A recent article in The Atlantic makes the case that very large language models effectively contain much of the works they're trained on . This article is an attempt to popularize the insights in the recent academic paper Extracting books from production language models from Ahmed et al. The authors of …
AI and Secure Messaging Don't Mix Over on the ACLU's Free Future blog , I just published an article titled AI and Secure Messaging Don't Mix . The blogpost assumes for the sake of the argument that people might actually want to have an AI involved in their personal conversations, and explores …
Transferring a Signal account between two Android devices I spent far too much time recently trying to get a Signal Private Messenger account to transfer from one device to another. What I eventually found worked was a very finicky path to enable functioning "Wi-Fi Direct", which I go into below …
A Call for Public Discussion about App Store Oligopoly Over on the ACLU's Free Future blog , I just published an article titled Your Smartphone, Their Rules: How App Stores Enable Corporate-Government Censorship . Free Software users and developers likely already understand the reasons why it matters who controls what tools you …
dkg's New OpenPGP certificate in December 2023 In December of 2023, I'm moving to a new OpenPGP certificate. You might know my old OpenPGP certificate, which had an fingerprint of C29F8A0C01F35E34D816AA5CE092EB3A5CA10DBA. My new OpenPGP certificate has a fingerprint of: D477040C70C2156A5C298549BB7E9101495E6BF7. Both certificates have the same set of User IDs: Daniel …
I'm lucky enough to work at the intersection between information communications technology and civil rights/civil liberties. I get to combine technical interests and social/political interests. I've talked with many folks over the years who are interested in doing similar work. Some come from a technical background, and some …
Bitstream Vera must die .
dkg's 2021 OpenPGP transition As 2021 begins, I'm changing to a new OpenPGP certificate. I did a similar transition two years ago , and a fair amount has changed since then. You might know my old OpenPGP certificate as: pub ed25519 2019 - 01 - 19 [ C ] [ expires: 2021-01-18 ] C4BC2DDB38CCE96485EBE9C2F20691179038E5C6 uid Daniel Kahn …
What are the risks and potential benefits of contact-tracing?
DANE OPENPGPKEY for debian.org I recently announced the publication of Web Key Directory for @debian.org e-mail addresses . This blog post announces another way to fetch OpenPGP certificates for @debian.org e-mail addresses, this time using only the DNS. These two mechanisms are complementary, not in competition. We want …
WKD for debian.org You can now fetch the OpenPGP certificate for any Debian developer who uses an @debian.org e-mail address using Web Key Directory (WKD). How? With modern GnuPG, if you're interested in the OpenPGP certificate for dkg just do: gpg --locate-keys dkg@debian.org By default, this …
Community Impact of OpenPGP Certificate Flooding I wrote yesterday about a recent OpenPGP certificate flooding attack , what I think it means for the ecosystem, and how it impacted me. This is a brief followup, trying to zoom out a bit and think about why it affected me emotionally the way …
OpenPGP Certificate Flooding My public cryptographic identity has been spammed to the point where it is unusable in standard workflows. This blogpost talks about what happened, what I'm doing about it, and what it means for the broader ecosystem. If you work with me and you use OpenPGP certificates to …
Update I've scrapped my first try at a new OpenPGP certificate for 2019 (the one I published yesterday). See the history discussion at the bottom of this post for details. This blogpost has been updated to reflect my revised attempt. 2019 OpenPGP transition (try 2) My old OpenPGP certificate will …
In my work at the ACLU , we fight for civil rights and civil liberties. This includes the ability to communicate privately, free from surveillance or censorship, and to control your own information. These are principles that I think most free software developers would agree with. In that vein, we just …
Analysis of usability and mechanics of cryptographic protection in e-mail
The GNU Privacy Guard (GnuPG) upstream team maintains three branches of development: 1.4 ("classic"), 2.0 ("stable"), and 2.1 ("modern"). They differ in various ways: software architecture, supported algorithms, network transport mechanisms, protocol versions, development activity, co-installability, etc. Debian currently ships two versions of GnuPG in every maintained …
