ninjashogun: mircea_popescu, well the main problem is that you need to reserve your hardest edge for when you need it the most. I've spend very long hours discussing very deep technical points without calling something "idiotic". It can be broken, wrong, unexpected, totally incompatible, etc. Those words are more specific.

ninjashogun: mircea_popescu, and more importantly those words allow the problem to be fixed.

ninjashogun: mircea_popescu, my 'half-lie' model applies to everything that is new and being built.

ninjashogun: There are a TON of errors that are always hidden and swept under the rug.

ninjashogun: The image of a startup is like a duck -calm above the water but paddling like hell underneath.

ninjashogun: mircea_popescu, sorry what are you talking about not working?

ninjashogun: mircea_popescu, could you be more specific please!

ninjashogun: mircea_popescu, I'm sorry you are factually mistaken.

ninjashogun: mircea_popescu, let's walk through it. If Facebook had been the same in every way, except Mark Zuckerberg was transplanted to be an Oxford student instead (same skills, same drive, same ideas) - what would have happened?

ninjashogun: mircea_popescu, the ansewr is very simple. he would not have gotten an investment or interest from peter thiel. Or any VC. And nobody outside of 10,000 people would know the word "facebook".

ninjashogun: It shows you very clearly the role that VC money plays.

ninjashogun: mircea_popescu, I've lived in Boston, New York, San Francisco, Paris, Berlin (a bit) as well as some Eastern European cities. I've been interested in startups in all of them, have worked for one in the first dot-com bubble in the 90's. I can tell the difference between different climates and how people behave in them.

ninjashogun: mircea_popescu, let me put it to you like this. If ughlol were farther along, and actually already convinced 10 engineers at his university to be 'cofounders' for equity totalling 5%, 95% to him (which would show GREAT founder skill) and got some traction. HIs company would still probably die, and those 10 people would leave. Because he is in India.

ninjashogun: Now you repeat hte same thing in Cal Tech and he has a term sheet for $1M at $3M valuation within 3 weeks of launch.

ninjashogun: and his company may OR MAY NOT die. But if it takes off, it's (in part) due to investor sentiment.

ninjashogun: To use another example. Steve Jobs and Steve Wozniak built what turned out to be $500B company in very large part on the investment climate in the area.

ninjashogun: if they were two kids doing hte same thing in just about any part of the world, they would have nothing 30 years later.

ninjashogun: mircea_popescu, yes, I know this.

ninjashogun: I know it from trying to build a hardware business, and suddenly seeing that none of that sliver is interested.

ninjashogun: mircea_popescu, in a lot of ways it's enshrined into the way MANY people think. Some of it is legal (only accredited investors can be targeted; accredited investors display groupthink). Other parts of it are cultural - a lot of people just feel the same way.

ninjashogun: ok

ninjashogun: is this about the money jobs didn't share?

ninjashogun: mircea_popescu, the way I interpret that is that Steve Jobs used the $5000 to start Apple and make his friend a billionaire.

ninjashogun: No?

ninjashogun: fine, a $100Millionaire

ninjashogun: More to the point - for our purposes - you would not have lent the young Steve Jobs $5000 yourself, even if he had to repay 10x the amount, 50x the amount, 100x the amount, ore ven 500x the amount (at any point in the future) All of which would have been in his power.

ninjashogun: instead, he had to scam his friend for it. Just like Zuckerberg had to scam some map guy out of $2000.

ninjashogun: steve jobs could have borrowed $5000 from you and relent 500x as much. But you wouldn't have been interested. That is $2.5M.

ninjashogun: asciilifeform, yes, "had to"

ninjashogun: mircea_popescu, fine. Lend me $17,000 now and at some point in my career I will repay you 500x (8.5M). I am 30 now and it has to be in the next 30 years.

ninjashogun: I don't have to be zuck to repay $8.5M. Tens of thousands of people can do it, not just a few hundred billionaires.

ninjashogun: I don't htink $8.5M is a fortune. if I had that in cash today I wouldn't sit on it, I would do further startups.

ninjashogun: That doesn't mean I consider it a lot of money.

ninjashogun: asciilifeform, I don't know how to turn it into $8.5M. If I did I wouldn't be talking about the next 40 years, would I?

