ergot

The IPB is slightly tainted by the Snowden disclosures. It's an interesting thought experiment to apply Snowden's revelations to newly implemented surveillance measures by any government. Snowden produced documents which gave us all an intimate understanding of the mechanics and operational details of the NSA & GCHQ. It is clear that the apparatus is already in place for spying and is only a quick click away from being galvanized by broad and sweeping laws which allow such apparatus to operate out in the open.

I think the masses are not scared enough to encrypt their communications and that's why such an apparatus has crept in so brashly and abruptly, sort of a 'surveillance creep'.

The moment the masses are conscious of the fact we are going through our second 'crypto war' is also the moment they might encrypt. Not that crypto is some munition they can use, as is wrongly spouted by the cypherpunks (IMHO), but that crypto can provide viable amounts of privacy for their needs and it doesn't need to be absolute privacy as spouted by the 'go dark' movement. Just enough that I can surf the web without my eyeball hours being monetized or that the pressure cooker I am interested in buying is not a potential tool to be used in a terrorist attack several weeks later.

> I’m afraid that my idea get stolen

https://sivers.org/multiply

My stock answer is always Memory by Association too.

Many names can be associated with objects and other conceptual links, only few names are unique enough so as to be hard to associate with already pre-cached objects in memory.

And if a name is so unique that it's hard to associate with pre-cached objects/concepts then even more of a reason to memorize it.

For example, 'Mark' would be easy as I just think of the person being an actual mark[1] and I want to pull a Con Trick on him/her, Kareem Abdul-Jabbar might be trickier.

[1]: https://en.wikipedia.org/wiki/Confidence_trick

You can still stand on the shoulders of others when you are a solo developer. That might sound obvious, but you can offload an enormous amount of brain-power to the work of others due to the neural nature of the net. I consider the net my 'exobrain' and it's worth learning how to get answers rapidly using multiple different search engines. Google is handy, but it's worth investigating the native search capabilities of other sites.

One obvious search mechanism is, of course, Stack Overflow. HN's Algolia search is another. Personally I run Searx[1] locally and permanently have it open when coding.

[1] https://github.com/asciimoo/searx

Mostly a nonsense. Can old people who don't understand how the Internet works stop creating laws and rules that govern it?

My question sounds ageist, but we are dealing with people who can't even move a mouse, and then are apt to incriminate innocent people because terrorism.

"One click encryption is one click too many" - Bruce Schneier

What does it do? The about link does not gracefully degrade when JavaScript is disabled, which is bad design.

Pop a PM to the creator Joshua Stein asking for a invite link then?

https://twitter.com/jcs

> realized it was invite only

Send a PM to the creator Joshua Stein asking for a invite link then?

https://twitter.com/jcs

> I've been poking around the various *chans to see if I can brave the noise and chaos

Make Overchan one of your hops, there's a huge updated list of chans there:

https://www.1ch.us/

Keep in mind a VPN is a single hop proxy, and not a multi-hop one like TOR which is a lot more rigorous than a VPN.

But if you must use a VPN:

Surf under generic domains like Reddit.com which frequently cite other domains/pages and frequently quote articles from specific resources. The VPN sees nothing as a result, just an encrypted connection to Reddit. It can't see what subreddits you peruse, and it can't see what citations / quoteables you're reading.

I quite enjoy this script called make_windows10_great_again.bat https://gist.github.com/IntergalacticApps/675339c2b805b4c9c6...

Keep in mind this is a very rigorous script and modifies Windows10 beyond recognition. Infact it kind of makes Win10 appear and function more like Windows8

Add to this the fact that real name policies are difficult to enforce and require ICANN to become a centralized legion of bureaucratic paperwork.

So if I mix ASCII with obscure UTF8 characters like the domain in OP's post I can register it then?

