Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror

Comment Re:Neither are we (Score 1) 205

no, you're just being dishonest. Science works with the assumption that everything is physical, even the things we don't know, for which we look for answers. It may not be newtonian mechanics, but it will be definitely physical. It's not a belief, it's an assumption. You, on the other hand and much more the guy above are believers in the supernatural. And just like every butthurt, you're trying to trying to say that everyone else is.

Comment Re:How is it not intelligent? (Score 1) 205

humans hallucinate too and misfire pretty often. LLMs and generally deep networks have the concept of concept, that's what the upper layers do. Btw, we don't have a good definition of what a "concept", it's an old word without much bearing to reality, it roughly means "a pattern i put a label to". AI already can "see" patterns, they handle abstractions, higher order patterns. Why do you assume that human "concepts" are different than this? But even if it's a different kind of abstraction than human abstraction, it does not follow that it's not an abstraction at all. Maybe LLMs don't generalize yet as well, but they do. Maybe we may need a different architecture, sure, time will tell.

Comment Re:The UK Gov will just mandate a backdoor on phon (Score 1) 46

I worry about that. In my threat model, I assume the attacker wants to keep the backdoor secret, and is unwilling to push a secret mass surveillance backdoor to all phones. Even if no one noticed the backdoor, someone is likely to notice all that encrypted surveillance traffic. So, there may be occasionally used back doors in our phones already, but secret mass surveillance is done server-side. That's the main threat I'm worried about.

Comment Re:Sounds interesting (Score 4, Informative) 46

Data can eventually add up. It isn't like a block chain, but we might have say 1KiB per device, and 8 billion devices globally, so maybe 10 TiB? That's assuming we don't ever shard into different quorums, and 15-ish nodes run the world, which is probably unrealistic. With say 150 nodes by then, it could add up to 1TiB per node.

Queries per second would always be low. Using a public key for incremental backups and only rotating the private key every month or two, 8 billion devices registering once a month is only 3,000 QPS globally, and again dividing by 10, that's only 300, which a Raspberry PI can probably handle.

So... it's dumb, but I will find it entertaining to run my node on a Raspberry PI until I start having security concerns. That would be roughly when enough devices are enrolled to make the system a juicy target, probably at least 2 years out. We'll need improved security at that point, e.g. running nodes in data centers with multi party with for any changes, and maybe Tor routing.

Submission + - Help wanted to build open source Advanced Data Protection for everyone

WaywardGeek writes: Recall that Apple was ordered to back-door Advanced Data Protection in the UK. We need to take action now to protect users.

I helped build Google's Advanced Data Protection (Google Cloud Key VaultService) in 2018, and Google is way ahead of Apple in this area. I know exactly how to build it an can have it done in spare time in a few weeks, at least server side. The whole world would be able to use it for free, protecting backups, passwords, message history, and more, if we can get existing applications to talk to the new data protection service.

However, I need help. I've got the algorithms and server-side covered. This would be a distributed trust based system, so I need folks willing to run the protection service. I'll run mine on a Raspberry PI. Areas where I need help include:

* Running protection servers. This is a T-of-N scheme, where users will need say 9 of 15 nodes to be available to recover their backups.
* Android client app, and preferably tight integration with the platform as an alternate backup service.
* Same with iOS
* Authentication. Users should register, and login before they can use any of their limited guesses to their phone unlock secret.

The scheme splits a secret among N protection servers, and when it is time to recover the secret, which is basically an encryption key, they must be able to get key shares from T of the original N servers. This uses a distributed oblivious pseudo random function algorithm, which is very simple.

In plain English, it provides nation-state resistance to secret back doors, and eliminates secret mass surveillance, at least when it comes to data backed up to the cloud. iOS and Android systems don't currently do that. The UK and similarly confused governments will need to negotiate with operators in multiple countries to get access to any given users's keys. There are cases where rational folks would agree to hand over that data, and I hope we can end the encryption wars and develop sane policies that protect user data while offering a compromise where lives can be saved.

So, nothing too serious :-)

Are you up for this challenge? Are you ready to plunge into this with me?

Slashdot Top Deals

What's the difference between a computer salesman and a used car salesman? A used car salesman knows when he's lying.

Working...