ninjashogun: asciilifeform, likewise steve jobs did not know how to make a $500B company when he was 25.

ninjashogun: sorry, next 30 years ;-)

ninjashogun: asciilifeform, I am not interested in being involved with the local mob. You seem to consider this a short-term thing, but that's not at all what I stated, is it?

ninjashogun: asciilifeform, "then borrow it from whoever". Funny how that goes, isn't it? That loan is how I came into this channel. It doesn't work like that.

ninjashogun: asciilifeform, I'm from the USA but at the moment I'm not living there, I've been working on my proprietary hardware startup in a much lower-income country.

ninjashogun: asciilifeform, yes, you are quite mistaken in your understanding that I don't like the paying back part.

ninjashogun: asciilifeform, because I don't have assets?

ninjashogun: asciilifeform, because I've been working on my startup for no salary?

ninjashogun: asciilifeform, because banks don't consider incorporated companies with assigned intellectual property to be meaningful collateral?

ninjashogun: I don't have the time to take employment, even temporarily. Two months ago I was invited to give a demo with the working prototype as part of closing a $150K investment. I need to finish it.

ninjashogun: More to the point, at this point taking the employment you talk of would entail abandoning my team here, all of my work and living arrangements (about $150/month burn rate), as well as somehow moving to an expensive city and working full time there. My startup would cease to exist.

ninjashogun: asciilifeform, given my high-risk profile what APR would you (personally) extend me on between $7K-$22.5K (amount I take depends on APR) with no collateral except a registered Delaware C-Corp I'm currently full owner of (100%) going to 90% after an investment clears that I've committed to - the company has intellectual property including a patent that is pending and trademark that has been assigned, as well the equipment I

ninjashogun: would spend most of the money on can also become collateral.

ninjashogun: mircea_popescu, yes, rent in a very small room in a very large shared apartment, is $111 (after some clever negotiation from me based on how infrequently the room could be rented out due to its size). This includes all eelectricity bills, the Internet (that I'm using now) hot water, gas, utilities.

ninjashogun: asciilifeform, I have no proof of income due to the fact that I have been working without pay for my startups (startup at the moment)

ninjashogun: sorry, I meant to write: without pay for my startup (and now startups) - as I started working on the jobs site one after spending more than a month trying to collect the loan I closed

ninjashogun: I was extended this loan (basically) we did up paperwork for it and then I've been trying to collect it for over 5 weeks without luck. I can't get back in contact wiht the person (after exchanging many forms of contact). so so much after how easy it is to get a loan.

ninjashogun: asciilifeform, sorry - I don't get your analogy?

ninjashogun: asciilifeform, oh, you liken my arrangement here to a mexican factory? Well the problem with that is that this is where the development was being done, not production. We ahve a manufacturing partner lined up actually, production will be in China.

ninjashogun: asciilifeform, I had to make an unbelievable amount of progress to get offered a seed round on a hardware project that has not yet been completed and has no traction.

ninjashogun: asciilifeform, at this point I need the loan in order to get to the stage of prototype that the investors need to test (as part of their due dilligence also) and see in close to the final form factor.

ninjashogun: asciilifeform, I know how one "traditionally" secures capital, but it is usually against assets such as a house, etc.

ninjashogun: asciilifeform, in startups, on the other hand, it's usual to build an MVP using processes that don't scale, and without spending much money, until financing is secured.

ninjashogun: asciilifeform, did you already discuss a $7M investment, implying a valuaiton of $15M, with a VC who has recently made a $400M exit in another consumer hardware company?

ninjashogun: I don't mean to say anything about hte level of ambition you have in your hardware startup but usually a certified lab for developing ours costs $60K, which I am going to do on about $8K in used eBay equipment.

ninjashogun: (this is certified 2.4 ghz wireless equipment, this portion)

ninjashogun: Note that the wireless portion doesn't exist at all. I don't even have a specan (spectrum analyzer). The only eqiupment I developed is with large arduinos, as well as mockups of what it could look like.

ninjashogun: But you can't show an investor a mockup, and a bundle of wires, and say, imagine if the latter looked like the former!

