paulproteus

I removed the emoji heart and rendered the message successfully. :) Thanks! The recipient was happy to get it.

I might have broken it by adding an emoji heart ️ into my message! If so, apologies.

> I do not excuse Richard Stallman’s remarks, nor do I challenge the actions of both the MIT Media Lab and the FSF for terminating his positions with them.

It wasn't the Media Lab with which Richard had a position; it was MIT CSAIL.

I'm one of the volunteer organizers of the Roguelike Celebration <https://roguelike.club/> where Josh Ge gave this talk. Thanks Josh for making it to the conference! For other readers, you might want to visit the conference website and stay in touch for updates about next year's event! :)

Dear moderators: Can you adjust the title? I misunderstood it, as I think many others will, as defeating all RSA-1024 by all GPG users done on any computer. It's actually about people who share a computer with someone doing a GPG decryption.

The paper's title is: "Sliding right into disaster: Left-to-right sliding windows leak". Standard HN practice is to use the page's title as the post title.

Alternative options that seem clear to me:

- "Local-machine side channel attack defeats RSA-1024 decryption using GPG (CVE-2017-7526)"

- "Complete break of RSA-1024 in GPG (CVE-2017-7526) for local attackers"

- "Sliding right into disaster: Left-to-right sliding window attack against local-machine RSA-1024 in GPG (CVE-2017-7526)"

Thanks!

This is great! Nice to see another project in the history of C/C++ interpreters including:

- cling: https://root.cern.ch/cling

- cint: http://www.hanno.jp/gotom/Cint.html

- Ch: https://www.softintegration.com/

If people know of other ones, I'd love to hear about them in the comments!

FWIW, one way Sandstorm addresses this is that anyone can sign in with their Google/GitHub/email if you give them a sharing link. So they don't have to have an account first.

e.g. try this:

https://mrdomino.sandcats.io/shared/bqY9H9opr0AnKa6XYtC1Obfu...

This is my friend's bulletin board on his own personal Sandstorm server (admittedly ugly URL - we need to make it possible to make less ugly, but you could work around that with a redirect elsewhere).

Visit it, and then sign in, and you're talking.

Yes -- that would work great! With a caveat -- apps have no network access in Sandstorm by default. The way apps can get network access is that (soon) there will be a way to have one program called an "IRC driver" receive real network access, and then it would export the capability to speak to IRC servers to other apps. An Android intents-like chooser would let the user pick/install an IRC driver, if an app needs one.

The general idea is that if an app needs IRC access, it can bother the user once to get it, and if it doesn't need IRC access, then it shouldn't ever have access to IRC (or the network).

This isn't ready yet, but good golly am I excited for us to finish it up so I can tell all my friends that Sandstorm is the easiest way to run an IRC bouncer.

Hi wyldfire,

I hope you don't stay embarrassed. We could improve parts of the interface, and we need feedback like this to know what people think is going on, so that we can decide how to change the interface to show people what is actually going on.

Thanks for leaving the comment and I hope you enjoy using Sandstorm!

Hi andybak, I work on the Sandstorm team and it seems pretty clear that you're not an idiot.

I'll see if there's something we can do to make this essential UI element more discoverable.

To some extent, it's a matter of learning about Sandstorm -- Sandstorm's role in the web app ecosystem is basically to add sharing & access control, so maybe everyone has to learn this. But hopefully we can help people figure it out more easily.

There isn't an official Docker image for now as far as I know, so your best bet is to make an Ubuntu 14.04 Docker container and run the regular Sandstorm installer within it.

I agree it'd be great on NASs. I'm particularly excited about Synology ones since I know they have some x86-64 models. If you're interested in possibly helping out with that stuff, feel free to email community@sandstorm.io and I can see if there's a way we can give you a preview of that sooner rather than later.

That's something that should be possible in a Sandstorm app, if you want to make it do that. (-:

To do it securely in Sandstorm would have to wait for our secure inter-app communication system, similar to Android intents, called the Powerbox. But we're working on it.

This sort of thing would make a great Sandstorm app, for what it's worth. See https://news.ycombinator.com/item?id=10147774 for more about that.

In case you're interested, this is something we're working on. Consider subscribing to this issue:

https://github.com/sandstorm-io/sandstorm/issues/701

(Hi! I'm the author of the blog post & maintainer of the Sandcats service.)

