News for hackers. Stuff that matters.

yata69420

This is pretty obviously the reasonable take.

> A security is a contract, not just anything that people trade around in a speculative way.

The scary thing IMO is that I think if you had enough big money trading bottlecaps or baseball cards, you'd quickly find them being considered a security.

But words have to mean something. Things can't just be a "security" because they make the government feel insecure.

Re:Hype Will Turn Your Security Key into Junk on Thursday July 13, 2023 @05:24PM (#36716197)
Yes, you need to use `ykman` to set a PIN. This also allows some services (really only Microsoft Accounts right now) to use "passwordless".

The idea is you register 2 or 3 passwordless keys on important accounts. Keep one in the machine, one on your physical keychain, and one in a remote location.

Open source. I recently started getting back into submitting patches and hanging out on irc/matrix/discord.

I think a lot of the advice like "join the church" or "do an activity" are lost on chronically online people like myself.

For us, it should be "find an online community that makes you challenge yourself to improve", but it's hard to articulate that.

Re:Mullvad: Removing the Support for Forwarded Ports on Monday May 29, 2023 @10:24PM (#36120493)
I've been a customer since 2016 and they've been excellent. They also recently added wireguard support which is nice.

Reddit has a big comparison table if you're curious: https://old.reddit.com/r/VPN/comments/m736zt/vpn_comparison_...

https://en.wikipedia.org/wiki/Carfentanil wasn't banned in China until 2017.

I think the origin of what's now being blamed on "fentanyl" is the real risk that even the smallest inhalation of improperly stored synthetic opioids (things that are 100x+ strong than fentanyl) could cause injury or death.

Also (depending on who you believe), this class of drugs has been deployed as an aerosol: https://en.wikipedia.org/wiki/Moscow_hostage_crisis_chemical...

Because these synthetics were legal (?) to import for a long time, field agents probably do have a real risk of encountering them stored improperly, even if NPR couldn't find a case about it. Probably it wouldn't have shown up under "fentanyl" if that's all they searched, but it's the same crisis.

I even recall one HN poster telling their story about designing a synthetic opioid and paying a lab overseas to make it.

Obviously cops doing bad things important to report on, but it's a shame NPR doesn't give the context about the chemicals, since the chemicals are the cause of the crisis.

Re:The web’s most important decision on Sunday April 30, 2023 @09:36PM (#35768257)
100% agree. Also I bucket "free" into "data harvesting", "actually gratis", or "libre".
I haven't ever actually bought Windows, so I wasn't aware the discrepancy would be that crazy. I just assumed it was a reputation/escrow problem as there's no shipping information and no way to validate who used the key.

I wonder why Microsoft doesn't region lock them or do some kind of audit if they don't want that market to exist. I'm also not sure why someone would buy an obviously grey market key when there are KMS activation solutions on github.

If Microsoft did want to allow for resale at any price and at least capture the fees, an NFT solution would let them do it without a lot of effort (building an exchange, processing payments, handling fraud, etc in each locale).

That's the sort of problem NFTs solve, generically, for digital ownership and transfer (licensing, tickets, club membership, etc).

With some amount of network effect and ease of use (the web3 wallet experience is actually quite good), I think NFTs will look like the obvious answer.

> Not if people just swap NFT accounts and sell their keys+accounts in their entirety.

There's a cost to doing this. Usually as an escrow fee paid to ebay or g2a or wherever you're selling keys. As long as the NFT transfer fee is lower than the escrow cost, I don't see how it wouldn't be cheaper and safer for everyone.

I'm not saying this is a solution to piracy or violating the regionality of the licensing agreement, just that it would allow buyers and sellers to trade; with the original licensor taking the fee instead of ebay, because the NFT cryptography takes the place of the reputation+escrow provided by existing platforms.

I think you've got it, so I'm not sure why you don't understand the value of NFTs. It's entirely about economics.

In the case of Windows keys, if Microsoft issued them as an NFT, then the only way to get a valid one would be from Microsoft or via secondary market resale.

Obviously, if Microsoft sells the key, the user paid for the key.

If the user resells the key, Microsoft can now also get paid a transfer fee baked into the NFT contract. Plus they have traceability for where every key went.

Now instead of policing secondary gray markets, they capture additional value from resales. The purchaser of the resale is 100% sure it's a valid key, and the sellers with surplus licenses have a marketplace to unload them.

The NFT in this scenario facilitates Microsoft getting paid for this trade without the trouble of setting up a secondary license trading site. As long as the fee to Microsoft on the NFT transfer is less than the 20% or so that the escrow (ebay) takes, it makes good economic sense for all 3 parties.