I encourage anyone interested in debian development to get involved with the Reproducible Builds project . My own project is to try to diagnose (and hopefully provide patches for) two unreproducible packages a week. Maybe you can do one package a week? Reproducible Builds is another example of the kind of …
When paultag recently announced a project to try to move debian infrastructure to python3 , my first thought was how large that undertaking would likely be. It seems like a classic engineering task, full of work and nit-picky details to get right, useful/necessary in the long-term, painful in the short-term …
I just took a few minutes to write up my preferred Debian packaging practices . The basic gist is that i like to use git-buildpackage ( gbp ) with the upstream source included in the repo, both as tarballs (with pristine-tar branches) and including upstream's native VCS history ( Joey's arguments about syncing with …
I'm using grub version 2.02\~beta2-2. I want to make a USB stick that's capable of booting Intel architecture EFI machines, both 64-bit (x86_64) and 32-bit (ia32). I'm starting from a USB stick which is attached to a running debian system as /dev/sdX . I have nothing that i …
The abbreviated title above means "Appreciation for Localization" :) I wanted to say a word of thanks for the awesome work done by debian localization teams . I speak English, and my other language skills are weak. I'm lucky: most software I use is written by default in a language that I …
Today, i uploaded GnuPG 2.1.0 into debian's experimental suite. It's built for amd64 and i386 and powerpc already. You can monitor its progress on the buildds to see when it's available for your architecture. Changes GnuPG 2.1 offers many new and interesting features , but one of the …
I'm replacing my OTR key for XMPP because of heartbleed (see below). If the plain ASCII text below is mangled beyond verification, you can retrieve a copy of it from my web site that should be able to be verified. -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512OTR Key Replacement for XMPP dkg …
We changed the default PGP signatures generated by enigmail in debian from Inline PGP to PGP/MIME last year , and the experiment has gone well enough that we're now using it in jessie and wheezy (where it arrived as part of a security update to make the extension work with …
I've said recently that pervasive surveillance is wrong. I don't think anyone from the NSA should have a leadership position in the development or deployment of Internet communications, because their interests are at odds with the interest of the rest of the Internet. But someone at the NSA is in …
If you maintain software in debian, one of your regular maintenance tasks is checking for new upstream versions, reviewing them, and preparing them for debian if appropriate. One of those steps is often to verify the cryptographic signature on the upstream source archive. At the moment, most maintainers do the …
Fingerprints and Key IDs OpenPGPv4 fingerprints are made from an SHA-1 digest over the key's public key material, creation date, and some boilerplate. SHA-1 digests are 160 bits in length. The "long key ID" of a key is the last 64 bits of the key's fingerprint. The "short key ID …
This Monday, I attended a workshop on Multi-party Off the Record Messaging and Deniability hosted by the Calyx Institute. The discussion was a combination of legal and technical people, looking at how the characteristics of this particular technology affect (or do not affect) the law. This is a report-back, since …
Many protocols today allow you to upgrade to TLS from within a cleartext version of the protocol. This often falls under the rubric of "STARTTLS", though different protocols have different ways of doing it. I often forget the exact steps, and when i'm debugging a TLS connection (e.g. with …
As I mentioned earlier , the information in the documents released by Edward Snowden show a clear pattern of corporate and government abuse of the information networks that are now deeply intertwined with the lives of many people all over the world. Surveillance is a power dynamic where the party doing …
Yesterday, i said a sad goodbye to an old friend at ABC No Rio . Cookiepuss was a steadfast companion in my volunteer shifts at the No Rio computer center, a cranky yet gregarious presence. I met her soon after moving to New York, and have hung out with her nearly …
A friend is teaching a class on data analysis. She is building a simple and rough data set for the class to examine, and to spur discussion. You can contribute in half a minute! Here's how: get a stopwatch or other sort of timer (whatever device you're reading this on …
