obvio171

Much better discussion going on there :) Thanks for the link!

Technical paper in English: https://sites.google.com/site/dfaranha/pubs/aranha-karam-mir...

"This work presents a security analysis of the Brazilian voting machine software based on the the experience of the authors while participating of the 2nd Public Security Tests of the Electronic Voting System organized by the Superior Electoral Court (SEC), the national electoral authority. During the event, vulnerabilities in the software were detected and explored to allow recovery of the ballots in the order they were cast. We present scenarios where these vulnerabilities allow electoral fraud and suggestions to restore the security of the affected mechanisms. Additionally, other flaws in the software and its development process are discussed in detail."

Brazil uses an obsolete, inauditable, and closed-source voting machine.

Tomorrow we vote for president, governor, and Congress members, and the fate of our 200M people democracy depends exclusively on the security of this machine (it produces no independent physical evidence of the votes).

We know for a fact, though, from respected researcher and cryptographer Diego F. Aranha, that it is insecure[1].

(For the technically-inclined, let's just say that the ballot's secrecy is guarded by srand(time(null)). You can imagine the rest.)

It's been like this for 18 years. This year, we're doing something about it.

We've launched a campaign to raise awareness about the very real threat of large-scale, undetectable fraud, and it has so far been a huge success.

We've raised over twice the amount we asked for in our crowdfunding campaign[2].

We were featured in every major news outlet in the country[3].

We've built and deployed a mobile app for citizen inspection of poll tapes, and reached an install base that is estimated to cover a sample of over 20% of all electoral zones in the country, positively impacting the electoral transparency of over 40 million people.[4]

But it is not enough. The Brazilian government has had enough time and resources in its hands to convince the whole country that not only are the machines secure, but that they are also the envy of the world.

We've made an impact. In the past weeks, they've adapted their rhetoric from "unpenetrable" to "nothing is 100% secure"[5], but we still have a long way to go.

We're now faced with the very real possibility that they'll flex their PR muscles once again, shove this all under the rug, and not change a thing after elections are over and people have moved on.

You can make sure that doesn't happen.

International pressure and public shaming have done a great deal for citizens all over the world, proving the Internet's power to unite humans across borders for the good of one another.

You can do that for 200M Brazilians today. Please, read the article in the link above and, if you feel it's important, share it and upvote it.

If we can't be heard from the inside, let's be heard from the outside. You can be our voice.

Thank you so much!

-- References: [1]: https://sites.google.com/site/dfaranha/pubs/aranha-karam-mir... [2]: http://catarse.me/VoceFiscal [3]: https://www.google.com/search?hl=pt-BR&gl=br&tbm=nws&authuse... [4]: https://play.google.com/store/apps/details?id=org.vocefiscal [5]: http://eleicoes.uol.com.br/2014/noticias/2014/08/29/tse-suge...

That would be "as good as it gets" with current science, I guess, so it's great if we can get to that, but I think it's a little farther down on the technology horizon.

"the problem of chronic hunger is not lack of access to food. It's lack of money to purchase it."

The idea is exactly to think of ways for money not to be necessary.

It's been done before, albeit not by us.

Our atmosphere is one grand f*cking infrastructure project, and it's all free-to-breathe for everyone.

That would have to be thoroughly thought of to offer a simple solution, maybe even at the cost of defining stricter boundaries of what such services would be allowed to do.

But there's no reason why running servers should be so scary that only the powerful are able to run them. And "server" is not synonymous with "webhosting". There's a lot of p2p to be done if we want a decentralized internet.

I regularly run a Bittorrent "server" available to the internet and never had any problem. I also run a Ricochet "server" (also a p2p app), no headache either.

We have to get past the FUD and dig ourselves out of this hole.

You know what a killer app for this would be? An "app store" of stupidly-simple-to-use server software.

Routers are most people's only always ON computer, and having the ability to run decentralized applications on them like media, backups, microblogging, chat bouncers, etc. as easily as one would install a smartphone app could really tip the scale back toward the edges and away from centralized services.

Money can't be ignored though. There has to be a (cryptocurrency-y?) way for people to voluntarily "subscribe" to recurringly give money to developers of these services, and it has to be so simple that it's almost easier than not giving.

Costs could be offset by the user by renting out cpu/bandwidth/storage in a similarly one-click way by running specialized apps that handle that.

That's great news! From what I saw, it seems like you implement onion routing separately from the Tor network, right? Do you have plans to integrate this into the official network as a way to incentivize relays too?

That's great to hear! I haven't decided anything, I'm just more familiar with Tor and thought this would be something interesting to do with it. I'm not even building anything really, just getting feedback on the idea.

