nanoscopic

I don't think this can be done legally by enom. Domain registrars have to abide by certain rules in order to be able to register/transfer domains etc. If they break these rules they could lose their authority to be involved entirely.

I would suggest investigating what those rules actually are and report them to the main authority that handles .com registration. Since it was registered officially to you in whois, and you did pay, to my understanding that constitutes a valid ownership of the asset in question also.

Even if the rules say they can do it, since you paid, since you "got" the asset, and since you could have transferred the domain out before this occurred, I think you could legally sue in small claims court to have the domain returned to you.

Are you sure that the original author deleted the question, or was it a moderator? You may be pointing a finger at the wrong person.

Hacker news mods have repeatedly said that they only respect professionalism, and they intentionally ban people they feel are controversial to a strong degree. So long as this is true, you are going to lose the passionate 1% of the community. The passionate 1% are those who keep the rest of the riff raff in check ultimately.

As far as I am concerned, "Do you want X? This is how you get X."

If Hacker News wants to have people care, it has to allow differing and terrible opinions. This is the very basis of the notion of freedom and free speech. When you censor the community, the community will suffer.

Note that upvoting and downvoting, especially when done via groups of people determined to make their comments be heard, can itself tend to become a type of censorship ( mass downvoting ). Votes should be purely for the benefit of the original authors of the comments being voted on; not to move content around.

I already posted publicly online how to find the identity of a Tor user.

To reiterate:

1. Get the Tor user in question to visit a website controlled by you ( or at least a site where you can cause JS to run; such as an advertisement )

2. Know which ISP the user is on, and be allowed to install a high speed device watching all traffic for a sequence of specific sized packets.

3. Use the JS to send a specifically crafted sequence of sized packets with specific time periods in between them. After sending this preamble, send sized packets to send the 'pseudo identity' of the user ( whatever pseudonym you wish to attach back to their real IP )

4. Use your monitored ISP device to detect the preamble, then log IP and the data.

Note this method could be done en-masse and would only require high speed FPGA devices at each ISP "trunk". Inject JS code correlating users back for any system which you wish to identify the users.

Done. Whichever Russian demonstrates this and wins the $100k; throw me a bone please. :)

1. Document what you do extensively, including explanative screenshots if it involves UI components.

2. Give the documention to your employer ( it will be greatly appreciated )

3. Ask your direct superior if you can keep a copy just for personal reference

4. Unless your superior is a jerk, this will likely be given the ok.

5. Do so ( strictly speaking this is often illegal; but if superior approves... )

6. Use said documentation to write -new- documentation based off it off work hours ( clean room rewrite of docs essentially ) ( note that depending on what you signed, even these conceptual documentation rewrites may be illegal to share; you'll need to read what you sign )

7. Give rewritten un-infringing documentation to whoever you wish

It is possible to de-anonymise any Tor user if they have JS enabled and you have passive listeners at their ISP. See http://webcache.googleusercontent.com/search?q=cache:kVKMeKx...

The described attack on Tor may not be well known, but at the very least I told the FBI how to do it myself, so they certainly know about it.

What you mean to say is that all the hacker news bronies need their fill.

This is not item #4 hacker news worthy.

Hacker news commentary options on coding advice: 1. Spin the advice to make it sound like the advice is bad 2. Turn the advice around to make the author look bad 3. Criticize technology choices ( promoting your own choices of course ) 4. Some variant of "duh" or "don't reinvent the wheel" 5. Lament the sad realistic state of the programming world 6. Cast the author and others into various categories ( such as what I'm doing now )

If you read the wikipedia entry is says that the destination id is required. I assume these must be created somehow and communicated to the sender before being able to receive anything.

So long as this is occurring, the way the scheme works, unless you download every message, it could be determined which id belongs to whom. Once you determine that it is easy to track originating packets to that destination since it is not an onion system.

Additionally, without side channel communication ( in person or posting that address somewhere publicly ) it is impossible to anonymously communicate to an intended recipient.

