Joanna Rutkowska

Joanna Rutkowska @rootkovska

In general solutions would fall into: 1. Try to make plugins non-malicious (white-listing, safe-compiling, constrained API), 2. Assume plugins are malicious and sandbox (prevent I/O to Internet, etc), 3. Build in an inevitable punishment mechanism for offenders (e.g. staking) — PolitiTweet.org

Joanna Rutkowska @rootkovska

Here is a 2017 post discussing security (or lack thereof) of https://t.co/nlxfVd2x9z plugins -- has anything improved since that time? https://t.co/2XVkd5T7zI — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @Snowden: I'd disable javascript, tracking, and fingerprinting in the browser, and even then I'd avoid the browser unless I had no choic… — PolitiTweet.org

Joanna Rutkowska @rootkovska

@MichalDzidziela Take a look at these scripts: https://t.co/PiEtHyJXha — PolitiTweet.org

Joanna Rutkowska @rootkovska

@Nodal_asymmetry https://t.co/X8p1n0GkS5 https://t.co/B275lFW5hF https://t.co/bAi27uAqco — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @andrestaltz: 2009: uploading my data to the cloud because I don't trust my computer 2019: downloading my data to my computer because I… — PolitiTweet.org

Joanna Rutkowska @rootkovska

@Marvelal "Why wait 25 minutes for (slow) food, if one can get a (fast) food at McDonald's in 5 minutes? These Mc's are everywhere in the world now..." ;) — PolitiTweet.org

Joanna Rutkowska @rootkovska

@sgoudswaard I want to be able to put whatever software does that into a docker and have a choice of running it wherever I feel like. — PolitiTweet.org

Joanna Rutkowska @rootkovska

It's great. Love it. Oh, and I use it without their cloud account - sync via ssh/scp-based scripts. — PolitiTweet.org

Joanna Rutkowska @rootkovska

What I need is a script which: greps through my Timeline, gathers top tweets(*) and puts them in a PDF. I could then copy this PDF to my reMarkable for relaxed later off-line consumption... (*) "top tweets" - ideally those which got RTed/liked most by those accounts *I* follow. — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @AndreaBarisani: I am delighted to announce that USB armory Mk II pre-orders are now live! Go get it! ^_^ https://t.co/biHXjX9hee http… — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @halvarflake: As mathematician, and someone that cares about the environment, and about research, this blog post and this slide deck are… — PolitiTweet.org

Joanna Rutkowska @rootkovska

@zooko @mik235 @n2vi Thanks. Downloaded and copied to my reMarkable, will read soon. — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @mbrennanchina: Simutaneous live-streaming on 40 accounts selling womens clothes. #Chinaecommerce https://t.co/EMifFcCLLV — PolitiTweet.org

Joanna Rutkowska @rootkovska

@zooko @mik235 @n2vi Can I use the *same* unified addressing scheme to also refer to files stored on some 3rd-party storage providers (i.e. ones that don't run Tahoe-LAFS software), such as e.g. Dropbox? — PolitiTweet.org

Joanna Rutkowska @rootkovska

Heh. #ThreadModelling https://t.co/orZbL1ZFFF — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @QubesOS: There will be two separate Qubes presentations at this year's @platformsec summit: Our project lead, Marek Marczykowski-Góreck… — PolitiTweet.org

Joanna Rutkowska @rootkovska

@laparisa @damienmiller @pamoshea @LeaKissner @k8em0 @natashenka @sigkate @aloria @evacide @maddiestone Thanks, Parisa! — PolitiTweet.org

Joanna Rutkowska @rootkovska

@securityfu @pamoshea @natashenka @QubeOs Thx. It's @QubesOS, not QubeOS ;) — PolitiTweet.org

Joanna Rutkowska @rootkovska

@pavolrusnak @gnupg ... and would be great if it could be part of the standard toolbox of e.g. @Tails_live. — PolitiTweet.org

Joanna Rutkowska @rootkovska

Are there any tools which allow to backup and later restore OpenPGP keypairs from a BIP39-like mnemonics passphrase? @pavolrusnak @gnupg — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @QubesOS: QSB #051: Insufficient validation of backup compression filter on restore https://t.co/iGXBJGIAjb — PolitiTweet.org

Joanna Rutkowska @rootkovska

"Persons" understood broadly, including also my devices (e.g. all the files owned by *my* camera). Perhaps "subjects" would be a better word here. — PolitiTweet.org

Joanna Rutkowska @rootkovska

Let me rephrase: are there any projects (besides https://t.co/mOivQ8BXEW) with an aim to create a person-focused universal data addressing/naming schemes (think: a link to *my* photos)? By person-focus I mean to contrast this with impersonal global schemes, such as... the URLs. — PolitiTweet.org

Joanna Rutkowska @rootkovska

@mik235 @n2vi My point being that upspin is designed to unify storage provided by 3rd parties, while Tahoe is (was?) mostly about providing storage, and any addressing sharing was designed to work for this only? — PolitiTweet.org

Joanna Rutkowska @rootkovska

@mik235 @n2vi "but based it all around storage" -> "(...) all around Tahoe's *own* storage", right? — PolitiTweet.org

Joanna Rutkowska @rootkovska

@mik235 @n2vi IIUC one can use upspin to expose Tahoe-LAFS-provided storage for the user. As well as storage on one's home NAS, laptops, cameras, etc. So: unification. Not so much for commercial providers such as Dropbox, however, as one would need to install upspin plumbing there? — PolitiTweet.org

Joanna Rutkowska @rootkovska

@mik235 @n2vi Isn't Tahoe-LAFS mostly about providing the (distributed) *storage backend* infrastructure, rather than a unified addressing and sharing (which seems to be the focus of upspin)? — PolitiTweet.org

Joanna Rutkowska @rootkovska

How many ppl use https://t.co/mOivQ8BXEW? Are there any other popular/promising projects with a similar goal? (i.e. unified addressing with access control + explicit sharing for data spread across different storage backends)? cc @n2vi — PolitiTweet.org

Joanna Rutkowska @rootkovska

Two insightful digests about decentralized "scene" (not focusing on blockchains): https://t.co/Wl0oVXSfSn https://t.co/ChiY7bvjgA — PolitiTweet.org