> What's stopping from people from sharing accounts?

I guess if the ScalperAccount has a dedicated wallet that only has one asset, and that wallet's private key is sold, sure. Of course, there would be no guarantee that you're not being scammed when you send payment and never receive the private key. When done on-chain, there is a guarantee that you will receive the NFT you purchased.

People do this today with video game accounts, usually ones that have a single game or subscription obtained through gray or black market transactions.

But in an NFT-enabled world, you would need to be signed into the seller's wallet to attend the event and it wouldn't be your normal wallet. Identity could be confirmed cryptographically with an attestation or heuristically by having some amount of additional assets in the buyer/seller wallets (because everything would go with the wallet if private keys were shared).

Also if people traded private keys in this way, they would lose out of value adds like POAPs that contribute to your history, which could be useful for getting better tickets in the future or proving social status or whatever.

In this case, NFTs allow for a secondary market to exist with additional stipulations (such as revenue sharing) via smart contracts.

Of course, all of this can be done with centralized services, but decentralized protocols have much better interoperability and trust than centralized databases with web APIs, which is the whole point of a trusted distributed ledger.

I use all those types of cryptography too, but NFTs provide additional features.

The special thing about NFTs is that they're securely transferable on a public ledger, which isn't really the case with client certificates or ssh keys.

Let's say I buy a ticket to a show as an NFT and I want to give it to you. I can simply send it to your wallet address, and now you own it and can prove you do at admission time.

If I resell the ticket to you at a premium, perhaps the performer gets an additional cut to help them capture some of the resale value and reduce scalping.

I'm not sure how you'd do this with SSH keys or private certificates, but I think you would end up needing some kind of registration/directory/ledger service, and then you've just invented cryptocurrency again.

The JPEG-flipping profile picture culture may be dead, but the technology works.

NFTs are great if you need cryptographic proof of ownership. I believe this actually has a ton of unexplored utility, even though people now associate "NFT" with pictures of monkeys.

The only NFTs I currently use are from Uniswap, but I think it's likely I'll use them for all sorts of ownership in the future.

NFTs can also make things like subscription services and club memberships transferable by allowing secondary marketplaces where they otherwise would not exist, which should be good for both businesses and customers. POAPs are pretty interesting too.

Re:The Case for Banning Crypto on Thursday April 06, 2023 @04:13AM (#35465676)
Ah, so I'm only allowed to do cryptography if I have a "legitimate use case". I've heard that before.

Also, nice list of people who did cryptography wrong. I guess there's more innovation to do.

To be clear, I think there's a legitimate need for crypto regulation to ensure that businesses that claim to be custodians do in fact have all of the crypto. The fiat rails are a sensible place to do this. Incidentally, this clearly illustrates why crypto is property and not a security.

Re:The Case for Banning Crypto on Thursday April 06, 2023 @03:11AM (#35465213)
> Who is arguing to ban cryptography?

> Regulation in the crypto industry means that crypto tokens are securities

So cryptography is fine, unless it's part of a network that you don't like, used to secure a ledger that you don't like.

If you don't like it, then those ledger entries magically become "securities" and all that entails.

Why can't you let people have their worthless internet tokens without the government getting involved?

For anyone who watched "cryptocurrencies" come online, this is beyond stupid.

Re:The Case for Banning Crypto on Thursday April 06, 2023 @01:22AM (#35464456)
> regulators will go through crypto with a fine tooth comb

I'm not sure if you're aware, but "crypto" isn't some company that will be regulated. It's math being done on computer networks.

What you're proposing is making math illegal.

This has been tried before with encryption. It's not a winning argument.

If you are this threatened by a distributed ledger, maybe you need to rethink some of your beliefs.

Re:The Case for Banning Crypto on Wednesday April 05, 2023 @11:43PM (#35463872)
> This is where the future is headed, not crypto.

Well, sure, your business interests will win if you ban competition.

If crypto is useless, it will die organically. If crypto is useful, it will thrive.

Why does the government always need to ban new things? If FTX wasn't a "crypto" scam it would have been some other type of scam.

When TikTok gets shitty, people will stop using that too.

This is supposed to be what makes capitalism strong, and instead we have authoritarians trying to disrupt any threatening innovation.

