eddieoz

In a world where US and EU are willing to ban Signal because it doesn't allow a 'master key', Zoom is the BFF of governments and regulators.

"[S]ince at least 2016, Zoom misled users by touting that it offered 'end-to-end, 256-bit encryption' to secure users' communications, when in fact it provided a lower level of security," the FTC said today in the announcement of its complaint against Zoom and the tentative settlement. Despite promising end-to-end encryption, the FTC said that "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised."

That's the concept of E2Z2EE (End2Zoom2End Encryption)

I think they are just being posers. When we compare the efficiency of debugging (p. ex.) it is clear who can find the problem fast.

Today if I'm conducting an interview and the someone tries to convince me he/she is a good programmer and just use vi/vim, I need to rethink my decision because it can compromise the whole project. I'm not saying they are not good, but having the capability of fast debugging and solving problems fast is crucial sometimes and is part of the whole package.

I was that kind of person someday and I understand the feeling.

But for devops, vim or emacs are the all-in-hands tool and everyday editor, just because they are available in everywhere and work very well on terminal mode.

Interesting perspective because as the term has been written, it can be used to invert the logic and exclude such groups of the rule.

> "From a reporting perspective, this means you cannot log and report on the full URLs of QUIC traffic, such as Google Search or YouTube, meaning search term alerts, or viewing a list of YouTube videos watched is not possible when QUIC is enabled. Since the different firewalls do not recognize QUIC traffic as web traffic, they typically only log the traffic in their firewall log as generic UDP traffic. This means that the rich logging data we expect from HTTP traffic is not generated, logged or sent out via syslog."

Until being officially supported, many website exploits will bypass the firewalls, which will not be able even to detect them.

> "McGraw installed a program to the machines that enabled him to remotely access the computers, including the clinic’s heating, ventilation, and air conditioning (HVAC) computer and the nurse’s station computer. Additionally, McGraw installed a botnet to some of the computers to subsequently use it to initiate denial of service attacks (DDoS) on the websites of rival hacker groups, on July 4, or as he called it, the “Devil’s Night.”"

That's what he did. But how should 'the justice' define the sentence?

> "How do they write the right stuff?

The answer is, it’s the process. The group’s most important creation is not the perfect software they write — it’s the process they invented that writes the perfect software.

It’s the process that allows them to live normal lives, to set deadlines they actually meet, to stay on budget, to deliver software that does exactly what it promises. It’s the process that defines what these coders in the flat plains of southeast suburban Houston know that everyone else in the software world is still groping for. It’s the process that offers a template for any creative enterprise that’s looking for a method to produce consistent – and consistently improving — quality."

I think here it is part of the solution. The team culture should be strong as also, to achieve a good software.

> "The upshot is that if you don’t trust any of your workers (public choice theory, again) and do trust the managerial elite to be able to run all industries equally, then you can just do whatever you want and blame the inevitable failure on the workers being too stupid or incompetent."

Strong statement.

> "has entered Phase II of its Small Business Innovation Research (SBIR) USAF project with a renewed mandate to investigate blockchain’s military supply chain value propositions."

I think the title of the article is imprecise because it is suggesting they will build something, but that budget is just for investigating the value proposition.

Working for many years on startups, normally we need to find the value proposition before.

Maybe you don't need physical access, but through some RCE and then inject the module.

As a demo of a web application, it works very well. But definitely not for playing yet.

> “When the level of spam activity is very high, the size of the history gets disproportionately large given the amount of useful activity on the network. This makes such blockchains much more difficult to analyze and reason about.”

> Write down anything that’s taking up mental RAM, whether it seems related or interesting or not. If you find you’re doing this a lot, consider you might have a secret goal you don’t know about.

Basically I do the same using Kindle, with the plus of getting everything on my email after, for reviewing.

And moving yuan to digital is the biggest move against the dollar.

Instead of doing a lot of conversions, or using 3rd parties, Chinese industry will start to only receive yuan near in future because it is easier, faster and more secure to them.

"Staff determined that Quadriga collapsed due to a fraud committed by Cotten. Cotten opened accounts under aliases and credited himself with fictitious currency and crypto asset balances, which he traded with unsuspecting Quadriga clients. Cotten sustained real losses when the price of crypto assets changed, thereby creating a shortfall in assets available to satisfy client withdrawals. Cotten covered this shortfall with other clients’ deposits – in effect, operating a Ponzi scheme. Staff calculated that the bulk of the $169 million in client losses – approximately $115 million – arose from Cotten’s fraudulent trading."