I'm excited about Sandstorm eventually helping people tackle issues like port forwarding. There's enough to do that it's not something I'm personally prioritizing, but it would definitely be very interesting. I can imagine the initial version of this feature working using UPnP for example, for routers that support it.

Thanks for taking an interest in Sandstorm!

As for ngrok-style tunneling, that's something I'm less interested in hosting/maintaining as part of the Sandcats toolkit for Sandstorm self-hosters. I'd be happy to see Sandstorm grow the ability to integrate with services that offer something ngrok-like, though.

Somewhat hilariously, a Tor hidden service is easy to set up and has built-in NAT traversal, if I understand things correctly, so maybe one day we'll see a "Run your Sandstorm server as a Tor hidden service" feature purely for the connectivity conveniences.

Thanks so much, dang!

Hi Scott!

I think this is interesting for two reasons:

1. Open source web apps often struggle to maintain a "Try it" server. The interesting thing here is that Sandstorm (through our package ecosystem and demo server) makes that easy for any open source web app, and this is an example of that.

2. Since I wrote the code that powers that link, I thought it would be a great thing to "Show HN", per https://news.ycombinator.com/showhn.html "Show HN is a way to share something that you've made on Hacker News."

True!

https://github.com/ether/ether.github.com/pull/21

One other possibly-cool thing is that any open source web app, when packaged for Sandstorm, can get a "Try it now" button of your own. That's what I explain at https://blog.sandstorm.io/news/2015-02-06-app-demo.html but I figure it's worth stating clearly here in a comment, to save people a click.

Thanks for taking an interest!

I personally wrote the code behind Sandstorm's "appdemo" feature, which is what the "Try it now" button links to, from the Etherpad front page. Etherpad itself is not written by me; it's written by many other great people.

See e.g. https://github.com/sandstorm-io/sandstorm/commits?author=pau...

I also wrote this blog post about the feature: https://blog.sandstorm.io/news/2015-02-06-app-demo.html

Happy to answer other questions if you have them!

Here's how:

* Backend: Due to Linux network namespaces, the app can't communicate with the network (except over "sandstorm-http-bridge" which allows it to respond to inbound HTTP requests).

* Frontend: Due to Content-Security-Policy, the client part of the app can't communicate with any hostname other than the one the app runs on. The CSP header is set by Sandstorm, not the app.

So then it has no network access, and therefore even if it is compromised, can't leak anything.

This does hinge on the app's dynamic code only being run for logged-in users. For many apps -- imagine a Google Docs spreadsheet only accessible to people within your domain -- this is a pretty straightforwardly reasonable model. Sandstorm handles authentication for apps, so it can enforce this even if the app is 0wned.

It's not currently possible to run arbitrary Docker containers through Sandstorm, since we prefer app packages (we call them SPKs) to be:

* Self-contained -- if the app needs MySQL, bundle it;

* Able to run with external network access unavailable -- this improves security, since even if an app gets compromised, it's not a big deal since it can't leak any data out to the world;

and a few other constraints that are more technical than philosophical.

https://github.com/sandstorm-io/sandstorm/wiki/Porting-Guide hints at them, but I don't quickly find a reference for all these constraints. I'm likely to write such a reference in the next few days/weeks, though.

Here's my own summary, which if you like it, I can try harder to make sure becomes more prominent somewhere:

Sandstorm is a way to run web apps as containers, gloriously sandboxed from each other, and moreover a web interface to install them easily and allow the user to create multiple instances of a web app easily.

It intends to grow features relating to sharing instances -- so that an instance of a web app is as easy to share with someone else as a Google Docs link -- and grow features relating to supporting more network protocols -- so that apps can safely communicate with the outside world, mediated by the person using Sandstorm.

Right now, the target audience is people who like running web apps like WordPress or Ethercalc on their own server. In the future, the target audience will grow to include companies whose IT departments want to enable users to install web apps safely without asking IT first -- they'll know it's safe due to the glorious sandboxing.

I agree -- the current WordPress package needs work. Thank you for trying it and looking into it!

Community-wise, one thing we're going to need, as Sandstorm grows, is an ecosystem of app package maintainers. Part of what we're hoping is that more developers of the apps themselves will maintain the Sandstorm ports, like Audrey Tang is maintaining the EtherCalc port.

Tech-wise, one thing we're going to need is a solid story for how Sandstorm packages will easily stay up to date with the latest changes as the upstream author releases new updates.

