5 ms·

My little fight back are some instructions on how to provide your own internet services, including encryption. http://freedombone.uk.to/ http://freedombone.uk.

by motters 13y ago

My little fight back are some instructions on how to provide your own internet services, including encryption. http://freedombone.uk.to/ http://freedombone.uk.to/ It's not ideal, of course, but in the short term since there seems to be no political appetite for relinquishment or meaningful reform then technical mitigation strategies - if they can be sufficiently popularised - may help to reduce the harm resulting from mass surveillance. Ultimately the solution is both political and technical. When politicians or other public figures make claims that what's going on is "not mass surveillance" or try to imply that collecting metadata is unimportant then they should be challenged.

mikegriff 13y ago
That's a good little installation document. I'm going to give that a go with a raspberry pi when I get home. How up to date are the instructions?
- eliasmacpherson 13y ago
  It's not little - it's quite comprehensive. Excellent job done. It's explained quite well in a very enjoyable writing style. I think anyone who knows enough to add a banner to a webpage can work their way through the document. It's a good idea to promote it as an alternative because from the outside at least, it seems freedombox has lost momentum since the privoxy release, even though the idea is sound.
  - mikegriff 13y ago
    I didn't mean to belittle it all, I'm well impressed with it. Nicely explained for the most part and I saw afterwards that it's up on github too so it's easy to send in corrections for it. I had to look up Friendica and Movim to see what they were (I'd never heard of them before), it'd be nice to have links to the respective homepages, so off I'll go and add them in.
    - motters 13y ago
      Pull requests for corrections or installation sequences are welcome.
      - mikegriff 13y ago
        No problems, I can see one or two bits that I think could do with clarifying (not least to get rid of emacs :P ). I'll have a go at it this evening and take notes.
        motters 13y ago
        The particular editor isn't all that important. You could just use nano or vi. I don't think any of the instructions contain anything really Emacs specific. I happen to use Emacs and the source for the site is an org-mode document, which makes editing it very easy. Exporting it as HTML is a few key presses.
        eliasmacpherson 13y ago
        As a vi user, i'd be willing to leave the great war to one side and give nano the thumbs up, many people not used to the console struggle to quit out of vi or emacs while being competent with sublime text or notepad++. nano works better for them.
        mikegriff 13y ago
        Only messing. I just couldn't resist bringing up the great editor debate :)
  - motters 13y ago
    Yes, that's the intention. Anyone with minimal skills should be able to follow the instructions in a straightforward way. Until such time as FreedomBox or maybe ArkOS are in a more developed condition this is about the best I can manage.
- motters 13y ago
  These instructions have been put together recently - mostly in January this year. It's an ongoing effort to include as much useful communications software as possible.
minimize_me 13y ago
This is really, really, well done. It'd be nice with some simple styling, to not make it look too "alpha-geek" to the wider tech sphere. Otherwise, cracking work.
- motters 13y ago
  Anyone with better web page design skills is welcome to make changes or forks via the Github site. https://github.com/fuzzgun/freedombone https://github.com/fuzzgun/freedombone Presentation and clear readability is certainly an important factor.
teawithcarl 13y ago
Extremely well-done. Thanks, will build one.
dredmorbius 13y ago
If you want some quick-and-dirty CSS to make that slightly cleaner: http://pastebin.com/7sGiHBwF http://pastebin.com/7sGiHBwF ... it's just a set of styles I slap on blank pages myself. Consider it GPL v2 or better, BSD / MIT licensed, though honestly, I couldn't care less how it's used or by whom.
- motters 13y ago
  Needs some work, but that makes quite a difference. Thanks.
  - dredmorbius 13y ago
    You're welcome. Anything specifically?
    - motters 13y ago
      The image probably needs to be smaller or the license text placed somewhere else.
      - dredmorbius 13y ago
        Unfloat the image.
pflanze 13y ago
Some feedback: * don't use md5 as a security feature! I suggest to replace the use of md5sum with sha256sum (not even sha1sum is really safe anymore). The only use of seeing md5 in security contexts is to indicate that the person recommending its use doesn't understand security, which may admittedly be a worthwhile feature in itself. Perhaps you're really saying "this is one of the weak links in our security chain, the source code we're getting here might be hijacked or have huge security holes, and I haven't checked the sources, so it doesn't matter much anyway whether you're using the same sources as me anyway"? Then perhaps point this out, like using sha256sum and at the same time mention "(although I haven't verified the source code against security issues or backdoor (yet?))". * I'm not a cryptologist, but regarding "the security of encryption depends upon how random the pseudo-random number generation on your system.." I think that's the wrong use of the term "pseudo-random number", as /dev/random really is about randomness, not pseudo-random numbers at all. /dev/urandom does stretch the collected entropy using pseudo-random number generation, but I think even the phrase "how random the pseudo-random generation" is mathematical nonsense, as it's not random at all, just random-looking when not knowing the generator inputs. Perhaps say "The security of encryption depends upon the randomness of the random source used on your system"? (* I think the NSA is able to track you anyway, regardless of whether you're using your own server on the same IP or not. Thus the suggestion "make you more vulnerable to traffic analysis" will probably only hold for companies trying to track you.)
- motters 13y ago
  Good points. Thanks. I used md5sum mainly because it was given on the original sites from which software was downloaded, but if sha256sum is more unique then I'll use that instead. Although there are some systems where I'm familiar with the code - such as Bitmessage - in most cases I havn't personally checked the code myself. Ideally Freedombone would be a pure blend (I think that's also the aim of FreedomBox), but for now it does involve downloading some non-packaged systems.
  - pflanze 13y ago
    > more unique That makes it sound like you're thinking that the chances for a conflict (same hash value) depend just on the size of the hash value. But it's worse than that, thanks to algorithmic insights, inputs that produce the same hash value can be found more cheaply than just by chance. Also, they can be found so cheaply that it's computationally trivial to do even for an individual [1]. Thus anyone who can change what data you receive, can trivially also make it hash to the same MD5. (I haven't checked whether publicly available software exists to generate conflicting files that are also, for example, valid gzip files, but I surely expect that an entity like the NSA (and perhaps blackhats, too) can create such software on their own.) [1] "produce a collision for two inputs with specified prefixes within hours, using off-the-shelf computing hardware": https://en.wikipedia.org/wiki/Md5#Security https://en.wikipedia.org/wiki/Md5#Security Yes, there are many sites that still tell users to check MD5 hashes. I think it's evident that those are totally worthless for some years now. Worse, it may be giving some people a false sense of security. OTOH those places might give those who do know a hint that perhaps the authors or distributors don't know about security. (Sorry for the harsh words...)

