HN user

piracykills

237 karma
Posts0
Comments86
View on HN
No posts found.

How they do this is basically to send google.com in the TLS SNI then when they get to the HTTP level send

Host: signal.org

This will only work with compatible servers. In Signal's case they use AppEngine which is behind Google's network and the servers for google.com are able to connect to their app servers when given the appropriate Host header.

That some tiny portion of the deaths in your country are from opioid overdoses? People voluntarily injecting themselves with drugs and fucking up? Why exactly does this concern you so much? It's hard to see it as representative of a larger systemic problem beyond the American drug enforcement and medical systems resulting in over-prescription of opioids and fenantly entering common usage. Not much beyond that, is there? I don't see a larger trend to extrapolate from that.

I'd advise reading the article I linked, the increases are far from modest in many cases.

I'll agree with you on the environmental issues, but I think we're well on the way to solving those too and largely via the same mechanisms, Chinese solar is close to pushing coal out of business on price. That's not to say there's no role for regulation in the environmental direction though, I certainly think there probably should be, but how to do so globally and fairly is a bit of a catastrophe.

Yeah, I managed to miss a digit when I ran the numbers myself so I was off by an order of magnitude when I wrote my post. Glad you checked it. Fucking hilarious what these guys will say - of course, I think that's a goal, to shock anyone remotely reasonable or who even tries to do back of the envelope math out of interest in it.

Are suspicions really enough to put you into illegal territory here?

If so it'd be a very hard crime to prosecute as unless you were working for them or something it's very hard to prove you aren't just another victim.

>6-7% annual returns

I wouldn't say quite that low, even S&P averages are often higher than that.

But 48% monthly is going to be something like a >1000% yearly interest rate. You really don't get much more of a dead giveaway than that, at that point you're either a fool or you're gambling and hoping you get out before a greater fool does.

FreedomBox 8 years ago

Looking for a way to do better remote access to Linux boxes - Microsoft's RDP completely nails it on Windows, I used to quite like NX, but don't hear much about it these days, how do you find x2go, particularly from a server configuration perspective?

My hosting provider eventually took it down, because URL redirectors can be used for phishing.

What provider was this? I'm going to make sure to never use them. That's not a valid reason at all to take someone's site down, even if it's being actively abused you notify them first and notify them many times before even considering booting them as a customer.

Doesn't scrypt suffer from much of the same parameter selection issues? I know I've had to choose some fairly obtuse values when using scrypt for login in a webapp.

In fact, taking a quick look again I find Argon2's "memorySizeKB" and "iterations" make much more sense to me than scrypt's "CostFactor" and "BlockSizeFactor" parameters as it's a lot clearer what's being impacted. I agree with the i-vs-d confusion, but in most cases I think using argon2id as you mentioned should resolve the contention as is already the suggested default in the IETF draft.

I suppose you're right, not necessarily between the two parties but between US citizens and each other, for which the parties are sometimes used as a proxy - you see lots of promotion of black rights groups with fringe views and far-right groups with thinly or completely unveiled racist views. Just little tricks that will hook a small number of people, but make the overall picture you see on TV look much worse than it is on average.

I'm under the impression Argon2 is at least marginally better than scrypt as it has heavily analyzed side channel mitigations and such. Is scrypt better in some other way?

Curious - why is argon2 still second to scrypt on this list?

I'd also question the backup solution, I think Restic is a better option due to its flexibility, I can do cheap backups to B2 and fairly reputable people seem to be approving of its cryptography:

https://blog.filippo.io/restic-cryptography/

If anyone sees a reason why Tarsnap would be better (other than Percival's brand), I'd be quite interested.

If you read the details of that decision, they're pretty interesting - they only did it because people were claiming CloudFlare were supporting their ideas.

Matthew Prince basically said "this is dangerous" and a month or two later that exact decision was being used against them in court to take down a copyright infringer.

Not saying one way or another about it being a good or bad decision, but they definitely knew they were setting a scary precedent when they did it.

Sure, you can sync to your own drives or to several commercial storage providers, but it's not as cheap as it should be. We're talking geographically distributed storage on an open marketplace, cryptographically enforced for extremely cheap prices.

Wasabi and B2 are pretty much the only commercial services which could even attempt to compete on price with something like Sia today (Filecoin and others in the future potentially), but they're only in single DCs and if they lose your data you have no one to go after. In the cryptocurrency-based systems, this is all automated.

For as many incredibly stupid and useless applications of blockchains as there are, this isn't one of them in my opinion. It may not be unique, but it's actually something that could have a competitive edge over a centralized service.

Yeah, I mean it only makes sense. It's about price discrimination - they don't want to give you a discount if you're willing to pay full price, same reason companies send out coupons or mobile app offers. They want to offer discounts only to bargain hunters and those who otherwise wouldn't be able to afford the service because that's where it's worth spending the money for them.

If you're not already, find yourself a local deals site - it can really help you avoid getting screwed over by stuff like this. You can also wind up staying if you're willing to call your current provider back and say "here's what they're offering, beat it or I'm leaving".

It's likely quite profitable, they don't buy bandwidth from Amazon, they get a few colo'd machines or dedicated servers in many DCs - you can get dedicated gigabit lines in several DCs for a few hundred a month. Most subscribers only use the service occasionally and won't place that much load on it.