security updates.

The article says that Maersk is taking the opposite approach. Quoting the CEO, Jim Hagemann Snabe:

"And this was a wake-up call to become not just good —we actually have a plan to come in a situation where our ability to manage cyber-security becomes a competitive advantage."

In most places in the US, the local cab companies are terrible. They might answer the phone, they might show up, and they might try to scam you.

Imagine you call a taxicab for a medical emergency, and they never show up, or only after an hour.

Uber and Lyft are extremely popular because the apps always tell you if a driver will come, the drivers almost always arrive very quickly, and the price is set in advance.

I'd bet that most people younger than 25 years have never used a traditional taxi, and they never will. They don't even see them as an option.

And I'd like to add that I am really skeptical of replacing this job with software, considering that facilities management in these buildings always seems to be barely holding it together.

I think a $50k employee can be more responsive / adaptable than a computer program whose administrative credentials are misplaced 2 weeks after installation. And probably cheaper, too.

I do deliveries to some buildings that still have freight elevator operators, in a USA city.

I don't know what they are paid, but it is worth every penny for them to manage the elevators. There is not enough "supply" of freight elevator in most tall buildings, so these operators distribute the capacity to the dozens / hundreds of people needing to use the elevator each day.

$50k per year is a bargain for all the time they save for the thousands of deliveries and other uses each year.

If you have experience in this area, then I should not say this: it's easy to criticize some work as useless when one is totally ignorant of the problem space. But buildings don't hire these operators as a charity.

I don't think that fraudulent behavior by site operators is relevant to the X.509 certificate system.

All that the certificates do is make it possible to ensure you are talking to the server at the address you intend to communicate with.

TLS has nothing to do with the morality, ethics or legality of the site operator.

It's too bad that the English word "trust" has so many meanings that people get confused about what it means in this context.

You can tell because every shadow will show the weird shape of the sun. Here is a photograph of the shadows during an annular eclipse:

https://imgur.com/gallery/8c7rdEU

Whether or not people >1000 years ago would notice this and record it... I refrain from pretending to know.

That kind of cellular ornamented vaulting is called muqarnas:

https://en.wikipedia.org/wiki/Muqarnas

Please, feel free to share your "off-limits" ideas, so that we can judge them in the light of day.

> It shares most of the codebase with Nix, so to say it's NIH is missing the point. Nix improvements are shared with Guix, and Guix improvements are shared with Nix.

In Guix, the only code from Nix is the Nix daemon. There is not really much code going back and forth, mostly just bug fixes.

Much of the "wealth" was the people they enslaved, so they did not get to keep it. The American Civil War is seen as a huge and enduring economic loss (but moral gain) for the southern states.

> Let's say the drop tower is open 9am-7pm Monday-Friday, so 10 hours a day, for 5 days a week, and 50 weeks a year. That's 2500 hours of drop time a year. Let's say the building can be expected to last 100 years (probably lasts much longer, it's solid concrete after all) and cost 20 million dollars to build. Thus, you get 250k hours of drop time for $20MM, so each hour of drop time costs $80.

The drop tower does not allow things to be dropped for 10 hours each day. There are only 3 drops per day, so each day gives <30 seconds of drop time.

Red is great, but if we want to preserve our musical heritage, we can't need to hide as we do it. I think that secret libraries are not as resilient as public archives.

Regarding Zimmerman's VoIP, Tarsnap does the same thing. The client source is available but you aren't allowed to use it for anything except building the client for the Tarsnap service.

I think your judgment is too harsh.

Very few software deployment systems make it possible for binaries to be independently reproduced from published sources by the public. AFAIK, it's limited to systems like Nix, Guix, recent Debian, and other participants in the Reproducible Builds project.

However, even within those systems, if you are downloading a compiled binary instead of building it yourself, how can you be sure that you get the "right" binary every time? Does the binary download system periodically "challenge" the binary provider by building from source and comparing with the downloaded binary? If so, does it report its findings anywhere?

It seems to me that even within a software deployment system that enables users to reproduce binaries, you still end up trusting whoever runs the deployment system, because there are no methods of challenging the reproducibility in a meaningful way. The systems I mentioned above sign the binaries, which means that you implicitly trust the holder of the signing key to send you the right binary. But it doesn't mean anything about the relationship of the binary to some source code.

Having said that, if I am using some program by downloading binaries, I am trusting whoever provides the binaries. If I trust them, then a source code audit is valuable to me, even though I can't be sure the compiled binary is related to the source code.

It's not comforting, indeed.

But you should know that the various space-based positioning systems (GPS, GLONASS, BeiDou etc) are deployed and administered by the respective governments of their countries of origin. They were invented for the military and can be selectively disabled or degraded for civilian users.

Does anyone think it's possible for non-governments to stand up replacements for these systems, from either a technical or legal / political perspective?

This is something I really dislike about the use of 3rd-party wikis for documenting software.

They always seem like a good idea at first, but then they slowly become misleading as contributors move on. You can't even call them "irrelevant" at that point because readers don't know they've become irrelevant.

And, by spending energy on the wiki, people don't try improving the upstream documentation. I assume they were motivated to make the wiki due to some problem with the upstream doc but, in the end, the upstream docs don't get improved, and you have a confusing wiki.

Please work with the upstream project on documentation instead. And if you are the upstream, consider a policy of rejecting patches that don't amend the docs appropriately.

As mentioned in the linked announcement, they also added a complementary option to completely prevent gpg from talking to the network. It should address the use case you describe:

* gpg: New option --disable-dirmngr to entirely disable network access for gpg.

Pretty much all free and open source software licenses specifically say there is no warranty at all.

All non-trivial software has security bugs. To reiterate, every program you've ever heard of has had and will have serious security bugs. If no bugs have been published, then either nobody is looking or someone is keeping them secret.

I agree that Apache has behaved irresponsibly.

> It's trivial to turn a signal for driving a speaker into something that can be recorded with an audio interface.

In theory, yes, it's trivial. But it's not trivial to 99.9% of people that listen to music.

Also, I don't think it will be about preventing the re-recording of the music. Nobody wants to keep a music library anymore, just as nobody keeps a movie library. Is the music industry really losing money to "pirates" anymore?

The DRM will be used to control which devices you can listen to music on. As Jay-Z's last album was only available on his streaming service, I predict that the next gimmick will be that you can only listen on his headphones.

The benefit of removing an analog audio output is that you can control what sort of device may play some audio. I am not looking forward to the new world of music DRM.

Yes, this will be true 99% of the time. Although I think that most people understand the concept of "backups" in a basic way, and backups are one of the best tools for mitigating ransomware and wipers. Especially for small businesses which are not going to be able to mount a coherent defense.

But if the relationship is important, they will be open to the conversation and it may be worthwhile. For some of us, it may also present a business opportunity.

Bravo to KQED for owning up to the compromise!

Meanwhile, there are countless lawyers, accountants, doctors, architects, engineers, landlords, and other small and medium businesses that suffer similar attacks and don't talk about it publicly. If you have an important relationship with a business like that, the time to ask them hard questions about security and reliability is now, before the court date, tax audit, surgery, construction commencement, etc.

True. It's the same thing in some cases. For example, you can no longer leave openings between the walls and roof, which used to let hot air out the top of your house. Talk about poorly insulated!

Early Florida homes (19th and early 20th century) were built by people who understood passive cooling techniques.

But, the invention of AC and the development of super-strong residential building codes in response to destructive hurricanes has steered the last ~70 years of home construction towards sealed concrete boxes with air conditioning infrastructure built in.

Many of the classic passive cooling techniques of the old Florida homes are not even legal now. The benefit is your house doesn't collapse in a hurricane.

Perhaps they are trying to improve the situation, but I read Debian security advisories regularly, and they are almost always published without a fix on the testing branch.

Unstable is the Debian branch to use if stable is too slow for one's tastes. The testing branch is just for testing and it's really not safe to use on the internet.

Please don't tar all electronic musicians with that brush :)

There is a big and varied universe of electronic, most of which is a lot more dynamic than radio-pop artists like Avicii.

Well, extended exposure to 85 dB will cause hearing loss. I think a good techno club will not be louder than 100 dB.

But my point was that many environments we consider "safe", "normal", or "enjoyable" are actually dangerous to our hearing, so we have to enter them with an understanding that we are trading temporary enjoyment for long-term health.