chflags

Assuming they chose a sensible cipher suite, where is the "crypto flaw"?

Maybe the problem is not the crypto but the strange system devised for authentication of an endpoint.

I call this x509. In my opinion this bizarre^1 "trust model" dating back to a long past era in computing is one of the reasons why MITM on SSL/TLS^2 in today's world of computing is so easy. The other reason is the trust placed in domainnames over IP numbers. Both are systems that delegate "authority" to third parties.

1. https://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt

2. Or perhaps an attack like the one here.

OpenSSH can use x509 for authentication but by default it does not. It uses host keys. Maybe it's not even a "default" but it is the traditional usage.

CurveCP also uses keys instead of certifcates.

The big difference in my view is that x509 relies on the idea of a "certificate authority" or "CA" that "issues" certificates for users.

Host keys require no such authority -- users generate their own.

With x509, there is a reliance on third parties that somehow are deemed "trusted". Host keys require no third parties and therefore no added layers of trust.

Certificates are a business^3. Host keys, to my knowledge, are not.

3. This is starting to change so that certificates can be "free" like host keys. I'd argue it is still a business however, due to the third party involvement in the process.

The widespread use of "self-signed certificates" seems to be an illustration of the desire by users to use certificates like host keys -- i.e., without needing a third party "authority" to "issue" them.

Certainly some of the encryption one can get via SSL/TLS is worth something. (But then one could use that encryption outside of TLS, too.)

And maybe some elements of the protocol are worth something.

But on the open internet is the "trust model" really worth anything?

It is so ridiculously easy to subvert. Cloudflare does it on a mass scale.

But one does not need to be Cloudflare to do it. The "incovenience" of subverting SSL/TLS is minimal.

Any website who is delegating their DNS to some third party is potentially vulnerable not to mention any user who is delegating their DNS lookups to a third party. Those are very large numbers.

Note I said open internet. I am not referring to internal networks.

Also - Question for the author: Was the archiving of dnshistory.org successful? Did they recently shut down and use Cloudflare to block ArchiveTeam?

Godspeed.

Out of curiousity I'm starting a counter today. Will post something when this IP addr fails. Feel free to take a guess how long it will be used by DDG.

And when it does change, if ever, I have a one line shell script that uses ed to remove entries from files, so all it takes to add a new IP addr to HOSTS is typing

    ed-script-name domain-name /etc/hosts
    echo aa.bb.cc.dd domain-name >> /etc/hosts

For example, the IP address for HN rarely changes.

But feel free to keep looking it up in DNS every day. Just in case.

If there are problems with DNS, most users will probably not remember the IP address for HN and will not be able to read the stories.

Meanwhile, the user that stores IP addresses as a backup will have no such problems.

It appears they are using AWS. Who really owns the server?

   echo 50.18.192.251 duckduckgo.com >> /etc/hosts

I guess that's one way to coerce the user into enabling Javascript, at least temporarily.

Is he saying the end results of the project to [insert stated project purpose here], e.g., "to automate everything", "to organize the world's information", etc., did not have enough economic value to sustain the project... and hence founders were "forced" to collect data as a means to generate value?

Here's another version: pre-Google search engines realized they could sell ad space, i.e., paid placements, e.g., to auto manufacturers.

Once the advertising industry became involved, then collecting data about the network's users, if one could do it, was a no-brainer.

"... really it's just the regular old world from before, with a bunch of microphones and keyboards and flat screens sticking out of it."

Not sure that young people who worship Silicon Valley want to believe this, and why should they?

The author always makes a good case for the potential long term consequences of the so-called "changes to the world" that many programmers are adamantly pursuing.

Maybe these programmers are not changing the world. Maybe they're just doing what others already did in the past, on a smaller scale, without the benefit of cheap electronics.

Then you have Zuckerberg who puts some blurb in Facebook's first SEC filings that his website^W company will follow the "hacker" ethos. What was he doing there, using that term? He sure has a lot of corporate sponsorship for a "hacker".

