HNHacker News
TopNewBestAskShowJobs

snakeanus

524 karma · joined September 21, 2015

submissionscomments
snakeanus··on Uber London loses licence to operate
> app-driven

Does that mean that you can only order for a cab via an app? Or are apps an alternative?

snakeanus··on Wire Server open sourced
I am more interested in actual arguments instead of just names. That being said, since you are so interested in names, here is a list by the FSF that includes whatsapp https://www.gnu.org/proprietary/proprietary-back-doors.en.ht... (I am sure that everyone here has heard of the FSF).

> This is the overwhelming consensus of the cryptography and security community

Yeah, having your client (automatically and without a warning to the user first) let a "trusted" 3rd party make it re-send and re-encrypt a message with another unverified public key is the "overwhelming consensus of the cryptography and security community".

This article did not try to debunk what the original article said at all. Instead its main argument seems to be "Sure, whatsapp resends a message encrypted with a different key when the server demands it without even informing the user but this is not bad (because of "usability concerns") and damn you for even daring to inform the users about it!". Its secondary argument seems to be "b-but users will switch away to less safe applications if you inform them about how much whatsapp sucks - even if you suggest signal afterwards!".

> Here’s a difficult attack that could allow a sophisticated, resourceful adversary willing to invest a good deal of effort, some components of which have never been demonstrated in practice, to read a few messages that had been sent but have not yet been read after events like the intended recipient changing phones or SIM cards

It's not a "difficult attack" if the trusted third party (or anyone who can compromise their servers or force them) can perform it at will.

In any case, even if this backdoor did not exist it would not make whatsapp any better as it still is a proprietary software that might perform shady things in the background (or might be updated at any time to do so).

For anyone else seeing this and wants to read more about the story see https://news.ycombinator.com/item?id=13389935 and https://news.ycombinator.com/item?id=13394900

snakeanus··on Distrustful U.S. allies force spy agency to back down in encryption fight
I don't see why would they bother with them when things like Chacha20 (which is a popular and well audited algorithm) already exist.
snakeanus··on Distrustful U.S. allies force spy agency to back down in encryption fight
DJB actually made a post on twitter about Simon/Speck https://twitter.com/hashbreaker/status/719884030796177409
snakeanus··on How to hack a turned-off computer, or running unsigned code in Intel ME
In that case this is the best moment to link to https://archive.lainchan.jp/sec/res/4386.html#4391
snakeanus··on How to hack a turned-off computer, or running unsigned code in Intel ME
This is truly odd, maybe they recently stopped blocking tor users but for some reason they decided to block vpn/proxy users? I honestly have no idea.
snakeanus··on How to hack a turned-off computer, or running unsigned code in Intel ME
I never had a problem using the wayback machine with js disabled.
snakeanus··on Apple does right by users and advertisers are displeased
For firefox there is dom.battery.enabled and https://developer.mozilla.org/en-US/docs/Web/API/Battery_Sta... but it seems that since 42 it is enabled only for addons. It seems that I was wrong about that indeed.
snakeanus··on Apple does right by users and advertisers are displeased
You can still do things like being able to get the battery status with JS or detect visited links.
snakeanus··on How to hack a turned-off computer, or running unsigned code in Intel ME
With JS disabled as well?

This is quite weird, I was never able to access it with TBB nor with any proxy without the cloudflare captcha page popping in.

snakeanus··on How to hack a turned-off computer, or running unsigned code in Intel ME
I wish that they would just publish that "hack" into the public, that way people would hopefully understand the dangers of "black boxes" and maybe even push intel and AMD to remove ME and PSP from their products.

I wish that open hardware (CPUS specifically) were more popular and closer to the market. RISC-V is still quite a long way off for everyday use (though I did see a risc-v based arduino thing, which is nice)

snakeanus··on How to hack a turned-off computer, or running unsigned code in Intel ME
Please use archive.org instead of archive.is as a mirror next time. Archive.is blocks VPNS and tor while making it impossible to see the target url and use it directly or via another archive. Moreover since it uses cloudflare every connection to it is being MITMed by them.
snakeanus··on How to hack a turned-off computer, or running unsigned code in Intel ME
Considering this, remember to push AMD to allow the disabling the PSP (their version of ME) or share the source of it. Recently they said that they won't do it https://news.ycombinator.com/item?id=14803373.
snakeanus··on Facebook is 'silencing' Rohingya Muslim reports of 'ethnic cleansing'
> A completely open web will be inundated with spam, pornography and propaganda

I doubt that. In fact, from my experience in a "completely open" I would say that this is false.

snakeanus··on Facebook is 'silencing' Rohingya Muslim reports of 'ethnic cleansing'
Which is why federated solutions like GNUSocial, NNTP or email win here as moderation can be applied per-node.
snakeanus··on EFF to Court: The First Amendment Protects the Right to Record First Responders
Moving and finding a job in another country is not something trivial, especially if you get 17k/year.
snakeanus··on EFF to Court: The First Amendment Protects the Right to Record First Responders
> $55k a year

This is actually a LOT. My mother who even has a PHD and works as a teacher only makes 16.8k per year.

snakeanus··on The Lil License
> So if I fix a piece of buggy open-source code and my patch is merged, then I "own" the bug fix and the author no longer owns that portion of the program?

Yes, and it makes sense, after all you made that part of the code. The same holds true for licenses like the GPL.

Remember the shitstorm about MIR and the CLA that it required? People do not want to sign their rights away and allow a company to sell away their code.

snakeanus··on The Lil License
Why not apache2 then?
snakeanus··on W3C abandons consensus, standardizes DRM, EFF resigns
> For a straight-text book, actually, Markdown is excellent. You can include images, or for technical content, tables, easily.

I would probably use org-mode for that.

snakeanus··on Why Keccak is not ARX
> is now an expected feature in all browsers

If you use the tor browser you are actually expected to have it disabled.

snakeanus··on DuckDuckGo vs Google
I would actually switch to ddg if they actually bothered to free more parts of their site and backend. Right now their JS is nonfree for example.
snakeanus··on W3C abandons consensus, standardizes DRM, EFF resigns
> HTML tags (or CSS) are out of reach for the vast majority

CSS sure, but most people can learn the basic html tags in a minute. Same for the basic latex conventions.

snakeanus··on Why Keccak is not ARX
The old site from the keccak team was nice, light, easy to use (you could easily find the paper or post that you wanted) and cute. The new one can't even be accessed with js disabled. Why that huge step backwards?

And referring to DJB just by his twitter handle, seriously?

snakeanus··on W3C abandons consensus, standardizes DRM, EFF resigns
Markdown is a bad joke.
snakeanus··on W3C abandons consensus, standardizes DRM, EFF resigns
> And not postscript. Something you can author by hand.

How about TeX? Many sites already use js libraries that integrate latex.

snakeanus··on Court OKs child porn prosecution of minors distributing pictures of themselves
> What is strange is how today's puritanism is coming from the left rather than the right.

From both actually, take the UK for example, the anime=CP law was made under a right-wing government.

snakeanus··on Court OKs child porn prosecution of minors distributing pictures of themselves
I think that the abortion answer is quite simple: let it be legal as long as the mother agrees to remove her womb afterwards.
snakeanus··on Court OKs child porn prosecution of minors distributing pictures of themselves
> Dictators usually kill illegally

Do they? They are the ones who define the law after all.

snakeanus··on Chromium: FTP resources will be marked “Not Secure”
FTP nowadays is only useful for fetching resources from very old sites. Everyone I know has switched over to sftp and other ssh-based solutions.
← PreviousPage 2 of 12Next →