Earlier quoted context omitted.
Could you illuminate those of us who are not in the know?
Presumably this refers to Hicks's advocacy for an "unbiased genocide against the whole of humanity"...
I prefer Sweet Meteor 'O Death 2020
The Great Cannon has been deployed again
331–340 of 470 posts
Re: The Great Cannon has been deployed again
#332Earlier quoted context omitted.
I think China's government requires websites to give them their private keys. HTTPS is useless then.
Not with (perfect) forward security: > In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if the private key of the server is compromised.[1] Forward secrecy protects past sessions against future compromises of secret keys.[2][3][3] * https://en.wikipedia.org/wiki/Forw…
Forward secrecy only helps you if the server private key is comprised in the future. If it's compromised already, and an active attacker can modify traffic between you and the server, forward secrecy doesn't help.
Ultimately, if an attacker has all your keys and controls all your traffic, there's nothing left that distinguishes the attacker from you. No security is possible in that scenario.
Re: The Great Cannon has been deployed again
#333Earlier quoted context omitted.
That would be the kind of signal that would be hard for the Chinese to spin in such a way that it would make them look good, and the economic effect would be pretty much instantaneous. There is plenty of historical precedent for this: spammers' IP ranges would be blackholed to send a message to their ISPs that such behavior wasn't tolerated. That the Chinese authorities decide to play this game at the nation state le…
I'm not sure 'We have the technology to censor the internet, and it's okay to deploy it' is the message you want to give the CCP.
Not really, it is more like "if you behave like a malicious actor similar to a spammer, we will treat you like one".
Re: The Great Cannon has been deployed again
#334Re: The Great Cannon has been deployed again
#335Earlier quoted context omitted.
I don't know who to attribute this to but I've heard a saying: "Countries that trade with each other don't make war with each other." As we isolate countries and disrupt trade we definitely are increasing the risk of conflict.
https://www.telegraph.co.uk/news/worldnews/asia/china/955570... This was a common argument as to why WWI couldn't happen, countries were far too economically dependent, everyone would be ruined. Except it did happen, and everyone was ruined.
There were more guns and power mongers than economic ties. Plain and simple. Those arguments should have been qualified a lot more.
Re: The Great Cannon has been deployed again
#336Earlier quoted context omitted.
I'm not sure 'We have the technology to censor the internet, and it's okay to deploy it' is the message you want to give the CCP.
That's not censorship. https://en.wikipedia.org/wiki/Censorship The criminal co-opting of networks and nodes on those networks is not speech by any definition.
The point is that technology could _also_ be used for censorship.
Re: The Great Cannon has been deployed again
#337This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…
I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand). When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The emai…
There's Plain Text Offenders which covers part of that.. https://plaintextoffenders.com/tools
Re: The Great Cannon has been deployed again
#338This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…
> This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). We're talking about China, so that's probably not going to work: Chinese users are using Chinese browsers [1] to access Chinese web…
sure. but that would still limit the attack to only come from within CN (and possibly users outside with a CN browser) and not from every potential user who has Safari/Mozilla/Chrome.
It would mitigate attacks from inside China against outside entities, which for somebody not based in China is all I want.
Re: The Great Cannon has been deployed again
#339I'm curious: is it technically and politically possible for the operators of all internet cables receiving traffic from China to filter out malicious scripts? AT&T's writeup says the injection is only possible because it's HTTP (not HTTPS), and that there are two specific JavaScript files which sometimes serve up the malicious code. So in case of known malware like this being served from within a geographic region...…
>I'm curious: is it technically and politically possible for the operators of all internet cables receiving traffic from China to filter out malicious scripts?
Considering that the halting problem is undecidable, it's impossible to filter out the malicious scripts with complete certainty. The best you can do is use blacklists/heuristics which lead to an arms race.
>So in case of known malware like this being served from within a geographic region... is there any way to filter this out at scale? Or is that computationally infeasible at scale, so it would have to be built into the browser or something?
foreign ISPs can block port80 or http requests from coming into china. sure, it's going to break a lot of sites, but it's relatively simple for any site to get unblocked - all they need to do is set up letsencrypt.
Re: The Great Cannon has been deployed again
#340Earlier quoted context omitted.
There is no problem. Routers can use a self signed cert.
Could you expand on that a little? What do you mean? Won't my browser complain if the cert if self signed?
Yes, it will complain and for good reason: it has no way of knowing whether the kid next door is spoofing your router's IP or Mac address and presenting their own self-signed certificate.
I wouldn't go as far as calling it «capricious constraints imposed by the system of "certificate authorities"» but at the same time, I agree that it's not a fundamental limitation of the technology.
Better protocols could be developed to allow a browser to trust a server without (all) the limitations of the current system.