Re:Onionmx: Mail Delivery over Tor on Wednesday September 14, 2022 @11:06PM (#32846489)
Clever and great writeup.
Re:When to use Bazel? on Tuesday September 13, 2022 @05:24PM (#32830365)
The benefit is that it keeps a huge graph of all dependencies, so everything from the toolchain through your application can be built with hashing and caching. Sort of like make, but decentralized and based on hashed file contents.

Once you have bazel, you can distribute the workload so that you could have thousands of machines each producing artifacts to be shared with other build machines.

Then you can set up your dev machine to rely on those caches, so your local builds either use everything directly from cache or instruct a remote builder to produce the artifact for you.

No matter what you change, because the dependencies are graphed precisely, you only need to rebuild a very tiny set of artifacts impacted by your change.

Of course, this doesn't actually work in practice.

Your builds probably aren't deterministic, so your graph of artifacts won't be either, causing lots of stuff to rebuild. Also, it may work great for something like Java that produces class files, but not provide any caching at all for ruby.

Debugging and supporting it is a full time job for a team of engineers that dramatically outweighs the cost of keeping your projects sensibly sized.

You might think that as the project gets larger, it's totally worth it to use bazel for that sweet caching. But in reality the graph construction and querying will become so bloated that just figuring out which targets need to rebuilt becomes a full time engineering effort that breaks constantly with all tooling upgrades.

Also, the plugin ecosystem is just poor.

Bazel is the perfect storm of computer scientists loving big graphs, Google exporting an open source project and then rebuilding it internally, and inexperienced engineers being sold on a tech as being obviously right because all the big players use it.

Re:Framework Laptop 2.5Gbps Ethernet Expansion Card on Monday September 12, 2022 @04:21PM (#32816348)
Every time I see one of these frame.work posts, it looks like they're doing so much right. I can't wait to buy into their ecosystem.

How long until 120hz+ displays?

Re:Defending Privacy in Crypto on Friday September 09, 2022 @03:15AM (#32776270)
Cash is already effectively gone in a lot of situations.
Re:Defending Privacy in Crypto on Friday September 09, 2022 @03:12AM (#32776237)
> Widespread privacy in crypto == end of civilisation. This sounds ridiculous but logically one has to follow the other in a few very short steps.

That does sound ridiculous. What are the steps?

Related, the Launch Control XL is pretty much the only sensibly priced and well built box of knobs, sliders, and buttons.
Re:Tornado cash takedown and its repercussions on Tuesday August 09, 2022 @07:29PM (#32406007)
I thought we had previously sorted out that money is speech?
Re:Tornado cash takedown and its repercussions on Tuesday August 09, 2022 @07:26PM (#32405984)
Vitalik came out as a TC user earlier: https://twitter.com/VitalikButerin/status/155692560223356928...

He apparently used it to donate to Ukraine.

Re:Carbon offsetting is just another form of greenwashing on Sunday August 07, 2022 @09:49PM (#32381716)
I was in favor of aggressive lockdowns at the time, but I live in a part of the US that proudly does not lockdown or wear masks. I think we had 2 weeks of total "lockdown" when people were legitimately scared. We haven't had significantly more deaths per capita than other stricter parts of the country.

We now have examples from all around the globe. China's super strict approach seems like it sort of worked for a while, but even they had cases.

Even as recently as the late 90s or early 2000s, I think most people would have concurred that a degree represented some amount of training and skills, earned with some amount of legitimacy, from most institutions.

I don't think that's true anymore.

Yes, eventually, and we will need programs for people in their 40s+ who have been cared for by their now deceased families. I suspect you're going to need hot pockets, video games, cots, showers, and they'll do ok. Maybe by then they'll be happy they're in a community together because they've been community deprived their entire lives. Who knows, this is a new problem.

But if you force them to "sink or swim" now, you're going to have a raging generation of 20-somethings with nothing to lose and contempt for the society and families that abandoned them. Also, did you notice the planet is literally burning?

For personal reasons, I'd like to keep society going a little longer. If we could not start a Joker breeding program, that'd be great.

American here, but this seems like a problem only for working class Japanese? And this study seems to be looking for a "solution"?

I can't imagine that anyone would care if you're rich and isolated.

> If parents kick them out then they'll be forced to sink or swim.

If you've ever lived in or near a US city, the "sink" outcome is actually quite common.

> Better to learn how to live in society sooner than later.

Your approach converts a family struggle into a community problem.

I don't see why society would encourage families that can support hikikomori for some number of years to offload all of them onto society immediately, even if some would successfully "swim".

Also, you can be personally and criminally liable for a lot more than the average job. I'll pass on any job that requires you to swear an oath.

Older »