doomrobo

Very cool! I wonder if this model is the one the US sold to the Saudi Air Force to bomb Yemeni school buses.

https://en.wikipedia.org/wiki/Royal_Saudi_Air_Force

https://www.nytimes.com/2020/05/16/us/arms-deals-raytheon-ye...

Funny, I recently stared in wonder at a cuneiform tablet in a museum. When I looked at the description, I found out that it was a log of how much wheat was sold in a transaction several thousand years ago. Why do you think we consider that kind of thing interesting?

If you apply this criterion consistently, nobody would be allowed to protest anything

It looks like everything after Dec. 11 2018 is slideshows. Is there a link to the minutes of those meetings?

I have a Digital ocean droplet that costs me $5/mo. I host a static site at https://mrosenberg.pub using Jekyll, nginx, and Lets Encrypt.

I can't find your claim in the linked Wikipedia page. What section?

That spurred a memory! I remember reading the pictured Head First HTML book cover to cover when I was younger. A big part of it was the jokes. I remember laughing out loud while reading the book, and I think it definitely positively affected my idea of how difficult content could be presented. Humor is an effective backdoor to get people to engage with otherwise difficult content.

age is the standard answer to this https://age-encryption.org/

Good question. There isn't really a great answer right now.

Matrix supports e2ee. Though I believe the only existing implementation is Riot-IM (which actually planned on stabilizing e2ee and making it default today, Apr. 16 https://github.com/vector-im/riot-web/issues/6779).

Also the MLS protocol (https://messaginglayersecurity.rocks/) will likely support federation once it's published, although it'll be a long while before people start implementing and federating it.

Looks like this is a PGP addon for existing email web interfaces. In case anyone is considering using this, they should first think about the strong recommendation to not use encrypted email https://latacora.micro.blog/2020/02/19/stop-using-encrypted....

To answer your question: the handling of medical data is governed by HIPPA. Everything else (outside banking data) in the US (outside of California) is pretty much fair game.

Ah, ok. So in that case, people would probably be have to be uncontactable by default (otherwise we'd be back to the current universe). Now you'll have to explicitly opt in to being contacted by every new person you meet. This is fine for some, but it's a massive usability tradeoff. Think about all the non-tehcnical people that Signal is intended to be used by, and imagine trying to teach them about Safety Numbers and a necessarily-opt-in contacting scheme.

I don't follow. I'm sending (or trying to send) messages to my contacts. If I know their phone number, I'm going to try to initiate a Signal conversation with them. So I ask the Signal server for a signed prekey. Your argument is that Signal should not respond with "I don't know this person" and should instead respond with something indistinguishable from a "real" response. So they must send me something that looks like a signed prekey, right? Well then I would use that in order to do a key exchange and now we're in the situation I described above.

Solution A does not compose well with how Signal does encryption. In order to make this indistinguishable, Signal would basically have to man-in-the-middle all non-existent users. And if one of those users signed up for Signal it would have to stop man-in-the-middling them, causing all the people who were talking with their ghost to observe a key change. It's complicated at best, and sketchy at worst.

Solution B ties in to a bigger argument I won't address

How would a messaging app work without contact discovery? You try a friend's number, and see if the message goes through? Well if that's what you want, then you can do this for all your phonebook numbers, and all the ones that go through are on Signal, and all the ones that error are not. Oops, you've reinvented contact discovery.

All this is technically true. As long as you believe that you will never ever under any circumstance send the same video chunk twice under the same key, you get all the security guarantees of a real CPA-secure (=> non-deterministic) symmetric cipher. But 1. I don't think this is a reasonable belief, and 2. even if it is, why chance it when you can use CTR mode and a random nonce, with practically zero overhead?

Do you think it should be restricted to SaaS? I know of some desktop software with free or discounted licensing that I'd like to share too

I agree there are complications that e2e adds that makes it pretty much unfeasible for something like Zoom. But why is client-side compression not a solution to the problem statement here?

Aha, looks like it's using a salt and iterated hashing under the hood. Thanks for the link.

It looks like you're storing an unsalted hash of the database's password in the plaintext header of the database itself. Is that correct? If so, this is a really really bad idea

Finite implies algebraic. The other comment says that the converse isn't true.

A nit:

"reals are a field extension of ℚ. They could be considered an algebraic number field..."

This is not an algebraic extension. Pi is a "useful real number" and it is not algebraic over Q.

Microphones pick up harmonics of the input frequencies. So if the ultrasound white noise is a multiple of the human voice range, it'll get let through.

IIRC Wikitribune fired its journalists is now WT.Social, a social networking site which requires a login to view the content of. I don't know what's on it.

Friends don't let friends use Telegram

https://threadreaderapp.com/thread/1129026681291911168.html

This is also true of the GUI. It's called Selective Sync

Why would you prefer this over, as another commenter already pointed out, a web standard like the CSS `prefers-color-scheme` media feature? A web feature like that works across websites, is better equipped to deal with user accessibility issues, and doesn't require Javascript.

Abstract:

Cryptography rearranges power: it configures who can do what, from what. This makes cryptography an inherently political tool, and it confers on the field an intrinsically moral dimension. The Snowden revelations motivate a reassessment of the political and moral positioning of cryptography. They lead one to ask if our inability to effectively address mass surveillance constitutes a failure of our field. I believe that it does. I call for a community-wide effort to develop more effective means to resist mass surveillance. I plead for a reinvention of our disciplinary culture to attend not only to puzzles and math, but, also, to the societal implications of our work.

Nice work! Off-topic but remember that you can get a surprising amount of analytics using just your web server logs and no JavaScript at all https://goaccess.io/

But being an ordinary relay means you are still being used as a hop for people to connect to hidden services. Do you think hidden services are less ethically dubious than clearnet services?