Forum adverts like this one are shown to any user who is not logged in. Join us by filling out a tiny 3 field form and you will get your own, free, dakka user account which gives a good range of benefits to you: No adverts like this in the forums anymore. Times and dates in your local timezone. Full tracking of what you have read so you can skip to your first unread post, easily see what has changed since you last logged in, and easily see what is new at a glance. Email notifications for threads you want to watch closely. Being a part of the oldest wargaming community on the net. If you are already a member then feel free to login now.

 Albatross wrote:

 daedalus wrote:

 Jimsolo wrote:
It's a victory for criminals everywhere! Yay!

As someone who earns a livelihood from copyright encumbered software, I still emphatically must say: Oh, stop that.

It is though. Or, rather, that's one of the things it is. It's other things too, but the point deserves to be made. Correct me if I'm wrong but wouldn't this be a pretty tremendous boon for online paedophile rings wishing to exchange material?

People like that will always find away. I know I spent a bleak week or so giving evidence against a local one. And yes it does make you feel like your the criminal. Do we stop producing cameras so they cannot take pictures.. Better to be more forceful when sentencing.

 Peregrine wrote:

Automatically Appended Next Post:

 dementedwombat wrote:
A certain degree of privacy is necessary in life, but that's because people suck, not because I want to have it.

IOW, "as long as we live in a magical fantasy world where nobody wants to do anything to violate my privacy I don't need to put up an explicit fence to keep them out".

I see now. You define privacy as affecting things up to and including actions against another person. I always defined privacy as knowledge of another person. Actions against another person fall under harassment, which I always lumped into a different category that is its own problem. I always viewed privacy as an unwanted side effect of the fact that harassment can happen, but it is never good in itself. Thank you. This conversation made me realize a lot about the mindset of people who support privacy and why they think it is a good thing.

Also, in response to the "magical fantasy world" comment, I've never been a fan of just accepting that something is broken and sticking a band-aid on it as opposed to fixing the real problem.

I'm going to put this "engraved plaque" here for all those who have looked into my post history.
I fully admit to being mildly insane during this period. I had not yet understood "Good taste" or "Logic", and I admit that I had contracted a minor case of Religion.
Please do not consider anything I have posted before my ideology switch an accurate reflection of my personality or beliefs.

Verviedi wrote:
Huzzah! College researchers/students being absolute morons again!

In spite of it, Dakka's not all bad though.

 Ouze wrote:
As long as one device has to tell another device what it wants and where to send it, there will be no anonymous protocol.

This. The info still has to bounce through physical hardware.

 daedalus wrote:

Verviedi wrote:
Huzzah! College researchers/students being absolute morons again!

In spite of it, Dakka's not all bad though.

Hah. Fair play to you.

Bad Cryptographic Key Generation
https://github.com/Tribler/tribler/issues/874

https://github.com/Tribler/tribler/blob/devel/Tribler/community/tunnel/crypto.py#L29
https://github.com/Tribler/tribler/blob/devel/Tribler/community/privatesemantic/crypto/optional_crypto.py#L14

Using random.randint (even as a fallback) to generate Diffie-Hellman secrets is not a good option, this is not a cryptographically secure PRNG. It would be better to fail closed if you are unable to retrieve entropy from a cryptographically secure source to generate keys, rather than fail open with a warning about performance.

The Tribler "decentralized BitTorrent" software's crypto is completely broken

http://www.reddit.com/r/programming/comments/2pzg2i/the_tribler_decentralized_bittorrent_softwares/

I think what is of concern is that it used to be to avoid getting nailed by a criminal or "the man" you just had to do things to escape notice, keep a low profile to avoid being checked-out or specifically targeted.

The difficulty with all this automation / scripts / bots is that a wider net can be cast: no specific attention required: the casual or the more serious minded user can be targeted.

I like that this system is made so various communication / file sharing can be anonymous but it just becomes a system to target / exploit like any other while many are lulled into thinking this method is "better" in the broad sense of the term.

Freedom vs security is a similar dichotomy of computer security vs ease-of-use: The best security out there tends to go into the realm of unusable or at least highly inconvenient.

From tribler main site Do not put yourself in danger. Our anonymity is not yet mature.

Tribler does not protect you against spooks and government agencies. We are a torrent client and aim to protect you against lawyer-based attacks and censorship. With help from many volunteers we are continuously evolving and improving.

New version now available
http://www.tribler.org/download.html

Changes since last release:

This release contains critical security updates. PLEASE UPDATE from V6.4.0 to V6.4.1.

The anonymity in V6.4.0 did not function properly.
Users are advised to only enable anonymous downloading in V6.4.1 it if they understand the implications stated within the on-screen advisory.
Our experimental hidden seeding feature did not perform adequately. You are likely to function as a exit node for the traffic of other users. We are deeply sorry for this. We're working hard on fixing this issue, but that will take significant amount of work. We will make Tribler exit nodes explicit in the future and reward them (issue #23 in Github).
We want to get this right. We are very grateful for the help that security expert "Yawning Angel" is giving us. All critical issues raised by him/her are either fixed or are being working on. Especially the advise to replace our simplistic AES-ECB with AES-GCM saved us quite some development time. You can track our progress at: https://github.com/Tribler/tribler/issues/1066

Detailed changes:

removed all references to gmpy.rand (security cleanup)
one-time AES keys are generated with python's random.randint() (FIXED)
code for researching homomorphic encryption removed, how not to do RSA: def rsa_encrypt(key, element) (security cleanup)
warn user about the dangers of enabling anonymity (_temporary_ emergency fix)
Fix Tribler crashes when starting Tribler just after stopping it.
Fix: allow removing torrents from own channel (Thanks Dan Arnould!)
Fixes for the tunnel community.
Make TunnelCommunity (P2P encrypted proxy downloads) loading configurable and disabled by default
Opt-in dialog for TunnelCommunity
Several fixes and cleanups for the cryptographic code.
Update .deb dependencies
Update windows packager for new curves.ec location
Updated tunneled download test description