Cryptography nerd

Fediverse accounts;
[email protected] (main)
[email protected]
[email protected]

Lemmy moderation account: @[email protected] - [email protected]

@[email protected]

Bluesky: natanael.bsky.social

  • 0 Posts
  • 17 Comments
Joined 3 months ago
cake
Cake day: January 18th, 2025

help-circle
  • It’s kinda comparable in terms, but because both licenses have comparable copyleft “no rights may be removed and no terms added” restrictions they conflict and can’t be merged.

    CDDL came after GPL, and I’m not convinced by the arguments for why it was used (to make some kind of development with commercial modules easier, but this could’ve been done with GPL + exceptions)

    That license plus patents (which only are freely licensed to the CDDL implementation specifically) means you can’t just rewrite it for Linux either. You’d have to wait for the patents to expire and then do clean room reverse engineering.





  • Reddit admins are insanely biased towards right wingers. They talk about the same free speech bullshit while only allowing one side to speak freely.

    They tolerated brigades organized by them for years despite brigades being prohibited, they allowed T_D to absolutely dominate the front page by vote manipulation until a huge majority of the site got too outraged (that’s when the 2 post cap/day per sub was set, along with ignoring votes on pinned posts). T_D screamed and screamed and screamed about being censored when that happened (nothing was even removed), and everybody else was happy reddit FINALLY AFTER YEARS did something, anything, to make the site a bit more usable again. Tons of left leaning subs were banned long before they ever touched any far right extremism.

    The left wing bias you might have seen comes from moderators who actually have expertise on their subjects (like science subreddits), not from the admins



  • I hate them.

    I run a cryptography forum on reddit (now here too). On reddit it’s /r/crypto. Before the random suggested usernames every spam operation had to make up their own random username scheme. They ended up being mostly distinguishable because they used patterns normal people didn’t. Now? A ton of users with limited activity are now indistinguishable from bots. So the subreddit has to be in restricted mode so only approved users can post, and for anybody with ambiguous post history I have to send them a request for more detail to be able to keep spammers out while still allowing genuine newbies to join to ask questions. Otherwise the spam volume just ends up being way too intense.



  • If you’ve already noticed incoming traffic is weird, you try to look for what distinguishes the sources you don’t want. You write rules looking at the behaviors like user agent, order of requests, IP ranges, etc, and put it in your web server and tells it to check if the incoming request matches the rules as a session starts.

    Unless you’re a high value target for them, they won’t put endless resources into making their systems mimic regular clients. They might keep changing IP ranges, but that usually happens ~weekly and you can just check the logs and ban new ranges within minutes. Changing client behavior to blend in is harder at scale - bots simply won’t look for the same things as humans in the same ways, they’re too consistent, even when they try to be random they’re too consistently random.

    When enough rules match, you throw in either a redirect or an internal URL rewrite rule for that session to point them to something different.





  • Hashing alone if it’s just usernames isn’t enough. Need something like keyed hashes, but then malicious servers can lie about numbers of votes.

    Otherwise you need something ridiculously overengineered like public but encrypted logs of user actions and Zero-knowledge proofs of correctness mapping everything to a distinct existing user without revealing who it is.

    As I mentioned in another post: for consistency is better to have each server count total votes from their own users, send a signed & timestamped message with the count to the host of the post being voted on. Then the host can display a consistent vote count to everybody that shows where votes are coming from without manipulation of external votes.

    Each individual server can lie about its count, but not by too much or else it will be detected and the server can get defederated (or have its votes ignored).



  • The steam controller didn’t really fail, but the patent fight was a mess that took way too long (much too late disqualified patent over paddle buttons). That sucked a lot of energy out of the project. Don’t forget the steam deck kept those touch pads (although with a different design)!

    Steam Link IMHO also wasn’t bad, but there didn’t seem to be much interest in it then. (interestingly enough I think it could be recreated today in a Chromecast-like form factor)

    Stream machines was definitely a big mess however, there just wasn’t enough interest, too limited compatibility, the machines just wasn’t versatile enough for average Joe to pay for one.


  • “yes”? He’s definitely not building any significant fraction himself, but if he didn’t care for these things he wouldn’t let the company put so much resources into them.

    Credit for the things built goes to the people building them. Credit for it being possible to build goes to the people who founded and funded the teams