by motters 13y ago

mikegriff 13y ago

That's a good little installation document. I'm going to give that a go with a raspberry pi when I get home. How up to date are the instructions?

eliasmacpherson 13y ago
It's not little - it's quite comprehensive. Excellent job done. It's explained quite well in a very enjoyable writing style. I think anyone who knows enough to add a banner to a webpage can work their way through the document. It's a good idea to promote it as an alternative because from the outside at least, it seems freedombox has lost momentum since the privoxy release, even though the idea is sound.
- mikegriff 13y ago
  I didn't mean to belittle it all, I'm well impressed with it. Nicely explained for the most part and I saw afterwards that it's up on github too so it's easy to send in corrections for it. I had to look up Friendica and Movim to see what they were (I'd never heard of them before), it'd be nice to have links to the respective homepages, so off I'll go and add them in.
  - motters 13y ago
    Pull requests for corrections or installation sequences are welcome.
    - mikegriff 13y ago
      No problems, I can see one or two bits that I think could do with clarifying (not least to get rid of emacs :P ). I'll have a go at it this evening and take notes.
      - motters 13y ago
        The particular editor isn't all that important. You could just use nano or vi. I don't think any of the instructions contain anything really Emacs specific. I happen to use Emacs and the source for the site is an org-mode document, which makes editing it very easy. Exporting it as HTML is a few key presses.
        eliasmacpherson 13y ago
        As a vi user, i'd be willing to leave the great war to one side and give nano the thumbs up, many people not used to the console struggle to quit out of vi or emacs while being competent with sublime text or notepad++. nano works better for them.
        mikegriff 13y ago
        Only messing. I just couldn't resist bringing up the great editor debate :)
- motters 13y ago
  Yes, that's the intention. Anyone with minimal skills should be able to follow the instructions in a straightforward way. Until such time as FreedomBox or maybe ArkOS are in a more developed condition this is about the best I can manage.
motters 13y ago
These instructions have been put together recently - mostly in January this year. It's an ongoing effort to include as much useful communications software as possible.

