squidlogic

Wow, I knew Cisco helped with the GFW, but didn't know they made a module specifically designed to find and capture Falun Gong participants[0].

Thats ... pretty messed up.

[0]https://www.eff.org/files/2016/01/12/113_second_amended_comp...

Does anyone know if WhatsApp still stores your master key? I assume you can still reset your password.

If so, kind of makes you wonder what you really buy by adding the axolotl protocol. Thoughts?

Try Balboa. End to end encrypted. Has video calls too. Also has faster file transfer speed.

Targeted towards international NGOs operating in rough areas, but works for other business too.

Not free though. Seems security comes at a premium.

I thought they already did this, but I have no proof. It seems reasonable because Google got evicted from China for not playing ball, so I find it hard to believe that Apple would get a free pass.

The creator of ZeroTier, a super easy way to set up virtual networks. Connects all your devices and encrypts the traffic by default. Pretty slick stuff. We use it in our backend to keep our microservices topology simple.

Probably not to TLS, but TLS is typically solving a different problem than the one people are trying to solve using JS crypto.

One valid use, I think, could be around ensuring you don't pollute your backend with user data to avoid liability.

For example, if you wanted to use a distributed database in your backend and needed guarantees that when you delete data it is deleted everywhere at once, you could use JS crypto to do client-side encryption of the data and only have to delete the key to render the distributed data inert.

I heard about this through an article that was on HN a few weeks back (https://blog.balboa.io/yet-another.html)

Going to miss these guys. They wrote some beautiful clojure.

Interesting thought, "rolling your own crypto" seems to be something of an accordion term. I took it to mean creating your own crypto primitives, but I guess there are plenty of opportunities to mess up security while writing code.

I thought this article was interesting because the author talked about how encryption can be used to "delete" data from distributed systems instantly, by just removing the key.

Not really a new idea, I don't think, but not one that gets surfaced much when people talk about client-side crypto.

As a user you probably don't need more push notifications in your life. As a developer, my app benefits from higher user interaction if I have push notifications.

In my opinion, the onus is on the user to be responsible with their time, guarding their attention from competing interests. But we as developers can probably help out as well. One way might be giving people easy ways to opt out of notifications (or opt out by default).

That's a good way of putting it, I think. Revenue is obviously very important, but there are other values that an enterprise may be concerned with as well.

As someone who is bootstrapping without a lot of personal capital to fuel operations, I have a hard time relating to this post.

I almost want to invent another category for bootstrapped startups that have access to large amounts of personal liquid assets.

Just think of the difference in strategic moves available to you if you have $1MM vs $10k to throw at a problem.

Having said that, I applaud his efforts to try things differently, and even agree with a lot of what is in there.

You are also correct. There is a beautiful simplicity to business interactions when you tell them up front: hey, I'm only going to tell you the truth, I'm not going to buy you gifts and alcohol and prostitutes. I'm just going to try to find the best outcome for all of us.

So much easier.

Yet so much harder.

But that's China ;)

Everyone is brought up under a certain value system. I don't think the traditional label of 'religious' is very informative. Which religion? Which sect of that religion? For that matter, which non-religious value system?

The study makes a distinction between the 'big three' of Christianity, Islam, and Judaism, but anyone with even a cursory knowledge on the matter knows that there are sects and divisions within those overarching categories that are worlds apart.

I think what this study shows is that religious belief isn't necessary for moral behavior. But that's a question of epistemology, not a question of ontology. Said another way, people can be awesome people, but still lack a 'grounding in being' for their values.

Everything you say resonates with my experience too. And not to contradict myself but on the plus side for business in China, I found the expat entrepreneurs there to be pretty close-knit and more than happy to collaborate and help you out. That made things a lot easier and was probably the saving grace for many of my peers.

Having said that, after navigating those waters for awhile, I enjoy dealing with a clear legal framework, laws that are more often than not applied uniformly, and a government that doesn't stifle the free exchange of ideas on the internet to such a point that you need a pretty beefy VPN solution just to do a Google search.

Just my opinion though, good to hear you have been successful in your work - good luck and keep on trucking!

Agreed. The difference is that with ransomware the act has already been done. You can think of it as negotiating with kidnappers vs. paying off the mob to not rough up your shop.

Doing business in China is definitely doing it in 'hard mode' from my experience. If you can become successful there, where contracts mean nothing and guanxi with people in power is everything, you will probably plow right through anything you find in the states.

Social connection has such a big impact on physical health (isolation is more deadly than obesity).[0]

In my experience it is becoming harder and harder to form relationships, and one of the factors seems to be our housing choices[1].

[0]http://journals.plos.org/plosmedicine/article?id=10.1371/jou...

[1]http://www.vox.com/2015/10/28/9622920/housing-adult-friendsh...

Good point, you're right that gaining root/admin isn't the only way to ruin someone's day.

Keeping everyone on mission is incredibly valuable, but there is a finite amount of work you can and should extract from your employees.

Employers have a disproportionate amount of influence over the lives of the people under their employ. This should carry with it a sense of duty, or responsibility, to the well-being of their fellow human.

Skype is not blocked in China. That alone should tell you a lot.

Unlike a lot of other malware out there, crypto lockers don't require privlidge escalation to be effective.

Got to hand it to them, its actually a pretty cool attack vector.

I think of it like this: usability can be a security feature.

If you build a "perfectly secure" piece of software, but it takes a very high level of skill to use it, your users will use something else that is easier to use, but less secure. And then how has your ideologically perfect piece of software helped improve their security?

If you make tradeoffs for usability, you will raise the bar because people will actually use what you make.

Regarding cryptolockers, if you have a backup drive on a SAN ... beware. Crypto ransomware will scan for any attached drives and encrypt those files as well.

To make matters worse, your DropBox syncing software will automatically cryptolocker your files stored in the cloud.

>Lesson learned - Be very circumspect when turning your back on 40 years of computer science.

So true. We moved away from Mongo for very similar reasons, but we moved to Cassandra instead of Postgres only with great trepidation (we were worried about scalability issues).

Only time will tell if this was a good move or if we should have just done as you did. Good luck out there!

Here's the study cited by the article: http://www.mckinsey.com/insights/business_technology/four_fu...

The takeaway: "All this points to new top-management imperatives: keep an eye on the speed and direction of automation, for starters, and then determine where, when, and how much to invest in automation."

Thanks, good thoughts!

> You want to start with something very simple—as little surface area as possible—and launch it sooner than you’d think

Honest question: does this model apply when your product can't at any point be, for lack of a better word, half-baked?

Say you're making a security product or working on control code for rocket thrusters.

We use ZeroTier to encrypt our AWS microservices traffic. Way easier to setup and just ... works.

For less important things, I agree, run of the mill TLS is enough. But for things that are critical to the business, trade secrets, strategy, SWOT analysis of a recent breach, etc, I think every company should have an e2ee chat/file sharing app in their toolkit.