Forgot your password?

Comment: Demote 99% of the vulnerabilities (Score 1) 40

by Burz (#48464673) Attached to: The People Who Are Branding Vulnerabilities

Keep all the complex interfaces and code if you need them, but put them behind very small paravirtualization codebase ingrained into the OS which keeps them isolated -- from the core system, and from each other. Really, even your devices like USB controllers and NICs can be treated as untrusted in this way if you have an IOMMU. And you can have it in a normal desktop GUI.

Kernel-implemented security is a failure; Its ridiculous to go through continued years & decades of pain by relying on it and worrying about breakouts from its weak sandboxing tactics.

Comment: Re:Replace Cisco, and Akamai and then maybe.. (Score 1) 210

by Burz (#48415593) Attached to: Launching 2015: a New Certificate Authority To Encrypt the Entire Web

"Lawful intercept" has entered the business models of Verisign and CISCO. I would not trust CISCO...

Not even an inch...

Proper security on a network is properly done at the endpoints. Its doesn't belong anywhere else.

What is Mozilla thinking?? They could help fund They could implement clever ways to get it to ride on existing social networks. They could look at network privacy layers that use public keys as addresses. There are options for improving privacy that don't involve elevating the PKi clusterf*ck any further.

Comment: Re:Immune system for operating systems? (Score 1) 50

by Burz (#48400265) Attached to: Open Source Self-Healing Software For Virtual Machines

This is the one thing QubesOS could use to improve its security-by-isolation approach: Detection and repair in VMs. Even if you assume the hypervisor stays safe (and therefore, your trusted VMs stay safe), you're still relying on VMs to get everything done and the VMs doing the risky tasks are vulnerable to attack. It would be nice if those less-trusted VMs could get automatically restored after a successful attack.

Comment: Come on over to I2P (Score 3, Informative) 135

by Burz (#48357189) Attached to: Tor Project Mulls How Feds Took Down Hidden Websites

There are no privileged routers (or 'guard' nodes) on I2P, and from the perspective of "relays" I2P has many times the number Tor has.

Its way better than Tor when you're looking mainly to communicate with other anon sites/users. Comes with bittorrent and an option for decentralized (serverless) securemail.

Comment: Re:Don't totally agree (Score 2) 224

by Burz (#48345427) Attached to: Mayday PAC Goes 2 For 8

Its dumbasses like you that think "As long as you are voting for the lesser of two evils you are making a difference"

There is such a thing as a protest vote, "dumbass".

Showing up to vote is critically important. At the very least it ensures the authorities will have to do the dirty, dirty work of physically turning people away if they have been purged from the rolls.

Comment: Re:Unfortunate, but not surprising (Score 1, Insightful) 450

by Burz (#48341643) Attached to: Joey Hess Resigns From Debian

As a (primarily desktop) Linux user since 1998, the unfolding of this debacle is starting to look like an example of why Linux distros in general lack appeal in the desktop space. Desktop/laptop users can't 'make do' with server architecture; there isn't enough veritcal integration of the powerful features we need. When layers represented by systemd and wayland must be considered swappable, the more talented users turn off to the possiblity of building stable user-facing applications on that platform.

One bit of advice is, don't be such primadonnas. Like the laptop users, you'll have to explain to the world which workflows and features are getting broken by these recent changes. OTOH, if all that's getting 'broken' is your philosophy then you might want to take a step back and consider that a better (if larger) one may have replaced it.

Comment: Re:Would love to see how I2P-Bote fares. (Score 3, Informative) 96

by Burz (#48314911) Attached to: EFF Begins a Campaign For Secure and Usable Cryptography

Thus, any packet sniffer out there (be it by a credit card thief, the NSA - who may also be credit card thieves, or anyone else) can't look for context to decide what packets to grab. There is no context.

Actually, there is the very important context of who is transmitting to whom, and when, which IPSec is giving away. Each user, therefore, might as well be the subject of a pen register.

With I2P, all they see is a stream of encrypted packets to random points and even the 'when' is obscurred (I2P users onion-route traffic for other users by default and expectation, so you can think of this protocol as marrying ideas from IPSec, Tor and Bittorrent).

That means having to decrypt absolutely everything, including DNS lookups...

Speaking of DNS lookups: Why make your addressing dependant on centralized, establishment-controlled scheme? If PKI can be subverted to let them eavesdrop, then IP addresses and DNS certainly can be as well. Addresses that operate like public keys are much better.

Its already there on your TAILS disc... try it out. ;)

Comment: Re:Would love to see how I2P-Bote fares. (Score 2) 96

by Burz (#48314447) Attached to: EFF Begins a Campaign For Secure and Usable Cryptography

Its also worth noting that the I2P layer under I2P-Bote is general purpose: You can browse and even torrent with it, anonymously and securely.

Why make the focus so piecemeal??? We have experts going around saying the answer to mass surveillance is to make application-level crypo ubiquitous. I'm sorry, but that sounds like an unnecessary hassle that begs people to "just turn the crypto thingie off". Its better to have one tool that can provide security and anonymity for a large array of applications.

I respect the EFF's work, but I think their technical vision is very tiny and may meet up with the blind alley it deserves.

Comment: Would love to see how I2P-Bote fares. (Score 1) 96

by Burz (#48314343) Attached to: EFF Begins a Campaign For Secure and Usable Cryptography

"I2P-Bote is an I2P plugin, fully decentralized and distributed email system.[18] It supports different identities and does not expose email headers. Currently (2014), it is still in beta version and can only be accessed via its web application interface, but POP [also IMAP] support is planned. All bote-mails are transparently end-to-end encrypted and, optionally, signed by the sender's private key, thus removing the need for PGP or other privacy software. I2P-Bote offers additional anonymity by allowing for the use of mail relays with variable length delays. As it is decentralized, there is no email server that could link different email identities as communicating with each other..."

Comment: Re:Engine vibration? (Score 1) 150

by Burz (#48306577) Attached to: SpaceShipTwo's Rocket Engine Did Not Cause Fatal Crash

Let's see what a few seconds on Google can find us:

"The vibrations and oscillations in the version they used for the first three test flights would have torn the ship apart well if it had been fired for anywhere near full duration of about a minute."

It refers to a Times article which is behind their paywall, so I can't read it.

"There have also been accidents where nitrous oxide decomposition in plumbing has led to the explosion of large tanks."

Weren't the engineers killed in the accident while developing the Spaceship Two engine killed by an exploding NOX tank? I couldn't find the details.

Yes, and VG ignored warnings from an outside propulsion expert:

The major difference between bonds and bond traders is that the bonds will eventually mature.