palisade

Dropbox isn't secure. They have a master key override and have many times already unlocked boxes without the user's permission. Also, they cache your credentials, anyone who gets a hold of the cache file can put it on another machine and get into the box without authenticating.

The use case I gave is: You lost your backups and your main, now what? You're done. Firesale on your life or business. Backups are something everyone has to contend with in any situation, but it isn't one that has been completely solved in the security industry yet in a way that is acceptable or uniform in any way. The average user just doesn't have a clear system for providing a high level of protection for both their security and ensuring they have redundancy in their life or livelihood.

There are lots of different ways to skin a cat but no one has established a definitive solution or made it easy or obvious. Something like a YubiKey is only one part of a solution, and without something more you are at risk. Or, perhaps there's a way to create an encryption with redundancies built in so you're never in that situation to begin with. What if the concept of a backup was built into the key exchange and losing your original didn't necessarily lock you out.

Hm, I suppose, though that is the functionality the poster I was replying to was discussing. Though, one has to wonder, what other flaws are lurking below the surface on that chip. It isn't flawless. Once there is another major issue it is going to be an abandon ship type of situation. What are the alternatives if any, move to a new key that doesn't have the problem or look into an alternative means, etc.

I think drcongo's point is that if an operative meets someone at the pub and swaps out a similar looking fob on his keychain for one that contains a virus. It doesn't matter if you only "pwned" a single device, you're in the network and it is time to start exploring.

Yea, except YubiKey got compromised.

https://www.yubico.com/support/security-advisories/ysa-2017-...

And, if you lose your fob or your backup fob you're boned.

YMD is the only sane format. When you sort, you can sort by the year, followed by month and day. I do this a lot with folder names or log file names in directories, file system creation/modified dates don't always match reality. e.g. a folder named 2018-01-07 is entirely readable to anyone who looks at it, but at the same time easily sorted.

During an interview I had at Discord recently the lead engineer mentioned they had exceeded 130 million users. Though, there was also a recent bump by almost 70 million people that left Skype and joined Discord in the news recently as well. He told me that Skype is the 800 pound gorilla to beat and that they have around 300 million users or something. They're definitely gunning for them, and Microsoft has changed Skype so much that they've alienated much of their user base in addition to having lots of security flaws. Discord touts their security, two factor auth, IP address hiding, plus having all the features of Skype in addition to the concept of slack-like chat rooms. More than just gamers are starting to use it.

https://variety.com/2018/gaming/news/discord-turns-three-120...

At the moment, Discord is ad-free and other than Nitro subscriptions which let you have animated profile images and use emoticons in any server, which he admitted was an almost unnoticeable revenue stream at the moment, they don't really have a way to monetize the platform. When I asked how they were planning to generate revenue and whether my job would be secure he said they haven't settled on any ideas yet but have a few bouncing around that he wouldn't tell me.

He mentioned that once they reach 600 million users they consider that the break-even point where they've succeeded as a platform and can start considering putting possible plans into action. My guess is that advertising will play a big part, and possibly various other techniques like microtransactions, platform integrations, affiliates, partnership deals, content distribution (movies, music, games), etc. It is probably the break point at which you can afford to anger a percentage of your users in exchange for enough revenue to establish themselves as a self-sufficient organization.

I made a thing. To wrap my head around the Milankovitch cycles. https://i.imgur.com/V3RIKL5.png

Due to the acidification of the ocean, there's an overpopulation of squid in the seas. It would actually be beneficial if people started eating more of them, because they're predators of other fish species that we ourselves are already overfishing. Note: I'm not an environmentalist, it is just something I noticed.

The objections to the project internally could have been brewing for years, though.

They changed to "Do the right thing" from "Don't be evil" back in 2015 long before the 3000+ employee protest against the Pentagon drone project. I doubt this is the event that triggered the change in stance.

Clearly they're trying to guide internal ethics. "Don't be evil." suggests that it is forbidden to be evil in all circumstances. How to read the new guideline: "Do the right thing, even if sometimes it requires evil." Some big event inside must have triggered this change in stance. Like a letter requesting they capitulate on some requirement to protect or give up user data, reveal whereabouts, key escrow, or something like that.

I guess what is confusing is how subjective "the right thing" can be. If an employee were to cite this new slogan and try to address a problem with it, is the right thing to capitulate or to defend. Who is to say really.

It almost seems like it is reworded to be more vague so higher ups can just wave their hands and say these aren't the droids you're looking for. But, are they waving their hands at employees protesting the mistreatment of customer data and privacy? Or, are they waving their hands at the powers that be who want unfettered access? I guess time will tell.

