zmanian

Basically the problem with Safe Harbor is Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333. The cumulative effect is that all people non US persons are legitimate targets of mass surveillance under US law.

The fix for Safe Harbor was negotiated with Department of Commerce who has no authority to talk about reforming this policy.

Options were

1. Immediately end the ability of US based digital companies to do business in Europe

2. Cave completely and have a few months of normalcy before Europe Commission kills the deal.

When the USS Jimmy Carter[1] splices an intercept into an undersea fiber optic cable it probably leaves something similar to this behind of locally filter the data and only uplink relevant data.

Makes you wonder what vendors the Navy uses and if MSFT is using the same.

[1] http://www.nytimes.com/2005/02/20/politics/new-nuclear-sub-i...

Intel has shown a disturbing willingness to add unproven revenue generating functionality to the trusted computed base like require an Intel signature on SGX software or giving Intel DMA access to everything.

There are lots of interesting questions in an effective basic income system.

Sybil and fraud resistance come to mind immediately.

If I were in the top 0.01% of wealth, I'd really like to see research into basic income. It would help with deflationary spirals, social order in an automated future and increase the supply of good ideas because it would free more people to explore high risk areas.

Op seems to misunderstand the following:

1. Your hypervisor is the security boundary. 2. Unikernel design lets you maximize the security benefits of AppSec and LangSec by removing the large OS surface area.

The biggest challenge of micropayments is how to minimize the cognitive load of making many tiny payments.

How should the user agent decide when to alert the user?

There are ways of coping with that like sending volumetric information to the headset rather than individual frames

Here is a good article on the technical details. http://arstechnica.com/tech-policy/2015/11/how-dropbox-found...

Hey Nadim, how would you like the broader applied crypto/tech community to support you?

It is really unacceptable for a company's whose core assets are your work to cause you this much distress.

If I remember that anecdote correctly, Edison was producing very variable results on diluted venous blood not finger prick.

I wonder if Steven Wright has any open source code that we could review.

While it seems plausible that he would obfuscate his styleometry, it would be interesting to do a comparison with early Bitcoin.

The early Bitcoin code is super awkward.

Wonders about the state of Swift on Linux? Was expecting this to be timed with the open source announcement.

Android only on the sense that the ability to provisions two device keys with one account is Android only.

OWS is hiring iOS devs to implement more pieces of this.

Agree, lutz.

But EFF and Freedom of Press also use Paypal and they have a nice interface for monitoring recurring contributions.

They use the funding to pay the developer who develop the Tor software/daemon and the engineering effort there is extraordinary.

Thousands of volunteers provide the network capacity that makes the daemon useful.

Support Tor's first donation campaign.

Become a crowdfunder.

https://blog.torproject.org/blog/our-first-real-donations-ca...

I'm intensely looking forward to Swift for Linux. I'd love to contribute more to open source iOS targeted project but I'm really unwilling to learn languages that I can't use on Linux at all because I don't want to make a Mac my daily driver.

It always seemed like MSFT was about to position M# right into same niche as Rust. Both languages had the mantra of safety and zero cost abstraction.

Tor should be robust against strong adversaries unconstrained by ethics.

Part of the way this strength will be achieved is researchers in public interest settings behaving ethically.

We've always had anonymous money: Cash and money laundering

Regions like Scandanavia are trying to eliminate anonymous money.

If you eliminate anonymous money, it is unclear how freedom of speech, religion, inquiry etc can be preserved.

Anonymous money is always going to be less convenient that paying in the clear. But it should exist.

Good Luck Electric Coiners

I'd like to see more information about transactions. Is it possible to update a several keys atomicly?

I think it is simultaneously amazing and scary that the FDA is starting to approve self replicating organisms in therapies. Bacteriophages are a promising replacement for antibiotics. I wonder if they can follow a similar regulatory path.

The site attacks seems to fail in Tor Browser. It returns a list of sites that have nothing to do with my browser history. Probably because Tor Browser reduces the time precision.[1]

It seems like it would be nice to require some sort of user privilege escalation like accessing location, or webcam to access high precision timing. This would close off a huge class of time related side channels.

[1]https://trac.torproject.org/projects/tor/ticket/1517

It is probably impossible for a lay person to understand how a court is likely to interpret statutory language. I prefer my analysis from folks who devote a substantial amount of time to it.

Marcy compares the CISA liability protections to the very similar Section 314(b) of the Patriot Act financial information sharing liability safe harbor.

It seems at least plausible that they will operate in a similar fashion if CISA becomes law.

https://www.emptywheel.net/2015/10/14/time-to-get-very-conce...

I could bug Marcy for an answer. I will do totally inadequate job of defending her analysis compared to her.

It seems relatively simple to read this passage in the following way:

Let's say a major car company decided to leave open a port with a remote code execution vulnerability on their cars.

Let's say this car company discovered this port was being exploited and informs the NSA of affected vehicles IMEI numbers, IP addresses etc.

Now let's say FTC/NTSB wanted to put together a case for punishing the car manufacturer for their poor security operations.

It seems perfectly reasonable for a lawyer to read the passage from CISA and claim the court couldn't use any disclosure to the government under like the number of affected vehicles(easily calculated from the threat information previously shared) in any determination of liability.

It is uncontroversial to state that corporations and special interest groups frequently lobby in public for a position and in private against a position. Frequently you know this only through un-attributable information passed to you.

Advocacy organizations are not journalists. They don't need to cite their sourcing before making claims they believe are true. The purpose of calling out Facebook is an attempt force them to align their public and private positions if they differ.

As usual, Marcy does excellent analysis about what information NSA will be able to collect, analyze and disseminate under CISA.[1]

[1] https://www.emptywheel.net/2015/10/26/two-intended-consequen...

It seems likely in a post Quantum computing world, we will have signatures and key exchange protocols at least good enough for software signing and secure communications.

But ECC has many ancillary properties for constructing homomorphic and zero knowledge proof based systems that don't have an post Quantum equivalent.

The output is a giant table of A= g^X mod p where given A you can look up x.

How much software has been updated to use stronger DH either ECC or 2048 bit prime field?

Is there an easy way to check if a VPN provider has updated?

The ASICs NSA built for breaking some common 1024 bit fields are probably breaking specific RSA keys now...

Basically is RSA so vulnerable to sidechannels that we can only use it safetly inside HSMs?

I bet this would be much harder to do for ECC.