slasaus

Interesting. Good to see they seek information about systems that "are based on voters marking paper ballots".

Contrary to popular belief, in state or nation-wide elections paper is a safer way to vote than electronics because the former is simpler and thus easier to verify by the general public.

Most people don't realize how hard it is to beat the transparency and simplicity of a physical ballot box. It can be inspected by the public at the start of the day so anyone interested can verify it's empty and people can keep an eye on it during the day and see if anyone tampers with it. Then at the end of the day it's important the votes are manually tallied right after the ballot box is opened. This makes the process transparent to most people in society and assures the highest level of scrutiny and confidence that the vote and vote count are legit.

It's hard to replace this with anything more complex i.e. electronics.

For a recent discussion see:

https://news.ycombinator.com/item?id=10076919

"A major challenge we face is that many Firefox add-ons cannot possibly be built using either WebExtensions or the SDK as they currently exist. Over the coming year, we will seek feedback from the development community, and will continue to develop and extend the WebExtension API to support as much of the functionality needed by the most popular Firefox extensions as possible."

So to all extension developers leaning on the current permissive features or XUL/XPCOM, please contact Mozilla and help them with finalizing their WebExtension API in the upcoming year.

Also, in the future if all XUL in Firefox is replaced by browser.html, there might be full customization options again based on html/css/js (thanks to nwah1 for pointing that out).

"These results pose a challenge to those who wish to aggressively scale back incarceration, since the current politics of reducing sanctions for drug offenders is less complicated than that for reducing punishment for violent or property offenders."

I think there is an important difference between someone who is violent against other people versus someone who uses drugs (and might be violent in a sense to him/herself but no one else). So where "reducing sanctions for drug offenders" might be a novel thing to do, "reducing punishment for violent or property offenders" might not be. Apart from which one is "less complicated" or more efficient to the goal of scaling back incarceration.

Don't like the 10 vs. 20 year jump there, it would have been nice if they had added statistics for 2000 as well.

tl;dr: "Taken together, these findings suggest that the effects of the War on Drugs are often relatively slight compared to other causes, and that they are certainly not as big as many often assert. In reality, a majority of prison growth has come from locking up violent offenders, and a large majority of those admitted to prison never serve time for a drug charge, at least not as their “primary” charge. These results pose a challenge to those who wish to aggressively scale back incarceration, since the current politics of reducing sanctions for drug offenders is less complicated than that for reducing punishment for violent or property offenders. Reforming drug statutes is easier, but doing so will likely not effect significant change in the overall incarceration rate." p.6

Are you guys familiar with lowRISC.org and is your work maybe partly overlapping with their work? I read that your MISC design falls somewhere in the middle between RISC and CISC.

Mirror in the Netherlands, Amsterdam: http://controleerbareverkiezingen.nl/pub/PSJ2014_Hursti-MacA...

See this video from last December at the CCC in Berlin a famous research professor presents his findings: https://www.youtube.com/watch?v=JY_pHvhE4os

They filmed the whole NOC because they wanted to be transparent, but then it became clear there were passwords sticked on paper on the wall :) Never forget or undermine operational security.

All paper and pencil in The Netherlands after some techies realized black box voting is a dangerous thing. http://wijvertrouwenstemcomputersniet.nl/English

Although some people really want to get the electronics back so it's an ongoing battle of educating people (even most hackers and others in the security industry that did not think a lot about voting in particular).

About the dutch campaign in 2006: http://wijvertrouwenstemcomputersniet.nl/English

And about a follow up campaign in India with some of the same people: https://indiaevm.org/

Also see some recent research done with the Estonian e-voting system: https://www.youtube.com/watch?v=JY_pHvhE4os

That was not a pencil but still a lot of technology/mechanics. But you're right, paper and pencil are not perfect, just the most secure we can practically achieve these days and probably for the upcoming decade. See this video of J. Alex Halderman on e-voting in Estonia and about electronic voting in general [0]. (Halderman is a professor also known from the cold boot attack and the more recent vulnerabilities in a lot of Diffie-Hellman implementations).

https://www.youtube.com/watch?v=JY_pHvhE4os

For a related discussion see https://news.ycombinator.com/item?id=10076919

It was successful because they were able to detect if someone voted CDA (ChristenDemocratisch Appèl) because the "è" sent out a different radio wave that was detectable from a distance and broke voting secrecy. The main point, that electronics are orders of magnitude harder to secure because they are inherently more complex and less transparent than simple solutions like ballot boxes and voting on paper, is still not well understood in society and even not in the hacker community as you can read in most of the comments here.