ninjashogun: asciilifeform, again, this is why I mention that Steve Jobs (a kid who stole $5000 from his best and only friend to start Apple), Mark Zuckerberg (a guy who scammed a map website guy out of $2000 to start facebook), and Larry Page (a poor grad student who had to give $50B away in equity to get an immigrant to code up his Larry Page Rank), also did not have the means to play.They couldn't play. They did anyway.

ninjashogun: mircea_popescu, fine. AirBNB had to sell Cereal. Yes Cereal. To fund their idea of a C2C ebay of Rentals.

ninjashogun: https://www.airbnb.com/obamaos

ninjashogun: that's what they sold

ninjashogun: mircea_popescu, so how would I learn from them? What use are they to me?

ninjashogun: mircea_popescu, also, if my investors don't know of them, i can't leverage their background to get an investment, either.

ninjashogun: mircea_popescu, I think your model is a very, very fair one under normal circumstances. (Such as the Efficient Market Hypothesis.) However, I have very deep theoretical proof that your model is mistaken, and that these founders were in fact leveraging the same opportunity inefficiency that I am.

ninjashogun: mircea_popescu, I don't know about the criminals, generally they're not very smart. But I do know about founders and creating something.

ninjashogun: asciilifeform, I was actually responding to the earlier statement (day 1: ...lottery) with my statement about his model being wrong.

ninjashogun: The lottery model of startups is simply mistaken and wrong.

ninjashogun: You can know this for a fact ,because

ninjashogun: I don't know if it's evil or not but it's factually mistaken.

ninjashogun: You can convince yourself of this fact by being nearly 100% sure that more than $190B in wealth would be created if 10,000 qualified engineering and bioscience etc grad student founders were funded at $200K each for 100 years. It's not a lottery - it's just some unusual percentages.

ninjashogun: mircea_popescu, the answer is that they do not have the right socioeconomic perspective.

ninjashogun: mircea_popescu, it's the same reason (to be honest) that very few Romanians found startups and that you would have had far more trouble finidng cofounders if you didnt' want to do it alone, than you would have in (for example), Berlin, Rome, Brussels, London, Paris, Tokyo, etc.....

ninjashogun: it's a cultural issue.

ninjashogun: asciilifeform, that is part of what I mean

ninjashogun: asciilifeform, can you imagine doing due dilligence on a company that isn't even registered? That means only best friends can invest. Your pool of potential investors is literally limited to 7-20 people, no matter who you are in Romania. (Because that's how many people you trust through highschool.)

ninjashogun: I'm generalizing, but only a little bit.

ninjashogun: It's what was different about Palo Alto, for example.

ninjashogun: mircea_popescu, I don't mean to pick on Romania. For many of my examples I'm really thinking of Hungary, and using it as an analogy.

ninjashogun: The question isn't whether it was built - but how many Romanian cofounders or investors were on board?

ninjashogun: romania has 21M people in it, Ungary has 10M

ninjashogun: so about half the size by population

ninjashogun: mircea_popescu, well I could just ask you. Not really that interested.

ninjashogun: :)

ninjashogun: mostly on state privatization though no?

ninjashogun: The ones I know that made a killing did so by immigrating to the United States :)

ninjashogun: asciilifeform, what does your hardware startup do?

ninjashogun: or what are you building?

ninjashogun: ok

ninjashogun: I'm reading that page

ninjashogun: that first paragraph isa joke right? ("what's the idea")? like it's pseudo-lofty, right?

ninjashogun: anyway it's a good intro :)

ninjashogun: It's an intersting introduction. In the end I like it :)

ninjashogun: I just wasn't sure if the tone is somewhat pseudo- or ironic, or it's meant to be read "straight"

ninjashogun: So, I like the idea very much.

ninjashogun: That you've put here.

ninjashogun: asciilifeform, I have a suggestion for your next version. My suggestion is that the air gap with the computer be maintained, by running (a different brick) that is a wireless access point. You can connect to its wifi and use Firefox on localhost to upload and sign or upload and encrypt/decrypt files, which it would then serve back. This requires a computer with access to WIFI. However, I think in general a network stack

ninjashogun: is more resilient than a USB stack against, for example, man in the middle attacks (if someone knows that you will use that usb drive they could put a fake USB controller in that MITM attacks it.

ninjashogun: this suggestion isn't for the current version, which as a piece of hardware is great.