I don't see any antagonism between the two, and I'm glad to know there's something being done with I2P already, will check it out.

A Popcorn Time dev got in touch and showed interest in the idea, so it could be a great opportunity for the I2P community: https://twitter.com/xaiki/status/487732035331842048.

You should get in touch with them, I'd be thrilled to see this happen!

Btw, seems like Popcorn Time got removed from Github because of DMCA. Is that valid? The code wasn't pirated, so how does that make sense?

Is there any kind of connection privacy on cjdns? I'm not too familiar. With labels/studios spying on trackers/peers to go after downloaders, it's important to have that added security.

Which peers are connected to which, for example.

Hadn't heard of it, thanks for the link! Seems like it doesn't protect metadata though, does it?

This "Popcorn Tor" (too bad can't use the name ;)) could also soft-enforce some download limit based on the amount of traffic the user has relayed. Sane defaults and interface nudges can go a long way.

Here's a related way to maybe add a ton of new relays to the Tor network without having to go all "transparent through virtual network interface" right from the start:

1. Make a torrent tracker that serves out peer onion addresses (OAs?) instead of IPs;

2. Fork Popcorn Time, make it create a hidden service for itself and connect to the OA tracker;

3. Make the Popcorn Time fork also a relay by default. You'll add a lot of load to the network, so you have to give back.

Probably wouldn't be able to _stream_ anything, but otherwise should work.

Good point. If any sufficiently complicated NAT traversal solution ends up containing an ad hoc, informally-specified, bug-ridden, slow implementation of half of the hidden services protocol, might as well put our efforts into building out Tor itself and get the privacy for "free".

Those are very clever uses of this idea, glad to hear more people have thought of and run with it.

I hadn't given GeoIP much thought yet, but you make an excellent point. GeoIP determining citizenship and basic civil liberties is indeed crazy scary. Can't get more "the architecture is the truth" and "code is law" than that.

Let's hope someone smarter than me can figure out a good way to make this interface easier to use and more widespread, be it with a virtual network interface or not. It could just be a well-design, dead-simple API for building serverless/p2p apps on top of hidden services without knowing Tor, or a streamlined way to do tunneling as you're doing.

Thanks, I'll read them up. Skimming through, I saw this: "We [...] have built a system we have deployed on the Tor anonymity network [8] and on PlanetLab [13]."

Do you know if it's still alive or what happened to it? Was it released/adopted at all?

That could also work. You lose all the anonymity though, so only makes sense for when you need bandwidth and opt out of privacy. You could have separate virtual network interfaces for the different use cases.

I like this model, because then you have a scarce resource (albeit artificially so) that costs you nothing to make more of and you can use it to encourage users to do stuff you want, like inviting others. You could very well do it Dropbox style: you get 500 posts for every friend who signs up, and they get 500 too (starting out with 3500 in your example). It's not spamming if there's a gift.

If there's a "Like" or "retweet" equivalent you might also get extra posts for that (like you get more credits to post questions on Quora when people upvote your answers or follow your questions).

It seems like they're paying to post updates. It will be read-only of public posts for non-members.

Or if it shows that 10-50k is not a critical mass for a social product.

The original post by Dalton mentions freemium services such as Github and Dropbox as examples, so following a similar model and charging for certain features might allow for network effects to happen (although those examples aren't nearly as dependent on that).

Sure. I'm helder, the domain is on my profile description here on HN.

You plan to have an SLA? That would be a game changer. In-city delivery API, guaranteed.

Add Lockitron[1] to the mix with secure boxes for pick up and delivery and you got a winner.

[1]: https://lockitron.com/

Being the killer feature on the upgrade, I definitely agree they should've made it clearer that they don't support non-US addresses. I don't expect Yelp recommendations and other such things to work, but maps and routes is something that's pretty well developed in a huge part of the world and already works on the normal Maps app.

I'd pay for a "Kindle highlights & notes, for groups." I very often have the "everyone in my team must read this book" impulse, buy a bunch of copies, and then it's really hard to sync who's where, what they're finding interesting and to share notes.

The notes you take for yourself aren't the same ones you'd take for/with your team (imagine highlighting something and saying "see @jack, this has everything to do with what we were discussing on that project", it'd be awesome).

Besides Meridian (the app mentioned in the article), the guys at Building Layer (http://buildinglayer.com/) are also doing some pretty interesting stuff. They totally nailed the pitch at Vator Splash and already custom-made Microsoft Surface solutions for some hospitals and other places. It's a very interesting space!

Oh no, not now, not yet!

Search is indeed a real big one. Google built Chrome and Android just so they could control the search box. Siri did away with the search box. That's crossing a moat.