This is a pretty touching story. John has definitely been one of my heroes for a long time in the field as has Steve. At the end of the day, they're human. It sucks that he regrets not getting back in touch with Steve before his passing. We can't turn back time unfortunately. I guess the lesson here is we can get focused on the hero worship and the little details and forget we are dealing with someone's ego and feelings. Some constructive criticism from John and a declined phone call broke up their relationship. :(

Steve could be rough to work with but they obviously had respect for one another, so it is sad to see in the end there was some bad blood. At least John tried to get back in touch. I think the line at the end really says it all, "...but elements of the path that led to where I am today were contingent on the dents he left in the universe. I showed up for him."

Edit: If you're reading this John, thank you for all the gaming joy you've given the world over the years. I remember asking you programming questions and you were always responsive. You've left dents for others too.

Edit: Regarding the snide comment Steve made that you could write your own OS. He might have secretly feared you would. He knew you could.

4. The Savant: Also known as the absent minded professor. You could throw questions at this person in an interview and they will seem completely inadequate and unprepared. But, then apply them to a problem on the job and like a juggernaut they will defeat any obstacle. They will even solve problems your best engineers have been struggling with for years without breaking a sweat. A lot of companies make the mistake of weeding this type of engineer out in the interview process.

Learning how it used to be done isn't a bad thing, though. Because when you need to maintain code that existed before modern C++, of which there is much, you'll be ready.

Yea. Overly paranoid. You guys were surely messing with him all the time. The paranoia was probably justified.

Edit: At one of my jobs I had a coworker that put a program he wrote himself on my computer that slowly ate up cpu cycles until the machine seized up and froze. I always carefully locked my machine and out of "paranoia" I had usb autoplay disabled. That was long before this became standard practice in the workplace. He got it onto my computer remotely by exploiting a zero day flaw he had read about in the vmware driver at the time. Which I was using to get actual work done while he was sitting idly by. He thought it was hilarious. I was let go about a month later when I completed all of my tasks ahead of the delivery date. He ended up getting promoted to a senior position by accomplishing nothing and playing pranks.

At another job, some coworkers impersonated my boss by signing up for a google account with his real name and using that to register to the internal business chat system which apparently allowed that. And, then used it to yell at me with profanity that I wasn't working hard. It led to me writing a polite email to my actual boss stating that I was working hard and the profanity wasn't professional or appreciated. I ended up getting terminated over it. They're still there.

That is a weird way to look at it. Companies that used IBM hardware and services became successful. If anything they became locked into success with a reliable business partner. It is odd to look at that as a negative thing. Likewise, Amazon has built a reliable and professional platform for cloud computing that is guaranteed to make your business successful for years to come. Why wouldn't you want that? What is the disadvantage really to becoming reliant on a superior architecture and support structure.

Discord

Edit: The only thing it doesn't do in your list is call a phone number at the moment. Though, I heard about a bot that can make calls for you not sure if it works.

I left that out in my post because I've moved on. I may seem a bit triggered, but that is because reading about this Void project possibly doing the same thing to someone else right here in such public view just brought back strong memories. What the void guys are doing is clearly wrong, they should fork with another name, with a separate website, github, mailing list, etc. If the users want to follow them they will. Performing a takeover, even if the guy really is missing, is underhanded. If you see any project doing this, it should set off alarm bells. And, the open source community as a whole should start digging into some of these projects and see if proper attribution is being given. Because, I can guarantee there's a percent of those of us who were erased for political or personal reasons. I made peace with my exit, others might still be clenching their fists over it.

They may have tossed him out of the company but he still gets credit for having created it, and saving it again later. These guys wiped me from open source history. When you aren't making money, credit is one of the few perks. But, I get your point.

Sourceforge did this to me a few decades ago. I had created an open source project and was leading a group of developers. I told my group I'd be out of town for a week on vacation. Some members decided they wanted control of the project so they told sourceforge I abandoned it, which wasn't true of course. When I got back, sourceforge wouldn't hand control back to me. It turned me off open source to be honest. At that point I backed out of any other projects I had founded or was participating in. I then dove headlong into proprietary software as a career.

You can argue that it's open and one should be okay with that kind of behavior. But, imagine if Linus lost complete control of Linux, repository, websites, mailing lists and the group and was pushed to the side. We wouldn't have Linux today as we know it.

You can fork if this happens to you. But, the team members who wanted the project could have forked. They only performed a takeover because they wanted power and all the spoils of the effort that went into building the group, website, the name, developers, the claim of being the original project, social connections and user base. They also wanted to erase me from the history of the project. I was wiped out of the AUTHORS file. They had control of the blog entries, its message and direction of the project. It is dirty, underhanded and I am sure I am not the only one who it has happened to.

Not helping them improve precision of the drone strikes reduces the precision of those strikes which leads to more innocent lives lost as collateral. An argument could be made that using AI to improve surgical strike capability of drones would be the lesser of the two evils. Seems misguided, no pun intended.

Also, Google dropped the slogan "Don't be evil" in favor of "Do the right thing." Not that it matters because they barely followed it anyway.

