Isn't this basically what Duplicity does? It uses GPG to encrypt files before sending them to the remote server.
6,537 karma · joined May 16, 2011
Email: hn at my handle dot com
IPhones don't let you install add-ons in browsers, so you're stuck with rule-based content blocking, which has caps and can't do some of the things add-ons can do.
I'd love to switch to an iPhone, but this feature is a deal-breaker for me.
Isn't that the way it usually gets done for most non-profit altruistic efforts, though? If I'm a church and run a soup kitchen for the homeless, the volunteers who come in an prepare meals and serve patrons are probably not going to be trained professional chefs. They are going to be people who just want to help and are volunteering as a hobby to try to do some good.
I'm sure soup kitchens deal with this kind of situation all the time, where you have a volunteer complain about this or that, and then an outsider say that soup kitchen is a shit show. That doesn't mean soup kitchens shouldn't exist. It's just the drama you have to deal with when running a soup kitchen.
Hmmmm, I think this is a bit of squeaky wheel situation going on. Remember that the sks keyserver pool is mostly a decentralized group of volunteers running a server as a hobby. So you can have all types of people operating keyservers in the pool.
For instance, I've been running a keyserver in the pool for several years. However, I don't blame the attackers like you describe. In fact, I'm openly asking around for a mentor to build a keyserver implementation that can better deal with these kinds of flooding situations.
Anyway, even though I can totally understand why operators get mad and lash out at people trying to take down the service they are running as a hobby to try to help activists communicate securely, I want to stress that that reaction isn't representative of the many of us in the pool.
What mitigation strategies do other ecosystems use? Why can't they be tried in the keyserver pool?
A much bigger issue than the language itself is the overall architecture of the server. It uses Berkeley DB as the main database and only handles one connection at a time. So, if your gossip process starts syncing a huge spam key, you block all front-end web requests (see my issue #61[1]). Also, the keyserver is completely synchronous, so you effectively have to cluster multiple keyservers running on different ports and different databases and load balance across them if you want to add any sort of scalability to your setup.
Overall, the server code feels like an MVP or academic implementation. Definitely not designed for high scale or the ability to handle abuse like this. It would take a heavy re-write to make get the server code to where it needs to be, which is why no one has stepped up yet.
BTW, I'd love to step up and write an sks-compatible keyserver in python (using postgres as the database), so that it could scale using something like uwsgi, but so far I haven't been able to find a mentor who can help me learn the gossip protocol that's largely undocumented.
[1]: https://bitbucket.org/skskeyserver/sks-keyserver/issues/61/k...
So why can't we deal with these types of attacks? IMO, the main reason is the the server code.
The author mentions that the sks keyserver is "written in an unusual programming language called OCaml", but IMO the language isn't the main issue. Here's a rundown of what I think the main issues are:
* Non-scalable database - SKS keyserver uses Berkeley DB as the database for storing keys, and bdb can't handle more than one connection at time. So, when huge keys with lots of spam signatures are being written to the database, it blocks all other transactions, including serving web requests (see issue #61[2]). The server needs to be re-written to use a database that can handle multiple connections (e.g. Postgres) so spam writes won't affect the web responses for unrelated keys. Unfortunately, the server is currently single-threaded and synchronous so it would have to be heavily re-written to add this kind of async scalability.
* Undocumented gossip protocol - The gossip protocol used is a very efficiency syncing algorithm that lets servers fill in the gaps for their databases from other servers. Unfortunately, the only documentation I can find on the gossip protocol is an academic paper[3]. This is a huge barrier for someone wanting to write a sks-compatible keyserver. You basically have to read the OCaml code (which doesn't have comments) to figure out how it works. For years I have wanted to try to write an alternative sks-compatible keyserver that could handle attacks like these better, but as it stands now, I'd have to spend a huge amount of time learning OCaml and reverse engineering the code just to understand how to write a compatible gossip implementation. Every once in a while I ask the mailing list for a mentor in helping teach me the gossip protocol[4], but so far either no one knows it or wants to teach it to me.
* Few validation and revocation features - OpenPGP is very flexible for how you can build public keys and signatures. I think there's a lot of creative things you can do with signature packets to let keyservers and public key owners clean spam out of their signatures. For example, OpenPGP signatures let you specify a "Signature Target"[5] in a signature, which could be used to let public key owners denote other signatures on their public key they wish to revoke, which the keyserver could then stop serving up to public requests. However, since the current server code is largely unmaintained, we can't implement some of these cleanup options.
