• 4 Posts
  • 190 Comments
Joined 2 years ago
cake
Cake day: April 27th, 2024

help-circle



  • It’s mostly just that I don’t want the government to know precisely which websites I visit. Nor do I want the the porn sites to know exactly who I am.

    I understand, I want that too. It’s easily possible though (just one example for a scheme):

    • you visit porn site
    • porn site sends your browser a random nonce
    • you/browser tell government service: sign this if I’m >18
    • government signs the nonce + a timstamp to prove freshness
    • your browser forwards the result to the porn site
    • porn site can verify signature per standard public certificate chains
    • now porn site has proof that you are >18, but knows nothing else about you; and government only knows that you wanted proof that you are an adult, but not for what site or purpose you wanted to prove that

    Alternatively, if we go the “device has an age bracket field browsers access” route, it’s even simpler, and just as if not more privacy preserving.




  • So let me get this straight:

    When I was 13, I managed to figure out the router password, disabled child protection for myself, then watched porn on my Android 2.3 phone that I had managed to put a custom ROM on because I liked the way it looked and had no idea what a “launcher” was yet.

    This is not a hypothetical btw.

    My parents were smart enough to enable appropriate blocking and secured access to those settings. I’m not sure something on-device was available at the time, but I included the bit about the custom rom to demonstrate that, even though I didn’t know WTF I was doing, I was more than capable of fucking around with the tech to get it to do what I wanted.

    So were my parents in breach of their duties on child protection?

    I don’t think they were. They actually did educate themselves (visiting a course / parent meetup to discuss and learn how to protect me from the Internet), and implemented everything they learned.

    I was just a little shit and found a way around this.

    And this is NOT an edgecase. Because guess what. It takes one kid in the friend group to figure out a way to circumvent parental controls, and then EVERYONE knows how to do it.

    It simply does not fucking matter how well intentioned, knowledgeable, and present the parents are (mine were all of that).

    Going “this would not be a problem if parents parented” is the LAZIEST fucking excuse, and I’m sick and tired of reading about it on here.

    (Because I probably have to make it clear: I’m not advocating for photo/passport scanning, third party age verification,… and all that bullshit. What I think would be a FANTASTIC idea would be privacy-preserving age verification. There are two good ways to do this: 1) on a login attempt, prove that you are of age by presenting a fresh, signed token from a government service proving that you are over 18, and nothing else; site does not get any info, government does not know what you were trying to access; 2) a device-level age field. Proof here comes from the device itself, and can be 100% privacy preserving; just a “yep, is of age”. In this scenario… GUESS WHAT, PARENTS GET ENABLED TO PARENT “PROPERLY” BY PROVIDING THEM WITH A GOOD, SIMPLE, PRIVACY-PRESERVING TECHNICAL SOLUTION.)



  • Huh - you’re right. I went back to Signal’s X3DH spec because I was sure I was right, but it seems I misremembered how the “prekey bundles” work: Users publish these to the server, allowing (in my original assumption) for the server to just swap them out for a server/attacker-controlled key bundle for each Alice and Bob.

    However, when Alice wants to send Bob an initial message and she gets a forged prekey bundle, Bob will simply not be able to derive the same key and communication will fail, because Bob knows what his SPK private key is, while the server only knows the public key.


  • A compromised server would allow the server to man-in-the-middle all new connections (as in, if Alice and Bob have never talked to each other before, the Server/Eva can MITM the x3dh key exchange and all subsequent communication). That’s why verifying your contact’s signatures out-of-band is so important.

    (And if you did verify signatures in this case, then the issue would immediately be apparent, yes.)

    Edit: I was wrong. See below.





  • Here’s the email I got from them:

    Dear xxx,

    This mail is to inform you about an unfortunate, but necessary price change that we must make.

    There have been drastic price increases in various areas in the IT branch recently. That is why, unfortunately, we must also increase the prices of our products.

    The costs to operate our infrastructure and to buy new hardware have both increased dramatically. Therefore, our price adjustment will affect both your existing products and new orders.

    The underlying causes of the increased costs are, among others, the exploding demand for AI-related computing power and for cloud services. In addition, raw material prices and production costs have also generally risen for manufacturers. The costs for RAM and SSDs especially have risen by a large amount. For example, the cost for DRAM memory has increased up to 500% since September 2025. And according to market researchers like TrendForce, this price trend will continue throughout the year.

    We have genuinely tried hard to optimize our costs and to prevent increasing our prices for as long as possible. But we can no longer compensate for the strain that it has placed on our operations. We want to continue to deliver quality products that meet both our standards and your expectations, so we must take this step.

    The price changes will take effect on 1 April 2026 for both new orders and existing products. For orders placed before 1 April 2026, but delivered after 1 April 2026, the adjusted prices will apply.

    The following existing products, listed under the customer number specified in the subject line, are affected by the price increase as follows.

    Product previous price New price as of 1 April 2026 Server Auction € 43.56 € 44.87 all prices incl. 21% vat

    We know that price changes are always a challenge for everyone. However, we believe that our products’ prices and conditions still have a competitive price-to-performance ratio.

    We have prepared a list of all new prices for you on Hetzner Docs at https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment. Starting on 1 April 2026, the new prices will also be on our website.

    If you do not wish to continue your contract, you can cancel the products within the regular cancellation periods via your administration interface.

    We hope that you will be able to understand and accept our decision, and that we are sorry that we have to change our prices.

    If you have any questions, we will be happy to help. Please log onto your account and go to “Support” in the menu and create a support request.

    Kind regards,

    Hetzner Online






  • Eh… Not really. Qemu does a really good job with VM virtualizarion.

    I believe I could easily build containers instead of VMs from the nix config, but I actually do like having a full VM: since it’s running a full OS instead of an app, all the usual nix tooling just works on it.

    Also: In my day job, I actually have to deal quite a bit with containers (and kubernetes), and I just… don’t like it.