I used BigBlueButton between 2010-2013 for remote training classes on OZ Technology.

The infrastructure was built over AWS, automatically stopping the servers after all people leaving the channels. For starting it, it was monitoring the training schedule and 'opening/loading' the channel a few moments before the class start.

Cheap, open-source and reliable.

I'm building a decentralised blog, blockchain + ipfs based.

As I'm using markdown as the example above, probably I can apply this method to update the search database index when the post is published, and then enable the client-side search in the platform.

I'll try it using this approach.

https://github.com/eddieoz/549-personal-dx-blog dex blog: eddieoz.com (or eddieoz.crypto using unstoppable extension)

"Instead, the style guide suggests those systems should be labeled as "partially" automated or as an advanced driving assistant." - It could be something like a driver assistant system, but semi-autonomous would mislead people, imo.

I searched their wikipedia page (https://en.wikipedia.org/wiki/GnuTLS) and there are many applications that rely on gnutls: GNOME, CenterIM, Exim, Weechat, Mutt, Wireshark, slrn, Lynx, CUPS, gnoMint, GNU Emacs, Synology DiskStation Manager, OpenConnect

The discussion and pressure always start on the engineers' side, but normally they don't consider it is different to build a system from scratch using the technology or migrating.

The article is clear: Coinbase has a very strong, tested and validated infrastructure and moving to Kubernetes 'just to be part of the hype' does not bring any benefits at this point. And a statement like that is a nightmare to some DevOps.

With solutions like that getting more popular, it will reflect in the future price of our expensive noise-cancelling headphones :)

The only problem with Twitter doing fact-check was they were unilateral and biased. If they were neutral, probably they could to the fact-checking without problems.

Definitely it is not the place to be if you want some privacy.

Dollar shortage and stable coins are the keys to increasing the use of alternative currencies (cryptocurrencies in this case)

Improving usability will open access to African countries, who are starting to understand better and using this kind of technology.

When they have a fractured bank system plus a very weak currency, it opens the door for new opportunities. If Bitcoin is the best I don't know, but it is always called first.

Yes, I got the point. The approach is every bidder doing the zkproof to create a receipt of their bid because the auction will end at some point in the future. I understand it works very well, and it is the most used approach.

I was wondering about the possibility of another approach and my point was creating just the winner zkproof on the auction side (not bidder side), at the end of the auction. If all the bidders used some stealth method plus homomorphic encryption, the bids could be hidden and maybe they could receive the 'winner zkproof bid receipt' and check it against their very own bid. Then the winner could be able to prove it being the owner of the keys who delivered the stealth bid which won the auction.

I read the paper again and understood their approach. It is clear why they are doing the zkproof for every participant in that context.

Attack architecture

Erebus falls under the general “man-in-middle” attack scheme made possible through the P2P nature of bitcoin. Greek for “shadow,” Erebus is itself a derivative of the “Eclipse” attack first described in 2015.

As theorized, the malicious actor will try and connect to as many nodes as possible around one node that the attacker wishes to isolate (an exchange’s node, for example). The malicious node can begin to influence the victim node by connecting to its peers. The end goal is to make the victim node’s eight external connections pass through the malicious party.

Once accomplished, the victim is isolated from the rest of the network. The malicious actor can decide what transactions and information are sent to the victim; this information can be completely different from the rest of the network and could even lead to a chain split or censorship.

But was it discontinued?

I was looking into their terms (https://keybase.io/docs/terms) and they should notify before it. And seems my account is up over there.

Craig: "No message was signed, you can't sign anonymously - you have to have an identity to sign....key doesn't count"

Does he really know about how a digital signature work?

For who doesn't know about this case: Someone signed a message using the keys of some wallets Craig Wright used in court proceedings, saying they were owned by him.

https://gateway.ipfs.io/ipfs/QmWFr2UgfdeDngad8W8AEVejyQyW4FB...

Agreed, but a server turned off has lower risks to leak information. And I think also they bought the expertise of the team to improve zoom, more than getting the solution per se. It will take some months to have this question answered (about what will really happen to keybase)