apeace

42 ms·

361.
by apeace 9y ago
> If I could easily tear down the entire tunnel from the remote client to my hidden service, then the delay to rebuild the tunnel would mitigate the resource exhaustion attack ... For example, if I see hostile activity from 127.0.0.1:123
362.
by apeace 9y ago
Regarding your comment about Tor, I hope my recent comment on the subject can make you more skeptical of that claim: https://news.ycombinator.com/item?id=14251007
363.
by apeace 9y ago
Yes, great point. But I said _easier_, not _easy_. Using HTTPS, a user may have a more outdated version of the Tor browser with different cipher suites than everyone else. Using plain HTTP, that can't happen. > unless someone at the
364.
by apeace 9y ago
That's true. If you're talking about your ISP sniffing your traffic, HTTPS is a win. But since the author was talking about using Tor, I figured he was focusing on fingerprinting by the websites themselves, where HTTPS is easier f
365.
by apeace 9y ago
Thanks for the thoughtful reply! > My link was a direct response to your second link. Yes, and they only take issue with the the claim that 94% of Tor requests to Cloudflare are malicious. It's a shame that Cloudflare hasn't re
366.
by apeace 9y ago
I hope I can make you more skeptical of the "Cloudflare is the bad guy" trope. Cloudflare is lightyears ahead of any CDN when it comes to supporting Tor. They specifically built controls so that web sites can remove CAPTCHAs for T
367.
by apeace 9y ago
The author is correct. HTTPS adds more vectors which can be used to form a fingerprint, such as the TLS version or the preferred cipher suites of the browser. For example: https://www.ssllabs.com/projects/client-fingerp
368.
by apeace 9y ago
> The things that makes TOR useful for people avoiding prosecution also makes it useful for people involved in malicious and criminal activities ... Everything from spam and network attacks to trafficking people and contraband. > Alth
369.
by apeace 9y ago
I'd be interested in helping out. Please get in touch! https://apeace.github.io/contact.html
370.
by apeace 9y ago
One could argue this is actually a good security practice. It's bad to train users that their bank/whoever will be sending them links via email, because then when the user gets a phishing email, they will have no way to tell the d
371.
by apeace 9y ago
Yes, that's exactly my point. This article makes it sound like you need a distributed system at almost any level of scale. Yet the reality is, you only need one of you are doing tons of writes. Most systems are read-heavy, which is why
372.
by apeace 9y ago
Yes, the point of Convox is that it deploys your docker containers to AWS using your docker-compose config. It sets up a VPC for you, ELBs, autoscaling group, private docker repository, the whole deal :)
373.
by apeace 9y ago
Everything the author describes sounds like docker-compose to me. Combine that with Convox and you've got a powerful, easy-to-use cloud platform.
374.
by apeace 9y ago
> There are many reasons why an organization would need to build a distributed system, but here are two examples: > - The demands of a consumer Web site/API or multitenant enterprise application simply exceed the computing capaci
375.
by apeace 9y ago
Great article. If you find magic interesting, I highly recommend you search YouTube for Penn & Teller's material. There are not only a lot of tricks to be seen, but also plenty of speaking appearances where they talk about their ph
376.
by apeace 9y ago
I also enjoyed the article, and also have a nitpick which you may find interesting. > Still, over time every new internal project pretty soon begged the question... You probably mean "raised the question". Begging the question
377.
by apeace 10y ago
The Cloudflare blog is top-notch. If you skim past all their product and data center announcements, there is a ton of good technical content. https://blog.cloudflare.com
378.
by apeace 10y ago
To clarify, that quote was directly from Jenny Jones, a member of the UK Parliament. It was her editorializing, not the socialist web site. https://www.theguardian.com/commentisfree/2017/mar/22/whistl...
379.
by apeace 10y ago
What would move my needle is reproducible results, i.e. science. For example, have a shaman go into a room and describe the spirit he sees. Then have another shaman go into the room, and see if his description matches. Or, write about how m
380.
by apeace 10y ago
Apologies if I'm missing something--what is this doing in the front page of HN? This person claims he can see spirits perturbing the mentally ill. He claims he has the cure for schizophrenia. What kind of science or unbiased analysis i
381.
by apeace 10y ago
Exactly. And what a silly move, since even shutting down all the Tor nodes in Russia would not stop Russians from using Tor for the same activities. It will be interesting to see if Russia adopts a network monitoring and censorship strategy
382.
by apeace 10y ago
Since nobody has mentioned this yet: I found that the core search functionality is not very good. I tried drawing a frowny face, a stick figure person, and a puppy face, and it didn't recognize any of them. I'm terrible at drawing
383.
by apeace 10y ago
> Snowden categorically dismissing anything that NSA does That's not representative of Snowden's opinion at all. From the beginning he's always stated he believes in the mission of the intelligence agencies. Heck, he used
384.
by apeace 10y ago
Does anyone have a source (article) that states whether these Twitter accounts were created via Tor? I could have sworn I read that they were, but can't seem to find a reference anymore.
385.
by apeace 10y ago
> It's similar to what ideas 2.1 and 2.2 are in the blog post - a local directory that is maintained and authenticated centrally and then distributed to browsers that perform a central lookup. The downsides are that it is too centra
386.
by apeace 10y ago
That is correct. And no, people don't use jump links everywhere--only if their site is new and they are passing the links to folks on IRC, etc. Another thing I forgot to mention: if a name is unknown, your local HTTP proxy will ask you
387.
by apeace 10y ago
The way DNS works in I2P[0] is pretty neat[1]. Nothing in this post sounds quite like it. It provides a great "default" user experience while allowing for finer-grained control and tighter security if a user chooses. To summarize:
388.
by apeace 10y ago
If anyone's first reaction was along the lines of: "Faxing in 2017?" or "Is this an April Fool's joke?", consider that the healthcare industry still uses faxes frequently. I once interviewed at a company that w
389.
by apeace 10y ago
In this post the author links to one of her previous posts[0], where she wrote: > As a proof of concept of unprivileged containers without cgroups I made binctr. Which spawned a mailing list thread for implementing this in runc/libc
390.
by apeace 10y ago
While I agree there is some level of mass psychosis surrounding JavaScript, I think there is a lot more nuance to what's going on. I don't think the onslaught of new frameworks and transpilers has been due to JavaScript's wea

More ›