neutered_knot

It is also not proof of work because of asymmetries between attacker and defender. An attacker only needs to find one exploitable issue before the defender finds it and patches it, while the defender eventually needs to find all issues - and even then can't really be sure they remediated everything.

The defender also not only has to discover issues but get them deployed. Installing patches takes time, and once the patch is available, the attacker can use it to reverse engineer the exploit and use it attack unpatched systems. This is happening in a matter of hours these days, and AI can accelerate this.

It is also entirely possible that the defender will never create patches or users will never deploy patches to systems because it is not economically viable. Things like cheap IoT sensors can have vulnerabilities that don't get addressed because there is no profit in spending the tokens to find and fix flaws. Even if they were fixed, users might not know about patches or care to take the time to deploy them because they don't see it worth their time.

Yes, there are many major systems that do have the resources to do reviews and fix problems and deploy patches. But there is an enormous installed base of code that is going to be vulnerable for a long time.

I took my model Y in to the Tesla dealer yesterday for some minor repairs. It was taking longer than expected so they gave about 4 or 5 customers loaner cars so we could go do other stuff. Each of us got a Cybertruck.

It sort of speaks to the fact that it isn’t selling well that they are using them for loaners.

It’s a pretty unappealing car.

> So unless you’re hunting down someone selling enriched uranium, major abuse content producers/hosters, or something of that scale, putting in all that investment to gain a fuzzy data point that likely isn’t even useful in an enforcement context is just not worth the tradeoff.

But I don’t think we disagree. My view is that TOR is inadequate against a nation state attack because for some of these attacks it is easier to do mass de-anonymization and hope you get some particular user or set of users you are interested in. The resources to do this are small for something the scale of an intelligence agency, but excessively large for some local police department.

I’m not sure why you appear so hostile to citing attacks that are well-known and already part of the public threat model.

But you don't need all the hops. You can run a correlation attack (which has been long known):

https://github.com/Attacks-on-Tor/Attacks-on-Tor

and if you can get the guard and exit node for a clearnet connection and the guard, rendezvous point and exit for the onion service that can be enough.

I think that is referring to the node exit policy, which explicitly allows particular ports and IP addresses to be blocked.

https://support.torproject.org/relay-operators/exit-policies...

The documents you referred to just say you need to honor your own exit policy.

The site linked takes a shot at enumerating how unlikely it is. Do you claim it is wrong? If so, what is your calculated chance?

To me, TOR is not adequate to protect users targeted by a nation state who are the ones that TOR claims to be created for.

That’s not at all what I proposed. Not even close.

Edit: on second look I can see how you could think it was. I’m just proposing that if you run a node you be allowed to not become a rendezvous point for onion sites.

It is absolutely a design decision. I don’t understand though how allowing exit nodes to filter (by port and IP) doesn’t permit censorship but allowing internal nodes to not complete connections to onion sites does. I do understand that early nodes on the path are unaware of what the traffic but it seems pretty straightforward to allow nodes to not become rendezvous points for onion sites.

Your question made me curious so I tried to see what information about onion sites is available. It’s hard to measure onions sites by design, but

https://99firms.com/research/tor-stats

Says there seem to be about 65k onion sites.

This site:

https://protectchildren.ca/en/press-and-media/blog/2025/tor-...

Has some varying numbers depending on the observation time, but in final month listed saw 30k sites that had they identified as having CSAM.

I’m not sure how accurate either number is or if they are directly comparable but that would be a 50% of all onion sites ballpark.

Not sure how to measure general sites vs dedicated abuse sites.

I think the point is that exit node operators can filter traffic they don’t want to support. Guard and middle nodes are not given the same choice; they apparently must support all traffic or get booted. Why can’t other nodes have freedom to decide how they want to participate?

It’s a drop in the bucket for state actors who might want to find TORs target user base of dissidents, whistleblowers, and journalists.

A story from 2020 about how effective the US funded anti-screwworm program used to be.

https://www.theatlantic.com/science/archive/2020/05/flesh-ea...

Archive link: https://archive.ph/3sD9d

Pardon inbound

As depicted in the move "The Abyss". https://en.wikipedia.org/wiki/Liquid_breathing

Yes. I’m an academic computer scientist at a top-25 US university. I find that people in the field tend to be excessively critical and very often lack empathy. There is some culture of intellectual one-upmanship where it is more socially desirable to identify flaws and unhandled corner cases in an idea than to recognize some overall value that could be improved on. Perfection is very much the enemy of good enough or better than what we have now.

