tptacek

9 ms·

181.
by tptacek 2mo ago
In other words, the reason NAT is seen as security is that it provides security (imperfectly, like almost everything else).
182.
by tptacek 2mo ago
I think this is not really a good way to divide up the space. It's obviously true that there are non-NAT firewalls. But NAT was introduced as a firewalling technique. In the first decade of firewalls, there was a whole taxonomy of diff
183.
by tptacek 2mo ago
NAT wasn't so much normalized as a security feature as it was introduced as one. The flagship NAT product of the 1990s was the Cisco PIX, a firewall. It resulted from Cisco's acquisition of the company that originated NAT.
184.
by tptacek 2mo ago
She had very high levels of mercury in her blood, and all attempts at chelation therapy to remove it were ineffective. That’s surely because it had spread throughout her body by the time the problem was recognized, but frankly no one can b
185.
by tptacek 2mo ago
I appreciate what this piece is trying to do directionally but it shares a logical flaw with lots of other pieces about AI and knowledge work. It assumes that in order to disrupt a particular field, AI needs to print serviceable work unassi
186.
by tptacek 2mo ago
I'm fine with you running Anubis. My point was that Tavis flagged the outcome this blog post is discussing a year ago. It was hotly disputed on HN at the time. That's all I'm saying.
187.
by tptacek 2mo ago
I had a fairly long conversation with Xe privately about this and didn't feel the need to repeat it here, especially since (as the search box will tell you) I've already talked about this before. But, do go on.
188.
by tptacek 2mo ago
What I'm hearing is that you spent a year designing a more complicated proof-of-work challenge rather than moving to a challenge system that actually impacts scrapers. Consider revisiting this decision!
189.
by tptacek 2mo ago
That doesn't matter! Every time they successfully solve the challenge, they're getting the token reward. That's the missing asymmetry. In an anti-spam system, 99.999% of all transactions are unrewarded.
190.
by tptacek 2mo ago
I don't know what you mean by "the best argument". My entire argument is that it's bad CS. I'm not trying to convince people not to run Anubis. If anything, I'm trying to convince Anubis to use better computer
191.
by tptacek 2mo ago
I'm not moralizing. The sites running Anubis are owned by people who like Anubis and are fully within their rights to run Anubis. I don't care how enthusiastic they are about it. It's their call. I'm just saying, it&#x27
192.
by tptacek 2mo ago
I suspect that's most of the value, and that the deterrent is about software construction and not about the proof-of-work, which I've been saying for the last year is a productive direction for Anubis to head towards. Instead, it&
193.
by tptacek 2mo ago
This is the basic misconception behind the Anubis design. In an anti-spam system, there's a user/abuser reward asymmetry. Users make single requests and get some constant reward V. Abusers make millions of requests and also get
194.
by tptacek 2mo ago
It's weird to believe data center based, Internet-scale scraping operations will be less able to allocate compute to proof-of-work challenges than individual users. This is design problem with things like Anubis: proof-of-work depends
195.
by tptacek 2mo ago
Tavis Ormandy called this, about Anubis, almost exactly a year ago: https://news.ycombinator.com/item?id=44962529 It never really cohered as a solution. High-powered scrapers are better equipped to handle proof-of-work chal
196.
by tptacek 2mo ago
The trouble I have with this argument is that you can look at almost anything Musk does and make an argument like this. He's discredited AI, data centers, cars, space exploration, biotechnology, you name it. Yes, Musk's data cente
197.
by tptacek 2mo ago
Andy Masley, who's more responsible than anyone else for debunking the idea that data centers abuse water resources, has been a broken record for the past month on Twitter saying that he doesn't buy into this "Chinese spy op&
198.
by tptacek 2mo ago
I appreciate you for sharing your expertise here!
199.
by tptacek 2mo ago
You have the better argument, and could just leave it at the last comment before this. (I'm not the boss of you, but I hate seeing the better argument taunted into writing like this.)
200.
by tptacek 2mo ago
I mean, the PKK definitely was a terrorist organization!
201.
by tptacek 2mo ago
Obviously they are not.
202.
by tptacek 2mo ago
Because they're legally required to.
203.
by tptacek 2mo ago
I guess we're doing this again. The author of the 404 article that broke this story (about "rare books" being destroyed by AI model companies) was interviewed by NPR. The books, so far as anyone knows, turn out to be manuals
204.
by tptacek 2mo ago
It's an agent system that basically embeds the core idea of CodeQL (Datalog extraction from codebases) and then allows a model to pose questions and answer them.
205.
by tptacek 2mo ago
No. I'm a cofounder at Fly.io and have spent the last 6 years (really, the last 25) in ops world. The points you're making here are addressed directly in the article. It's kind of hard to miss them!
206.
by tptacek 2mo ago
I don't have an opinion about the PKK. My broad take is: if Europe doesn't care, there's no reason for the US to be leading a sanctions effort. I'm confident like everybody else that this is largely pretextual. All I car
207.
by tptacek 2mo ago
I don't think that's the right way to frame it. To me, in-band vs. out-of-band signaling is the real dividing line, and has been all the way back to PARC.
208.
by tptacek 2mo ago
It's perfectly possible to design a GUI without button controls, where literally all the interaction is done with keyboard inputs. It's still not a TUI: it has graphical visual layout, and the UI signaling is out of band with resp
209.
by tptacek 2mo ago
Modern GUI frameworks maintain a visual UI tree for on-screen interaction, and a semantic tree for accessibility features. You can find TUI libraries that do things like this, but for most TUIs, if you close your eyes and have the UI read t
210.
by tptacek 2mo ago
Signal and WhatsApp don't have the plaintext of your communications to begin with.

More ›