> while you weren't looking

Well then you don't, and another requirement is that the voting stations may be accessed by the public from start till end. In that case each individual can verify for themselves that ballot boxes are empty at the start. That no one tampers with the ballot boxes during the day, and at night when the boxes are opened and the votes are being tallied.

It ends up a bit commercially, but they still make a valid point I think.

Don't forget Whisper Systems protocol used by TextSecure[1] which is based on Google's protobuf[2] and JSON in a REST api.

[1] https://github.com/WhisperSystems/TextSecure-Server/wiki/API...

[2] https://developers.google.com/protocol-buffers/

I personally found BSON* (or maybe protobuf) a better format for a wire protocol. I really miss support for a date type and binary data in JSON (for my own applications).

* http://bsonspec.org/

"making firefox less insecure": http://marc.info/?t=141616714600001&r=1&w=2

and for those who think lynx is a more secure alternative, read this thread: http://marc.info/?l=openbsd-tech&m=140516601718662&w=2

They will probably release a merged version in October which will be named Node.js 4.0 and will be supported for 2,5 years.

https://medium.com/@nodesource/essential-steps-long-term-sup...

Can you maybe elaborate on the main non-js vectors? I know image/video is one, is webgl/canvas maybe a big one? or webrtc? Or would you say js is by far the biggest vector? I currently browse with developer edition (daily patches) with noscript and requestpolicy to make firefox as secure as I can but I still feel using a browser, and Firefox in particular is very unsafe practice and the code is a mess. Am I right in this as far as you know?

I assume your point is about the first sentence of the article "This library was born out of a need to set up a secure channel over a TCP/IP network without the overhead of TLS.", but I interpreted this not in terms of performance, but in terms of lines of source code. OpenSSL in particular is pretty bloated [1].

[1] http://www.zdnet.com/article/openbsd-forks-prunes-fixes-open...

For those who just want to read about it, see http://nommu.org/

At first I was wondering if this was about http://riscv.org/ but it is not.

And see this recent patch [1] from an Oracle developer to make PF SMP proof. It's under review.

[1] http://marc.info/?t=143526332700004&r=1&w=2

See this follow-up as well "Ted Unangst: signify shortcomings": https://news.ycombinator.com/item?id=9721737

It's really a shame that there's still no good way to revoke a certificate [0].

Mozilla has been discussing it for years [1] but an implementation or even a chosen direction is far from reality.

[0] http://www.rfcreader.com/#rfc7525_line799

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=901698

a little tweak for nginx https redirection* , use:

> return 301 https://example.com$request_uri;

instead of the rewrite.

* http://wiki.nginx.org/Pitfalls#Server_Name

I really like the support for tls in syslogd. Unfortunately it looks like it is not yet supported server-side. At least in current, syslog.conf(5) doesn't mention anything about specifying a private key.

I've recently found out about Diceware and the importance of a strong password [1][2]. Often users choose a really weak password to begin with. I've read [3] that if you have a strong password (like a 7 word Diceware password) even MD4 or MD5 would suffice :O. I'm really curious if this is true.

[1] http://world.std.com/~reinhold/diceware.html

[2] https://firstlook.org/theintercept/2015/03/26/passphrases-ca...

[3] https://github.com/freedomofpress/securedrop/issues/180#issu...

ps. for those that use bcrypt and want to ensure a constant user experience on their server see https://www.npmjs.com/package/bcrypt-speed

That is not true. OpenNTPD is a server as well. Just put the following line in your /etc/ntpd.conf:

  listen on *

See ntpd.conf(5) for all options: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/...

From [1] I get that PHK decided not to use privilege separation because it's not portable enough. AFAIK that's one of the main differences between OpenNTPD and Ntimed. Well, that and precision of course. OpenNTPDs accuracy is "only" around milliseconds [2] (which is probably good enough for anyone not using dedicated time hardware like a stratum server). The portable version missed the frequency adjustment code for years, but recently this has been added to the portable version as well.

I've also read a discussion with PHK somewhere that he didn't like OpenNTPD because it had no auth (sorry, can't find the source again). I guess this complaint has been mitigated recently now that TLS auth is supported in OpenNTPD [3].

/edit: not sure if it's clear but I was comparing OpenNTPD to Ntimed. But the named differences still exist when compared to ntp4.

[1] http://phk.freebsd.dk/_downloads/FOSDEM_2015.pdf page 13 and 14

[2] http://www.bsdnow.tv/episodes/2015_02_11-time_for_a_change at 30:30 and 34:00

[3] http://undeadly.org/cgi?action=article&sid=20150210103656