Is that Russian ship still parked nearby? I recall reading about that a while back. Maybe that's where the signal is coming from. https://www.cnn.com/2018/01/22/politics/russia-spy-ship-us-c...

I've been warning friends and family about it for years back before it was well known, my first email about it was 2015. Their reaction has been one of three things; you're too paranoid, who cares so what, and stop talking to me. I've always made a variety of suggestions and updates on general security issues, even beyond the Intel ME problem, to friends/family via email.

It is not just a matter of apathy. They get violently ill at being told to think about protecting themselves. If you tell them not to put their debit card into an ATM without giving the card reader a tug to see if its real first for example, they'll do it wrong anyway just to spite you. It isn't that giving the tug is hard or that it isn't wise, but they simply do not want you to be right or have to think about it.

Admitting that you are right about that one little thing means they have to deal with all the other issues that you brought up as well. There is probably an interesting field of psychology to be researched with just that phenomena alone. I don't think this is just the people I know personally because I've encountered a lot the public who has this mindset as well. It is how we got ourselves into these problems in the first place with no recourse.

I stopped sending the emails about a year ago because they asked me to. The reason stated is that no one cares about security and a number of them had already auto-forwarded me to the junk folder. Or, told me they saw my name and would skip my emails and not open them. I don't even feel like bringing it up again now that it is a going concern. They will continue to not care.

I find it frustrating.

EDIT: I've disabled Intel ME on my machines. I would offer to do it for others but they'd have to acknowledge it's something that concerns them to want that help, and they won't.

And, some of the best products ever created were written without agile. How did we ever manage. I don't like it when people tell an engineer they're wasting the company time because they implemented something no one asked for. Usually, the customer or client needed that and didn't realize it. And, it bites them in the ass later if they don't.

Alphabet held back robotics by purchasing a military industrial complex corp that produced excellent terminators and then couldn't handle the backlash from the public when videos started coming out of scary bipedal robots that could bring about the apocalypse.

They proceeded to tell their engineers to "cut it out" and started creating parameters like, "no more bipedal robots" and "stop scaring the public." And, actually, their engineers ignored them and kept doing it, which annoyed Alphabet further so they put additional pressure to stop work in that direction. Though, the irony is that this led to a pretty awesome terminator bot that uses wheels, moves ridiculously fast, can jump and balance better than their bipedal robots and therefore become your friend faster.

I don't personally feel they've held back robotics as an actual field, because the progress continued internally in spite of Alphabet's mismanagement and fear. However, Alphabet suppressed those robots from becoming mainstream products because they weren't the products they wanted and they were very sensitive about the impact on their public image.

That division fully had the capability to release robots that could help people or industries in various ways; military (pack bots, soldiers), police (peacekeepers), steal your job bots, medical (bots that help lift people out of bed, or keep old people from wandering out of their prisons), pets (pet dogs, cheetahs that can hunt down your ex with speed and accuracy, a spider that can climb in bed with you and inject you with life saving chemicals that extends your life before giving you a hug goodnight), companions (definitely think sexual here, perhaps even combined with some of those pet ideas), and so on.

It might have begat the dystopian future that keeps many of us, or just Elon Musk, awake at night. And, if that's the case be thankful Alphabet couldn't manage to get much into production.

The only real way they've held back robotics is by never releasing anything, beyond previous commitments of course.

The common advice of, "You'll never know enough to use them safely so don't bother trying, just trust us." that has been going around has been proven itself to weaken encryption.

Just recently, an amateur programmer with very little background in cryptography discovered a flaw in libsodium in the Argon2 implementation and also in the reference implementation that everyone in the world was trusting without question. My advice is if you're an engineer, don't be afraid to write your own implementation of tried and trusted ciphers. This is how we find bugs and improve. This isn't the only trusted library or algorithm that has been shown flawed in recent times.

The strength of your cipher implementation can be tested and proven. We need to stop telling everyone these algorithms are absolutely trustworthy so don't try understanding them or implementing them. Nothing ever advances or improves that way. Buck the trends, create competing libraries, try new things.

The ancient ones were not all knowing, they were doing everything wrong. Their designs are full of flaws. Deny them. We need to code ourselves out of the coming cryptographic apocalypse. Do not hide your heads in the sand and hope the world doesn't come crashing down around you.

Edit: I found the blog/website of the man I mentioned in this comment who discovered the Argon2 flaw.

http://loup-vaillant.fr/articles/implemented-my-own-crypto

In his own words, "There's something worrying about this bug: I was the first to discover it, in January 2017. According to Khovratovich himself, it was two years old. Now I understand why the authors themselves didn't find it: unlike me, they didn't have a reference implementation to compare to.

What I don't understand is, how come nobody else discovered this bug? If you implement Argon2 from spec, you cannot miss it. Test vectors won't match, and searching for the cause will naturally lead to this bug. I can draw only one conclusion from this:

I'm the first to independently re-implement Argon2. This 'never implement your own crypto' business went a little too far."