Imagine Stallman and Zuckerberg in a certain American game show that ran for several decades. Hint: The game's title relates to honesty.

"Will the real 'hacker' please stand up?"

No. The opposite. I'm trying to draw attention to the fact that besides free open source software, improvements in the network allow companies like Facebook to grow as big as they are.

Before clang, FreeBSD used gcc. I'm actually not a GNU/Linux user; I wish BSD did not have to use gcc, but for as long as I've been a user, release engineering has always used gcc. I would personally prefer to use something like pcc as opposed to clang.

Today, lots of companies use GNU software, when they could just as easily use BSD. And many BSD users still need gcc to compile their OS. Not how I expected things to turn out but attacking Stallman makes little sense at this point.

Instead, maybe we should be thanking him.

Companies like Facebook offer very little while taking all our personal information for their commercial use, while open source projects like BSD and GNU continue to offer a great deal, without requiring so much as an account or password, much less tracking our every move.

At the risk of being wrong, I'd even go so far as to say they need this software.

But does Stallman ever need to use software written by Zuckerberg or Facebook employees?

Personalities and errors in judgment aside, give respect and credit where it is due.

I have never needed Facebook's software. And I doubt I ever will.

From a purely utilitarian viewpoint, my gratitude goes to Stallman and the people who brought us the internet. I'm not sure what I could thank Facebook for.

If Zuckerberg had failed to be in the right place at the right time, there would always be a substitute.

But if there was no Stallman back in the 70's and 80's, would we still have gcc, gdb and so much free, open source software?

That's "name-calling".

But I understand the need to detach the silly hyperbolic responses my comment triggered. I was not expecting those.

Please accept my apologies for any incomvenience I may have caused.

Microsoft/Windows is a cancer. Ballmer once said Linux was a cancer. He later retracted, after it was well-known Microsoft itself uses Linux.

There's nothing more pathetic than when you see Microsoft's businesspeople or lawyers at conferences all faithfully using Windows, as if there was no other choice, and rambling on about how their products can solve any problem. These are not stupid people, but they are blinded to independent reasoning about computer software.

And then there are the people at Microsoft Research. What a waste (not for them -- they probably get paid handsomely). It is like MS is keeping these minds locked away, so the zombie-like adherence to Windows can persist. Keep the monopoly going.

Microsoft is a cancer on the brain. It creates a zombie-like, tunnel vision of computing. Everything must pass through Redmond.

Microsoft continues to remain dangerous to the future of computing, because they continue to work dilgently to effectively quell all independent thought from being implemented and made accessible to users.

Intent, malice, etc. is irrelevant. Regardless of why they do it, the end result is suppression of non-Microsoft software.

And now hardware.

But over time how much has Google itself influenced the product of its own "Pagerank" algorithm?

If Google places a website as a first search result for some frequently searched term(s), even if by accident, then that website is going to become very popular, very quickly.

Opinion: Google determines the popularity of a website.

In the early days we believed they were presenting results based on the relative popularity of websites. At some stage Google itself became the determinant for the popularity of websites.

Stories like this one support this idea.

One could argue Google is running what amounts to an online version of the Yellow Pages where the ads can be changed or rearranged hourly, daily, weekly, etc. Instead of calling a telephone number to place an ad in the Yellow Pages, one has to enter an opaque Adwords auction for words instead of ads.

But for the small business, especially those who do not bid on words, it gets worse. A business listing in the search results will likely never been seen if it is not in the top 10, i.e., on page 1.

Imagine if this were true for the Yellow Pages, which is organized alphabetically. Businesses with names beginning with numbers or the letter "A" would receive a grossly disproportionate share of calls, because no one would ever get past the first page of listings.

As crazy as it sounds, I think there's an argument Google and not the user is effectively doing the choosing. Whether it's intentional or not is irrelevant. The way the system is implemented and used, this is the effect. And this only benefits Google.

As a result of advances in technology, news, scholarly research, books, music, film, etc. can all be created and distributed by _anyone_, because it can be done at lower cost. This is bad news for some old school money-making schemes, but good news for consumers.

Perhaps consumers on the web are getting accustomed to "free" without any focus on quality. The classic arguments that lower cost means lower quality may be weakening.

Poor analogy: The computers we use today are less expensive than the ones we used in the 1980's. But who argues that they are lower quality? (I am not suggesting whether they are or not, just pointing out the arguments that people make.)

But honestly, as you have highlighted, these announcements should be insulting to users' intelligence.

"Dear Users: Please allow us to store copies of all your sensitive data, including every email ever sent or received, in perpetuity. In return, to the extent the law permits us to do so, we'll let you know (_ex post facto_) when some other third party is having a look at it."

The solution to the problem if indeed there is a problem here is not going to come from Google.

The problem _is_ Google.

The only parties who need a copy of an email are the sender and the recipient. If you really care about privacy, security, whatever, then "store and forward" and "POP" via some third party (Google, etc.) is not the proper way to implement email.

Hypothesis: Google does not charge for Gmail because, quite simply, no one would pay.

If www search engines and "journalists" are being paid primarily by advertisers, and not readers, then we have the best system for "news" that has ever been created. And we can be proud of their achievement, and how they are using the latest communications technology and the public resource of internet bandwidth for its highest and best purpose. Everyone in the ad sales industry should pat each other on the back. You have provided readers with so much greatness. You have earned your success.

As readers, we should be thankful for these heros for making the internet and mobile carrier networks work so smoothly and keeping us so well informed, at such low cost to readers. Everbody wins. Brilliant.

Not just cool, but useful. "UEFI" should have been a Forth-like REPL like Sun, FreeBSD, OLPC, etc.

The output of rappel reminds me of an "assembly level debugger" I used for many years called "ald". Maybe I am just stupid, but when I'm writing assembly I like to verify the contents of registers as a program executes.

From user.h: "Fuck computers, multiarch is bullshit."

Agreed.

I need something that compiles easily on NetFreeOpenBSD x86. Mo multiarch bullshit. Meanwhile I will stick with as, objcopy and ald.

Keep in mind that in the 1990's it was rare for Windows uptime to exceed 24hrs and Microsoft demos of new features barely worked if at all. Not to mention that "security" was not yet on the PR agenda.

Gates' home, replete with low quality software a la Microsoft, sounded silly if not scary back then. But what do I know? Maybe it was all very stable and reliable.

On the other hand, placing evergreen confidence in "TLS", believing that it is "good enough" or concluding "it's all we've got" are lines of thinking that not make sense to me. The vulnerabilities just keep coming, one after another.

High speed crypto not part of TLS that, as another commenter put it, is "considered safe". Does it exist?

Useful software that is written from the start with such care that it does not need to be continously patched ad inifitum. Nonexistant? (No need to answer. I know the truth.)

Getting something added to TLS seems difficult enough, but getting something removed seems impossible. Like all bad software, TLS has numerous "features" I do not need and will never use. OpenSSL is like a museum of cryptography, preserving the obsolete for posterity.

Long live TLS. May it forever waste my time and energy.

Is there an assumption hidden in this statement? That the cost of map data _must_ be sending personal information to Google? Why can't the cost be a dollar value? What if it was? How much do you estimate it would be? Would you pay it?

Could there be a company that could create maps and directions of the same or better quality than the enormous, well-known one you mentioned? And could that company charge actual currency for licensing the data? In fact I believe there was such a company, until Google acquired them and their work became "Maps".

I also remember in the earlier days of the www getting directions without sending personal information to Google, via sites like MapQuest. I also remember map software that did not require internet connectivity.

"As much as [what Google chooses to do] is infuriating, I'm not likely to give up my pocket computer..."

Is there another hidden assumption in this statement? That it would be _impossible_ to build a pocket computer that can serve maps and directions from a local data store, without an internet connection?

