sarahj

Grab the source, compile it and get it running...after that...whatever you find interesting. Some ideas:

* Trace the execution of one of the user land programs (e.g. ls) to see how it uses the syscalls.

* Add a new syscall - there are a few open-courseware labs online which have this as in introductory exercise (e.g http://moss.cs.iit.edu/cs450/assign01-xv6-syscall.html)

* In a similar vein - find some other labs for other courses using this - and follow them.

* Read through the companion book (can be compiled from the source or downloaded pre-compiled) and follow it through the source code.

xv6 is an amazing teaching OS - it is very simple to dive into and play around with. A while ago I wanted to explore some filesystem/permissions stuff and use xv6 to play with some concepts (see http://sarahjamielewis.com/posts/file-system-permissions-and... - still lots I want to play around with there when I find some time) - If you are at all interested in OS dev it is a great gateway.

One of the reasons for the relative expense is the heavily-subsidised corn (and a few other) industries which pretty much all goes to animal feed.

That being said, my food costs were easily cut in half when I went vegan (and now, they are about 1/4 after some fine tuning of some other recipes) - I mostly get protein from chickpeas, kidney beans and lentils - which are all super-cheap compared to meat. I also eat a fair bit of tofu (which is very low in fibre and which is also very cheap compared to meat). Tempeh is another option, but I don't tend to make it often. We generally cook a big batch of food at the beginning of the week - which means time to prepare is amortized nicely (and frying tofu is very quick also)

I will admit that processed vegan meat-alternatives do tend to be more expensive than their animal derived counterparts, and not the healthiest - so I tend to avoid them - most of the expense is due to small production runs and limited quantity - and the extra processing.

> Maybe you can explain to me then how it is that this makes a significant difference in global warming. The carbon that is released by cows and humans after consumption of plant matter was derived from said plant matter. The carbon in those plants came from the air. Hence, this is a closed system where carbon is taken from the air by the plants, consumed by the animals, and then put back into the air by the animals. There cannot be a net gain of carbon from this.

Instead of the energy taken to grow those plants going to feed people - they are used to grow animals. This takes an enormous amount of input energy from farming the plants, to transporting them to the animals. Not forgetting water transport also. Then there is the energy that is taken to manage the huge sums of waste that these animals produce (most of which is stored in huge silos or pits, which ends up leaching into ground water - but that's another thing). Then there is the energy to transport, kill, transport, package, transport and eventually sell - so the energy / calorie of animal food is no where near efficient as it is for plants and beans. Basically, it is not a closed system - we input so much energy into sustaining our meat habit (as well as the ethical implications of killing 100,000,000-500,000,000 sentient animals a day - including fish and the resulting bycatch)

I think we agree when it comes to the impact of a solution - there needs to be a HUGE concerted effort to even make a dent - people can't immediately change the nature of the worlds largest companies - but I believe that our only hope is to promote local change (to get people to commit to a lifestyle change that has to happen one way or another) - and push for governmental reform - will it be perfect? no. Will it be easy? nope. But we have to start somewhere - and I think diet and local economies might be a good first step.

One of the (many) reasons I went vegan was to cut my impact on the environment. I don't own or use cars. Where I can I walk, where I can't I take public transit. I've made considerable changes to what and how I buy, to source food with less of a total impact. I've started to look at alternative clothing and technology strategies to reduce my environmental impact there too.

I know there are plenty of geeks who have done similar things. The truth is that a new tech or more companies aren't going to solve this problem - the problem is we (who live in large economies) now live in a world which is completely separated from the daily realities of where our stuff comes from. We have spent the last 50 years enabling large mono-cultures and promoting specialization - which has done amazing things for food availability - at the expense that now a single plate of food easily contains ingredients from every continent - at a huge environmental impact. Similar trends have happened in manufacturing, textiles and practically every other industry.

Trends in tech that might help us:

* Hyper-local agriculture

* Locally-efficient down-cycling / recycling programs - for clothes, tech...pretty much everything.

* Teaching people how to buy and cook produce.

But the truth is that every individual needs to make a transition in how they live - that means eating less (hopefully no) meat and animal products, repairing instead of buying new, developing ethical supply chains (starting by knowing the supply chain is a good start!)

And yes, companies need to change and adapt too...that means more environmental regulation, more incentives to develop and adopt renewable sources of energy - how we structure those is completely beyond my expertise though...and I don't have much hope there.

No it isn't accurate for hidden services. See https://www.torproject.org/docs/hidden-services.html.en - hidden service communication some some level of encryption end to end (whether that is sufficient or requiring another layer - say TLS - is a matter of usecase and threat model).

