Hacker News new | past | comments | ask | show | jobs | submit | echoangle's comments login

> It cost at the very least the salary of a software engineer, though most likely a lot more.

Why is that the very least? If keeping a forum running a full time job?


Well the whole point of hiding your tracks is evading law enforcement, why would you care if it’s illegal? Or is it because of the „only do one crime at a time“ thing?

Why do you assume this is about doing illegal things? This is about protests, many of which never turn into riots or illegal acts.

I was thinking along the lines of „the state wants to oppress the protestors and makes it illegal“, but if you just want to avoid surveillance at a legal protest, yeah, you’re right.

Going into a protest with illegal communication devices is almost a direct sabotage of the protest's intent. It gives law enforcement a legitimate reason to act, even if almost certainly ex post facto. And it paints the protest as wilfully illegal--you went in intending to break the law.

If you're protesting an oppressive regime then it's likely most privacy respecting methods are illegal.

If you're attending a protest with a phone, the cell tower ping will deanonymize you anyway.

The state has every reason (for itself) to demand perfect law-abiding behavior. The abstract Protest’s intent does not.

“If you have nothing to hide you have nothing to fear” right? That’s the same logic politicians are using to make spying on populations legal.

"Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say." - Ed Snowden

No one was arguing this.

It’s possible to have encrypted communications without fucking up public parts of the spectrum.


Hiding from surveillance is not the same as planning to do something illegal.

... but it benefits the state if people think it's the same ...


> As far as having a strong pin to help protect you, it won’t protect you from rubber hose decryption.

I wonder why no one adds a „decoy pin“ which looks like it unlocks the device but secretly deletes sensitive data.

Probably, most people don’t see rubber hose cryptography as a real threat, and in most cases, they’re probably right.


I don’t have any trust in the police or even more so the various 3 letter agencies.

Is that something a country is actually allowed to do? Isn’t that international water?

There are some wriggle room here. The rights provided by the UN do have conditions, like protection of undersea cables. If a country do not enforce such protection, they could in theory loose the right associated with international waters. Insurance requirements could in this theory be used to codify compliance with the requirements of the United Nations Convention on the Law of the Sea.

Lot of shipping lanes in the baltic are international waters, but to get into baltic, you have to pass through Danish waters.

Looks like they signed the right to inspect ships passing the straight away though, if I’m understanding this correctly:

https://en.wikipedia.org/wiki/Copenhagen_Convention_of_1857


Maritime law is definitely not my forte, but I think the convention was related to the tolls imposed to pass through these waters (Sweden's Gota Kanal was built to bypass this). It's also related to "innocent passage", which may not be so innocent in this case. Either way, there are probably provisions here for Denmark to close this off, as ultimately they are Danish waters.

Now make inspection queue 3 years long.

Denmark can put some constraints for ships passing the straits. They are danish water. So the Baltic is special in that you can’t reach it on international water. Similar to the Black Sea. But these restrictions are codified in existing agreements so I don’t think Denmark could easily and unilaterally change them to include more conditions. But they could start enforcing ships following the existing requirements for environmental safety and insurance. It would make life pretty difficult for those shipping oil past the sanctions in rusty single hull tankers.

> That also means that 2nd easiest to acquire PADI qualification is enough to dive there by yourself.

How? Open water diver is 18m, advanced Open water diver is 30m. With „deep diver“ specialty, you’re at 40m.

I think you need to become an instructor to go deeper, that’s not the 2nd easiest qualification at all.


> How? Open water diver is 18m, advanced Open water diver is 30m. With „deep diver“ specialty, you’re at 40m.

Correct. Those are the limits of those certifications.

> I think you need to become an instructor to go deeper, that’s not the 2nd easiest qualification at all.

In order to go down to deeper depths and returning you generally need a technical or professional certification. Anyone can go to any depth, as long they don't expect a reasonable chance to get back to the surface alive.

PADI open circuit technical course go down to 50 but there are other agencies for technical diving with a bit better reputation, and those generally max out at 100.

