ryalfalpha

You can fake it with a number of extensions, but there's a load of fingerprinting options that are sneakier than the user agent. The Tor Browser project has a document outlining changes they had to make to make things less fingerprintable.

The real question is, can you delete it completely? :)

That's a fascinating idea, even if it's not made public to the end user. Getting the git blamed stacktraces mailed to the dev team would be interesting!

Definitely recommend this site, it was a big influence in my early programming days, I found it way more interesting than Project Euler.

Whenever said members/affiliates are former leaders we're really just splitting hairs. I get your point though, I mistook what he had said as there is no link at all between them. Instead he is saying 'The Irish government never commanded the IRA' which I'd largely agree with.

I don't get your comment?... prominent members from various versions of the IRA are and have been members of Irish governments, see Gerry Adams/Martin McGuinness (Or even Michael Collins if you're talking way back).

Here's my reference for reference, http://www.slideshare.net/grugq/opsec-for-hackers (slide 137/138)

I cannot recommend either, but I would note that in your link they do seem to state 'Anyway, not so many people seem to do use a tunnel before they connect to Tor, therefore it's not so well tested, do not rely on it too much.'. So I'd be wary of their advice for anything you need to bet your life on.

I don't want to slam your site too much, but just because You don't log Typeview information doesn't mean someone doesn't. If you're using regular HTTP then everything the user types in your textbox can be intercepted by people on the network or logged on proxy servers anywhere. This is not something the user expects to have to worry about.

Mentally, the google search box has a very different contract than a textbox to communicate with support staff, the user generally gets immediate feedback and understands their data is being sent as they type.

From what I remember, Wave had it optional as they even said themselves a lot of people were uncomfortable with the idea of people seeing their train of thought (and mistakes). It's an interesting idea but it's a horrible way to treat the user.

If you have to update your browser to read a site, on a site that's main function is to provide someones thoughts in text form, then I'd consider the website at fault.

Yes, as far as I've heard,

  VPN -> TOR = DANGER, 
  TOR -> VPN = PROBABLY_OK

I'd replace 'good at programming' with 'proven ability to ship'. Most of the time it's values way over a decent codebase from what I can see. Which is often fair enough!

Haven't done much golang and don't have it installed on this laptop, but are string comparisons constant time?

If not, I think there is potential for a timing attack here?

if usr == _admin_usr && pw == _admin_pw { return RootMode, nil }

Someday ;)

Perhaps there could be open whitelists where sites could nominate their sites as 'https only'. Wouldn't even need to be built into the browsers, could just be a thing people do when they launch a clean browser install, hit up https://blahsitelist.com and click a button that fires off https requests to all of those sites which would cache the HTST header? (I've only stumbled on HTST headers today, so I may be overly flamboyant as to their usefulness)

Although, come to think of it, isn't that just basically what the HttpsEverywhere extension does?

That's a valid point, but I can't see it being an impossibility that the user will never accidentally stumble sending a http request rather than https. Whether that is user input, or a maliciously placed link.

My understanding is that the HTST header would make this attack less useful. But it's still a concern if you used Private Browsing/Incognito. The initial request will still hit a 301 (vulnerable to interception by MITM). I've just verified this with Facebook.com on my machine (Chrome 26, OSX).

I think it's quite fair to expect a user using this kind of site is likely to use Incognito.

I'm actually kind of surprised as I thought Chrome had a standard list of sites that use https only such as Facebook. (Woah.. seems the preload list is TINY http://www.chromium.org/sts )

I said 'Not sure how valid that still is' for a reason :). I just found it extremely interesting and 'out of the box'. After reading up a bit on modern defences, I think you're right that it's irrelevant nowadays. (Unless you're in legacy hell, doubtful for the target user demographic)

But the parent comment is still valid, there's nothing to stop Moxie registering another domain even note-crypt.com or notecrypt.org or anything like that and the average user will be complacent with that. (same applies for appspot, note-crypt.appspot.com vs notecrypt.appspot.com vs notecrypto.appspot.com)

It only takes a single lapse in checking the domain and they've lost their login details and encryption key to the attacker.

Point is, the JS crypto does not add anything to the situation. All the security is provided by SSL, and once it goes, the JS doesn't help. It just gives the users a fake sense of an additional layer of security, which is dangerous.

Moxie broke the current SSL usage, and therefore, he broke the JS crypto (as he controls the communication channel). He beat the current state of the challenge.

I think it's also worth pointing out in Moxie's sslstrip talk he does go into detail on using IDN http://en.wikipedia.org/wiki/Internationalized_domain_name to spoof something similar (for non-english TLDs).

Not sure how valid that still is (as the talk is a couple of years old? I only watched it today), but it has to be assumed that a portion of users are going to fall for even a badly mimicked url.

Gotta say the IDN stuff is impressive in how generalised it could be. Terrifying. I'm convinced he's owed the $1,000.

Could probably ensure it fits in the window nicely though, with zooming etc. Seeing only the North-West of London on screen without scrolling is not as useful. I'd imagine it's damn hard to use on a laptop without two direction scrolling. Functional over pretty, I vote :)

I'm pretty sure there's a market for this, I was in talks with a major Chinese company hiring to achieve a similar service for brands on Weibo (Chinese Twitter/Tumblr mashup). But it sounded kinda scummy to me and I dislike social media so I bailed.

They seemed to have a pretty manual system already up and running and were working on automating a lot of the churn, not sure how well that would translate to English markets, but I'd bet some companies would pay for it to save themselves hiring 'that social media guy/gal'.

It's just a larger, older model with less storage capacity! http://upload.wikimedia.org/wikipedia/commons/8/82/8-inch_fl...

If by 'on there' you mean kicking ass and making bacon!

Today I learned the ISS has baby-wipes aboard it.

Oh yes, in source & commits it's fair game! I'm talking more about editorial content that might have been outsourced. E.g. how-to articles for a company product or articles written in-house that are localised by an external vendor. These things need to be quite clean!

It really would be the best repo. I can see the commit logs being the stuff of legends!

I don't see much use in profanity filters on the net these days, but it is definitely useful for businesses working with external teams just to sanity check content before publishing :)

Could someone explain the economics driving this? Future up-selling?

Oh man, when I worked there in Localisation for Office, there were crazy length lists for every language, it was so much fun to read through with foreign friends!

Yeah, when I caught that, I thought that it might just be semantic trolling! (a terrible variant)

That's a really great resource, thanks for sharing!

"A constant time initial cost for recurring savings in bytes transmitted seems like an excellent use of CPU time to me."

Wish more people understood this aspect of web scale! well said :)

It's not even rsync yet alone dropbox!