Overall, I really love the idea of having a public, open, decentralized keyserver pool. Unfortunately, sks-keyserver wasn't written with much ability to scale (which was totally appropriate at the time), so it's in desperate need of being re-written. I'd love to do it, but simply haven't found the time to reverse engineer the gossip protocol. If someone out there wants to mentor me through it, I'd happily write an sks-compatible keyserver that could operate in the pool and also deal with these types of attacks.
[1]: https://sks.daylightpirates.org/ (currently down)
[2]: https://bitbucket.org/skskeyserver/sks-keyserver/issues/61/k...
[3]: http://ipsit.bu.edu/documents/ieee-it3-web.pdf
[4]: https://lists.nongnu.org/archive/html/sks-devel/2016-08/msg0...
Now: Firefox + uBlock Origin (no Containers)
Upcoming: Firefox (no uBlock Origin, no Containers)
Seems like we're moving backwards, no?
Isn't this the main argument that is used to defend gerrymandering? That since political ideology is not a protected class, it's okay to redraw district maps that discriminate against a particular ideology?
I'm curious what case law there is there for this situation.
I change my passwords fairly frequently using a password generator, so if I don't use the password regularly, I forget it quickly. If someone brought me an old laptop of mine, it's more likely than not I genuinely wouldn't remember the password for it.
Also, there's the situation where someone isn't sure if the order to give their password is legal, so a court battle ensues for a year, but then even if they lose at the Supreme Court, what if in that year they forgot their password simply because they hadn't used it in so long?
It's been amazing. With the ad-blocker she almost never texts me now with suspicious stuff. Also, it was super easy to teach her that if she ever gets into a situation that feels shady, just close the browser and open it up again. Starting from a clean slate every time in a well protected browser makes her feel a lot safer because she knows that if things get scary, she can just close the window and start over.
Having to log in every time hasn't turned out to be that much of an inconvenience either. See actually feels safer because of it. It makes perfect logical sense to her that the website ask her to login every time. "My bank asks me for my ID every time I go in to deposit a check, so of course it makes sense to ask for my password every time I open my browser and visit the website."
Anyway, my takeaway is that Firefox + uBlock Origin for parents is really a wonderful thing.
Having been in the carbon-neutral energy sources industry for a while, I agree with your statement, but not your example. There are already carbon-neutral energy sources that exist and are cheap and competitive (solar and wind). So while it would be great if nuclear could eventually join the ranks of cheap carbon neutral sources, that's not currently the hard part. The hard part is (1) scaling up deployment and integration of these new sources, and (2) figuring out how to deal with all the stranded assets that are being displaced by new renewables.
But, yes, I agree that these are hard problems, experts are optimistic, and AI isn't a blocker since the issues are around business model, regulation, and political influence.
Fortunately, within the past few years, this is no longer true. Renewables + storage are now cheaper than nuclear as a carbon free and dispatchable resource. They are actually not only winning bids for new generation, they are actually starting to win power purchase agreements over _existing_ coal power plants and expecting to start beating existing gas plants within 5-10 years.
It's truly remarkable how fast solar, wind, and batteries have scaled up and started competing on price in the base load markets over the past few years.
The current expectation in the utility industry is that by the time next gen nuclear is commercialized, the grid will already be >90% carbon free. So even if we missed the boat on nuclear, there are other carbon free alternatives that are scaling up to meet decarbonization needs.
When you install a battery in a building in order to manage load more effectively, how do you know when you should charge and discharge the battery? There's a ton of complexities going all the way from not hurting the battery by cycling it too much, to tariff complexities for optimizing the maximum dollar impact to the customer. Then throw on top of that new incentive programs that start to pay out for things like demand response, frequency control, and load shifting for the overall grid. The term in the storage space is called "value stacking", and it's a very hard problem that requires a ton of data and calculations.
Sounds like a great gig for data scientist!
Converting CO2 to hydrocarbons is a fundamentally an endothermic reaction (e.g. it needs energy to happen), so given the limits on process and thermodynamic efficiencies, it will always take more energy to convert CO2 back into gasoline than the energy you got from burning the fuel in the first place. So it seems like what they are proposing is throwing 1x of one type of energy (electricity) at undoing the effects of less than 1x of another type of energy (fossil fuels used in transportation).