Something like www.ｐａｙpal.com --> www.n--pal-n76secrc.com

Most browsers should forcibly transcribe this to Punycode[1]:

    https://www.𝙿𝙰𝚈𝙿𝙰𝙻.com/

And yet when I paste this into the latest Firefox it redirects to https://www.paypal.com/

No 301 redirects or anything, the browser just treats it like ASCII, which it is clearly not, it actually happens to be Fullwidth:

https://en.wikipedia.org/wiki/Fullwidth_form

Serious phishing opportunity if you ask me!

[1] https://en.wikipedia.org/wiki/Punycode

Wow what an odd site

For me it just redirects to

    http://money.get.away.get.a.good.job.with.jack.ilovevitaly.com

The actual domain is http://xn--oogle-wmc.com/

Which is an Internationalized domain name[1] in punycode transcription

[1] https://en.wikipedia.org/wiki/Internationalized_domain_name

The G in question here is

https://en.wiktionary.org/wiki/%C9%A2

OR

http://charcod.es/#%C9%A2/610

Opening this in an airgapped machine

> I think I'm missing something pretty basic here

I'm referring to something like Powersploit https://github.com/PowerShellMafia/PowerSploit/

Which is a post exploitation tool. Assuming you have a payload in Windows ready to execute, one typically wants to leverage tools already in Windows itself, like Powershell, which can make rootkits and other payloads have a lot less footprint, and make them difficult to spot using heuristics. Most crap payloads are actually easy to spot because their payload is massive.

Essentially my point is that you don't want to make it easy for attackers. For context, one would not want Powershell installed on 1000 Windows 10 installations.

I happen to get paid good money for deploying Win10 kiosks in different offices in my area and Powershell is one of many tools I routinely remove from Windows to decrease the attack surface in Win

Powershell is very insecure and is heavily abused by potential attackers as it's more flexible than CMD.exe. Of course, arguing about CMD.exe vs PS.exe is pointless, but it still needs to be argued.

There has been a recent spate of talks in Blackhat conf. and other confs, about the versatility of PS.exe, how it is used to perform persistence in comparably little characters, or lines of script than CMD.exe

Some of my Win10 deployments even contain a script which silently disables PS.exe in the installation, and removes every reference to that executable in the registry. There are a few cases where I caught PS.exe re-spawning itself when a Win10 update arrives, so a PS-free deployment is hard to enforce.

Or just disable mp4, webm, flash altogether in about:config. I typically view media in specially sanctioned browsers, just for viewing rich media.

E.G Chrome on windows 10 hooked up to a 4K Acer monitor via HDMI

You can harden FF also and remove a few other annoyances like the default PDF reader, etc:

https://github.com/pyllyukko/user.js/

> I use a catch-all domain

Just make sure you renew the domain and maintain ownership. Even if the domain provider says they'll ensure ownership after expiration, I don't trust that they will. Assume the domain is ripe for new ownership by somebody else once it expires.

There are services like Mark Monitor which address this issue, but they are prohibitively expensive and only useful for large enterprise.

I usually break E-mail addresses into the following categories:

Monolithic. That one email address you put on business cards, hand out at conferences, post in public forums. Basically a catch-all that quickly becomes a firehose for spam and bacn[1] but every now and then you get an actual reachout as described in this post. They are infact gems when you get them, and always remind me how precious E-mail, as a loose social network, is.

Registrations. For creating throwaway accounts on various online social outlets. Got an IMGUR.com meme you must send to a friend over IM? No problem, your trusty registrations e-mail account, or account(s) have you covered.

Commerce. Super secure email address which is on a trusted provider, and is rarely, if ever, given out publicly. You change your password frequently on this, and make sure not to contaminate it with other identities. Typically tied to several accounts where money moves in them. Accounts with credit cards, PayPal, etc.

Others? I am interested to hear other people's single-duty uses for email? I know I could write about other categories, but those three cover a large portion of what I use E-mail for.

[1]: https://en.wikipedia.org/wiki/Bacn