Viewing profile — phw

I've been building WhyNotLog to answer tricky questions using statistics. Example questions include "what gives my dog allergies?" or "what affects my sleep?". Available at https:/…

An unrelated but practical example: I used to play a competitive ski racing game. You would race a course and upon finishing, your client sent the locally-determined finishing time…

Location: Chicago, IL Remote: Yes Willing to relocate: Yes Technologies: Go, Python, JavaScript, React, PostgreSQL, Docker, k8s Résumé/CV: https://files.nymity.ch/resume.pdf Email:…

In case it's helpful: I'm maintaining a tool kit that makes it possible to run unmodified, general-purpose code inside Nitro enclaves: https://github.com/brave/nitriding

Brave Software | Security/Privacy Researcher | Remote (in-office also possible) Brave is on a mission to protect the human right to privacy online. We’ve built a free web browser t…

I've been working on a book for new Ph.D. students: https://research-power-tools.com It's 95% done. Most of the (unedited) content is available for open review: https://nymity.ch/b…

Brave Software | Security Researcher | Full Time | Remote Brave is on a mission to protect the human right to privacy online. We’ve built a free web browser that blocks creepy ads …

Consider adding Tor onion services to that list. The idea is that you run a Tor daemon that starts an onion service which can expose any TCP-based service. Communication is facilit…

I've written a few paragraphs on the topic. Maybe it's helpful: https://nymity.ch/book/#make-your-code-public

UAP sightings are rarely taken seriously, which is no surprise considering that 99% don't hold up against any kind of scrutiny. There are however a number of credible sightings, th…

There's research on the same idea but with a (presumably) sounder method behind it: https://sandlab.cs.uchicago.edu/fawkes/

> IEEE seems to have no problem with this paper though. IEEE is just the publishing organisation and doesn't review research. That's handled by the program committee that each IEEE…

You generally start as an assistant professor, which means you are on the tenure track but you don't yet have tenure. After several years, if you did well, you get promoted to asso…

We used an online survey to study this, and some other questions: https://nymity.ch/onion-services/ Figure 10 shows that most users (52%) use bookmarks, followed by locally-saved t…

This idea has since been applied to several other domains. Last year we had a look at all archived RSA keys of Tor relays: https://nymity.ch/anomalous-tor-keys/ We found that sever…

Ideally, a geolocation system should also work in an adversarial setting, when somebody is trying to spoof their geolocation. We recently learned that some VPN providers do that, t…

If the SYN queue is more than half full, the kernel (used to?) adapts the number of SYN/ACK retransmissions to mitigate the load. Interestingly, this opens a side channel that can …

I'm one of the authors. You are right, these are the only onion services that were most likely targeted. The others are part of our publicly available dataset, but most likely fals…

Here's a summary that's a bit easier to digest: https://blog.torproject.org/blog/learning-more-about-gfws-ac...

Citation needed. I have been hosting various IEEE papers on my websites for years and have never heard from IEEE. My understanding is that CS publishers tolerate researchers hostin…

The bots in the "botnet problem" were connecting to a hidden service that was hosted in the Tor network. That isn't quite the same thing as bots that connect to hosts outside of To…

Raspberry Pis don't make very good relays. They don't have enough CPU power to relay non-trivial amounts of data, and slow relays that clog easily aren't useful to the network.