Maybe that would be a good idea if we had excess clean electricity generation and couldn't effectively decarbonize transportation, but neither of those are true.
First, we currently need all the clean electricity generation we can get our hands on, and aren't anywhere close to fully decarbonizing the grid to the point where we have excess capacity for stuff like this. Spending 1 megawatt-hour on this for less than 1 megawatt-hour of impact when it could be use to straight up replace 1 megawatt-hour of fossil generation is, I think, a waste of resources right now.
Second, electrification of transportation is starting to happen exponentially, so many of the things you were looking to offset in the short term will probably just cease to exist over the next 10-20 years. The exception is air travel, where the energy density and having propellants are super important, but then you're competing with the price of producing biofuels as a carbon neutral alternative. I suspect that biofuel production will be cheaper, simply because the energy required to grow the algae or convert the cellulose is less than the co2 reversal they are proposing here, but I could be wrong about that for process reasons other than thermodynamics (e.g. capital expenses, etc.). However, focusing on decarbonizing air travel is sooo far down the list of priorities right now. There's so much more lower hanging fruit we should be investing in.
Overall, I think spending energy sucking co2 out of the air and converting it into fuel isn't a good idea right now. Maybe in the medium term if it can compete with biofuels, and definitely in the long term after we've decarbonized as much as possible and still need to remove co2 from the atmosphere. But when I see investment dollars get thrown at this instead contributing towards deploying 1:1 replacements of fossil fuels, I feel a bit sad. Mostly because I know it will be used by propagandists for delaying decarbonization efforts (e.g. "See? We have tech than can undo all these fossil fuels we're emitting! So we're all good and don't need to electrify transportation.").
It seems that in any climate change thread, many if not most of the comments get downvoted, much more to an extent than other topics.
Could someone scan the 50+ comment climate change posts and compare the controversial comment ratio (e.g. number of greyed-out vs non-greyed-out comments) and compare it to other types of 50+ comment posts? If the ratio is much higher for climate change posts, it seems like there's something nefarious going on (brigading, astroturfing, etc.).
They are. Clean energy mandates are being passed in many states; climate change and the Green New Deal is a front and center topic in the Democratic presidential primary race; the Paris Climate Agreement passed on a global scale; China is electrifying transportation and building as much solar, wind, and nuclear as fast a possible; India is phasing out coal as fast a possible; and on and on.
A person as an individual isn't changing their behavior to a large extent, but people in aggregate are.
> And that is what causes climate change.
No, it's not. Again, climate change is caused by injecting sequestered carbon into the carbon cycle. Previously, it just so happened that the act of driving your SUV around did exactly that. However, more and more that's not true. As we electrify transportation and clean the grid, the act of driving around becomes less and less what causes climate change.
> We don't have time to develop all that technology
We already have the technology, it's just a matter of deploying it. Every auto manufacturer is releasing major electric models by next year. Clean energy generation in the U.S. is set to surpass coal generation this year. China is electrifying transportation and switching to clean energy (including nuclear) as fast as possible. India is building more solar than ever and accelerating that deployment.
As I'm sure you've seen, my favorite climate change joke is, "They say we won't act until it's too late... Luckily, it's too late!"
Climate change is my generation's great challenge. If we lose, we die. So, many of us are fighting with everything we have. Some are trying to get people to change behavior, some are trying to make drop-in replacements. But none of us are giving up. It sounds like you've already given up.
FYI, HN is limiting reply depth, so I doubt I can reply more. Please email me back if you can.
> Blaming the “companies” and “lobbyists” is such a cop-out. The companies are just giving people what they want. If people demanded a shift to a climate friendly lifestyle tomorrow, Exxon would have no choice but to follow suit.
As we've seen with Russian propaganda efforts, the firehose of falsehoods can be extremely effective at keeping people in the dark or convincing them of something not in their best interest. People demanding a shift requires education around the topic, and Exxon literally prevented research on the topic from coming out for decades.
> Looking at the major trends of the last several decades. People moving to brand new sunbelt suburbs where they drive everywhere in SUVs. Buying disposable clothes, electronics, etc., made in China and shipped over the ocean. Even the token attempts at being environmentally conscious are ridiculous. I go to Whole Foods here in Maryland and everything is grown in f—king California. It’s a joke.
