umaguma

This is good work.

Your comment begs the question: Do you fall for the marketing hype? And if not, then do you think you should keep quiet about stuff that works?

At the time, IMHO, PG was indeed smart to be one of the few using FreeBSD as opposed whatever the majority were using.

But he has admitted they struggled with setting up RAID. They were probably not too experienced with FreeBSD. I am sure they had their fair share of troubles.

PG's essays and his taste in software are great and the software he writes may be elegant, but that does not necessarily mean it is robust.

Best filesystem I have experienced on UNIX is tmpfs. Backing up to permanent storage is still error-prone, even in 2015.

The -D option is a superfluous feature, IMHO. I always remember who proposed it and that alone discourages me from ever using it.

Why does the author have to use a "web gui"? Or maybe he doesn't have to, he just _wants_ to?

"99.9% of activities which brain controls..."

s/activities/known &/

The post from 1997 assumes /var/log is not vulnerable tampering; assumes that the syslogd or access to the socket or port it's writing to is not vulnerable to compromise; and assumes that all signifcant programs write to a log.

The world is much more familiar with UNIX in 2015; I trust that today no one would rely on /var/log.

My approach would be to look at periodic memory dumps and look for anomalies there.

And not to rely on the integrity of utilities stored the system that you are analyzing.

Yes! You got it!

"... because you can trivially MITM someone..."

This assumes the user is relying on certificates for authentication. Certificates that are likely tied to domain names.

What if the user authenticates by another means? SSH keys, real life meeting and exchange of keys, keys printed on paper and sent in the postal mail, etc. No domain name involved.

There are other ways to authenticate an endpoints besides domain names and certificates.

It's possible to have encryption without authentication.

It's also possible to have each of encryption and authentication handled by a different program. What we have now are programs that try to do both, and may do a very bad job of one at the expense of the other. These programs provide a false sense of "security".

The fundamental question: Are domain names easier to MITM than IP addresses?

It sounds like domain registrars are being used to supplant the role of CA's?

This reminds me of the situation with email where if a user has not purchased a domain name, then it is nearly impossible for the user to send or recieve email without a third party "email provider".

Will encryption become the same? If at least one endpoint has not signed up with some third party (e.g., letsencrypt) _and_ purchased a domain name, then it becomes nearly impossible for two endpoints to encrypt traffic between them?

Will we ever again allow users to be fully empowered, _without the involvement of third party endpoints_ (CA's, domain regstrars, etc.), to send email, encrypt traffic, and all the other basic things one can do with a computer and an internet connection? Is it unfathomable that two parties connected to the internet might actually know and/or trust each other already, without involvement of a third party interloper?

Those are meant to be yes or no questions, or perhaps a rhetorical ones. No need to provide rationale. :)

Is the lure of letsencrypt that

1 it's accepted without warning in browsers or

2 it lets users ignore learning how to use the openssl binary (or writing their own tools with libssl, polarssl, etc.) to generate ca and site keys, certs, csr's, crl's, etc., or

3 both?

Here, the author appears to benefit mainly from 1.

Assuming letsencrypt does not do any sort of commercial CA-type "verification" then why do they need to be a CA? Why does one need an account?

Answer: browsers clinging to CA system.

Why not just get browsers to drop the warnings for self-signed certs?

The goal here, I thought, is to facilitate encrypted traffic, not to give a false sense of "authentication", correct?

Encryption and authentication are two different things.

Every user should understand that.

It's not a secret when you know how to code but you are an end user. Knowing how to code and knowing how to learn to code makes this widespread incompetence masquerading as competence and even "professionalism" radiate from every bit of software you ever come in contact with, as an end user. Seeing the source code just drives home the message even more. You become a more discerning end user.

A letter apologizing for his wrongs, announcing that Facebook will no longer collect personal information and that it will exist for users not advertisers, as well as promising to refrain from ever using the word "hacker" again to refer to himself or anyone at Facebook.

"Move fast and break things." Privacy: broken.

Won't fix. Sorry.

Otherwise known as PR. Some clients need it more than others.

Did Ballmer ever do any programming?

If not, why?

Did he just have no curiosity or interest?

Sounds like he had far more capacity for maths than Jobs.

Someday his children will read this, along with his "letter". announcing the LLC.

They "trust me"

How can anyone claim that it would be common and understandable for anyone of his age at the time, attending Harvard, to accept all this personal information and then say such a thing?

"...so if you ever need info about anyone at Harvard".

That sounds just a tad anti-social for the founder of a "social network".

And then, of the students who would say something like this upon receiving people's personal life information, how many would you trust later as adults _with all your personal information_? Too late. Already done.

Apparently wealth changes everything. Zuckerberg is now transformed. Trustworthy and benevolent. Or it does not matter; it is irrelevant. Or it matters, but what can we do; what choice do we have?

Maybe believing one of the above makes all those who submit their personal information through his website a little more comfortable.

Cognitive dissonance.

Wow. How many emails, pictures, addresses, SNS does he have now? And this is what made him so wealthy? Collecting personal information? Incredible.