hyper_reality

Joined 9 years ago

Karma
1,238
Submissions
137
Member since
May 3
Co-founder of CryptoHack.org

[ my public key: https://keybase.io/hyperreality; my proof: https://keybase.io/hyperreality/sigs/UP-XDCQUL1Z4L1T9KfF14x0Jpy_WxPs5UEyAPkIKPRs ]

View on Hacker News

Recent submissions

Comment · 3 days ago
Following the eMudhra incident I made a tool to distrust all except the 30 most essential CAs on my Linux and Windows systems (https://github.com/hyperreality/distrust). I was shocked at how messy the situation is on Linux, with browsers, CLI tools, programming languages all having their own stores and distros building the bundles differently (update-ca-certificates in Debian vs update-ca-trust in Arch or Fedora). Or like Firefox not using the certs in /usr/share/ca-certificates/mozilla/ but its own per-profile NSS store instead. There has to be a better way.
Comment · 3 years ago
Comment · 3 years ago
This map looks cool but it doesn't tell us a lot about the safe and unsafe places to cycle in London. Because it's based on collision data by location, but we don't know how many people cycle on each road per year, so can't normalise for that.

To compare two examples, you can pick out Richmond Park in south-west London due to the low number of collisions in it. But this is actually a highly popular location to cycle. The relatively low amount of vehicles, 20mph speed limit, ban on large vehicles, high visibility, and few junctions, makes it a great place to cycle.

There are also a low number of collisions in the boroughs of Bromley and Bexley in south-east London. But this is not because they're safe, but because very few people cycle there. There are loads of fast roads in these boroughs and little cycle infrastructure, and more of an hostile attitude from drivers compared to many other places in London.

Comment · 3 years ago
Are you sure you're thinking of the right author? Filippo used to work at Cloudflare so I can't imagine he got the technical details about it too wrong.
Comment · 3 years ago
HackTheBox (https://www.hackthebox.com/) is the largest and most active hacker challenge website. Focussed mainly around black box pentesting of vulnerable Windows and Linux machines, but they have lots of other types of content these days too such as CTF challenges and paid lab environments.
Comment · 3 years ago
Thanks for mentioning CryptoHack!

Yes while some challenges overlap, we also explore more deeply the mathematics of cryptography, as well as its practical use in protocols like TLS. We recently added challenges on lattice-based post-quantum cryptography. In this way it makes a great complement to CryptoPals.

But it's not all harder, our introductory section gradually introduces concepts like base64 encoding and the modulo operator one challenge at a time.

Comment · 4 years ago
> - higher lifeforms are more valuable than lower ones (cat vs lobsters)

Choosing between preserving the life of one cat vs one lobster seems straightforward enough. But the trolley problem was asking whether one cat was more valuable than five lobsters. According to the stats, many people agreed, but how about one cat vs a million lobsters? Or one cat vs all the lobsters on earth? Most people would think that making lobsters extinct would be very bad (unless they really hate lobsters).

The difficulty is when we can no longer rely on intuition and have to come up with a precise exchange rate of when one being's life is more valuable than another's, which, like you say, is impossible to do in the complicated world we live in and our limited understanding of consciousness and neuroscience. In absence of that, deferring to the first law "whenever possible, do no harm" seems sensible.

Comment · 4 years ago
To pick an extreme but well-known thought experiment. You are walking past a pond, and see a child drowning in it. You glance around and there is nobody else nearby. You could easily jump in and save the child. It will certainly die if you do not.

If you choose to do nothing and ignore the drowning child, are you really not morally responsible in any way for the child's death?

Comment · 4 years ago
> I'm curious, why do you think that these requirements won't spread to the rest of the internet

I didn't say that, I only said that we currently have two Internets, but that there has been a shift towards the walled gardens of identified accounts over time. The proponents of the law probably would end up creating loop holes just because their main beef is with the big tech firms, and it would be challenging for a single country to enforce legislation on the rest of Internet.

> Verified accounts, as I understand them, on the social platforms are only for people who publicly want to build a brand around their identity. While people have to use a "real name" on Facebook and Google, there's nothing requiring to get verified.

We may be getting mixed up with the meaning of "verified", I'm talking about accounts where the platform has associated you with your RL identity through some method, not just the process to get a public blue tick.

And, while there may be nothing formal requiring verification, there are many reports of people suddenly getting locked out of their accounts and being required to provide ID or at least a phone number shortly after registration. In fact a phone number is a pretty widespread requirement and it's getting harder to obtain a phone number that's not linked to your identity in some way. I don't see the contradiction in what I wrote, I have simply pointed out trends, not absolutes.

Comment · 4 years ago
> I think it’s pretty clear at this point that the notion of the web as a self protecting organism that naturally rejects misinformation and stops bad actors is completely wrong.

It's an interesting question, but the point isn't as clear to me. First of all I believe most people are able to see through misinformation. The biggest blame should be laid on algorithmic feeds that optimise for engagement, and are therefore designed to lead people into self-reinforcing loops where their ideas never get challenged. That's the main bad "innovation" that social media platforms brought; the arguments about dangerous ideas, censorship, and bad actors echo all the way back to the dawn of the printing press.

> But I also think you can’t ignore that misinformation from anonymous actors has pushed democracy to the brink of collapse, and “that wasn’t the original idea of the web” isn’t the best rebuttal.

I think this is overstating the role of "anonymous actors" - plenty of misinformation comes from well-known politicians and simply normal people. Are you referring to FB's concept of "coordinated inauthentic behaviour" and troll-farms in authoritarian countries? This is definitely a problem which platforms have to tackle, but again I don't think it's as huge a factor as people make it out to be and certainly has not pushed democracy to collapse on its own.

Comment · 4 years ago
I still remember the days when almost everyone on Internet forums used pseudonyms and closely guarded their identities. It was even taught in schools not to reveal who you are online.

Google, FB and other tech giants changed the norms around this completely for most Internet users. Once these platforms realised it was easier to monetise their users, and control abuse when dealing with real identities, they pushed hard for verified accounts (e.g. Google Plus) even though this is antithetical to the founding ideas of cyberspace.

Today we have two Internets, one where anonymity is still possible but you can reveal your true name if you want (e.g. HN), and another of walled gardens with verified identities. The UK government is proposing to enshrine the fully identified concept of the Internet into law. While this will prevent some abuse it's a sad reflection on how some of the early values of cyberspace have been lost, where people could be who they wanted to be, and freely discuss topics they might not wish to have associated with their real names forever. Politicians whose main interaction with the Internet is through their Twitter accounts just don't get that.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton