josephholsten

While I appreciate the reluctance to operate in fourteen-eyes/SSEUR, where do people trust to be secure outside SSEUR?

I've said this elsewhere, but I'm trying to help, not spam!

Please make sure to report evidence of blocking to PIA support, they do have some solutions available. Worst case, it gives them evidence that it's time to rotate IPs.

I would be very interested to know what you think a VPN provider could do to assure users that the servers are safe.

I've yet to see an example verifiable safe server configuration, but some people have claimed that SGX might do. I'm pretty sure that wouldn't work with stock OpenVPN or StrongSWAN today.

Are there any other practices they could adopt that would ease your worries?

This is actually less insane than it sounds. Most VPN providers rent space at traditional datacenter providers like Equanix. Search for "dedicated server hosting" and "colocation providers" for the exact same list of vendors that the VPN companies consider.

Please make sure to report that to PIA support, they do have some solutions available. Worst case, it gives them evidence that it's time to rotate IPs.

Very true! Unfortunately, your RPi is going to have only one user in responsible for traffic. Commercial VPN providers act as a multiplexer to hide who is responsible for what traffic. Ideally you'd have at least a Type III anonymous remailer mixing your traffic, but then you're dealing with much higher latency. As with everything, there is a compromise between the effort required to break a security system, the ease of detecting such a break, and the burden of using the system.

I'm not sure what point you're making about colo and transit costs. Are you saying that operating your own has higher costs? Or that a commercial VPN provider has higher costs? I'd be very interested in a price analysis that beats PIA while offering a remotely similar security profile. Keeping an RPi at your house provides defense against totally different threats.

I've set up scripts to convert an existing virtualbox/vagrant .box file to a vmware compatible OVF. I would use those to deliver to clients at my last employer. I know github is doing a similar process. Additionally there's mccloud, which lets you deploy to aws. If you need help getting any of these set up, let me know.

Glad to be one of the users who uses vagrant every day!

You should know that people have been trying reputation-style digital currencies since at least the early nineties. They require a ton of bootstrapping to get anywhere. That's because you end up with a trading system that's looks like a foreign exchange market with 7 billion different floating currencies. And that's assuming only individuals have them, excluding corporations. You'll notice old cypherpunks have a lot of skepticism toward the fiat-currency arguments against bitcoin. We've been trying to make fiat-currencies work. Keeping the rep net up to date is at least as expensive as mining bitcoins, but with none of the hard-crypto backing to the algorithms. And it's way more opaque. That's ideal if you're trying to soften shocks across a national economy. It's less ideal if you've got more self-serving interests than eyes.

Bitcoin isn't perfect. But we can test it, and if it breaks, we'll see quickly. Broken rep-net economies are like building markets on pyramid schemes: people have an incentive to pretend it still works until the damage is orders of magnitude larger than the economy proper.

And I encourage you to investigate what fractional reserve banking looked like in the days of specie-backed-currency. Banks still made loans and kept less than the entire value of their demand accounts on hand. It'll be weird, but there will be an M2 and an M1 in bitcoin, we aren't technically limited to an M0 money supply.

I hadn't heard of that! I'll be sure to mention it on our opt-out page, along with adblock.

We thought about how much people would hate us if we did some digg-bar thing like that. We'll leave the being debatably evil to google.

As for the GPU-accelerated JS, check out WebCL: http://webcl.nokiaresearch.com/

We thought so too! But then we realized that if you're going to download and install a miner, you probably want one that's actually fast. Browser plugins, which are almost all javascript these days, are basically the worst of both worlds from that perspective: slow and require manual installation.

Fortunately, that's not actually true. If the community agrees when the last valid block is, all the transactions before that will be accepted as trustworthy. The DHT (now moving to freenet) ensures that this transaction history is reliable up to the date of the exploit. Then it's just a social problem of converting into a less flawed system.

But social problems tend not to end up as near the worst case as is often feared. What you're describing is like saying that if we break the crypto underlying git repositories, you can trick the world into thinking you are the original author of linux. Obviously, no one would fall for that. But every git commit after the exploit, or from sources lacking a large consensus, would be of suspect authorship. It's a big problem, but not exactly the way you imply.

We're looking into the best way to let adblock users turn us off, as well as a cookie based opt-out.

That's pretty interesting! We'll give it a look and see how much it improves things.

I'm one of the developers of bitp.it. We're still working on an opt-out cookie, but for now we encourage you to use adblock. I'll be throwing a howto up later this afternoon.

> quality/UX standards were relaxed somewhat

Yow.

Not exactly. If you look a bit closer, you'll see that this isn't just a strict child, otherwise they might have managed by swapping a foreign key or something. In a graph db, you'd still have to reconnect dangling edges that no longer make sense, like for comments and users. Also, the transaction rollback issue. Which is to say: tanstaafl.

Hey, I resemble that remark.

Way to build a short and beautiful step path to the land of Not Invented Here. It's one think not to write a tutorial to using one of the well supported OAuth gems. But you didn't actually commit to helping people either. If (and when) someone finds a bug in your implementation, they won't be able to fix it with a gem update, they'll just have to return to your gist for the lifetime of their app.

On the other hand, you've done a beautiful job at showing how simple OAuth can be. If I ever want to write a twitter client in Io or something, I'll definitely be ripping off your (apparently still copyrighted) code to do it.

Translation from press release speak:

[The iPad is great for entertaining one person, but sometimes you want a TV because you want to entertain more than one person. Apple TV lets your TV be entertaining, as Steve Jobs demoed yesterday. It's $99, which is cheaper than an iPad. Also, you can bore people with slideshows of your last fishing trip if you have both. Compared to the old price of $299, it's priced like an accessory, like my fuschia Fendi iPad carrier fanny pack.]

> it looks a lot like my pre-code scribbles

Absolutely, and I mostly write ruby. I actually love that about python. But it feels optimized for writing code with a pen, not with a keyboard. Come to think of it, I don't prefer either for the reading of other's code. But ruby and perl seem to flow from my keys much more naturally than python.

Maybe if I switch from vi to emacs I'll change my tune? ;)

Seems like this author just doesn't realize how painful migrating to OAuth is for a service provider. Of course xAuth isn't a real security improvement to HTTP Basic. But it forces everyone to support auth that isn't inherently broken. So once Twitter stops receiving many xAuth requests, they can just turn it off.

The migration to OAuth 2 will be interesting though. All the existing clients will have the right kind of structure to plug in drop in a replacement flow, but I bet there will still be a bunch of complaints. "OMG I don't want to use HTTPS! This is so hard! Who cares that I can use curl to debug now, I want programming to be drag and drop." Haters gonna hate.

Kinda strange that they don't lump android and linux. What exactly is this 'platform' they speak of? It's not the browser used I guess. But it's not like they're calling KDE and Gnome separate platforms either.