system33-

Nah. The natural pivot is from “we have never observed abiogenesis” to “see? Life required a creator.”

You can’t win

They terminate TLS. It seems like you wouldn’t want to use this service even if all those questions were answered to your satisfaction.

Not disagreeing, just elaborating, about “fine” Chinese Amazon tools.

I needed safety wire pliers to assemble some brake rotors. The metal in the ones I got on Amazon was softer than the metal wire they came with such that the cutting edges got little wire-sized dents in them and increasingly useless the farther I got along in the job.

Returned those afterward. Junk.

But there’s other stuff I’ve gotten from RANDOMLETTERS Amazon that’s actually holding up “ok.”

Also, Harbor Freight is a better source of ok/fine tools where you don’t need quotes around those words.

Tup. https://gittup.org/tup/ https://gittup.org/tup/make_vs_tup.html

But the Internet’s make mind-share means you still have to know make.

Edit: and make lets you use make to essentially run scripts/utils. People love to abuse make for that. Can’t do that with tup.

Yup. +1 for fossil. I wanted an issue tracker that wasn’t text files in the repo. Lots of git-based things that were heavier (gitea and friends) or hackier than I wanted. Decided to finally try out fossil and I think it’s really really neat.

So cut those people. They will continue to be a problem. Can’t fire them because of the rights of federal employees? Get the law changed.

Actually solve an actual problem, not wave a machete around cutting the government in half.

Subsonic and airsonic (the latter is a fork of the former).

Exactly. “Unsolvable” is a strong word, but … how wrong is it? Shrug.

Before clicking the link or seeing the domain, I was expecting either a rehashed (or if I was optimistic: a novel) argument for why what LE does isn’t actually validating domains. Philosophically or technically. For example: they don’t validate you’re going to the domain you intend on visiting. And 500 words on why that makes them useless. (I don’t agree, but that’s what I was expecting)

My comment is strictly about exit nodes which are not used as part of connecting to onion services.

Ignoring TLS errors might mean you’re ignoring the fact your exit relay is MitM attacking you.

The job these days is boring but secure. Tor stuff was more exciting, then I switched teams because grass-is-greener.

At least for the teams I have been on and my view of leadership, there is very little political talk.

But patriotism isn’t politics… lol. The higher you get the more “hoo rah America!” is a part of the motivational speech or report or whatever. Down here in the streets it’s just another job. Pride in the country isn’t much of a driver. At least for me.

Yes timing attacks.

And yeah mitigation gets you into a huge body of research that’s inconclusive on practical usability. Eg so much overhead that it’s too slow and 10 people can use a 1000 relay network and still get just 1 Mbps goodput each. Contrived example.

People need to actually be able to use the network, and the more people the better for the individual.

There’s minor things tor does, but more should somehow be done. Somehow…

Clients aren’t necessarily good relays. Reachability. Bandwidth. Uptime. I’ll-go-to-prison-if-caught-and-idk-how-to-change-settings-this-needs-to-just-work.

Unfortunately the tor part is the part I can most obviously talk about. Not that I work on anything classified. I just need to be mindful.

I got to travel to Canada, Mexico, and Europe (from the US) for tor meetings and privacy-enhancing technology conferences.

More or less every single cell that goes through the tor network today is prioritized and scheduled by the cell scheduler I wrote.

Sorry that it is hard to find. This is the root link to point you towards.

https://community.torproject.org/relay/

Thanks for considering to run a relay.

If you’re advocating for a bigger network… we need more relay operators. Can’t wave a magic wand. There’s like 8000 relays. Haven’t looked in a while.

Or if you were arguing for increasing the number of relays in a circuit, that doesn’t increase security. It’s like one of the OG tor research papers deciding on 3. Bad guy just needs the first and the last. Middle irrelevant.

Tor was literally developed by the Naval Research Lab. Not a part of the IC.

I know because I work there. AMA

To protect our most sensitive communications and vulnerable communities , Tor usage should be normalized so it is common and not notable.

It’s then best we’ve got for achieving actually meaningful privacy and anonymity. It has a huge body of research behind it that is regularly ignored by those coming up with sexy or off-the-cuff alternatives.

It’s the most popular so it gets the most attention: from academics, criminals, law enforcement, journalists, …

Depends on the content of your traffic.

If “deanonymize” strictly means perform a timing attack using info you have from the beginning and end of the circuit, then by definition you’re correct.

But if you visit an identifying set of websites and/or ignore TLS errors or … they can still deanonymize you.

Monitoring exits is completely irrelevant to onion services, in fact.

Completely.

Exits aren’t a part of the circuit. Ever.

“The western governments run most of the exits” is one of those things everybody “knows” but rarely backs up.

The list of all relays is public knowledge by design. There’s contact information attached to relays. The big operators are known individuals and organizations. They contribute. Interact.

Which ones are actually the governments doing bad things against their citizens? It’s hard to tell? Then why do you make such claims?

Relays that observably do bad things are removed from the network all the time. Are those ones the government? Tor seemingly has a reasonable handle on the situation if that’s the case.

If the fed is doing correlation attacks, why would they run relays at all? “Just” tap the IXPs near major hubs of relays. Or heck, get data from the taps you already had. Silent and more widespread.

Pushing people away from tor potentially makes it even easier to deanonymize them, depending on the adversary model assumed.

I think their point is that no matter how secure your base password is, once one site leaks it, the bad guy basically knows your password to every site.

It would also be very annoying at home games. It would take a special group of friends to tolerate or even get a kick out of how optimally you’ve solved a self-imposed problem.

It’s a fun mental exercise and programming problem, but that’s it IMO.

A VPN can be required to access internal network(s) without implying a lack of further roadblocks/restrictions/authorization checks/etc.

Electric Light Orchestra is a band.

Put the overage in the safe.

I’m sure the policy adopted, if any, depends on a number of factors such as how often cash is used and typical purchase size.

Places don’t like to accept them.

- buy a pack of gum with a counterfeit $100, get 98 real dollars back

- even with legit currency, it can throw off the drawer. Business might have a policy for cashiers to never have more than, say, $200 in the drawer. Force half of that to be your $100, and now the cashier has crippled change-making ability. Business have this policy to make them less tempting to rob and limit the damage if they are.

Have you checked out RIPE atlas?

Volunteers run probes and earn credits. Credits can be shared and spent to run measurements of their custom design. All measurement results are public info (I’m pretty sure, it’s been a while since I did stuff with RIPE atlas).

So all that nonsense about credits and volunteering may not matter to you if the results are useful.

https://atlas.ripe.net/

https://en.m.wikipedia.org/wiki/RIPE_Atlas

Yeah. Mullvad. Actually good too.

Something like $5.30/mo (forever). They take literal cash (as one of the options). WireGuard support. They actually do privacy, not just market it.

Edited to fix price estimate and clarify it isn’t just for the first year.