lucgommans

Does anyone know of a raspberry pi (or similar) webcam system that can upload an encrypted video stream to a server? Preferably a (any) plain file host rather than hosting some custom service, but I'm interested in either option.

I want to have an off-site backup of the security cam but preferably only access my camera data myself. That's what I'm always missing in these projects. There are dozens, perhaps hundreds of raspberry pi (security) camera setup tutorials and scripts with motion detection and all sorts of features, but I haven't found any that implement any sort of encryption, if they do uploading at all...

Grooveshark's was a beauty as well: xor 0x25

Wrote a blog post about it back in the day, for those wondering how to break (super easy) encryption: https://lgms.nl/blog-1-plain

That is the main factor indeed, but the other questions do change the amount by which you go above 50 a lot, and there are other paths to get to being predicted positive without having loss of smell or taste (LOST). From what I read and if I remember correctly, different studies say somewhere between half and a third of the people did not report LOST while they did have other symptoms (there are also completely asymptomatic cases of course, but that's iirc more like 1/5 to 1/10 of young people). Even if you have no LOST, the model can return positive, despite LOST being very characteristic.

I don't know why male/female or age matters, my best guess is that the younger males in their sample were more likely to have a positive test result. That seems like a pattern which would shift over time as the media claims different age groups cause it, different measures are taken, etc., but I'm not really qualified to question their results or change the model without (new, or so much as the original) data.

Paper on which the code is based: https://www.nature.com/articles/s41591-020-0916-2

The RIVM, the Dutch public health agency, referred me to this paper after I asked about combinations of symptoms (their website[1] only lists individual symptom occurrence percentages for seropositive and seronegative cases). Given that most people will not read a scientific paper and calculate that formula, I thought this might be helpful to others.

Disclaimer, as is also written on the site in bold and red: this is NOT validated or endorsed by the authors of that paper and this is NOT a replacement for a real COVID-19 test! The point is to give a rough indication using the same phrasing and exact model from the paper.

[1] https://www.rivm.nl/pienter-corona-studie/resultaten (Dutch, see "Tabel 1")

A girl I fancied in school used Linux (various distributions, installing new ones to try out was a hobby of hers). I had been meaning to try it out anyhow, but being able to impress her with Linux skills was the trigger to actually get into it. Also Python; she was also into Python and so I started on learning that as well.

Took me a few months to get settled, initially using Linux Mint, but I never looked back. I actually tried going back to Windows when buying a new laptop and the latest hardware just wasn't supported at all, figuring I'd just modify and tweak it in every possible way, but it is just too cumbersome and inflexible now that I'm used to Debian.

As for the girl, the impress-her part worked well enough I think but sadly we never got together and ended up losing touch. Sometimes I wonder if she's alive: accounts on all social media are inactive since years and while she didn't seem unhappy, she was an unusual person and didn't easily fit in with society. I hope she's okay.

Knowing Linux and Python are invaluable skills for the work I do now. If I hadn't started then, I would have had to catch up later or maybe ended up in a more standard tech job, so a head start there was definitely good to get a foot in the door at places that use both extensively in pentesting.

There are many legitimate uses for localStorage, e.g. see the API key field at https://beanstack.io (disclosure: a site I helped build): it will remember the value for you if you enter a value and hit submit. If you then, upon clicking submit, had to click through a browser pop-up asking if you want to let the website store data in your browser, that would feel like we're indeed tracking you when really what we're doing is trying to make your life easier without doing tracking. We could have used a cookie, but why should we if we can use localStorage which is privately yours and not sent to the server with every request?

Adding a warning upon localStorage would be like adding a warning upon setting cookies. The banners that websites add for setting non-essential cookies are annoying enough already without having to click past browser permission screens for essential cookies as well.

Also note that privacy laws or "cookie laws" don't ever mention the word cookie. If you are being tracked using localStorage, canvas fingerprinting, ETags, etc., they have to disclose the tracking. Not the method, I think, but what data they are collecting, for what purpose, with which retention period, and what their legal basis is (e.g. "we collect your address on the basis of fulfilling the contract to ship your package" or "we track you on the basis of consent"). LocalStorage is not something to be more or less afraid of than cookies, etags, etc.; the browser doesn't ask for those either, and I personally think that's better.

Yeah the plan is to eventually make it public, but for the moment I want to have a reasonable amount of data to make sure I'm capturing the right things. I mean, (x,y,time) is all there is to it, but perhaps I should be measuring it in some desktop software (where I might be able to capture the interrupts and their jitter) rather than just record the movements in javascript.

> wiggle the mouse for entropy

You don't have contact info in your profile, would you mind shooting me an email at mouserng-hnpublic@lucgommans.nl? As far as I could find, there has been no research into the randomness of those key-generating mouse movements, so I'm slowly (over months, probably will be years in the end) collecting data to finally do this. Collecting a trace for me shouldn't take more than two minutes of your time. (Anyone else who's interested is also welcome to mail me, by the way. The address will work for at least the next 7 days.)

Same here. It may be basic and crappy, but if you want to read an unsuccessful blog with no attempt at monetization or ads or even visitor counting, mine[1] is where you should feel right at home.

But I guess the author means a platform, not loose websites without a collective 'new' feed. I remember looking for one when wanting to make a new blog and I haven't found a platform that felt right, at least back then (probably ~2015). Heck, I couldn't even find software to install: everything is either super heavy stuff that requires caching or at least a beefy CPU to survive the HN homepage (with custom software, HN can be survived on an ancient Atom CPU even if you use PHP (also pre-PHP7) and do multiple SQL queries per pageload) or some static generators that I wasn't looking for.

Edit: While we're at it, another blog I read is Robert Heaton's one[2], and I'm subscribed to a few others but they don't seem to post anymore since I stopped getting email notifications. I remember Coding Horror[3] was also nice to read but he posts very infrequently now (for those who don't know, that's by the co-founder of Stack Overflow). Finally, Cryptography Engineering[4] might be nice if you're into that sort of thing. But I suppose those can all be mostly considered successful in that they all have a following.

[1] https://lucgommans.nl/blog

[2] https://robertheaton.com

[3] https://blog.codinghorror.com

[4] https://blog.cryptographyengineering.com

More info in a Dutch article on Tweakers (presumably from an article in Latvian that was linked): They have four planes and six vehicles looking for it, all carrying equipment that would allow them to control the drone again. One flight from China had to divert to another airport. People have reported sightings but they still can't find it.

Keybase Chat is audited and widely regarded as secure, but when prodding for details on how key verification works without human verification, people kept telling me that blockchain magic takes care of it. Eventually I did a deep dive and spent some hours trying to find any path through which the keys are reliably verified, resulting in the post as linked.

As far as I can tell, there is no key verification possible in the mobile app and it's basically "trust the server on first use" (TOFU; details are in the StackExchange question). I'm not saying that this is insecure per se, better use open source Keybase than some of the more popular apps, but they claim it's proper end to end encryption (E2EE). One might argue whether this can perhaps fall within the E2EE definition and shift the discussion to whether we should weaken the definition of E2EE to unambiguously include TOFU, but the question whether my analysis is correct remains: is there a way to verify Keybase's end-to-end encryption between me and a friend, or do I just have to trust the server's initial key?

It seems weird for Keybase to make a claim that is not in line with what I think is the common understanding of E2EE, so I'd love if someone else can also read all the docs and post an answer to either confirm it or prove it wrong. Maybe the Keybase authors could chip in, and one of the auditors is also the highest ranked user on the security stackexchange site so I had some hope that he would answer (I also sent him an email). It is now tied for the highest voted unanswered question on the site and someone opened a bounty on the question for more attention but it hasn't elicited answers so far (that's actually why I posted it here for attention: someone with only 100 rep whom I don't know opened a bounty for 50 rep, and I don't want it to go to waste). If someone here knows more, a definitive answer would be welcome!

Yes, that's one of the examples in the video, but thanks for sharing anyway :)

Have you watched the video?

I don't have the data to prove you right or wrong, but it does seem contrary to what the presenter states without giving a convincing argument why they are wrong.

Overly brief summary for those who can't watch the video with sound: it might seem that 'the poor' make bad choices and therefore they don't have money. However, research shows that this is not the case and that a basic income would help the rich and the poor alike.

Personal thoughts: the speaker presents the research as unequivocal and while I don't completely believe that we have enough data just yet, I do think these are some very strong indicators that we really should be giving this a try, either regional or country-wide, in one of the more pioneering countries. According to the speaker, in the end it should save money rather than cost money, so it sounds like it should be possible if we can get the political will together.

They weren't sued "anywhere": sued to hell just means they were sued out of existence -- and that is, literally, true. Or that's how I, as a non-native speaker, see it, and why I thought it was correct.

Well there is already a summary at the bottom, but I guess I should refer to it at the top. Thanks :)

Author here. Can confirm: you're right.

But I did learn a lot and will surely try this first in the future.

Should I have written on top that, if you're into crypto, you may want to skip to the summary?

I've actually written an article about this for the Dutch website security.nl two weeks ago. Looking at the facts alone, I find it far-fetched but most certainly feasible and it should be considered a possibility. So I disagree with anyone saying it's totally infeasible, but I'm skeptical about whether they really did go through the effort of doing this.

Dutch article: https://www.security.nl/artikel/47135/1/De_onzichtbare_backd...

English summary:

Intel included a new CPU instruction called RdRand as of their Ivy Bridge architecture. This RdRand instruction produces random numbers generated by the chip itself. However the issue with this kind of random number generation, especially since Intel says it's cryptographically secure, is that it can not be audited or verified. Sure we can run statistical analysis on it, but we cannot tell the difference between true randomness and the output of AES-CBC. Nowadays the output is mixed with the existing entropy sources in Linux, but in closed source systems such as Windows and OS X we don't know how RdRand's output is used.

I also mention the potential consequences of such a bug, which are rather wide-ranging. If RdRand's output is used directly then we can assume: if you have an Ivy Bridge CPU or newer, all your ssl/tls traffic can be decrypted (it needs randomness to setup a session). If the server that generated the private key was Ivy Bridge or newer, all traffic to and from that server can be forged. Furthermore, things like TCP sequence numbers or DNS source port numbers could be predicted, allowing offensive capabilities as well as passive cracking of our traffic.

Again, I'm personally skeptical about all of this, but the potential consequences are quite bad, and it's not all that hard to hide their tracks... I can provide a theoretical proof of concept on demand. The only thing I have to guess at is whether the CPU can maintain a state between power cycles, that question is best left for others to answer. It would not have to be large though, a few bytes is all it takes.