remx

Yeah Hypothesis is a bit nerdy. This is why Genius exists, and if rap/hip-hop is not your thing, Hypothesis can be used for any niche annotation.

Yep. Tor is just a great big eye for the NSA and GCHQ. For them it doesn't matter if scoundrels use it, as long as they can use it too.

Make everything static. Unless you really need some sort of dynamic content. If you do need dynamic content, make sure to stress test it. There are tools out there to load test your website to see if it breaks.

Put it on Cloudflare. Cloudflare can absorb huge volumes of traffic with ease. Keep in mind there are other WAFs (Web Application Firewalls) you can check out.

Use as little third party widgets / bells and whistles as possible, and self host assets when you can. If these go down (which they will when your site is trending on Hackernews), then your site may not load correctly and leave your users frustrated. Remember the recent S3 failure? It broke thousands upon thousands of sites.

For those looking for something similar there are these: Telescope[0], Drum[1], Slashcode[2], and Microscope[3]

[0] https://news.ycombinator.com/item?id=7861985

[1] http://drum.jupo.org

[2] http://www.slashcode.com/www.slashcode.com/

[3] https://github.com/DiscoverMeteor/Microscope

So why now?

I think it's because it's cool to use the word "cyber" now in the news. It makes news outlets appear edgy and with it. Infact these cyber attacks are nothing new, and have been an ongoing problem for organizations like the NHS, the only difference being there is a remarkable uptick in the scale of the attack. The reason it stands out is because it's a cluster, instead of a slow, trickling problem for the NHS and other organizations.

What's so special now?

The sophistication and worm capabilities. Were it not for the Shadowbrokers leak, small time malware authors had to use tired old strains of malware to spread. Now they can draw upon the vast arsenal of the Shadowbrokers leak and appear like state actors, which they are not.

If anything, the leaks were a blessing, because now we can mitigate against such attacks. NSA's mantra 'NOBUS' (No-one-but-us) does not apply here.

This is what I want to know[0] too.

To mitigate, you can disable SMB1.0 with the following command. Make sure to run as administrator:

    dism /online /norestart /disable-feature /featurename:SMB1Protocol

After the recent so called 'cyber attacks' of WannaCry, I was careful to update any Windows machine I have and install things like EMET and MalwareBytes on them. I switched to Linux years ago because I've heard nothing but bad news concerning Windows, but one thing struck me about the WannaCry infections: I heard the attackers used an exploit pulled from the recent ShadowBrokers leak, something related to 'SMB'. A few questions: Explain it to me like I'm five please

1.) What is SMB? And is it easy to remove from systems by simply uninstalling it (like I have done[0])?

2.) Does WannaCry just land on a machine through a simple point-and-click exploit? Do they just enter a vulnerable IP address and they can plant the exploit on the machine and run it?

3.) I am aware that it also gets onto machines by people randomly clicking on shady e-mail attachments, but I am very curious about how it simply lands on computers with very little or no user stupidity at all?

[0] I uninstalled SMB by going to > Add or remove programs > Remove windows features

There's also all different types of work. Work on the body, the mind, etc

A lot of people also forgo carrying a smartphone completely for privacy reasons

But what's new? What's your favorite new upstart project?

A few:

- https://hypothes.is

- https://genius.com

- https://www.ethereum.org

- https://thegrid.io

- https://neocities.org

- https://github.com/ipfs/ipfs

Certain Linux live CDs usually have a read only filesystem and are useful for tasks where you don't want to leave a trace, and everything is flushed from RAM after use. Ubuntu, for example, allows a user to try out the O.S without installing and is a great way to 'trash the hotel room' and then shutdown leaving no trace of your actions. Any files you create, for example will be wiped, and the kernel is exactly the same when you restart the system cleanly. Just to be safe, I would recommend booting from read-only media like an actual read-only CD so nothing can persist.

Greasemonkey[0] is fairly handy for scraping. You can even include remote resources like jQuery if you're targeting specific DOM elements in the page. For storing the data, you can just use LocalStorage (for example if you're paginating)

[0] https://addons.mozilla.org/en-US/firefox/addon/greasemonkey/

Thanks for the tip, and I will try this. As I said, .DOCX files work best in their native Win Office environment as I've had problems with them in open source solutions (formatting issues), whitespace injection ruining the layout, etc

To mitigate, I am running Debian as the host and jailing Windows 10 in a Virtual Machine, and have uninstalled SMB1.0 on the machine by going into > Programs and Features > Add or Remove Windows Components. I have also blocked port 445 (SMB) with ufw (On Debian)

    sudo ufw deny out to any port 445

I store all my critical files in an offline environment (sandbox) so the only files that are going to be encrypted are replaceable (non important) and disposable. For example, I wouldn't cry if my C.V got encrypted because a copy of it exists in about 50 locations either offline and online.

Unfortunately I need Windows because my colleagues like to send Windows-only .DOCX files which work best in MS Word, and I don't have a Google account, so I can't open them in Docs. This is a conscious decision to permaban Google from my life, but Windows is staying.