Support privacy-respecting network services! Donate to Riseup.net! There's a lot of news recently about some downright orwellian surveillance executed across the globe by my own government with the assistance of major American corporations . The scope is huge, and the implications are depressing. It's scary and frustrating for anyone who …
Occasionally, someone asks me whether we should encourage use of the --ask-cert-level option when certifying OpenPGP keys with gpg . I see no good reason to use this option, and i think we should discourage people from trying to use it. I don't think there is a satisfactory answer to the …
Most OpenPGP User IDs look like this: Jane Q . Public < jane @example . org > This is clean, clear, and unambiguous. However, some tools ( gpg , enigmail among others) ask the user to provide a "Comment:" field when they are choosing a new User ID (e.g. when making a new key). These …
Today i saw a billboard on the side of a bus. It was from a cable TV channel, bragging about how well-connected their viewers are (presumably on the internet, social media, blogs, etc). It shows a smiling, attractive man, with text next to him saying something like "I told 9000 …
I feel like i've done a lot of blogging recently about failing to do things with proprietary software. That's annoying. This post is about something i made successfully with free software (and some non-software crafting): I made a Woolly Mammoth for my nephew! I documented the pattern (with pictures!) that …
i have a colleague who is forced by work situations to use Windows. Somehow, I'm the idiot\^W\^W\^W\^W\^Wfriendly guy who gets tapped to fix it when things break. Well, this time, the power supply broke. As in, dead, no lights, no fan, no nothing. No problem …
Better debugging tools can help us understand what's going on with MIME messages. A python scrap i wrote a couple years ago named printmimestructure has been very useful to me, so i thought i'd share it. It reads a message from stdin, and prints a visualisation of its structure, like …
I was upset to learn about Aaron Swartz 's death last week . I continue to be upset about his loss, and about our loss. He didn't just show promise of great things to come in the future -- he had already done more work for the public good than many of …
A friend wrote me a simple question today. My response turned out to be longer than i expected, but i hope it's useful (and maybe other people will have better suggestions) so i thought i'd share it here too: Angela Starita wrote: I'd like to save my work in a …
I run mpd on debian on "igor", an NSLU2 -- a very low-power \~266MHz armel machine, with no FPU and a scanty 32MiB of RAM. This serves nicely to feed my stereo with music that is controllable from anywhere on my LAN. When playing music and talking to a single mpd …
I'm maintaining a lab of debian squeeze machines that run OpenOffice.org (i'm considering upgrading to LibreOffice from squeeze-backports). I'd like to adjust the default page margins for all users of Writer. Most instructions i've found suggest ways to do this as a single user , but not how to make …
Here is a bit of simple (yet subtly-flawed) sql, which produces different answers on different database engines: 0 dkg @ pip : ~$ cat test . sqldrop tab le if exists foo ; create tab le foo ( x int , y int ); insert int o foo VAL UES ( 1 , 3 ); insert int o foo VAL UES …
In supporting a labful of Debian GNU/Linux machines with NFS-mounted home directories, i find some of my users demand a few proprietary programs. Adobe Flash is one of the most demanded, in particular because some popular streaming video services (like Amazon Prime and Hulu ) seem to require it. I'm …
i dislike having to run Windows as much as the next free software developer, but like many sysadmins, i am occasionally asked to maintain some legacy systems. A nice way to keep these systems available (while not having to physically maintain them) is to put them in a virtual sandbox …
This paper should be required reading for anyone developing, deploying, or administering web applications. It's also interesting to read the perspective of the folks operating the compromised webapp (details are in the section titled "Digital Vote-By-Mail" on pages 34 to 38).
A few months ago, Adobe announced a slew of vulnerabilities in its Flash Player , which is a critical component of Adobe AIR: Adobe recommends users of Adobe AIR 2.6.19140 and earlier versions for Windows, Macintosh and Linux update to Adobe AIR 2.7.0.1948. [...] June 14, 2011 …
I've been getting strange failures on some architectures for xdotool . xdotool is a library and a command-line tool to allow you to inject events into an existing X11 session. I'm trying to understand (or even to reproduce) these errors so i can fix them. The upstream project ships an extensive …