Pinning necessarily has to restrict the times a certificate can be changed because otherwise we have to solve a different problem "How can I tell this new certificate is a good certificate".

You have proposed a solution to that second problem, let's look at the threat model:

You adversary is:

* Capable of forcing or otherwise being able to create valid certificates.

* Has the capability to MITM nodes in a network.

The solution you have provided adds an additional hurdle for the adversary:

* must also be able to subvert your CA (or more generally, a specific CA - it doesn't actually matter if you or someone else controls it - what matters is it is a specific root certificate).

So the browser, now TOFU'ing the initial certificate makes a note of the current certificate (and pins it) as well as the secondary signing CA (and also pins that).

When you want to rotate certificates you have your new cert signed by the two CA's, one of which has to be the pinned CA.

I actually think this is a fairly elegant solution (for the operator), although it does come with some fairly large assumptions:

* If your adversary is large enough to be able to corrupt multiple CA's (say a federal government) - then they are powerful enough to corrupt all your CA's (even you - although, to be fair, if the can force you to do anything then the MITM capability is less interesting). So while this scheme benefits the operator, it provides negligible benefit to the client.

* You are reliant on the secondary CA to remain static (or having a backup CA) - this is the same problem as the original simply shifting the capability up one level - maybe this is OK.

Overall, this approach does provide more flexibility to the operator of the site - but provides no to negligible additional security on the client side (it upgrades the capability from being able to mimic any CA to being ale to mimic a specific CA), and may even put clients at greater risk - since there is now an additional avenue of certificate rotation which means extra code, extra verification to mess up etc.

These were a few thought that jumped into my brain - I would like to see a more detailed threat model / paper exploring some new schemes as I think there are wins in this space that haven't been realized yet - and there maybe improvements / clarifications which can improve this model further.

A few ideas from a quick brainstorm, none of them are perfect, but neither is the centralized server solution:

1. Bookmarklet - In a similar vein to the way some password managers work you could construct a bookmarklet that the user can click on to make a site do the right thing - there are some security configurations depending on your threat model - however this does require user interaction.

2. Browser plugin - like #1 but obviously with the pain of writing and maintaining a browser plugin.

3. Bake the site determination into the flow - so instead of a 1-click retweet it becomes a 2-click retweet with the second step requiring the user to provide the site where they want to retweet - again some security implications and breaks the regular flow (although you could get around this by doing it once and storing the value in a cookie)

4. Have a local app listening on a specified port (so retweets get POSTed to 127.0.0.1:7000 for example) and then from there onwards - requires extra setup, makes the system less portable (can't just throw it on a hosted server). Like #2 but more annoying.

Some of the technical points of this article are simply wrong...

> The exit node IP address of the user was easily obtained using the two different methods discussed briefly above.

This is really not a vulnerability but simply how tor, and the internet at large, works - hidden services by design protect the service not the user (the user is protected by tor by default) - what the author actually did here was "leak" their non-hidden services IP.

> and true external IP address (see partial data example to the above). And to answer the second question, “no”, this did not involve the placement of malicious malware. Read on…

The author then goes on to state that they gave the users malicious malware to run which revealed their ip address. They justify that this was not malware by stating:

> It should be noted that this was not malware per se. It did not replicate and was run voluntarily by the user. The user was notified that a “security scan” was going to be run on their machine and they freely chose to run the scan.

The author then goes on to publish a list of tor exit nodes with tor user agents...which they could have gotten directly from the tor directory services...

And, as pointed out by others, the author never really goes on to state why they think Tor is the devil - they built a honeypot and were disgusted by the flies it attracted....I'm not really sure what they were expecting...

For private browsing check out Tor: https://www.torproject.org/

If you want to dive deeper then there is Tails: https://tails.boum.org/ - an OS which is designed with privacy in mind.

https://prism-break.org/en/ has a lots of links to various tools be they operating systems, messengers, browsers etc.

None of these tools are a silver bullet - most require some level of effort or perseverance to use and none of them will protect you against every attack imaginable. However, they will make it more expensive for an adversary to target you.

For the record, I am logged in over Tor - so if there is a block it appears to be inconsistent.

I remember reading about Bitcoin a couple of years ago and expressing disbelief that many of the major advantages being heralded were little more than fantasy, these were:

* Micro-transactions.

* Replacing practically everything related to money in developing countries.

From this thread it is clear that many of those dreams are still very much dreams - the ever growing energy and resource requirements to participate significantly in the network is staggering, the amount of storage required for the blockchain is a burden to even tech-aware users (unless of course one would want to trust a third party...), and now it would seem that there are minimum bandwidth requirements which sit outside what is possible in even modest parts of the USA - impossible to achieve in places where the main link to the internet is a satellite.

