On 10/11/2015 08:31 PM, Travis Biehn wrote:
Your onion or your clearsite?
What clearsite? One aspect of the design is that lighttpd runs in a VM that can't see the Internet except through a Tor-gateway VM.
How do you establish that your onion and clearsite host the same content?
Running a clearsite just doesn't work for me. It would paint too big a target on the server. Anyone not using Tor can just use <http://dbshmc5frbchaum2.onion.link/>.
How do you federate changes from your onion to your clearsite? What do you do if your clearsite gets seized and used to serve up TAO payloads?
Don't have a clearsite :)
How do you prevent your upstream from logging the IP addresses that hit port 80 and 443? The size of those messages (you know the https sizing attacks which can reveal which particular pages your visitors are on, right)?
Upstream = Tor. And sure, maybe Tor gets hosed.
How do you make your visitors aware of the above and more? How do you ensure that they saw your message?
Look at my front page :)
-Travis
On Sun, Oct 11, 2015 at 10:15 PM, Mirimir <mirimir@riseup.net> wrote:
On 10/11/2015 07:49 PM, Travis Biehn wrote:
I'd rather have what you call 'lazy' over nothing.
Look, I mean no disrespect to Cryptome. But I do think that there ought to be a warning for users to protect themselves, if they don't want their access logged by everyone and their little yellow dog.
The ideal is all distribution modes available: "Keep the info off the dark web, off the deep web and in the search indexes."
Cryptome shows up on google searches. Your onion does not.
Well, Cryptome has been around for about 20 years, so hey ;)
But Google is indexing it. And it shows up well enough in relevant searches. But I haven't been promoting it very much.
-Travis
On Sun, Oct 11, 2015 at 9:38 PM, Mirimir <mirimir@riseup.net> wrote:
On 10/11/2015 06:20 PM, Travis Biehn wrote:
A billboard doesn't need much 'security.' *shrug*
Well, there are the access logs ;)
It ought to be an onion service, no? No sure bet, of course, but better than nothing. In my opinion.
Putting it all on users is awfully lazy, I think.
Travis
On Sun, Oct 11, 2015, 8:18 PM John Young <jya@pipeline.com> wrote:
> I would not have expected Cryptome to be on shared hosting ;) But
yes,
> that would explain it.
Shared is cheap, so are we. Shared is vuln, so are we. So are the others despite credentials and billion-dollar armaments and above all else secrecy and shallow oversight. That explains it.