ninjashogun: it would also save a connect and disconnect. And can be done unobtrusively at a computer, without having to insert a USB stick.

ninjashogun: it could also come iwth storage, so that it could be used as a "wireless storage device" (thru the browser). rather than have to plug and unplug a usb stick.

ninjashogun: mircea_popescu, let me think about this.

ninjashogun: mircea_popescu, Why not? assume that the other end is in the person's home. Then the wireless key is truly unusable.

ninjashogun: mircea_popescu, in fact it could be set to ONLY sign/encrypt/decrypt the next 1 message or 2 messages. So that it can't be stolen off someone's body, as it's in theri home and will only sign the next 2 things.

ninjashogun: I think this would be an interesting application for using one's private key without having it in one's possession.

ninjashogun: :) I undrestand what you're doing with the USB thing. However, I, personally, do not consider USB stacks to be very secure.

ninjashogun: I think there are a lot of unknowns over USB and it is a frequently underestimated attack vector, with very little security research being done.

ninjashogun: I think wifi security has more attention paid to it, yes. Even when it's broken. Many eyes make security deeper.

ninjashogun: But this is not to detract from what you've done, asciilifeform (and mircea_popescu ?) Overall the device is a VERY good step.

ninjashogun: and I like the basic idea of not having your key on another PC.

ninjashogun: BingoBoingo - yes, absolutely.

ninjashogun: BingoBoingo - you are right and for this reason I probably shouldn't ahve called it an "air" gap.

ninjashogun: BingoBoingo, however, it is absolutely doubtless that wifi protocols get roughly 100x as much security research as the usb protocol does.

ninjashogun: BingoBoingo, also, in my personal opinion as a security observer, a man in the middle attack with a PC (or laptop) being opened, and a second usb host being inserted between the real USB and the device, whose purpose is to subtlely alter what is being signed, is a very real risk.

ninjashogun: BingoBoingo, since this device as described does NOT retain the signed document in memory, it is therefore signing something without knowing what it is, if it has been transferred between the PC and storage medium.

ninjashogun: I mean it retains no knowledge of what it signed. The person can't go home and check everything they've signed.

ninjashogun: What changes with Wifi? Well, you can still have a man in the middle, but it would be much more prohibitive. It would need a complete access point that connects to the device masquarading as the computer, while exposing itself to the computer and hiding the true signal from the computer. It's possible, but more difficult. And in the end the computer can do a complete secure session (in javascript with the browser) compl

ninjashogun: etely defeating the MITM.

ninjashogun: asciilifeform, packet capture is not a concern because you can establish a higher secure channel from Firefox on the computer all the way to the final device. This is possible because hte device can have a known fingerprint.

ninjashogun: and it doesn't matter if there are devices in the way.

ninjashogun: However, the current version transfers files in the plain over the USB protocol. it is 100% vulnerable to a USB mitm - which could probably be made so small that it almost fits in a usb drive.

ninjashogun: asciilifeform, ....?

ninjashogun: asciilifeform, okay.

ninjashogun: dignork, it doesn't matter who firefox trusts. You can run a complete tunnel using javascript all the way to the final end-point. The whole point of PKI is that it doesn't matter who sniffs packets.

ninjashogun: asciilifeform, I get your point.

ninjashogun: sure

ninjashogun: it makes sense to me. You can always assume any computer will have javascript, and a wifi.

ninjashogun: the wifi connects either a) to your device or b) to a MITM that connects to your device

ninjashogun: dignork - hmmm.. Well, on Mac and Linux you could do an md5sum or sha1sum on the javascript before you run it. On Windows you can only use a custom certificate, signed by yourself, and know the issuer.

ninjashogun: asciilifeform, this is not to take anything away from cardano - I like it.

ninjashogun: asciilifeform, I was just suggesting some directions for version 2 or 3.

ninjashogun: (my hardware has future versions as well, that we haven't done any work toward)

ninjashogun: Overall I would suggest you consider it due to the amount of security attention that 1) the WIFI stack 2) browser communications, have received. You can leverage that.

ninjashogun: what, do you not like the word?

