conformal

you're doing it wrong: haskell is too slow.

we have more bandwidth than we use and we donate this bandwidth to the tor project. we are fans of the tor project and care about protecting personal privacy and individual expression.

we have 3 nodes running up to 4 processes on each node. each node is capable of pushing out up to ~600 Mbps with 4 processes on it. the nodes run bitrig, a fork of openbsd that several of our developers hack on.

EDIT: i just read the linked article and i see why we are listed - we have our own ASN and run openbgpd from our colo space.

cyphertite uses a private (per-user) deduplication pool, not a global deduplication pool like dropbox and many other online storage providers.

Example 1 - user1 uploads file1, then at a later time user1 tries to upload file1 again. the 2nd occurrence of the data in file1 is recognized as a duplicate of what has already been stored, so the service does not re-upload the bulk data of file1. this saves bandwidth, time, cpu cycles etc.

Example 2 - user1 uploads file1, then at a later time user2 uploads file1. in a private (per-user) deduplication pool, both user1 and user2 would need to separately upload a copy of file1, but in a global deduplication pool, user2 would not need to actually upload the bulk file data since it can reference data that user1 uploaded earlier.

the upshot here is that each user has their own separate crypto keys that are used client-side, similar to spideroak, tarsnap, etc.

i could get into the details here, but it's pretty well summarized in our infographic and crypto whitepaper

https://www.cyphertite.com/papers/CT_InfoGraphic.pdf https://www.cyphertite.com/papers/WP_Crypto.pdf

that's a pretty definite statement that is definitely false. Conformal Systems LLC has no government contracts at this time.

hi there jcr, this is jy-p, thanks for the kind words :)

no, no, no, the bikeshed is YELLOW.

suffice it to say that the guy seemed to permanently have a nervous sweat going on and he did this over 5 years prior to when i spoke to him.

per the article, it is not uncommon for "serious" distributors to do this for whatever reason.

i spent a couple hours talking to a guy who had supposedly done approximately 60 mg print back in the day.

one component i didn't see in this blog post was what he described as "A PIERCING WHITE LIGHT". :)

from my own personal experience, govt folks like to follow. the business of knowing usually doesn't involve overt intimidation that is demonstrable to outside parties.

even though i am not "allowed" in canada currently, i found the govt folks to be pretty reasonable when i had to interact with them.

"As in who cares about security enough to encrypt their messages but not enough to install a standalone client, which has a stricter security model."

this is so spot on. secure comms have no place in a web browser, which is a complex beast with a large set of underlying dependencies. webkit vulnerabilities leading to comms being blown is a crappy architecture.

people who care about comms use a standalone client and a separate server. if you care about the integrity of the server, you run some disk crypto, DDR3 memory, secure it physically, etc.

lol. you must have seen me at the border, eh? ;)

your original product was riddled with problems, so much so you had to entirely change the architecture. a stream of ppl popped out of the woodwork and had a laundry list of problems with your original work. making security products that are not built properly endangers those who use it, as i am sure you have heard many times before.

you are clearly very talented with marketing yourself and the project, so cryptocat getting lots of media coverage led to an essentially crowdsourced design for cryptocat 2, very similar to mega. sure enough, this design has held up relatively well and gotten through audits without too many serious issues. as someone who cares a lot about secure comms, i have seen and continue to see no reason to use cryptocat.

i find it particularly ridiculous that a supposed proponent of free speech suggest i am not entitled to my (negative) opinion of your project. i see no point in filing bug reports for software i will never use. i believe in people doing their own homework, it is not my job to improve your project.

if i assume that your govt troubles are indeed legitimate, there are a couple things that seem inconsistent to me:

- you seem very concerned about the negative ramifications of angering your local govt, and all this is linked to (1) your dev work and (2) your prominence in the media. if you are so truly concerned about govt action against you, why are you publicizing the harrassment you have experienced? it only serves to promote your dev work and elevate your media presence, which i would expect to further aggravate your local govt.

- the govt likely knows that actions like this, properly publicized, only lead to an increase in the reach and use of your product, in direct contradiction to your suggestion that they don't want to have your product circulate. it seems that "cui bono" in the context of your story is that you and your project directly benefit by getting lots of publicity.

i found it a bit difficult to fish out details on the ciphers and modes you use with cryptocat 2, which doesn't exactly inspire confidence. i am not a fan of using a stream cipher (AES-CTR) to protect non-streaming comms due to the nonce re-use issues your audit found. ssh using AES-CTR makes sense to me, an IM protocol, not so much.

this whole account sounds patently ridiculous considering the nature of cryptocat.

i would like to think that "CSIS" had better things to do.

i know the author (nadim) is in here and this is all a bit fantastic. cryptocat is one of many crypto snake-oil products that i would never consider using for any kind of secure communication.

using defective crypto products is much riskier than not using any crypto at all and exercising caution. cryptocat has always seemed a poorly disguised honeypot to me.