If I was feeling particularly optimistic I would say that Bitcoin has been shown to be unscalable in it's current form. Further, the network itself tends towards centralization because of the ever growing storage, processing and bandwidth requirements.

I look forward to seeing where the future of crypocurrencies leads us- there is so much promise.

They gave permission to Google to store, parse, tag and understand 16 years worth of family photos of themselves and others so that Google can more accurately present them (and by extension the other people in their photos) with adverts that they believe will result in a higher conversions for their customers - the advertisers.

> Should I be worried?

That really depends if you think the benefits of giving Google such information outweigh the negatives. I personally think that they do not (but then again, I'm not much of a photo person).

> Should my family and friends [be worried]?

We still live in a world where it is socially acceptable for people to take, upload and publish pictures to a variety of 3rd parties without the consent of the subject - even in what would typically be classified as "private" events. I've seen some movement in the direction of explicit consent or "you can take the picture but don't upload that to X" but the truth is that most people don't think too far ahead and frankly probably don't care - should they be worried? Again, that really depends on what they think of Google.

This is great news. With the fall of advertising publishers will have to find new ways of paying for content production and selling produced content - there are a few options in this area - subscriptions are one, micropayments are another, crowdsourcing payment upfront like kickstarter/indiegogo is another - and all of those have a complex ecosystem of models to try.

The reliance on advertising revenue has resulted in a race to the bottom in many areas - it is no longer about the content but about the views to that content (see: the influx of # ways to <something> <something>)

If this report is accurate consumers don't want advertisements which is probably an uncontroversial statement to make - it may take a while for consumers to get used to paying for content but I think as more effort is spent in the space and the friction barrier lessened I would hope to see more sites adopting a paid format (for those who require adverts to operate - there are plenty of sites out there which don't require ad money which are doing just fine - or are run with no expectation of profit).

Reading over some of the specifications - I really like this approach - I think this is probably the closest I have seen to a truly distributed approach to IM at the protocol layer.

If anyone would like to try the chat interface my address is ricochet:qn6uo4cmsrfv4kzq

> Sound and rational means peer reviewed paper

"My doctor has told me I should not take in as much potassium as I have been so I am reducing my consumption of legumes" and "I have an ethical objection to killing sentient creatures so I restrict my diet in ways that minimize such killing"

Are both sound, rational judgements which do not require a peer reviewed paper.

>You(sic) vegan foodstuff also require the killing of sentient creatures - to grow food we have displaced a lot of animals from their habitats. Sometimes quite forcefully. So yeah - you probably have fewer animals on your conscience , but you have some.

I agree with you, completely - it is an uphill battle. It is very difficult to not directly compensate the killing of creatures in a world that considers it moral to kill 50+ billion animals every year (not including marine life) - but my ethics require that I at least try.

I will agree that there is much ignorance in the world surrounding what we eat and in science in general - however, as I said, when I talk to people who have dietary restrictions they tend to have a sound, rational basis for them.

> That will push you only to vegetarian. To go vegan you need more reasons.

There are no animal products which do not involve the killing of sentient creatures (if you doubt this I would suggest learning about the process by which milk or eggs are farmed).

> It seems like every single young woman has bizarre food taboos that are based on no rational basis.

I'll ignore the blatant sexism.

As a young woman, although admittedly not single, who happens to be vegan I really don't understand the point you are trying to make here.

I am vegan because I would rather not have had a sentient animal purposely killed for my meal - and it is a decision I came to after years of thought and consideration.

And yes, there is a growing trend of people caring what they put in their bodies - whether it is noticing that caffeine after 2pm disturbs their sleep, or that as they age they need to consider an increase in b12 or vitamin D - the majority of these choices are very rational ones - I have yet to meet a person whose diet choices fall out of the range of rationality - except, perhaps, the excuses people give me for not cutting down the amount of <insert foot they acknowledge they eat too much of> in their diet.

The message here is avoid low-level crypto - if you find yourself having to mess around IV's or choosing modes and padding then you are far more likely to screw something up.

NaCl/libSodium provide higher level interfaces where the underlying primitives are removed from the developer which makes it much more difficult to implement bad crypto (at least as far as the individual constructs go...protocol design may still get you)

> Even RSA which has stood the test of time since 1977, is only considered 'safe' in so far as there's no algorithm better than brute force for factoring products of large primes

https://en.wikipedia.org/wiki/General_number_field_sieve but most of your point still stands. RSA is edging slowly closer to the abyss.

> Really? In the Judeo-christian framework? Which, like-it-or-not, has to be considered the base reference for the definition of marriage.