ninjashogun: Fine, you can take advantage of that; you can make us of it; you can profit from it; you can be an indirect beneficiary of it; you can depend on it; you can rely on it; you can take it for granted

ninjashogun: make use of*

ninjashogun: asciilifeform, before you go -

ninjashogun: what is that APR?

ninjashogun: on the $7-$22.5K?

ninjashogun: asciilifeform, if I can have up to a 3 year grace period I would accept that with the full $22.5K.

ninjashogun: BingoBoingo - I always consider the simplest hting that could possibly work.

ninjashogun: I disagree, I think firefox running javascript is one of the simplest things to develop and target 100% of PC's with. Also it would work on some tablets, which have no USB subcomponent at all, but do have copy and paste and wifi connections.

ninjashogun: on an iPad and iPhone, you can copy the text, connect to the brick's wifi, paste it, copy the result, and then reconnect to your normal wifi. These things don't have a USB stack at all.

ninjashogun: Again, it doesn't matter if you reimplement PKI over javascript.

ninjashogun: Better than it can a usb subsystem, yes.

ninjashogun: I don't think packet sniffing is a problem if you tunnel over it.

ninjashogun: Again, none of this is to take away from the design as I've already read about it here. I like it a lot.

ninjashogun: dignork - yes, it would also be a good idea.

ninjashogun: dignork - but then they could no longer treat it as a mass-storage device.

ninjashogun: BingoBoingo - I learned of this literally 20 minutes ago. My improvements already have something that can at least theoretically work with an iPad and iPhone, which loads of people do their surfing on in the evening, and certainly don't want to keep keys on.

ninjashogun: you're on the couch on your iPad, want to sign something an email it. Are you going to keep your key on your iPad?

ninjashogun: no.

ninjashogun: BingoBoingo, Yes, I am. I realize this is not an airgap.

ninjashogun: on http://trilema.com/2013/how-to-airgap-a-practical-guide/ - I would also suggest running several copies of hte same hardware next to each other. If they're all doing something, how is someone going to know which is the one that is of interest. This can even subvert someone physically ocming in and using it in your absence.

ninjashogun: also the EM radiation might be similar when coming off of several similar computers.

ninjashogun: asciilifeform, by the way don't let the haters take anyting away. All of my suggestoin are at a single layer - and do not in ANY way impact the basic idea you've come up with with mircea_popescu --- which is a VERY good one. I don't really add anything in my suggestoins - it is the same design. You should patent it.

ninjashogun: the basic thing that you came up with is an escrowed key service embodied in a physical device that does not disclose the key, but uses it and discloses the result. This is a very good invention.

ninjashogun: asciilifeform - how could it be kept from the public? Wouldn't every electrical engineer with a scope see it?

ninjashogun: asciilifeform, the fact is, if you want to get this into millions of people's hands you will have to invest half a million in research and manufacturing. it could be the only secure device in their whole household (if they run windows.)

ninjashogun: asciilifeform, if you have to compete with Kingston copying your idea then you are dead in the water. You can't even make it to market.

ninjashogun: maybe 20 years is too long for a patent to be valid - then consider donating it after 3 years or 7 years. You can assign it to a protective Open Source patent fund.

ninjashogun: BingoBoingo, I like it. It's also something you can unobtrusively carry around.

ninjashogun: BingoBoingo - in the eventual wifi version, no one would have to know that you even use it. if being surveilled by site, it wouldn't be obvious that it's on your person. (or whether it is).

ninjashogun: asciilifeform, that's not true. They don't like to innovate.

ninjashogun: asciilifeform, but they do love to use other people's innovations.

ninjashogun: me? no.

ninjashogun: dignork - you misinterpret my tone if you think I'm arguing. I like the idea of the Cardano very much, I think it's a genuine, useful, good, and non-obvious innovation, and I encourage asciilifeform in building it and getting it to market.

ninjashogun: dignork - further I don't have any problem with it in the current form. I think asciilifeform should patent it. I also suggest he work on just one layer of the solution, which is the physical transport layer, and consider bluetooth or wifi.

ninjashogun: dignork, but for the next version.

ninjashogun: dignork, after selling thousands of this one :)

ninjashogun: asciilifeform, I told you? You can consider the link totally insecure and still use it....?

ninjashogun: asciilifeform, the way a tunnelled layer works, is it's OK to give a copy of every bit to an Evesdropper, they still can't make out the plain text.