Most people who are trained for 80+ depth usually do so on a rebreather. Padi do have a 100m course for that. However with rebreathers, students mostly look towards specific instructors and not agencies. What agency a instructor uses is generally much less important than that you trust the instructor.


I think PADI doesn't even go that far, it is predominantly a leisure diving organization. Their technical diving courses seem to end at 50m. Not really related to instructor courses either, a regular instructor typically has no need to go beyond 30m.

Diving to 80m is a serious endeavor on this scale.


80m is moderately serious. I've personally done 75m in the Atlantic and I wouldn't say I'm superhuman or anything (or military).

It requires helium mixes and personally I'd only want to do it with a rebreather, not normal "blowing-bubbles" type SCUBA gear (too wasteful on the breathing gas). 20-30 minutes at the bottom will mean around 90-120 minutes decompressing. You don't want to be doing anything taking too long, or being too laborious.

Could be done from a fishing boat without any problem.


Yes, it's very doable given the right training. But it's not really an extension of what a typical "PADI diver" might do, is what I meant.

Having had equipment failures no deeper than 30m, I decided any dives that require decompression are not for me. I'll leave deep dives and sabotage to others :)


You know, I never dove but I always wonder, why do deep divers not breathe a nitrogen-free atmosphere before they dive to flush out the nitrogen? I understand astronauts do this too (they breathe pure oxygen but at a lower pressure so it's not dangerous). And because this a sudden pressure drop won't give them the bends.

It would seem simple, being able to deep dive then without decompressing. I'm sure there's a good reason it's not being done, I just wonder what.


I think what you breathe pre-dive is almost irrelevant. The real kicker is what you breathe during the dive, and that's always going to be gas under pressure. The levels of gas in your blood go up very quickly. Recreational divers can only afford ~10-20 minutes at 30m depths before they need to decompress. And that doesn't even count as "deep".

You can't breathe pure oxygen under water, as it becomes very toxic very quickly as pressure goes up. So you have to dilute it with something. Nitrogen is easy to get hold of (actually you just compress atmospheric air). I'm also not sure cutting nitrogen out helps much with decompression sickness, you get it with other gases too - maybe more slowly, I'm not sure.

You can, and do, replace nitrogen with other gases, mostly helium (and in rare circumstances, hydrogen), but for other reasons. Nitrogen too becomes toxic under pressure, around the 30-40m mark, with symptoms similar to drunkenness - not good under water.

Funnily enough, helium does the same deeper down, except the symptoms there are the opposite - nervousness, tension etc. So to some extent perhaps these two balance out. Hydrogen has very low toxicity, but for some reason people feel queasy about mixing pure hydrogen and oxygen.

Crucially, too, a lot of deep diving is commercial in nature, and cost-sensitive. Anything that isn't just compressed and bottled air is getting very expensive very quickly.

It all gets incredibly complicated. Deep enough, you need to breathe gas that contains so little oxygen that you would suffocate on it at surface pressure. At pressure, it's fine - the partial pressure of oxygen is sufficient, and having less of it makes it less toxic. But you have to be careful to only use this gas deep enough, else you'll run out of oxygen. Or at other times, when decompressing, you might use an oxygen-rich mix, which while more toxic, helps you purge some of the other gases from your bloodstream, cutting decompression times.

It's a fascinating topic to read about from the comfort of my sofa.


Might work for technical divers but regular leisure divers use compressed air which contains nitrogen anyways. If you prebreathe pure oxygen and then begin the dive using regular air, you will reaccumulate the nitrogen pretty quickly, I think, so you will need to decompress like normal. And you can't dive with pure oxygen because it becomes toxic when going lower than about 6m due to the high partial pressure.

Also, you would need to have pure oxygen available and breathe that for maybe an hour before each dive, which would be expensive and annoying. For touristic dives, especially along the shore, it's easier to just plan the dive so you can still see something interesting while waiting for decompression.


> When a domain name is stolen, definitionally it leaves control of the registrar.

So call the registry?