I work on+for Sandstorm, and I'm also a Debian developer. Debian is not a shining example with regard to either of the above, and I'm sure we can do even better at Sandstorm.

I'm at FOSDEM! I'm on #fosdem and #sandstorm on freenode -- my nick is paulproteus. Also I work on+for Sandstorm.

Hey begriffs!

I'm a volunteer with OpenHatch, which egor83 mentions below -- a non-profit to help people get involved in open source. At our Open Source Comes to Campus events, we aim to find great projects to connect newcomers with. (More info on the event series here -- http://campus.openhatch.org/ )

Your question struck a chord with me, since I think your curriculum and the curriculum we use for our weekend-long events would have some overlap: https://openhatch.org/wiki/Open_Source_Comes_to_Campus/Curri...

But the hard part is helping find great open source projects to contribute to.

To help with that, we wrote a guide for projects: http://opensource-events.com/

and are trying to reach out to project maintainers to help projects become "OpenHatch affiliated"; https://openhatch.org/wiki/OpenHatch_affiliated_projects -- maybe one great next step is to take this list of goals for projects, and work together in reaching out to projects to become OpenHatch Affiliated. Then you can have your students join the collection of people reaching out to those projects.

We find that having a specific person in the project care about the newcomer experience matters more than what we could find algorithmically. We still have the automated tool here: https://openhatch.org/search/ , in case you're interested.

Semi-sorry that this is a long comment, but I wanted to fill you in on a bunch of things, and I'm about to go to bed, so this has a higher chance than usual of being rambly.

OpenHatch-y people who care about outreach like this convene on the "Events" mailing list <http://lists.openhatch.org/mailman/listinfo/events/> and I hope you'll join us there and say hi! And/or reply with your thoughts here.

I'd love to collaborate on this, as it's something that we're always interested in improving for our students, too. I'm based in SF, in case you want to meet up for coffee etc.

P.S. The OpenHatch web app is itself is an open source project, in Django & Javascript, and we are always welcoming contributors. (-: Also, oppia is the project that we're furthest-along with in terms of OpenHatch affiliation.

Oh, also, w/r/t OpenBadges, we haven't gotten around to it, but are vaguely enthusiastic.

A very reasonable thing would be to think about the various ways people are learning open source-related skills, and make a badge site, and then make sure the places where learning happens also participate in badge publication.

If that interests any reader of this comment, we'd love to hear about it! Joinhttp://lists.openhatch.org/devel and say so.

For those interested in the technical details, here are some changes we made to better-handle the traffic spike:

* Remove some of the MySQL-specific query syntax to make faceted search at openhatch.org/search/ work nicely. A goal of the current implementation is that if you search for "C" you won't find "C++". We implement this by a crazy hack of MySQL REGEX queries, which are (iirc) always unindexed, which is bad news under load. We should probably switch this to client-side faceted search, as here in 2014, it's safe to assume people have Javascript.

* Stop using synchronous requests.get() to fill the cache of blog posts that . The problem here is that if the cache is empty, every web worker will try to fill it. This leads to massive queuing of inbound requests, which is always bad news.

- Use CloudFlare in front of us, so at least people get reasonable error messages, and so static resources don't bother our server.

It's still not the speediest site in the world, but it's mostly handling the traffic, from what I can tell.

I filed these as bugs:

* https://openhatch.org/bugs/issue927

* https://openhatch.org/bugs/issue928

If you're interested in helping out, by all means join us. We love new contributors. Over 26 people contributed to the codebase in 2013, and per http://openhatch.readthedocs.org/en/latest/getting_started/i... we've tested the dev environment setup process on Mac, Windows, and Linux, and it should take 10 or fewer minutes.

Blahah, your http://solvers.io initiative seems super cool!

We've found over the years that having one specific task for new contributors to complete makes a huge difference in attracting that next contributor. See http://mairin.wordpress.com/2010/07/23/second-fedora-design-... for a really successful effort along those lines.

If you want to join #openhatch or join http://lists.openhatch.org/mailman/listinfo/events/ and chat with us, we'd be happy to see if there are ways we can both learn from each other!

If Tuffy doesn't look good on OS X or Windows, then we should look into switching to something that is readable and nice to look at. Thanks for saying so!

I filed https://openhatch.org/bugs/issue926 so we don't forget to find out more about it.