I doubt this could happen on any grand scale in a city. This does sound like the temporary autonomous zones you find in Burning Man, or the sustained exaltation you find at dinner parties and get-togethers. The key word here is sustained, because something always breaks exaltation. Someone makes a rude remark, or the wine goes to everyone's head and they make cynical remarks which dampen the mood of the dinner. Multiply this concept to cities and it's clear you're going to have bad apples ruining it for everyone. The bikes casually parked outside shops will be stolen even if they're freely given out to tourists to explore the city. The bum drinking cheap Olde English liquor will start begging for change.

    As long as you know the index into p of your file and its length,
    its a simple task to extract the file using the Bailey–Borwein–Plouffe
    formula Similarly, you can use the formula to initially find the index of your file

    Now, we all know that it can take a while to find a long sequence of digits in p,
    so for practical reasons, we should break the files up into smaller chunks that
    can be more readily found.

    In this implementation, to maximise performance, we consider each individual
    byte of the file separately, and look it up in p.

http://thunder.cat

http://trashbat.co.ck

https://xn--vi8hl0c.ws/ (.ws)

http://www.xn--vi8hiv.ws/ (.ws)

http://xn--n3h.com (.com)

I enjoy applying the I Ching[0] to decision making. It's like a coin toss, but on steroids

[0] https://www.goodreads.com/book/show/534289.The_I_Ching_or_Bo...

[#] https://en.wikipedia.org/wiki/I_Ching

There's a big discussion about PGP here and why so many fail to use it: https://news.ycombinator.com/item?id=13114538

Some of the comments are worth reading if not for the sheer size of the discussion. It could take an afternoon or two to fully digest that thread.

The comments are in response to this: https://blog.filippo.io/giving-up-on-long-term-pgp/

I remember this from a while back:

https://news.ycombinator.com/item?id=12158174

&&

https://techcrunch.com/2016/07/25/security-as-a-service-star...

I have no experience with the Stackpath CDN itself, but I can only guess it's exactly like MaxCDN, which are apparently the cheapest and fastest. All these CDNs are more or less the same in terms of speed and availability though. Since it's such a competitive space, I don't really mind what CDN I use, as long as it's cheap compared to others and it has a decent amount of PoPs (Point of presence) scattered around the globe.

Take your pick from this list here:

https://github.com/kilimchoi/engineering-blogs

With uBlock Origin, you can select the HTML elements that are offending you, and remove them from the DOM It's called the 'elemental picker' and is a tiny picture of a pipette. You can use this to remove adblocker blockers. Some are more tricky to remove than others and can take some time.

If you don't want to use uBlock, you can always put yourself in a common pool of browser clients such as the TorBundle and blend in, thus improving your privacy. TorBundle doesn't block ADs.

It also fingerprints you and shows you specific pictures depending on who you 'are' in their eyes. I always get pictures of mountains for some reason, no matter how much I try to appear like a John Doe client

You can see the full HN furore here: https://news.ycombinator.com/item?id=13303436

I wouldn't move large volumes through Paypal. PP is useful for small donations and shuttling small amounts around, but not for the amounts being discussed here, because the larger the amount, the more it hurts you when things go awry.

Indeed this. All your Blackberry belong to Mallory

Just going to leave this link here: https://mathiasbynens.be/notes/javascript-unicode

For context, it was removed from this chart of privacy-respecting email services: https://prxbx.com/email/

that laypeople have accepted and can work with

There is the caveat that it's hard to get things done in a timely manner on phones, or even tablets/phablets. If I need to crank out a lengthy blogpost, then I need a full desktop environment where I can do cross referencing, wikipedia lookups, file selection, photo editing, and all the other things that a desktop affords. I have tried writing a blogpost on an iPad and it took up my whole day when it should have taken 2-3 hours.

I know people who have developed super-fast methods for working on iOS but they are such a rare creature, and I'm not so sure their workflow is even teachable enough to be widely adopted by journalists or professional bloggers. From my experience they're relying on all sorts of hacks to get a blogpost out the door like using some perfectly curated mix of apps, and being able to pass files to and fro different apps with ease. Hardly the stuff of laypeople.

But if a journalist is going to use a secure desktop Operating System, he/she/they should investigate the current trio of recommendations which are as follows, and have different threat models baked into each:

Subgraph. Currently in Alpha version, so be careful using this. Still has to be vetted by the wider infosec community, but worth downloading and playing around with.

TailsOS. Very useful for journalists, but since it heavily relies on Tor it can be tricky dealing with mixed-anonymity workflows where sometimes you just need a Windows environment (preferably an airgapped Windows sandbox you can use to code / play around with files using Windows freeware).

Qubes. Heavily reliant on compartmentalization, and this can sometimes prove too cumbersome if you typically do one type of activity on the web like chat / email / hang out on slack. Typically for when you need to insulate different activities from each other and to avoid contaminating different contextual environments / tasks.