bauruine

I think the main reason that GNU tools are overly optimized is copyright. [0] They just try to avoid any copyright claim by the old proprietary UNIX tools like the copyright on an empty file. [1]

[0]: https://www.gnu.org/prep/standards/html_node/Reading-Non_002...

[1]: http://trillian.mit.edu/~jc/humor/ATT_Copyright_true.html

What is the advantage of EA over the existing client authentication with client certs?

I'm not sure if this is well known but you can actually dig (AXFR) the whole .ch and .li zone. Are there other tld that allow this?

https://www.switch.ch/open-data/

According to Kim Dotcom [0] The Chinese government has a backdoor to MEGA.nz.

[0]: https://nitter.net/KimDotcom/status/1539426611870986240

Thanks for the link. That was what I was thinking about when writing my response about "complex code to do trivial things is kind of a meme." but i couldn't find it.

Not exactly an answer but OpenBSD sometimes has different portable versions of their software. e.g. https://www.openssh.com/portable.html

>GNU having ridiculously complex code to do trivial things is kind of a meme.

One of the reasons is that GNU had to reimlmement UNIX tools as GPL code. How do you reimplement something trivial without it looking as the original to avoid copyright claims? One of the solutions is to implement it as complicated as possible.

Somehow related. FizzBuzz at 40+ GiB/s https://codegolf.stackexchange.com/a/236630

It shouldn't be a problem, at least i never had one, if you don't change the authoritative DNS servers.

Where do you have the information from that "all malicious traffic attempts to use privacy respecting technology."? I just checked an access.log (from a searx instance) and an auth.log for malicious traffic and it doesn't look at all like that.

ssh bruteforce top 5 offenders:

147 (Tor: 0) TENCENT-NET-AP-CN

133 (Tor: 0) DIGITALOCEAN-ASN

31 (Tor: 0) CHINANET-BACKBONE

17 (Tor: 0) BAIDU

13 (Tor: 0) CHINANET-SH-AP

Overall there where 737 unique IPs from 241 ASNs and 1 was a Tor node.

access log top 5 offenders:

76 (Tor: 0) DIGITALOCEAN-ASN

58 (Tor: 0) CONTABO

54 (Tor: 0) AMAZON-AES

50 (Tor: 0) KAZTELECOM-AS

34 (Tor: 0) CORBINA-AS

Overall there where 1672 unique IPs from 618 ASNs and 4 where Tor nodes.

Back in 1996 Switzerland and Germany signed a non-binding agreement (Vertrag von Lugano) to increase the capacity for freight trains. Now in 2022 the Swiss part [0] with two 34km and 57km long tunnels through the Alps is basically finished meanwhile the German part is expected to be completed in 2042 [1]

[0] https://en.wikipedia.org/wiki/NRLA

[1] https://en.wikipedia.org/wiki/Karlsruhe%E2%80%93Basel_high-s...

Could you please post a source for this? The only thing i could find is from the man page "However, the fact that a client is accessing a Single Onion rather than a Hidden Service may be statistically distinguishable." but I'm not sure what exactly the impact is from that.

Yes that's correct.

You're correct this isn't really a solution but Tor Browser has already merged https only mode [0] so this should become less of an issue in the near future.

[0]: https://gitlab.torproject.org/tpo/applications/tor-browser/-...

Yes there is the onion-location http header to upgrade from clearnet to .onion [0]

[0]: https://community.torproject.org/onion-services/advanced/oni...

Can you just shutdown your nodes or can they force you to continue? Best practice for relay operators is to just stop the operation altogether if the authorities force you to attack the users.

The only attacks an exit alone can do is sniff all traffic and modify the traffic. There are constant checks done by the Torproject to detect bad exits that modify traffic but sniffing is not detectable of course. But both of those attacks are mitigated by https which most sites support nowadays. Firefox and therefore the Tor Browser also has an option to disable http. [0] And using an .onion service removes this attack vector also.

[0]: https://support.mozilla.org/en-US/kb/https-only-prefs

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit.

[0]: Search for HiddenServiceSingleHopMode on https://2019.www.torproject.org/docs/tor-manual.html.en or just use the following config options

SOCKSPort 0

HiddenServiceNonAnonymousMode 1

HiddenServiceSingleHopMode 1

This sounds like you where runnig a relay and not a bridge. Bridges are not public so your bank had to actively harvest them to block you which seems unlikely.

That's basically what was done the whole Cold War. USA goes to Vietnam --> USSR supports the other fraction with weapons etc. USSR goes to Afghanistan --> USA supports the Afghans etc.

Having Cold War situations again isn't desirable of course but it's kind of battle tested to not lead to further, direct, escalations.

>static IPv6 /28 I guess you mean /48. Even as a LIR the default assignment from RIPE is a /32.

A dualport 10 Gbit/s SFP+ PCI-E card with an optic is like 25$ on ebay.

Yes Swisscom has to lease it's infrastructure to every ISP the product is called BBCS [0]

[0] https://www.swisscom.ch/en/business/wholesale/angebot/anschl...

Define cheap. I use Swissbackup [0] which is around 4$ per TB. And rsync.net is at init7 IIRC.

[0] https://www.infomaniak.com/de/swiss-backup/tarife

Another point I would add is DNSSEC. With your own authoritative server you actually own the keys and don't have to trust another company.

What's also not mentioned is the possibility to run your own hidden master and use a DNS provider (or multiple!) as slaves. This way you have full control over your zone but you don't have to run your own network of nameservers.

If you only use it for NAT traversal and don't need to hide your location you can setup a single onion service. This way your server makes a direct connection to the rendezvous points which reduces the number of hops from 6 to 3 which should increase the speed and reduce the load on the Tor network.

This can be configured with two options.

HiddenServiceNonAnonymousMode 1 HiddenServiceSingleHopMode 1

Unfortunately you can't use it with the Tor Browser Bundle as you need to disable all client-side services on your Tor instance, including setting SOCKSPort to "0".

A /8 are 16777216 (2^24) addresses and IPs are sold for around 50$ each [0] so somewhere around 800 Million.

[0]: https://auctions.ipv4.global/prior-sales

> DarkMatter is under investigation by the F.B.I. for crimes including digital espionage services, involvement in the Jamal Khashoggi assassination, and incarceration of foreign dissidents.[28] The F.B.I. is also investigating current and former American employees of DarkMatter for possible cybercrimes.

Doesn't look like they only target Israeli companies.

They also allow cryptocurrencies. [0]

[0]: https://donate.torproject.org/cryptocurrency/

>The impact is that each byte in the RNG seed has a 97% chance of being 0 due to incorrect conversion. When it is not, the bytes are 0 through 9. >Due to the poor random number generation, keypair generates RSA keys that are relatively easy to guess. This looks horrible. Does anyone know where this is used?