Live data from Hacker News

What is this Gemini thing, and why am I excited about it? (2020)

drewdevault.com

141–150 of 211 posts

Re: What is this Gemini thing, and why am I excited about it? (2020)

#141
post #38

When I was in high school, I was part of an online community that wrote graphical shells for DOS (really NTVDM) in QBasic. One of the things we all started to want was a web browser, but most of us had no idea how to write a parser, let alone deal with the complexities of HTML and JavaScript. So we created our own markup language, where each "tag" was on it's own line, with the first character indicating the type of…

How did you do networking from QBasic? (And especially when running under NTVDM?)

Using serial or parallel ports, or communicating over modem was done in QBasic. It's possible they did something like that.

Re: What is this Gemini thing, and why am I excited about it? (2020)

#142
post #38

When I was in high school, I was part of an online community that wrote graphical shells for DOS (really NTVDM) in QBasic. One of the things we all started to want was a web browser, but most of us had no idea how to write a parser, let alone deal with the complexities of HTML and JavaScript. So we created our own markup language, where each "tag" was on it's own line, with the first character indicating the type of…

How did you do networking from QBasic? (And especially when running under NTVDM?)

Can't speak for the original author but if I had to guess: Files on a world writable shared network volume, as this was a "classic" in school settings ;-)

No matter the decade, allow some pupils a shared network volume somewhere, they'll soon or later write a chat app with whatever programming language they can get their fingers on in that network, at least that was my experience. I did it, heard from other schools were the same happened.

Re: What is this Gemini thing, and why am I excited about it? (2020)

#144
post #106

Earlier quoted context omitted.

This is the exact response that I tried to cover with the rest of my comment.

I actually think it’s an interesting idea that merits some investigation.

My first idea is that it would be a nightmare from a supply chain security perspective. Eventually someone from the Amazon box printing company will be bribed to print a different certificate hash on 0.5% of the printed boxes, for example.

Re: What is this Gemini thing, and why am I excited about it? (2020)

#145

Earlier quoted context omitted.

Would you notice if someone changed the "f" in the middle of that onion link to an "l"?

Again, it's impossible, or should be impossible, to easily change a single character in a hash. The avalanche effect means that small changes in the input data will result in huge changes to the hash.

The input data in this case is the private key so if you had that available to change, you would not need to do anything more as you could already control the real .onion domain.

The attack on things like onion domains would be finding another domain that to a human looks similar enough to be mistaken for the real deal. You'd do that by brute forcing (same as what Facebook did to get the "facebook" prefix in their onion domain) and for a sucessfull attack the space you need to brute force is limited by what humans can distinguish, which is smaller than the whole hash space.

Re: What is this Gemini thing, and why am I excited about it? (2020)

#146

Earlier quoted context omitted.

How did you do networking from QBasic? (And especially when running under NTVDM?)

Using serial or parallel ports, or communicating over modem was done in QBasic. It's possible they did something like that.

NTVDM has an interface called VDD you can use to write virtual device drivers. Basically a Windows DLL loaded into NTVDM.EXE and you can call the DLL from DOS by executing illegal instructions. Often a VDD would have an associated TSR which would provide a more normal interface to DOS programs (based on software interrupts not illegal instructions.)

Microsoft provides some, and third party vendors and open source provides others (the interface is documented in the Windows DDK, or at least it used to be). In particular, Microsoft had one called REDIR which included a bridge between the DOS and Windows NETBIOS APIs. Microsoft used to ship their own Netware client with old versions of Windows and that included another, VWIPXSPX, which similarly bridges the IPX/SPX API from DOS to Windows. Novel’s Netware client for Windows had an equivalent VDD called IPXVDD - https://support.novell.com/techcenter/articles/ana19970501.h...

And see http://netfoss.com/ for a VDD which connects the DOS FOSSIL API (de facto standard for DOS BBS to talk to multiport serial cards) to TCP/IP.

QBASIC doesn’t support any of these APIs, but it can call code written in assembler, and assembler can.

Another option would be to use a virtual serial port driver which makes a TCP/IP port appear as a serial port. QBASIC has built-in support for talking to serial ports. There are a bunch of these, for example https://pcmicro.com/netserial/ or http://com0com.sourceforge.net/ - it can be done either as a Windows kernel driver (so all Windows apps can access it) or as a VDD (only usable by DOS programs running under NTVDM but a pure user mode solution). Actually, if one uses DOSBox instead of NTVDM it has a serial-to-telnet gateway built in.

So there are lots of ways they could have solved it. Still wondering what they actually did.

Re: What is this Gemini thing, and why am I excited about it? (2020)

#147

This all seemed interesting at first, but the more I look at Gemini, the more I shrug and say, "Why not just build some text web sites without ads or trackers?" Literally millions of those exist, some dating back to the first eta of the web that every geek my age or older seems nostalgic for. (Really, they're nostalgic for an era when almost everybody else they ran into on the internet shared the background of being…

> Really, they're nostalgic for an era when almost everybody else they ran into on the internet shared the background of being a white, male American geek As someone who doesn’t fit into that pigeon hole, and whose friends mostly don’t either, it’s so disheartening to read essentialist assumptions like these. We liked the Internet better back then too! You’re taking something that’s objectively good, and saying it’s…

Is there something similar to Godwin's law for when white male comes up on internet discourse? If there isn't there should be :)

Re: What is this Gemini thing, and why am I excited about it? (2020)

#148
post #32

Earlier quoted context omitted.

People, or businesses, that you know in real life could exchange certificate hashes in person. This is one of those things that usually garners the response "normal people would never do that", but honestly I'm surprised that no-one has even tried. Let's say that web browsers put a short hash of the certificate right in the URL bar. Amazon, for example, could print its hash on every shipping box. Banks could print th…

.onion addresses are hashes, but a hash long enough to prevent a brute forcing is also too long for people to consistently recognize. Is facebookwkhpilnemxj7asaniu7vnjjbiltxjghye3mhbshg7kx5tfyd.onion the right URL for Facebook or a clever near-collision?

(The correct address is facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion)

Re: What is this Gemini thing, and why am I excited about it? (2020)

#149

This all seemed interesting at first, but the more I look at Gemini, the more I shrug and say, "Why not just build some text web sites without ads or trackers?" Literally millions of those exist, some dating back to the first eta of the web that every geek my age or older seems nostalgic for. (Really, they're nostalgic for an era when almost everybody else they ran into on the internet shared the background of being…

> Nobody is going to force you to use JavaScript. But they sure try. Latest iteration of coercion is called Google AMP. Images, videos and other embeds are fine, because they're clear siloes; it's easy to make sure the website degrades gracefully. JS is not, and fonts are not. These do not degrade gracefully. Neither do complex styles in CSS. Canvas does not degrade either. Gemini is a bit too simple to be really use…

> Latest iteration of coercion is called Google AMP.

I changed my default search engine from GSearch to DDG a couple years ago because of AMP, but it's now thankfully dead in the water, e.g.

https://searchengineland.com/google-news-app-will-display-no...

https://www.mediapost.com/publications/article/366242/amp-de...

https://www.seroundtable.com/google-remove-amp-no-search-ran...

Re: What is this Gemini thing, and why am I excited about it? (2020)

#150
post #135

People here saying they'd rather use just text-only HTML, or HTML+CSS sans JS, don't understand that what attracts people to Gemini is the ease of implementation . The main quality of Gemini is that it is easy to understand and implement thus allowing normal developers to create clients and servers from scratch with minimal fuss. You can actually keep the whole spec in your head which is no longer something anyone ca…

But still, there is TLS. Gemini is a bit conflicted here. It has both privacy and simplicity as design goals. But privacy (materialized by encryption) is far from simple, so much that "rolling your own crypto" is seen as a cardinal sin, and for good reason. Crypto is an arm race, constantly under attack, constantly updated, and very easy to get wrong. The argument on the Gemini website is to use a library, which is i…

I agree, and to be honest I'd rather the TLS was optional because this would open Gemini to a lot of retro computers. Anyway, there is Mercury which is a simplified Gemini without encryption IIRC which solves that.

The important part is that you can treat the TLS as a black box and still hold the Gemini spec in your head. It is easy to implement by simply leveraging a TLS and a network lib. To implement a modern Web browser you need way more than that these days, which is why almost all browsers are chromium :-/ no company can justify the effort to develop new engines and clients anymore (my opinion).

Post reply on HN