sarahj

One of the reasons for the relative expense is the heavily-subsidised corn (and a few other) industries which pretty much all goes to animal feed.

That being said, my food costs were easily cut in half when I went vegan (and now, they are about 1/4 after some fine tuning of some other recipes) - I mostly get protein from chickpeas, kidney beans and lentils - which are all super-cheap compared to meat. I also eat a fair bit of tofu (which is very low in fibre and which is also very cheap compared to meat). Tempeh is another option, but I don't tend to make it often. We generally cook a big batch of food at the beginning of the week - which means time to prepare is amortized nicely (and frying tofu is very quick also)

I will admit that processed vegan meat-alternatives do tend to be more expensive than their animal derived counterparts, and not the healthiest - so I tend to avoid them - most of the expense is due to small production runs and limited quantity - and the extra processing.

> Maybe you can explain to me then how it is that this makes a significant difference in global warming. The carbon that is released by cows and humans after consumption of plant matter was derived from said plant matter. The carbon in those plants came from the air. Hence, this is a closed system where carbon is taken from the air by the plants, consumed by the animals, and then put back into the air by the animals. There cannot be a net gain of carbon from this.

Instead of the energy taken to grow those plants going to feed people - they are used to grow animals. This takes an enormous amount of input energy from farming the plants, to transporting them to the animals. Not forgetting water transport also. Then there is the energy that is taken to manage the huge sums of waste that these animals produce (most of which is stored in huge silos or pits, which ends up leaching into ground water - but that's another thing). Then there is the energy to transport, kill, transport, package, transport and eventually sell - so the energy / calorie of animal food is no where near efficient as it is for plants and beans. Basically, it is not a closed system - we input so much energy into sustaining our meat habit (as well as the ethical implications of killing 100,000,000-500,000,000 sentient animals a day - including fish and the resulting bycatch)

I think we agree when it comes to the impact of a solution - there needs to be a HUGE concerted effort to even make a dent - people can't immediately change the nature of the worlds largest companies - but I believe that our only hope is to promote local change (to get people to commit to a lifestyle change that has to happen one way or another) - and push for governmental reform - will it be perfect? no. Will it be easy? nope. But we have to start somewhere - and I think diet and local economies might be a good first step.

One of the (many) reasons I went vegan was to cut my impact on the environment. I don't own or use cars. Where I can I walk, where I can't I take public transit. I've made considerable changes to what and how I buy, to source food with less of a total impact. I've started to look at alternative clothing and technology strategies to reduce my environmental impact there too.

I know there are plenty of geeks who have done similar things. The truth is that a new tech or more companies aren't going to solve this problem - the problem is we (who live in large economies) now live in a world which is completely separated from the daily realities of where our stuff comes from. We have spent the last 50 years enabling large mono-cultures and promoting specialization - which has done amazing things for food availability - at the expense that now a single plate of food easily contains ingredients from every continent - at a huge environmental impact. Similar trends have happened in manufacturing, textiles and practically every other industry.

Trends in tech that might help us:

* Hyper-local agriculture

* Locally-efficient down-cycling / recycling programs - for clothes, tech...pretty much everything.

* Teaching people how to buy and cook produce.

But the truth is that every individual needs to make a transition in how they live - that means eating less (hopefully no) meat and animal products, repairing instead of buying new, developing ethical supply chains (starting by knowing the supply chain is a good start!)

And yes, companies need to change and adapt too...that means more environmental regulation, more incentives to develop and adopt renewable sources of energy - how we structure those is completely beyond my expertise though...and I don't have much hope there.

Pinning necessarily has to restrict the times a certificate can be changed because otherwise we have to solve a different problem "How can I tell this new certificate is a good certificate".

You have proposed a solution to that second problem, let's look at the threat model:

You adversary is:

* Capable of forcing or otherwise being able to create valid certificates.

* Has the capability to MITM nodes in a network.

The solution you have provided adds an additional hurdle for the adversary:

* must also be able to subvert your CA (or more generally, a specific CA - it doesn't actually matter if you or someone else controls it - what matters is it is a specific root certificate).

So the browser, now TOFU'ing the initial certificate makes a note of the current certificate (and pins it) as well as the secondary signing CA (and also pins that).

When you want to rotate certificates you have your new cert signed by the two CA's, one of which has to be the pinned CA.

I actually think this is a fairly elegant solution (for the operator), although it does come with some fairly large assumptions:

* If your adversary is large enough to be able to corrupt multiple CA's (say a federal government) - then they are powerful enough to corrupt all your CA's (even you - although, to be fair, if the can force you to do anything then the MITM capability is less interesting). So while this scheme benefits the operator, it provides negligible benefit to the client.

* You are reliant on the secondary CA to remain static (or having a backup CA) - this is the same problem as the original simply shifting the capability up one level - maybe this is OK.

Overall, this approach does provide more flexibility to the operator of the site - but provides no to negligible additional security on the client side (it upgrades the capability from being able to mimic any CA to being ale to mimic a specific CA), and may even put clients at greater risk - since there is now an additional avenue of certificate rotation which means extra code, extra verification to mess up etc.

These were a few thought that jumped into my brain - I would like to see a more detailed threat model / paper exploring some new schemes as I think there are wins in this space that haven't been realized yet - and there maybe improvements / clarifications which can improve this model further.

A few ideas from a quick brainstorm, none of them are perfect, but neither is the centralized server solution:

1. Bookmarklet - In a similar vein to the way some password managers work you could construct a bookmarklet that the user can click on to make a site do the right thing - there are some security configurations depending on your threat model - however this does require user interaction.

2. Browser plugin - like #1 but obviously with the pain of writing and maintaining a browser plugin.

3. Bake the site determination into the flow - so instead of a 1-click retweet it becomes a 2-click retweet with the second step requiring the user to provide the site where they want to retweet - again some security implications and breaks the regular flow (although you could get around this by doing it once and storing the value in a cookie)

4. Have a local app listening on a specified port (so retweets get POSTed to 127.0.0.1:7000 for example) and then from there onwards - requires extra setup, makes the system less portable (can't just throw it on a hosted server). Like #2 but more annoying.

Some of the technical points of this article are simply wrong...

> The exit node IP address of the user was easily obtained using the two different methods discussed briefly above.

This is really not a vulnerability but simply how tor, and the internet at large, works - hidden services by design protect the service not the user (the user is protected by tor by default) - what the author actually did here was "leak" their non-hidden services IP.

> and true external IP address (see partial data example to the above). And to answer the second question, “no”, this did not involve the placement of malicious malware. Read on…

The author then goes on to state that they gave the users malicious malware to run which revealed their ip address. They justify that this was not malware by stating:

> It should be noted that this was not malware per se. It did not replicate and was run voluntarily by the user. The user was notified that a “security scan” was going to be run on their machine and they freely chose to run the scan.

The author then goes on to publish a list of tor exit nodes with tor user agents...which they could have gotten directly from the tor directory services...

And, as pointed out by others, the author never really goes on to state why they think Tor is the devil - they built a honeypot and were disgusted by the flies it attracted....I'm not really sure what they were expecting...

For the record, I am logged in over Tor - so if there is a block it appears to be inconsistent.

I remember reading about Bitcoin a couple of years ago and expressing disbelief that many of the major advantages being heralded were little more than fantasy, these were:

* Micro-transactions.

* Replacing practically everything related to money in developing countries.

From this thread it is clear that many of those dreams are still very much dreams - the ever growing energy and resource requirements to participate significantly in the network is staggering, the amount of storage required for the blockchain is a burden to even tech-aware users (unless of course one would want to trust a third party...), and now it would seem that there are minimum bandwidth requirements which sit outside what is possible in even modest parts of the USA - impossible to achieve in places where the main link to the internet is a satellite.

If I was feeling particularly optimistic I would say that Bitcoin has been shown to be unscalable in it's current form. Further, the network itself tends towards centralization because of the ever growing storage, processing and bandwidth requirements.

I look forward to seeing where the future of crypocurrencies leads us- there is so much promise.

They gave permission to Google to store, parse, tag and understand 16 years worth of family photos of themselves and others so that Google can more accurately present them (and by extension the other people in their photos) with adverts that they believe will result in a higher conversions for their customers - the advertisers.

> Should I be worried?

That really depends if you think the benefits of giving Google such information outweigh the negatives. I personally think that they do not (but then again, I'm not much of a photo person).

> Should my family and friends [be worried]?

We still live in a world where it is socially acceptable for people to take, upload and publish pictures to a variety of 3rd parties without the consent of the subject - even in what would typically be classified as "private" events. I've seen some movement in the direction of explicit consent or "you can take the picture but don't upload that to X" but the truth is that most people don't think too far ahead and frankly probably don't care - should they be worried? Again, that really depends on what they think of Google.