saljam

the reason i use this (and just a container with -v $HOME:$HOME before) is to get an environment with all the command line tools i'm familiar with from debian, instead of using something like homebrew. in general, i mostly trust these with access to my home directory. a bonus is that i can throw it away and rebuild it easily if i need to.

i'd still use less permissive containers for things i don't feel comfortable installing on the host, e.g. npm.

the arabic writing is also crazy, so i have no idea what author was going for.

have you actually looked at the map?

there a whole inset panel for israel, and not a single mention of palestine.

i used to slip mine in a manilla envelope whenever i needed to take it home from the office and i hadn't brought my backpack with me. our stationary cupboard was well stocked with these!

i'm the author. i keep a close eye on it for any security issues but i'm not adding any new features, hence the lack of commits.

i also obviously maintain the instance on https://webwormhole.io/.

i mainly use apple devices, but never put anything on icloud before adp came out.

yes of course - but in this case the "unexpected" prompt is presented to the attacker, not the user.

> You can mitigate this by including PCRs that sign the kernel and initrd

nope! the trick the article is describing works even if the kernel and initrd is measured. it uses the same kernel, initrd, and command line.

the reason this trick works is that initrds usually fall back to password unlock if the key from the tpm doesn't work. so the hack replaces the encrypted volume, not the kernel, with a compromised one. that is:

1. (temporarily) replace encrypted volume with our own, encrypted with a known password.

2. boot the device.

3. the automated tpm unlock fails, prompting for a password.

4. type in our password. now we're in, using the original kernel and initrd, but it's our special filesystem, not the one we're trying to decrypt.

5. ask the tpm again for the key. since we're still using the original kernel, initrd, and command line, we should now get the key to unlock the original encrypted volume.

the way to fix this is to somehow also measure encrypted volume itself. the article points to suggestions of deriving a value from the encryption key.

some years ago i played around with something similar: https://sa.lj.am/sun/

source is linked at the bottom. much of it was written in elm and i no longer understand how any of it works.

I developed it mainly on Firefox on macOS. I'd love to figure out why it didn't work for you. Do you get anything on about:webrtc while trying to connect?

The command line version shouldn't have any trouble with large files. There's https://github.com/saljam/webwormhole/issues/4 to fix the web version. :)

The QR code is generated client side.

The website uses Google's.

On command line it's an option and Google's is default. I'd like to make the signalling server also a STUN server at some point.

Absolutely true for the web interface if loaded from https://webwormhole.io. I'm open for any more suggestions here! https://github.com/saljam/webwormhole/issues/13

Someone mentioned the command line client. One can also build and serve the html/js/wasm from anywhere and it should still work, even with the same signalling server. It has pretty lax CORS for this reason.

Pion is great. Thanks for making it!

Definitely give a talk if you can. It's all remote currently!

This uses STUN servers to help it poke through NATs. (That's what I mean by "WebRTC's NAT traversal tricks")

There's no TURN server set for this, but it shouldn't be hard to add one. There are NATs where you'd need one to relay all the traffic, but these seem to be relatively rare nowadays. If anyone has any actual statistics on these I'd appreciate it!

Codes are intentionally single use, to limit the bruteforce vector. And only two peers can connect any given time currently. It would be interesting to figure out how to make it work with more than 2 peers!

Thanks! There's already a Go client: https://github.com/saljam/webwormhole

Making usable interfaces that work in a single directions is really hard. Making them work in both is much much harder.

The bugs might be funny, but I have great respect for the programmers trying to make their applications more accessible, be it for right-to-left languages or otherwise.

(I wrote the linked tweets.)

The sheer scale of this is facilitated by technology. We should all be wary of what we build.

That's an appalling thing to say.

Like the US's neverending war on terror, "extremism" here is a handy excuse to commit atrocities. It's no argument to justify this level and scale of human rights abuse.

The Upspin project uses these to make private key recovery easier. I love the idea.

However, the choice of letters only seems unambiguous to western speakers. In Arabic, for example, P and B sound the same, and so do V and F for most native speakers.

There's Mailpile: https://www.mailpile.is/

This was part of The Baby, AKA the Manchester Small-Scale Experimental Machine at the University of Manchester in the late 40s. Modern replicas and simulators can be found at the university and Manchester's Museum of Science and Industry. It was built by Williams, Kilburn, and Tootill. Alan Turing wrote some programs for this machine.

One nicest things about this is that your memory is visible. You can just see which bits are on and which bits are off by looking at the screen. No debugger needed!

One of the least nice things was that these tubes had a reputation of being horribly unreliable.

I'll add to what others mentioned the fact the proper text selection for bidirectional text is awkward at best, and often outright impossible with buggy UIs. Particularly at the border of where the text changes direction.

> but doing it in London and in such a high-profile way didn't really seem like their modus operandi

They carried out the Dubai murders in a high-profile hotel also covered with CCTV, with fake British, German, and Australian passports. I wouldn't put this past their "modus operandi".

it's not unusual for people to occasionally return to their country of origin to engage in politics. quite often the reason they're abroad is the security risk involved in being in opposition to the political status quo.

I find it surreal how this article is reporting about a business based in an Israeli settlement in the Palestinian West Bank as if that's completely normal and isn't part of a horrible colonial occupation by any international standard.

Does this have notation for quarter tones? I can't find that on their website.

That's always been a pain point for me. No quarter tone notation rules out a lot, including most of Arabic and Turkish, and much of Greek maqam music.