I'm very confused what point you're trying to make here. That systems or not optimizing for environmental impact? Of course they aren't. They are optimizing based on the incentives they are following. People move to suburbs and drive SUVs to feel safer and more wealthy. People move to the sunbelt because the winter sucks. People buy disposable clothes and stuff is shipped from China because it's cheaper to do so. It's really expensive to grow produce in Maryland, so you ship it from California.
> Nobody is willing to make the lifestyle changes it would take to have a real impact on climate change. And it’s not unique to the US. Canada and Australia have similar carbon footprints per capita, suggesting it’s more a combination of material wealth and low density. Blaming corporations instead of the people for all that is asinine.
You're right, asking someone to give up their lifestyle sucks. However, you're equating changing lifestyle with fighting climate change. That's where we disagree. The goal of fighting climate change isn't to get people to change their lifestyles, it's to stop sequestered carbon from entering the carbon cycle. One way to do that is to ask people to stop being so excessive (e.g. changing lifestyle), but nowadays we have so many more options.
Most climate change solutions nowadays start with the assumption that we shouldn't ask people to change lifestyles, and just deploy carbon-free infrastructure that is a drop-in replacement for existing carbon-intense infrastructure. Solar, Wind, EVs, batteries, biofuels, etc. all never ask you to stop buying disposable shirts from China. All they do is replace the power that powers the factory and the fuel that is used to ship it to you with sources that don't add carbon the carbon cycle. So that when you are living your life in your disposable shirt and eating your California avocados, you're not contributing to climate change anymore.
> And what are our best and brightest from Stanford, etc., doing? Figuring out carbon recapture? No, working at Google figuring out how to more effectively advertise disposable consumer goods that are shipped over from China, used a few times, and shipped back to China for disposal.
We'll I'm just the best and brightest from UT-Austin, so not Stanford, but I did make the career switch from traditional tech to cleantech. And every time one of these threads come up I try to post that you, too, can make the switch from Google to cleantech. However, every time that happens, there are pessimists like yourself who shit all over my call for help. That's okay though, the capitalist in me kind of sees this as an opportunity. The fewer competitors I have in my particular niche, the more money I make. So I guess I should be partially thanking you for slowing down the climate change tech enlightenment :)
Would you mind having a conversation offline? I'm interested in learning more about your point of view outside of these HN threads. Feel free to email me at the email in my profile.
Could we have a conversation offline? I'd like to learn more about your situation and what has brought you to this reply. Feel free to send me an email and we can schedule a time to talk.
I've noticed on most of the climate change posts on HN that they 1. fall off the front page very quickly (due to systemic flagging?) and 2. every single comment that's pro-fighting-climate-change has a "skeptical" reply that hits all the denier FUD talking points. For example, your comment has a reply saying both sides exaggerate, thus muddying the point you're trying to make. Classic whataboutism talking point.
What I don't understand is if HN mods see this going on and can tell if the person is a shill or an actual climate denier. Statistically, replies in these threads should skew heavily towards pro-fighting-climate-change, but even in this post, it seems like every other reply is denier talking points. It is really starting to make me think that HN doesn't care about stopping shills.
I'd like to encourage you to take a look and see what you can find about career opportunities in the clean energy sector. You may be surprised at how many software and tech jobs there are (it's a fast growing space).
I found a job in solar, then eventually started my own clean energy software company. Every day I wake up with the incredible feeling that I'm getting paid to fight climate change. If feels good, and I'd like to encourage you to consider joining the industry, too.
It turns out there's a huge need for software and other tech skills (data science, sysadmin, etc.) needed for the energy transition. With the deployment of so much "intermittent" generation like solar and wind, we need fuck tons of software and communications infrastructure to run a new "flexible" grid. For example, the California ISO is using neural networks to formulate the day-ahead markets, and recently started letting aggregated demand response providers (e.g. companies who manage smart thermostats) bid into the market as distributed generators.
So if you're thinking what can you to help fight climate change, the best thing you can do is get a job in the climate change fighting industry. Start googling around for jobs with climate change keywords ("solar", "wind", "clean energy", etc.). Start showing up to clean energy events (if you live in the bay area, check out my bayareaenergyevents.com). There's so many people in this space who came from other sectors, and it's incredibly easy to move up or start your own company doing some specific thing you think is needed for the fight. Also, feel free to reach out to me or read my previous comments on this topic.
"They say we won't act until it's too late... Luckily, it's too late!"