VuongN, you are indeed correct that you cannot currently share data with the service. this will change in the near future.

i had a look at your site, nice design :)

thanks for the plug guys =)

this is a bit of a stretch in that the concepts used in category theory are surely useful to programmers, but in reality programming is often sufficiently complex that category theory is too general to apply. you can spend all day drawing diagrams about morphisms, direct products, pullbacks, etc but the real work is in coding the api, not drawing pretty pictures.

most programmers don't have the time or inclination to complete an undergraduate degree in mathematics, which is essentially a prerequisite for taking a legit category theory course. category theory is usually taught at the graduate level.

category theory definitely helps in theoretical physics :)

had a good laugh when i saw this article. thx mithrandir :)

passwords stored in the clear in server-side sessions => server hack compromises data. storing keys server-side means admins can get into your data.

had a big lol at the use of blowfish ECB - use of any cipher's ECB mode for bulk encryption is asking for problems. they should be using CBC, CTR, LRW or, ideally, XTS modes.

this is a troll with very little substance.

summarized as "ls does not follow the unix philosophy", it points out that an example of a tool that doesn't follow the philosophy as close as it could or should. there are exceptions to every rule, what a substantive exposition.

ORANGE ALERT, send out the bubble!

i think the title of the article is misleading, it should have been something like "quick Galois Field overview". 3 or 4 images of GFs is not "visualizing" them.

take a commutative ring, mod out by a prime ideal and you've got a field. congratulations.

nice work zooko et al :)

my understanding is that tahoe-lafs is meant to be used as a live filesystem. how does the redundancy configuration affect latency? i would guess a cloned volume ("RAID 1") would be faster than a distributed volume (e.g. "RAID 5" or "RAID 6").

working longer hours != working more or harder.

much of the financial problems in .gr (and .it) have occurred because many citizens do not declare the bulk of their income, then, lo and behold, there is insufficient tax revenue to pay for the myriad government services. there are more porsche cayennes in .gr than there are people who declared over EUR 50K income in 2010.

based on the fact that .gr has essentially committed long-term fraud with their financials i put absolutely zero stock in any claim that "they're working harder than germany".

sure, there are some greeks who work really hard and are productive, but if you've spent any decent amount of time in other countries that border the mediterranean sea you'll notice that their definition of "work" is very different from most people from a less pleasant climate.

wow.

somehow i doubt these sites have multiple uplinks, so they certainly don't need BGP routers. even if they're doing IPSec between some locations this can be handled by an old piece-of-junk $100 computer running BSD or nix, e.g. with isakmpd and pf.

stuff like this is why america's infrastructure is crumbling: dodgy contractors looking for an excuse to upcharge municipalities for irrelevant gear and services.

wow, a company that refuses to release hardware documentation sans NDA has open sourced something. let's give them a gold star!

by forcing OS devs to sign NDAs it has actively slowed down the open source community. releasing open source code to make further use of their own products is talking out of both sides of their mouth.

"The prevalence of social bubble-worthy companies whose value propositions are little more than "cat pictures" suggests an inflated sense of self-importance among the founders, and I can't expect to keep my level of enthusiasm in line with their irrational exuberance."

i totally loled :)

organizations that expect unreasonable working hours from developers or sysadmins are a bad place to work. the only places i consider it somewhat reasonable to work employees over 50 hrs / week are professional services firms where the firm is actually gaming the billable hours of the employee involved.

remember that you have a choice about the amount of hours you work: don't let yourself get into a position where you're being chided to work countless hours. a good manager knows that working most employees over 40 hrs / wk leads to lower quality work product, but as i mentioned above, the only place where this consistently translates to revenue is a prof services firm. ppl are more likely to commit errors and generate crap product once you push them over an 8 hr work day. this is not to say some ppl can't work a 16 hr day and be nearly twice as productive as an 8 hr day worker.

don't get discouraged and don't let ppl push you around with respect to the hours you clock. i'm sure you'll find somewhere that fits you better than behemoth X.

cool story bro

dnb is a credit ratings related scam. if your business routinely has credit checks run it is helpful to have a dnb entry for the business.

if you operate mostly on cash basis and don't need to have credit checks run, e.g. for vendor accounts, there is no need to use dnb.

NOTE: once you are in dnb it is very difficult to be de-listed from their site/service.

been running with FDE on an SSD for >3 years now, still works fine.

sure it's slower but how often do most people really push their disk past 20 MB/s?

knowing file hashes assists substantially in cryptanalysis via PoE