ninjashogun: dignork - are you saying that hte presence of WIFI will leak the CPU state?

ninjashogun: asciilifeform, are you saying that the presence of WIFI will leak the CPU?

ninjashogun: asciilifeform, the paper that proved that also suggested mitigation strategies...

ninjashogun: asciilifeform, OK. If you think it is impossible to prevent WIFI from broadcasting the full contents of the CPU and RAM then you would have to design around it to make my suggestion possible, which may be too difficult.

ninjashogun: hn is hackernews normally

ninjashogun: oops

ninjashogun: BingoBoingo: I hate to be the one to break it to you. I thought you heard. /. had a stroke and is in a nurinsg home :(

ninjashogun: nursing

ninjashogun: asciilifeform, I've done that :)

ninjashogun: asciilifeform, I get your point but obviously if you can learn a single bit of a key, you can learn them all. Not one bit should be leaked, ever.

ninjashogun: asciilifeform, anything that leaked one bit, could be repeated until you have them all. It only works if you can't learn any of them, except by brute-forcing all of them together.

ninjashogun: asciilifeform, further, as a practical matter you are not being asked to transmit a real key. You are just transmitting a stupid session key that is used to sign a single document. And if that session key is used in javascript, which is VERY far from the metal (it's a VM, running in interpreter, JS running in a C++ program, firefox, running on Windows) you would have to have insnae precision on learning exact CPU state.

ninjashogun: asciilifeform, I don't even mena to "sign" a single document. Just to transmit it. And receive back hte signed version.

ninjashogun: personally anyone who could bruteforce all that, while breaking wireless encyrption and your whole network stack, can see the damn document as far as I'm concerned. and they still wouldn't have my private key.

ninjashogun: dignork - but above and beyond what the computer leaks anyway by itself?

ninjashogun: dignork - because all computers obviously already leak some information through faint EM

ninjashogun: dignork - if what you are saying is true than there should be a huge market for a USB wifi stick that is just 8 feet of shielded USB cable with a power conditioner on either end, so that your wifi transmission happens the fuck away from your CPU.

ninjashogun: nobody is this paranoid :)

ninjashogun: or c) this is tinfoil hat nonsense :) :)

ninjashogun: ooops

ninjashogun: lol

ninjashogun: maybe

ninjashogun: I tend to go from first principles.

ninjashogun: I guess I could radically underestimate how much CPU state a wifi transmission can carry away.

ninjashogun: and what distance

ninjashogun: it's just that a CPU does so much, you know? it's 2 or 4 cores at 4 ghz with megabytes of just CPU cache and then hundreds of megabytes of active ram and programs

ninjashogun: maybe

ninjashogun: I'm trying to invest in some 2.4 ghz wireless equipment (spectrum analyzer among other things) and would be the first time I use one.

ninjashogun: I'm currently developing a wireless version of my prototype, and it is true that I am still learning it.

ninjashogun: ok

ninjashogun: anyway I'd think there's a market for in-between, people (like me) who don't care that much, but would rather not keep a key on a PC

ninjashogun: or tablet

ninjashogun: Duffer1 - it' snot 'mine'. It's a feature suggestion for the cardano v2 or v3. it's still the cardano. 95% would be the same, including the basic invention that they described.

ninjashogun: I've introduced myself...?

ninjashogun: I'm Robert, as I mentioned. I hadn't talked to you guys before. ☟︎

ninjashogun: I stopped coming here and returned due to ughlol mentioning it. I think you guys are mostly trolling in here (which is fine).

ninjashogun: When I had been coming in here it was following an experience over a similar channel (related to doge) on a loan. As someone here (asciilifeform?) explained, I should have 'no problem' getting a loan of $20K. In fact I did have "no problem" on it, but in the end I couldn't collect it, and had come in here over a few days to see if anyone were interested in the same.

ninjashogun: on it->with it

ninjashogun: https://news.ycombinator.com/item?id=7419618 is showing as dead for me, bitcoinpete

ninjashogun: ThickAsThieves, I read your links. I didn't start any more conversations though.

ninjashogun: BingoBoingo, that is hilarious

ninjashogun: see you guys later. I'm going off to bed.

ninjashogun: hiya