The difference is that a judgement will actually get you something because in the end, the registry can give the domain to whoever they want. If your crypto DNS name is gone, you can’t appeal anywhere, even if you win your lawsuit (which you will, the opponent won’t appear).


> So call the registry?

Verisign's phone tree is pretty gnarly last time I checked.

> The difference is that a judgement will actually get you something

It could easily cost tens to hundreds of thousands of dollars to win a lawsuit in the registrar's jurisdiction, which is not feasible for an individual or small business.

As far as large corporations go, they don't have to worry about domain theft anyways. They all just pay tens of thousands of dollars for MarkMonitor to guard their domains with enterprise security, never have their domains stolen, and call it a day. I think where ENS shines is for small businesses and individuals.

The better option than recovery is just to prevent your domain from being stolen in the first place. For ENS or DNS this is fundamentally the same concept - just make sure you trust the company that holds custody of your domain name. For ENS, you have the option but not the obligation to custody your name yourself, or to use an M-of-N signature scheme amongst trusted friends, business partners, and/or third-party companies. It's hard to steal a domain name when you need to fool 3 out of 5 executives plus a third party into approving a transfer.

> the registry can give the domain to whoever they want

Could be a feature, could be a bug.


> Verisign's phone tree is pretty gnarly last time I checked.

If your name is like `microsoft.com`, then you call the registrar. They have contacts in the .com and .net TLD administrators to file issues. If that fails, there's a formal process: https://www.icann.org/resources/pages/providers-6d-2012-02-2...

Never mind that most registrars have protections against the transfer and will generally spam the hell out of you with notifications.

This makes the domain hijacking a low-value target for crooks. It happens, but not a lot.

> The better option than recovery is just to prevent your domain from being stolen in the first place.

Which will not happen. You still have all the same issues with lost keys, misconfigured settings, etc. Except now with zero recourse.

> For ENS, you have the option but not the obligation to custody your name yourself, or to use an M-of-N signature scheme amongst trusted friends, business partners, and/or third-party companies.

Yeah. Have you actually ever done anything like that in real life?

That's the thing, blockchain astronauts are kinda like PGP enthusiasts. They keep claiming that it solves all the problems, if you attend their groupie, erm, key signing party.


> If your name is like `microsoft.com`, then you call the registrar.

As I said, large companies like Microsoft don't risk their domains being stolen in the first place, since they use enterprise protection services like MarkMonitor.

> there's a formal process

Ultimately every time I discuss ENS, the conversation turns into a discussion about how feasible it is for a layperson to afford, file, and actually win a UDRP dispute to recover a stolen domain name, which doesn't have any provision for theft by the way. UDRP only considers whether the current owner of the domain is using the domain to infringe upon your business trademark (if you have one).

The answer is that UDRP is completely unworkable for the vast majority of people who are at risk of domain theft; it isn't even an anti-theft tool. In terms of theft resolution, it's a justice theater where you can watch it work for very specific types of companies who have very specific trademark issues that the UDRP covers, and imagine that it must work great for every mom and pop who has a domain name nicked because surely we live in a just world.

The individual filing the dispute is on the hook for the UDRP fees which are significant and I believe well into the four figures (completely unaffordable in developing countries, and likely not worth it for small businesses). Typically companies need to hire a specialized lawyer to navigate the UDRP system, at additional expense.

So you're misinformed that there is a formal process for domain theft - the UDRP is only for trademark infringement. UDRP is unnecessary for large companies (who have the resources to safeguard their name from theft) and it's useless to individuals and small companies who can't afford it and/or have theft problems but no trademark infringement problems. UDRP is only useful if you are a medium-sized company with a well-established trademark in a developed country and you didn't do your due diligence in properly securing your domain name.

So I'll give you that - if you're a medium-sized company with a well-established trademark in a developed country and you didn't do your due diligence in properly securing your domain name, then UDRP might be better than nothing. But depending on what kind of company you are, it still might be cheaper and easier to just switch domain names.