Bitmessage is essentially a torrent server where everyone gets a copy of everyone elses emails, so you get your email by downloading all emails.

Unfortunately in such a system, you have to download all emails, or request what you want in order to actual get the email you want.

The system either does not scale, or will leak information in order to remove the requirement of getting everyone elses emails.

Also, the government can collect -all- of the encrypted messages easily, and potentially eventually correlate who an anonymous id is based on their knowledge of who received messages on which day.

Basically, it sucks.

There are two types of nodes in the system, "servers" and "users". All servers communicate with each other so that they are all aware of all existing "servers" globally. There will likely be a limit on who is allowed and authorized to be a server. ( likely a list of their public keys published to the main site for the project )

All packets must be hashed and authorized ( signed ) by the server before they can be sent out. Any packet not authorized by a server will be rejected. In this way, servers will rate limit originating packets.

The traffic is distinguishable because the onion layer is identified at each level. If, after unwrapping your layer, you discover the underlying "level" is not 1 less than your own informed level, the ip origination will be flagged back to the server for spamming.

Current estimate for number of onion levels is 100. Actual destination should be somewhere in the middle 60 or so, to prevent government tracing of the packet because all hops.

At each hop, random delays will be implemented, as well as injection of extra data and/or disguising the entire packets as other forms of tcp communication. ( to prevent dropping of the packets through filtering )

The "servers" know that users are sending out origination packets at a specific rate and to whom, but nothing about the layers beyond the first. Additionally, the entire onion packet is never sent to any server, only a hash of it with specific other information. This way, "servers" can never be accused of harboring illegal data of any sort.

Forwarding rates are measured because each onion layer containing a "message of receipt" that is sent back to the server. The server receieves all of those from the originating user before approving the onion packet.

The only think attackers of the system could try to do is attempt to DDOS users of the system. This is prevented inherently by it being known at all types all users logged into the system ( this is public knowledge in the system ). Communication is only allowed from valid behaving users.

I am a U.S. citizen. I still believe in freedom of speech, as well as my right to "Life, Liberty, and the pursuit of hapiness".

I am also a Libertarian, which means I don't believe in large government, due to the corruption that follows.

So long as my goals and beliefs are for freedom and privacy, the creation of secure anonymous messaging is of little interest to the NSA. Will they "like" if it is intentionally designed in a way that it could be used by criminals? No... But I should have no fear of that.

Just because guns can kill people doesn't mean you should use them for that. Just because atomic theory can be used to make large bombs doesn't mean nuclear energy is wrong. Just because pressure cookers contain heat well at pressure doesn't mean you should use them for anything besides cooking your food.

Fuck the NSA.

Dear NSA: I can and will be designing a fully anonymous open source distributed messaging system that is entirely secure even if you tap every line in the world. At the very best, you will be able to accuse people just of running the software. If you don't like this, I'd advise you that your only option is to hire me and/or pay be enough money to become disinterested in finishing the creation of the software.

The problem with this is that it is basically this "server x supposedly receives stuff and then sends stuff on without linking identities A and B".

What if I don't trust server X to really be doing that?

What if the government contacted owner of server X and altered the software not to do that?

The system I am designing keeps anonymity without any need to trust the server. Hence the name. Don't trust anyone.

Your final statement here is not true. The way in which you keep anonymity with an onion system is as follows: 1. Use a central originating server for onion packet sourcing 2. Make it public who all users are 3. Have onion packet creation contain "token of receipt" for all messages along the chain. 4. Rate limit message origination from users 5. Ban users who refuse to forward encrypted packets at a steady rate 6. Only allow small message sizes ( 10k ) 7. Have all online users constantly originate "bogus" packets to random users 8...

I am currently writing such a system. Some details up at circleofdistrust.com in about a month or so.

I am in the process of developing a new messaging system to address exactly that issue ( anonymous communication where it is unclear who is talking to who )

The way in which it will work is having all users of the system constantly send encrypted streams to each other ( mostly gibberish ). When you want to send a real message you simply replace the encrypted gibberish with some real content.

It will implement "onion" style repeated encryption to prevent direct links from being statistically analyzed as well.

Look for it in 6 months or so. Details will be up at circleofdistrust.com in about a month or so.

Correct me if I am wrong, but FXG files are an archive with an XML file and assets, just as xlsx files are.

How is this a problem? How could is possibly be easier to open a file in sqlite than it is to just extract the file into it's folder structure with any standard decompression software?

I don't know about you, but last time checked there is no easy way to open a file contained in a sqlite database in my editor directly. I for one would much prefer the archive method than using a sqlite database.

Also, I would rather edit xml, than edit a sqlite database. XML can be edited by any text editor. I'd say text editors are a bit more universal and widespread than sqlite editors.

Unless someone has a recording of exactly what was said and can convincingly argue that what was said was anything besides harmless immature humor; I think this whole situation is utterly retarded. 2 people fired? Because 1 person made a joke about forking and said something about "big dongles".

I think the immature people are the ones who think it is reasonable for people to lose their jobs over this.

I participated in AngelHack 2012 DC. It was at the Microsoft building. It was a fun time. The projects were mostly complete crap, but it was fun.

Here is hoping they are not lying about giving free tickets to the first 200 upvotes.

"There are no namespace declarations. No self-respecting XML parser will have anything to do with this XML data."

I would argue that any self respecting xml parser should parser it just find and shouldn't demand the namespaces to be defined at all.

"...invented their own ad hoc analogous namespace prefix, rather than understanding the role of elements in XML"

I don't think you understand the base concept of XML much. It is meant to be a generic container to hold whatever you want. XML in and of itself doesn't enforce node naming. Sure if you are talking about the official spec it does, but people pretty much globally use whatever node names they want. Don't have a cow.

"I haven’t been able to determine the intended encoding of the files"

Well maybe you should look into a parser that just parses as is without attempting to use some specific encoding.

Check out XML::Bare on cpan for perl. It will parse pretty much anything you throw at it, in any encoding. It leaves it up to you, the user, to decide what to do with the data after parsing.

A couple of flaws with this: 1. After being forced to type it in once, I would remember the password in the scrambled form 2. Cutting off active thought processes during mid-thought would cause certain ideas to be lost 3. If you work for an employer who expects you to work constantly, they are going to complain when you very clearly sit in front of a locked screen periodically.

This person may be "important", but a lot of the comments about languages seem to be borderline flamebait. Also, the mention of -many- languages, but the deliberate lack of any mention of Perl seems odd to me. I really dislike PHP myself, but there is no need to bash it.

As long as you only generate bitcoins, and then use those online, I think it would be hard to say that is money laundering of any sort. Many many many people do that, including myself, so bitcoins will never die.

The md5 and shuffling of the md5 hash before doing a sha1 is entirely pointless.

The salt generation looks acceptable though.

The op stated that he already created a system using bcrypt. The fact that op doesn't know what is wrong with Dave's code, and needs others to explain why Dave's code is bad, makes me lean towards op stfu and allow Dave to continue.

Op is unlikely to be any more competent compared to the somewhat incompetent Dave.

I agree that it is likely that op and Dave are one and the same, and think this mess of code is some sort of genius.

I would just like to point out that this "ebook" is not really free because it is licensed under CC BY-NC-ND; meaning you cannot make derivative works from it. Eg: If you take the contents of the website and turn it into an epub manually you cannot legally distribute said epub.

In fact, the only way you could distribute the contents is by having an identical mirror to the site.

Tldr: Explain why you want to go, and why you think you should be picked, and grouper may potentially fund a trip to hack stuff ( preferably their stuff but also your own )

My own question: What is the definition of a skilled hacker? Are they looking for white hat hackers? What sort of achievments would count to demonstrate this? Writing some great software? Full pen test analysis and attack vectors on some software?

Considering this is "hacker news" this is a pretty vague offer.