minimize_me 13y ago

This is really, really, well done. It'd be nice with some simple styling, to not make it look too "alpha-geek" to the wider tech sphere. Otherwise, cracking work.

motters 13y ago
Anyone with better web page design skills is welcome to make changes or forks via the Github site. https://github.com/fuzzgun/freedombone https://github.com/fuzzgun/freedombone Presentation and clear readability is certainly an important factor.

teawithcarl 13y ago

Extremely well-done. Thanks, will build one.

dredmorbius 13y ago

If you want some quick-and-dirty CSS to make that slightly cleaner: http://pastebin.com/7sGiHBwF http://pastebin.com/7sGiHBwF ... it's just a set of styles I slap on blank pages myself. Consider it GPL v2 or better, BSD / MIT licensed, though honestly, I couldn't care less how it's used or by whom.

motters 13y ago
Needs some work, but that makes quite a difference. Thanks.
- dredmorbius 13y ago
  You're welcome. Anything specifically?
  - motters 13y ago
    The image probably needs to be smaller or the license text placed somewhere else.
    - dredmorbius 13y ago
      Unfloat the image.

pflanze 13y ago

Some feedback: * don't use md5 as a security feature! I suggest to replace the use of md5sum with sha256sum (not even sha1sum is really safe anymore). The only use of seeing md5 in security contexts is to indicate that the person recommending its use doesn't understand security, which may admittedly be a worthwhile feature in itself. Perhaps you're really saying "this is one of the weak links in our security chain, the source code we're getting here might be hijacked or have huge security holes, and I haven't checked the sources, so it doesn't matter much anyway whether you're using the same sources as me anyway"? Then perhaps point this out, like using sha256sum and at the same time mention "(although I haven't verified the source code against security issues or backdoor (yet?))". * I'm not a cryptologist, but regarding "the security of encryption depends upon how random the pseudo-random number generation on your system.." I think that's the wrong use of the term "pseudo-random number", as /dev/random really is about randomness, not pseudo-random numbers at all. /dev/urandom does stretch the collected entropy using pseudo-random number generation, but I think even the phrase "how random the pseudo-random generation" is mathematical nonsense, as it's not random at all, just random-looking when not knowing the generator inputs. Perhaps say "The security of encryption depends upon the randomness of the random source used on your system"? (* I think the NSA is able to track you anyway, regardless of whether you're using your own server on the same IP or not. Thus the suggestion "make you more vulnerable to traffic analysis" will probably only hold for companies trying to track you.)

motters 13y ago
Good points. Thanks. I used md5sum mainly because it was given on the original sites from which software was downloaded, but if sha256sum is more unique then I'll use that instead. Although there are some systems where I'm familiar with the code - such as Bitmessage - in most cases I havn't personally checked the code myself. Ideally Freedombone would be a pure blend (I think that's also the aim of FreedomBox), but for now it does involve downloading some non-packaged systems.
- pflanze 13y ago
  > more unique That makes it sound like you're thinking that the chances for a conflict (same hash value) depend just on the size of the hash value. But it's worse than that, thanks to algorithmic insights, inputs that produce the same hash value can be found more cheaply than just by chance. Also, they can be found so cheaply that it's computationally trivial to do even for an individual [1]. Thus anyone who can change what data you receive, can trivially also make it hash to the same MD5. (I haven't checked whether publicly available software exists to generate conflicting files that are also, for example, valid gzip files, but I surely expect that an entity like the NSA (and perhaps blackhats, too) can create such software on their own.) [1] "produce a collision for two inputs with specified prefixes within hours, using off-the-shelf computing hardware": https://en.wikipedia.org/wiki/Md5#Security https://en.wikipedia.org/wiki/Md5#Security Yes, there are many sites that still tell users to check MD5 hashes. I think it's evident that those are totally worthless for some years now. Worse, it may be giving some people a false sense of security. OTOH those places might give those who do know a hint that perhaps the authors or distributors don't know about security. (Sorry for the harsh words...)