Why? Marriage was around a long long time before Christianity or even Judaism. There were hue portions of the world which that framework didn't touch for centuries after it's conception. Even if we were to restrict our view to those polygamy still dominates large parts of their history - which is far from the view of "traditional" marriage.

https://en.wikipedia.org/wiki/Marriage#History_of_marriage is well cited, and links to other, more in depth articles concerning Greek History, Chinese History and others where "traditional" marriage was far from the norm (and around for much, much longer).

Defined by who? when? The problem with the argument you have presented is it lacks any kind of historical accuracy.

There are plenty of records dating back centuries to millennia which encode a whole Smörgåsbord of unions man and woman, man and women, man and man and the rarer cases woman and woman and woman and men and probably more that I have missed.

Humans did not just congregate somewhere in 10,000 BC and declare marriage is a union between a man and woman. Nor did they declare exactly what marriage was or the roles and responsibilities of the people involved and indeed today we can see some remnants of that - the concept of marrying for love verses an arranged marriage for example.

I do, it is mostly for me to record thoughts and document projects - I generally don't expect people to visit it, which is a shame I think.

In my opinion websites display the true intent of the web, decentralized spaces for people to express ingenuity and share ideas. I dislike the centralization of the modern web (I say that with a LinkedIn, Github and Twitter account) and the effort to streamline and reduce the variety of presentation of information.

I guess that is why I keep a site around, it lets me hold onto the web I remember growing up in, and that one day I hope it will morph back into.

And I had the domain for an email address and may as well have put something there.

I have run an ad blocker for at least the last 6 years, probably longer - it has been a staple in my browser setup for so long I cannot stand browsing without one.

The author linked to a tweet which I think requires further examination "ad blocking is shoplifting for the Web".

This argument fails on several fronts, the main one is consent - by loading a website, I am not required to load any or all resources that the server presents to me - certainly in many cases e.g. text-based browsers there is no point to loading these resources - they simply cannot be displayed to the user.

An adblocker is the same, it is a consent mechanism - the server presents my browser with resources that it thinks would be worth rendering with the content, I am free to allow or not allow these resources to be loaded as I choose - and this includes offloading the decision making to other code on my machine.

I don't have a solution for the content creators, I wish I did - I regularly buy books from authors I first discover online. I would be open to micro-payments - however I am skeptical surrounding current implementations as it requires me to submit my browsing history and likes to a third party which is one of the other reasons I run an adblocker in the first place.

It used to say something like "Failure of the Security Industry".

My guess is that for the most part the vendors wouldn't care - which would mean that every update cycle you would have to spend a day patching the platform to cope with whimsical proprietary format changes. Actively hostile vendors could easily make it very difficult to scale out the platform, even if they didn't target you for legal action.

Ultimately what we need here are open standards at all levels, that is the only way you can have a stable interaction of systems and keep the market open and competitive.

I have spent a large portion of my adult life finding and reading and understanding scientific papers. The advice offered in the tweet is good, so I won't restate it - but I will offer a couple of my own:

* Print the paper out and make notes on it by hand (this has a small mention in one of the articles) - this technique got me through university, I tried every software package imaginable but in the end having a hard copy forced me to deal with sheer amount of reading I had to do. It also allowed me to freely make notes, add sticky notes etc. Since then I have done this with any collection of papers I want to get my head around.

* Try to comprehend something on every read through - it doesn't have to be big, just something - whether it is the sample makeup or part of the methodology or the conclusions etc. You don't need to understand these in any particular order, but ensure to revise your understanding as you become more familiar with the paper.

* Most papers are useless (to you at the time you are reading them) - the sad truth about research is that 90% of the stuff you devote yourself to understanding will be wrong, outdated or not useful to what you are working on. It is very hard to pick out useful papers with nothing to go on but titles, and abstract and citations. As you get more used to the field it becomes easier and familiar names, authors and institutions can guide you, but even close to a decade after reading my first paper I still probably only manage a 10% hit rate when conducting research (but hey - 10% of a lot of papers is still a lot of papers!)

I am still a firefox user...but I don't want to be.

I will admit the whole Eich thing, when we was promoted I quickly lost my attachment to Mozilla - they clearly were not the organization I thought they were. But aside from that Firefox seems to be the worst of all choices - the only thing keeping me attached to it is the lack of an open source alternative.

Chrome seems to be far ahead in terms of security (XSS protection, Sandboxing etc.) and in many cases appears to be faster - but I don't trust an advertising company with my browser.

I think we need a fresh contender - an open browser, built from the start with an understanding of the security and privacy lessons we have learned over the last 30 years. I'm not sure how realistic that dream is, but I believe it is worth the thought.

Initially I capture it in a notebook/text editor. Then I go through an editing process and then use Wikis to capture an edited condensed version.