"...but it is what it is right now."

Right now, and forever more. Because there is only one "proper" way to do things, and that's how they're being done now. Those are safe assumptions, yes?

Are remote "software updates" to a buyer's phone, under the sole control of the seller of the phone, at any time (even after purchase), for any reason (e.g. the one being proposed here), a good idea?

Why? Why not?

Should Apple customers be given the option to flash the hardware they purchase from Apple with their own choice of software, whereby they might better control the HW and hence secure it from Apple and other third parties?

Or should Apple have the _exclusive_ right to flash the HW they sell, even _after_ purchase, without the customer's consent? As they do now.

Open hardware. Bad? Good? Necessary?

Making one DNS request is faster than making several, including ones for domains related to advertising.

There are the speed gains that Google can offer and then there are ones that are under the user's control, which Google will never offer, unless they change their business model.

Not requesting ads makes my user experience faster.

Experiment: Disable Javascript for Google searches and what happens? Do the ads still load?

In my observation, this has certainly been the trend.

In my experience, in this climate you have to look harder to find it user-focused software, and to some extent you have to write some of it yourself.

This is because the software world has been flooded with "easy to use" programs that are either located on third party computers or must automatically connect to third party computers in order to be useful.

To be truthful, I'm not sure that many users of today, i.e., younger ones, really understand what we mean by user-centric and user-focused. They may think if something is made "easy" for them, then it's user-focused.

But where computer software is involved, we've seen it is precisely the opposite. If users want more control then they have to endure a little inconvenience, at least in the short term.

The easier and more "frictionless" the software, the more the user should understand that the software has not been written so much for their benefit as for someone else's.

There are some who believe that distribution channels are actually more valuable than any content that passes through them. That is, content distribution is potentially a higher value business than content creation.

Assuming the Internet as a distribution channel, who owns or controls access to it? Rhetorical question.

One view is that the price of internet access is the price of "content".

If the internet was meant to be a medium for paid content, then why has so much content been shared through it "for free" beginning in the late 80's/early 90's and continuing even today?

I certainly do not know. What I remember is that only a minority of the population were avid www users when the public www first appeared in 1993.

So, in 1993, why upload "free content" that would otherwise be under paid subscription?

For the novelty of it?

To jumpstart the www?

To entice people to use the www?

Regardless of the reason, the end result is that the genie is out of the bottle.

The sharing of content "for free" started early on and continued unabated, even as www usage grew.

Today, if an internet subscriber seeks "content" she will find it, in large quantities, without ever paying anyone, except her access provider.

Greeting users with a deluge of advertising is not going to change the facts: users are continually presented with free content that they once would have had to pay for. The deluge of ads is not a "cost" of the content. It's just a new source of revenue for those who want to play www middleman (who should be very thankful for all the money they have made without ever having had to create any real content). At the same time, as a result the signal to noise ratio has become a serious problem for many www users.

(Users are also presented with enormous amounts of fake, garbage "content". That only highlights how open and inexpensive content distribution has become.)

It is undeniable that users can block the ads and other garbage and keep the content. The content is not going away. And the www will still keep growing.

With the barriers to distribution so low, it is no surprise that users should have to filter out some garbage.

The only surprise is how long it's taken them to start doing it.

What's nice is that filtering can be automated, in the same way the generation of ads and fake content have been automated.

There was time in the history of email before the ubiquitous use of spam filters. And there is a time in the history of the www before the ubiquitous use of ad blockers. That time is coming to a close.

This is complete nonsense. If we remove the advertising, those companies might lose money, but the functions we as users perform over the www would most certainly continue.

More importantly, there might be some decentralization and movement toward an "edge-focused" medium more resembling the Internet's end-to-end roots. This would make the internetwork much more useful than the one dominated by middlemen monopolies like the one we have now.

The money to pay for ads does not come from selling ads. Ask yourself where it comes from. Those are the businesses that must endure.