• 0 Posts
  • 171 Comments
Joined 3 years ago
cake
Cake day: January 17th, 2022

help-circle
  • Buying other hardware that you (well… not me ;) can inspect and verify, e.g RISC?

    For now the performances are pretty terrible BUT one can imagine, assuming they have the right discipline and mental model doing what’s actually personal on a verifiable processor, e.g browsing and reading emails, and what’s not, e.g watching a TV show on another machine with CPU/GPU with an unverifiable architecture.

    PS: I have a Precursor and a Banana Pi BPI-F3 with SpacemiT K1 8 core RISC-V chip and that’s the main idea behind them both, i.e knowing, as a community, how it works all the way down.



  • Neat.

    Warning disclaimer : I’m not a cryptographer.

    I actually tinkered with https://github.com/open-quantum-safe and it’s actually quite simple to become “post-quantum” whatever. The main idea being that one “just” have to switch their cryptographic algorithm, what one uses to encrypt/decrypt a message, from whatever they are using to a quantum-resistant (validated by NIST or whomever you trust to evaluate them) and… voila! The only test I did was setting up Apache httpd and querying that server with Chromium and curl, all with oqs, while disabling cryptographic algorithms that were not post-quantum and I was able (I think ;) to be “safe” relative to this kind of attacks.

    Obviously this is assuming a lot, e.g that there are not other flaw in the design of the application, but my point being that becoming quantum-resistant is conceptually at least quite simple.

    Anyway, I find it great to demystify this kind of progress and to realize how our stack can indeed, if we do believe it’s worth it now, become resistant to more threats.






  • Look at /r/deGoogle and you will, sadly, see a lot of people that have a problem stopping.

    A typical example is how services from Google, e.g Google Docs, Meet, etc do everything they can to avoid not logging in, and while having to do so, prefer to use a GMail acccount, or “at least” a Google account (which might not require a GMail email).

    So… a drug no but a dependency hard to ignore for a lot of people, the same way some people feel “forced” to use WhatsApp.

    You are extremely privileged if you never felt that way.



  • What if your domain registration lapses and someone else grabs it?

    Registrars do warn quite a bit but indeed you can add a yearly notification 1 week ahead in your calendar.

    What if you can’t afford the cost five years from now?

    You are in quite deep trouble then because the registrar itself is relative cheap, e.g $10/year. It also does not seem to increase significantly. If you can’t afford that you probably should focus on basic necessities first. If you are serious about it though, just like with the yearly notification, set $1/month just for this.

    What if you just don’t like the domain name someday?

    I mean… you change it? Just like when you went from person@gmail.com to person@mydomain.tld . That process is a bit annoying but as you’ve done it once, it will be easier.

    All of these reasons will be problematic and some can result in identity theft and significant fraud. It’s definitely not a decision to be taken lightly, particularly if you have a lot of online accounts.

    It’s not a light decision BUT it’s also not such a big deal. If I want to go back to person@gmail.com I can just do so any moment I want (well person-something@gmail.com to be precise). I will keep a 1 year grace period for the transition, start with the most critical accounts first, e.g government and banking then social media, then random accounts based on my history. It’s annoying but it’s a matter of hours over few weeks at most.

    The only challenge is to be methodical and giving up on the idea that you’ll update 100% of the account. Getting 99% of the account that truly matter is enough IMHO.

    PS: for actually sensitive data, and assuming you somehow didn’t manage to get the grace period YET still are smart enough to think ahead, multi-factor authentication will keep your accounts safe. Honestly I don’t think the overlap though between somebody who cares enough about that AND let’s domain expire is very big though.



  • Because without privacy you can’t be a proper human being. You need privacy in order to have the safe space to develop, to dare try, to explore without the constant judgement of others. If you can’t be a proper human being, can you genuinely have democracy?

    It’s both a per-requisite for humanity and what the political system that is often considered as the most just.

    That’s why I care.


  • I’d clarify that the shear customizability of Linux is optional.

    Take a SteamDeck with SteamOS versus a RPi with e.g Debian.

    If you “just” play with the SteamDeck and you don’t tinker, well, it “just works”. In most, even though not all, normal situations, e.g plugging a screen, pairing a BT headphone, mouse, keyboard, etc it is solid. It has no problem even while using a compatibility layer like Proton for games themselves made for Windows. It even enable some tinkering thanks to its immutable OS and let the player switch to desktop mode. Not everything works but my personal experience since it’s been out has been pretty much flawless.

    Now, take a RPi, with just as stable hardware, with Debian, even stable, and put on it some IoT device, make some weird modifications for it, try a bunch of stuff, remove package, tinker more, chances are it will still work. Tinker more, make stranger modifications to the point it becomes unstable. Is it Linux itself? I’d argue it’s not. I’d argue that instead because we CAN tinker we sometimes do then forget that it’s not the same context as something expected to run without hiccup because it’s been limited to basically the same verified usage.

    So… IMHO Linux is even better than it is, we just shouldn’t confuse weird (and important) tinkering with how it can be actually used day to day.



  • I didn’t try one so I can’t comment on it from first hand experience. At least on paper, including the claims that it is (which would make sense as France push for right to repair kind of laws) easy to repair, without a need for a specific Kilow “accredited” shop, makes is very tempting. If it’s true and a random person can buy an affordable small EV and fix it easily, possibly even at home, I believe in terms of democratization it’s going in the right direction. Eager to read reviews and see if it can become a trend.




  • 30k EUR or more… why? Or rather, what for and for whom?

    I mean I LOVE to see alternatives to cars but… a fancy electric bike is less than 5k EUR, a electric cargo bike (with a 400kg a payload, e.g Urban Arrow) is around 7k EUR, a tiny electric EV from France Bagnole (from https://kilow.com which did e-bikes until now) seems to be 10k EUR … this is 3x or 5x (!) more for a much better top speed but also not a lot of actual space.

    I understand the need for an electric bike (which I have) in cities but also in the countryside, going from a small town to a larger one where public transport exist but is very infrequent but … this, I don’t get. Who needs to reach 100km/h or more regularly and wouldn’t go for an EV “proper”. I briefly checked and a Nissan Leaf is in the same price range.

    I’d be curious who is actually buying this and even more why they are preferring this over alternatives.

    Apologies if I sound critical I’m just very surprised by the price and thus which market this is addressing.


  • never really gotten into the whole “Internet of Things” thing.

    Honestly… it’s not worth it. It’s fun, sometimes convenient, but nobody truly needs it except in some very specific situations. That being said it’s also now relatively easy and cheap to setup, e.g RPi4 then add a Zigbee dongle (30e) with a Zigbee lightbulb (20e) or switch (15e) or sensor (e.g temperature for 15e), install HomeAssistant in an hour … and voila, you have a setup you can play with and move from any home to any other in minutes. So it’s not a “big” deal to start but again, what for. I personally do it because I love tinkering and want to feel that I can be at the “state of the art” of technology WITHOUT surveillance capitalism, so it’s more an intellectual and more pursuit rather than a pragmatic approach. So I don’t recommend it but I also had to clarify it’s not that complex or expensive anymore.


  • Thanks a lot for taking the time to explain.

    I did notice CTF on the description so I imagine “escaping” it is “harder” than with containers. I recently participated to SplinterCon which included a “block-a-thon” (cf day 2 of https://splintercon.net/brussels/ ) to try to escape a limited environment, approximately simulating the limited Internet access of some political regime. It might be interesting in that context too.

    Could also be interesting then to distinguish which defaults are changed compared to Docker ones or examples for which nsjail is currently preferred.