> Never mind that most registrars have protections against the transfer and will generally spam the hell out of you with notifications.

A blockchain can be designed to be more reliable because it doesn't "generally" do anything. It always, specifically, does exactly what it's programmed to do. A smart contract's predictability is a function of how well it's understood, and the tooling for creating and auditing bug-free smart contracts is maturing rapidly.

If you want to be spammed with notifications, there's nothing more reliable than multiple audited pieces of open source software that run directly on all your devices and monitor a public blockchain for an action. Add several third-party blockchain monitoring services for good measure.

And, of course, it's easy to write custody code in such a way that transfers are time-locked, so you have time to see the notification before the name changes owners. Write-once, audit-once, use-many.

> Have you actually ever done anything like that in real life?

Yes.

But aside from that, I use cryptographic keys in my life for countless reasons other than cryptocurrency. Git, SSH, E2E messaging apps, web passkeys, object storage, HTTPS server certificates, tapping my credit card at the supermarket, accessing the cell network, unlocking my car, etc. Everyone is already managing cryptographic keys whether they know it or not, and everyone's cell phone has keys already available and quite safe in its secure element, ready to sign messages with.

No need to break out the pocket protectors and meet up in someone's living room. A key signing ceremony for ENS could be easily piggybacked off a standard E2E group chat, like for example a Signal or iMessage chat:

* Someone creates a group chat on their smartphone and invites people (specifying the "M" value, aka the threshold for a valid group signature)

* The invited people join, their devices silently and automatically exchange keys, and the chat displays the group key

* Whoever has the asset transfers it to the group key

* Whenever someone proposes a message to sign, the system messages the group chat showing how many more signatures are needed, with a "sign" button that people can click.

This is pretty similar to what Safe Wallet already does, and it currently secures over $100 billion worth of cryptocurrency for some of the largest companies in the industry. But it's also quite simple to just download the app and use it as an end-user. It's directly compatible with ENS, since they both implement the ERC-721 token standard.

I've thought through all of this extensively, I know quite a lot of details about how both blockchains and the current DNS systems work, I've had numerous conversations with countless people about it, and it all adds up to me.


Hi, LLM!

The thing is, ENS is strictly _worse_ than regular domains. If your key is stolen, then you are at the total mercy of the thief. With the regular domains, you simply lodge a complaint with the registrar, and they'll roll back the transfer within 90 days.

You can lose a domain if you basically register it, don't use it, and then forget to renew it for a year.

> But aside from that, I use cryptographic keys in my life for countless reasons other than cryptocurrency.

Can you please stop the bullshit? It's downright nauseating.

We're not talking about the general cryptography, which is incredibly useful. We're talking about "code is law" blockchains with proof-of-work/proof-of-stake method of consensus. They are completely useless for anything but paying for illicit drugs and other illegal transactions.


Not an LLM, just someone who has way too much time on my hands and a penchant for jumping into internet comment threads in a way that I end up regretting later. I'm not sure whether I should take it as a compliment that I can apparently type with flawless spelling and grammar just like an LLM (shout outs to my excellent English teachers!) or as an insult that my writing is not particularly compelling.

Yes, I naturally type in walls of text that are usually grammatically sound but tend to meander in structure. I'm pretty sure I repeated myself in places. You're repeating yourself in places, too. But believe what you want to believe. Maybe you're the LLM and the dead internet theory is well underway.

> With the regular domains, you simply lodge a complaint with the registrar, and they'll roll back the transfer within 90 days.

Domain registrars (for DNS) do not do this and they structurally cannot do this.

> You can lose a domain if you basically register it, don't use it, and then forget to renew it for a year.

Equally true of both systems.

> We're not talking about the general cryptography, which is incredibly useful. We're talking about "code is law" blockchains with proof-of-work/proof-of-stake method of consensus. They are completely useless for anything but paying for illicit drugs and other illegal transactions.

When you say that, what I hear is "When you use cryptography to sign messages, it's incredibly useful. When you timestamp messages, that can also be useful. But if you sign and timestamp messages, that makes it a Blockchain and Blockchains are incredibly UnUseful. That's silly.