Ideas that survive are the ones that anticipate and pre-empt criticism rather than the ones that are creative or innovative. There is little consideration of ethics and value or harm to society.

Honestly, I think it is damaging to the field. It is very demoralizing for newcomers to be subject to repeated criticism and not encouragement. There isn’t much culture of mutual support. I’ve been told by NSF personnel at review panels that CS grants proposals get much lower review scores than those of other sciences because the CS reviewers are so critical and that’s problematic for the field as a whole because it was hard to justify finding proposals with low scores when the funds could go to higher scoring proposals in other fields (though this was many years ago).

So in short, yes, it is also my experience. I’ve worked around it by trying to work with people from other disciplines which have better cultures.

What was fascinating to me was that the first US commercial ship sunk by Germany was sunk on the south side of Australia! I found that by accident clicking around. Truly a world war, I suppose.

https://en.m.wikipedia.org/wiki/MS_City_of_Rayville

It depends on the sensor and probably the state of the subject. This is called "liveness detection" and there is an article I found explianing the basics at: https://www.thalesgroup.com/en/markets/digital-identity-and-...

I am tertiarily involved in some efforts to prosecute offenders in this area. I am not of aware what volume of traffic online would be these images, but am aware of some material in cases where people are caught and prosecuted. My understanding is that in actual prosecutions such images and videos are quite common.

I’m not advocating widespread filtering in this answer.

This article is essentially referring only to edge cases which require context to determine if images are CSAM. There are other cases where context is not needed and determining if something is CSAM is sadly easy.

For example, there is no appropriate context for images or videos of adults raping toddlers or infants.

I want to believe.

This article is from 2020. It may not represent anything current. It should be marked with the year on the headline.

I wonder if this is the "one weird hack" to expand the tax base of a country. Just grant citizenship, then start sending tax bills.

"Dear Mr. Musk, here is your Argentinian Citizenship! We welcome you with open arms! P.S. please note that as of 2020 we have in place a tax on high-wealth individuals. The appropriate agency will be in touch. Renouncing citizenship takes about a year"

A launcher is visible on Google Maps, and is still there. I drove by it today.

https://goo.gl/maps/LByxzGzqQ28ETtJb9

Archive link: https://archive.ph/bgYoq

I do code review for legal cases on occasion. When I do, and when possible as sometimes the tools I can use are specified before I get the job, I like to use doxygen (https://www.doxygen.nl/) to convert the code to html. It also creates call graphs.

It is nice because it links to function and method definitions where it can, so as I go through the code I open each function I am teaching in a new tab - the open tab set simulates the call stack.

I’m an academic computer scientist. I submit things I review through my institutions cheating detection system. I have found plagiarized submissions this way.

I was fortunate enough to have Randy as a teacher at UVa. He changed my life. Here is a note I sent him when I received tenure in computer science: --------- Hi,

I don't know if you would remember me, but I took a data structures class from you back in the late '80s, when you were a new professor at UVa. I was living in the Monroe Hill Residential College, and recall that you came to at least one dinner there as well as the intramural inner-tube water polo championship game our team played in.

I just wanted to drop you a note to let you know that taking that class ended up changing my life - slowly, but very positively. I was a (very bad) electrical engineering student at UVa, but your class got me hooked on computers. I initially did some programming, then went into the Army after undergrad. I found myself enjoying programming for fun, and after a few years went back to grad school, choosing CS over law school just because of my enjoyment of it. I was originally a master's student, but found a good advisor and liked research, and eventually got my PhD. I ended up taking a faculty position at , but disliked the midwest and large department, so after a couple of years there moved home to .

I recently received tenure and a promotion to Associate Professor of Computer Science at University, and am certain that I ended up here, doing what I love and loving what I do, because of your class. Here is what I wrote in my tenure statement about it:

"The positive example who most influenced my attitude to teaching was Randy Pausch, now at Carnegie Mellon University. I try to show my enthusiasm for teaching and for the material as much as he did. He related complex computer-science topics to real-world examples. He often had students perform amusing examples in class to demonstrate algorithms, and he kept the material at an appropriate level. Most importantly, he cared about students doing the best they could and was both challenging and supportive throughout the semester. I challenge my students to succeed, and work hard to be as supportive as he was."

So thanks! You made a big difference in my life, and I appreciate it very much.

There have been hypotheses in the past that this drug would help; at least one study didn't find that it helped.

https://www.clinicaltrials.gov/ct2/show/results/NCT01354444

It isn't clear to me how this differs from iocage, other than it expects to run on the loopback interface instead of the public one.

Would it still work if you use the method in the edit?