• 15 Posts
  • 320 Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle
  • Technical summary: it seems OK against an observer who can see the network traffic but hasn’t infiltrated the phone of the source or the computer of the news organization.

    Any real message is stored locally on the smartphone by the CoverDrop module and sent as the next CoverDrop message, i.e. replacing the dummy message which would otherwise have been sent. Consequently a network observer cannot determine whether any communication is taking place and CoverDrop therefore provides the potential source with plausible deniability.

    The CoverNode and each journalist has their own public-private key pair. These keys are published by the news organization and available to the CoverDrop module directly so the user does not need know about them. When the CoverDrop module is used for the first time, it generates a new, random public-private key pair for the user.

    All real CoverDrop messages sent by the CoverDrop module to the CoverNode include the text written by the potential source as well as their own public key. The message is first encrypted using the public key of the journalist who will ultimately receive the message, then encrypted a second time using the public key of the CoverNode. All dummy CoverDrop messages are encrypted using the public key of the CoverNode. All messages, real or dummy, are arranged to be the same, fixed length. Encryption and length constraints ensure that only the CoverNode can distinguish between real and dummy messages.





  • I will use the opportunity to remind that Signal is operated by a non-profit in the jurisdiction called “the US”. This could have implications.

    A somewhat more anarchist option might be TOX. There is no single client, TOX is a protocol, you can choose from half a dozen clients. I personally use qTox.

    Upside: no phone number required. No questions asked.

    Downside: no servers to store and forward messages. You can talk if both parties are online.



  • Opinion:

    Politically, the ayatollah can’t be toppled by foreseeable events, except if an Israeli strike should kill him. His successor in that case is unlikely to be milder. Netanyahu is also firmly in power due to special circumstances, and probably pretty safe from any Iranian attempts.

    Militarily, Iran has taken bigger losses, and has probably lost expensive and important parts of its nuclear programme - but not its stocks of highly enriched uranium, or its ability to launch ballistic missiles. From that perspective, if the Israeli strikes were meant to disarm Iran - they didn’t.

    Prognosis: they will trade more strikes and neither will achieve breakthrough success. Iran will lose more in the process.



    • Not providing a platform for activities that harm society (e.g. scams, disinformation).
    • Not providing a platform for activities that will get you sued or prosecuted (e.g. piracy, child porn).
    • They had to pay a considerable amount for the service.

    On social media, putting the burden of blocking on a million users is naive because:

    • Blocks can be worked around with bots, someone has to actively fight circumvention.
    • Some users don’t have the time to block, simply conclude “this is a hostile environment” and leave.
    • Some users fall for scams / believe the disinfo.

    I have once helped others build an anonymous mix network (I2P). I’m also an anarchist. On Lemmy however, support decentralization, defederating from instances that have bad policies or corrupt management, and harsh moderation. Because the operator of a Lemmy instance is fully exposed.

    Experience has shown that total freedom is a suitable policy for apps that support 1-to-1 conversations via short text messages. Everything else invites too much abuse. If it’s public, it will have rules. If it’s totally private, it can have total freedom.








  • You just missed my point about the 1.6MP elephant in the room.

    For your information, a global shutter sensor is not required in that scenario.

    A global shutter is advisable if you want to get detailed video of a fast moving object that fills a large percentage of the frame, without distorting the shape of the moving object. With rolling shutter, you still see, but get a distorted (elongated, stepped) moving object.

    • Does a bullet missing Trump fill a large percentage of the frame? No.
    • Do you need to see details of the bullet? No.
    • Is Trump moving too fast to photograph without distortion? No.
    • Do you need to autofocus on the bullet? No, and you can’t. It’s fine, you already focused on Trump.

    It follows that you don’t need global shutter, and you don’t care about autofocus. Merely using fast exposure and having a sensitive sensor + big lens (enabling you to use fast exposure) it will be sufficient.

    You also need luck, of course. I think the photographer who snapped that shot had a considerable amount of luck. They weren’t fumbling on their bag for a better X or Y. They were already taking a photo, most likely. Things just happened at the right time for them.

    As for practicality of modular and DIY equipment, yes, it may not be everyone’s preference.



  • How to make Saudia Arabia a normal society?

    • deny it income
    • deny it access to advanced technology
    • deny it legitimacy and cooperation

    Most importantly: stop using oil and natural gas sooner rather than later.

    Reasoning: the king stays in power by paying cops, security officials and prison guards - and paying people to shut up and tolerate the regime. Once the system runs low on money, things may change.

    Note: women in Europe made rapid progress at getting civil rights at a time when they were needed to run ammunition factories.

    It doesn’t have to be a world war - any development that makes it economically unavoidable that women start going to work outside their home, will change the role of women in society.


  • Autofocusing external lenses is a real problem. Fuck the lens makers indeed, as a result of which I’ve only used Raspberry Pi based systems with manual focus.

    Depth of field is a property of the lens, not the sensor.

    Sensors: if you want to take pictures in starlight, you can get IMX585 (hard due to market problems). If you want lots of pixels, 64 M is not a problem. If you want to photograph a bullet, you can get the low-pixel global shutter sensor, there is code around to take video at 500 fps (disclaimer: tiny video, extreme light level required).

    Cameras can be homebrewed, big integrators like Canon charge too much.




  • how did you do it?

    In the BIOS options of that specific server (nothing fancy, a generic Dell with some Xeon processor) the option to enable/disable ME was just plainly offered.

    Chipset features > Intel AMT (active management technology) > disable (or something similar, my memory is a bit fuzzy). I researched the option, got worried about the outcomes if someone learned to exploit it, and made it a policy of turning it off. It was about 2 years ago.

    P.S.

    I’m sure there exist tools for the really security-conscious folks to verify whether ME has become disabled, but I was installing a boring warehouse system, so I didn’t check.