To be very clear I think "code is law" is a nonsensical idea, almost as incongruous as the term "cryptocurrency" itself. They are definitely not currencies, and their code is definitely not law. But blockchains can be useful without trying to create new currencies, and without their code being law.

I've been seeing where the tides are headed in both the public and private sectors, and everyone wants to use cross-organization attributable append-only timestamped databases as an accounting tool now, in part because they are so easily auditable. From there it makes perfect sense to want to attach expressive internal constraints to these databases, via a scripting language. And I'm not sure what anyone could call that kind of database except "blockchain".


> Nordstream of course is no issue and does not need to be investigated.

Did anyone ever say this?


[flagged]



I think you are strengthening the point of the parent poster. It was called hybrid walfare as long as someone else was suspected and was no longer called that after it became known who did it.

Yeah, because the west isn’t at war with Ukraine, so it can’t be a hybrid war. If there’s an explosion in a Mall and I say „it could have been terrorism“ and it turns out to be a gas leak, is it wrong if I don’t call it terrorism anymore?

It’s not hybrid warfare if it’s done by Ukraine, more like regular sabotage.


Indeed, you are right, but the analogy is not perfect. More like you first say it could have been terrorism and it turns out that it was one of the shopkeepers who did it and then it is not clear what to call it.

Also, you don’t have to necessarily use water. You can use alcohol, ammonia or something else with a different boiling point.

Try liquid sodium, it vaporizes at 883c

It doesn't matter - the fraction of energy you can get is the fraction you decrease the temperature relative to absolute zero.

And what does that tell you? I could probably find 10 people in every country on earth that claim COVID-19 originated in a lab there. I don’t think being Chinese is a good qualification for determining where COVID-19 came from.

You're right of course.

This gentleman works in a US national lab, graduated top of his class in a top Chinese school and has friends that, at the time, worked in the Wuhan lab.

He, while very proud of being Chinese, was very critical of what he perceived his countrymen's lax safety standards. Myself, I can't judge that as I am not Chinese or an experimentalist so I deferred to his expertise and experience.


What’s the solution? I’m a human and I can’t come up with a specific move I would call „the correct move“.

The board is backwards and black to move. It’s annoying in that chess puzzles should always have black on top and white on bottom, and a caption of whose move it is. It’s clear in the FEN, but the image reverses it with no explanation.

I mean, I disagree that a chess board should only ever be represented from the perspective of white. Or rather, I cannot square being even remotely decent at chess and being unable to figure out whose perspective it is from the labelling of the ranks and files.

It's just a norm and has been for centuries. For composed positions it should also generally be white to move.

You're right that this isn't necessary (particularly when the board is labeled) but by doing something weird you're just going to distract and confuse some chunk of people from the point you're trying to make - exactly as happened here.


Note that it's black to move and black's pawn moves upwards. All move but one has instant counterplay from white.

Here's the board; you can enable the engine to get the answer: https://lichess.org/analysis/standard/8/6B1/8/8/B7/8/K1pk4/8...


Same!

Winning is not possible: only the queen is strong enough to win against two bishops, and that fails to the check and loss of queen from black tiled bishop.

So draw is most one can get. Underpromoting to knight (with check, thus avoiding the check by the bishop) is the only way to promote and keep the piece another move.

I guess in this situation the knight against two bishops keeps the draw.


> I guess in this situation the knight against two bishops keeps the draw.

Yes, though - I think I can say without exaggeration - no human on earth can tell you exactly which positions the knight can hold out against the bishops for the required 50 moves.

So it's a strange problem: a perceptive beginner can find the right move through a process of elimination, but even a super-GM can't be certain it's good enough, or defend it accurately against a computer. I don't see anything about that that makes it a particularly good test of an LLM.


I didn’t even know you could pick which piece you want to promote to. But I’m also not an average chess player.

So the correct move is to move the Pawn up and promote to knight?

Thanks!


Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: