@dead.substack followed @james
@dead.substack in #cybernomad

I have assembled the cybernomad v1 parts minus the solar panel into a more cohesive unit:

parts_on_the_table_small.jpg

sitting_down_small.jpg

standing_small.jpg

Since these photos were taken I've placed the rpi, hmd brick, and battery in a side pouch made of a piece of purple cloth. I've also made a sling for the keyboard so I can type while standing. The nub thinkpad mouse on the keyboard is perfect for this arrangement.

The resolution on the HMD is higher than the specs on amazon listed. xrandr says 1184x624. It's a bit hard to focus on the left and right edges of the screen and places can be blurry, but I'm quickly getting used to that. I used the setup for a few hours and it wasn't too disorienting, although I had to take small breaks.

Raspbian was easy to get running on the rpi once I found an sd card adapter in a drawer filled with other rpis. I'm using two of the usb ports: one for the keyboard and one to power the HMD. The HMD ships with a ring socket power adapter on a europlug and the instructions are only in Korean. Luckily the adapter is 5v 2a, so I cut the plug and spliced on a USB connector that I can plug into the rpi.

@dead.substack
Re: %cb78v2Qf3

nodemcu (based on esp8266) boards support tls, so that could work. I think the easiest way would be to run certbot from a laptop and flash the certificates onto the chips. The DNS isn't protected, but the certificates do expire in 90 days which may be problematic for some use-cases.

I ordered 15 nodemcus, 15 arduino unos, 3 lots of 20 4.2 watt solar cells that should be in San Diego, picking them up tomorrow. I'm planning on building some things at maker.land in Oregon if anyone wants to hack on some electronics projects there.

@dead.substack followed @Nate
@dead.substack in #offgrid

Documentary about homelessness in LA

This segment about Slab City is really great:

"I live in the only town where there's no homeless. Even if you just got a tree and a tarp under it, that is your home."

"Ok, check this out. The economy's crashing and I'm in San Francisco. I get a house sitting job. I got two weeks in this house and I'm figuring out what I'm going to do. [...] I went to google and typed in very crazy things and really got really good information. So I typed 'how to live for free' and hit enter on Christmas Eve and all these links to Slab City came up."

@dead.substack
Re: %f6No+0gck

Centralized services require vast resources and complicated architectures to scale and the more internal services are necessary to run a piece of infrastructure, the less value there is in keeping the code open because it becomes harder and harder for other people to run it themselves to make modifications, as that issue discusses. The difficulty of replication for this scaled up infrastructure, exclusive control over deeding of property rights for the namespace, and network effects conspire to create barriers to entry which are defensible by design.

These are the ingredients of a successful business and hopefully a long-lived service as a result (because we need npm right now to incubate dexentralized alternatives), but we can take this example as illustrative for how power dynamics are embedded in computer architectures. If we want a more egalitarian, communitarian internet, we'll need to bake those features in from the beginning in such a way that we don't end up back where we've started from. We should fail in new, interesting ways or else succeed in building a future that doesn't need us.

@dead.substack in #traveling
Re: %8jZspxdgk

We are custodians of 2 dogs at present, but they each have other humans. Johnny's is now called Bernie's and is a regional Bernie Sanders campaign HQ.

@dead.substack in #traveling

In Los Angeles for the day, by mistake. @marina and I decided to go up to La Brea because it looked nice in Miracle Mile. In Park La Brea, pokemon players all around me. People keep talking about Charmanders. There are outlets on many of the lamp posts, and most of them work. I'm plugged in but also in the shade and the dogs are on high alert for more squirrels racing around in palm trees.

@dead.substack in #traveling
Re: %3EtLY6rWl

Machines, Madness and Freedom: Invention in the Mojave Desert

@dead.substack followed @josh
@dead.substack in #space

Moments ago, the ISS passed over Southern California and I also saw a shooting star in the same patch of sky. It's very bright and moves as fast across the sky, but clearly not a plane - no blinking lights. I double checked the position on the internet and it was sure enough the ISS.

@dead.substack in #resistcapitalism
Re: %5Xu/PQrgz

Here is another good Varoufakis talk given at Google about money, politics, and technology. He talks about how to make monetary policy work using technology while banks are collapsing and has some criticisms of the deflationary nature of bitcoin.

@dead.substack in #resistcapitalism

Yanis Varoufakis: The Future of Capitalism

Quote at #t=22m55s

"The neoliberal agenda that has emerged out of the second post war phase of global capitalism has undermined the narrative of the ruling elites regarding democracy. Now they are reaching a point of having no scruples about declaring democracy null and void. No longer do they feel even the need to appropriate the mantra of democracy for propaganda purposes. Now they are effectively it's the greatest vindication of Lee Kuan Yew, of Deng Xiaoping: the idea that efficiency has replaced the need to consult voters."

He has a story in the middle that stood out to me about how no leaders of Europe wanted to make debt restructuring actually work so that Greece could pay off its loans.

Another quote at #t=59m52s

"Increasing concentration in the IT sector is creating the new technologies that will do that which the left has failed to do: overthrow capitalism. It is really very simple. The moment machines pass the Turing test properly [...] The moment we are going to have 3d printers operating as public utilities. [...] The moment that this happens we have not just a process of Schumpeterian creative destruction, but we have a process where economies of scale and the whole logic of corporate capitalism collapses."

@dead.substack in #fashion
Re: %ERfX/1xeA

more info: this character is called Mentor from the scifi series Space 1999

mentor.jpeg

@dead.substack in #fashion
Re: %ERfX/1xeA

from http://atomic-chronoscaph.tumblr.com/image/147994426228

@dead.substack in #fashion

cape.jpg

@dead.substack in #peermaps
Re: %sOsydvkWu

You will need to file->save as that link or open https://substack.neocities.org/healpix.html#5

@dead.substack in #peermaps

subdivision scheme using HEALPix so that I can iteratively divide tiles that are larger than a threshold file size out of approximately equal area regions:

healpix.html

@dead.substack unfollowed @balupton
@dead.substack in #optics
Re: %/ILz+MoOa

These components are routinely used to make projectors, but I haven't found any price information listed on the internet.

@dead.substack in #optics

One of these chips seems like a good starting point for a google glass style HMD, except for both eyes and for HDMI input: http://holoeye.com/lcos-microdisplays/hed-2200-color-lcos/

Appears difficult to order, I think the only way is to use their contact form.

@dead.substack voted related to this (and many other contemporary topics): > "when you're accus
@dead.substack voted [@balupton](@xz1BsT3ekQS2LCAUYIkNi/5S1opbKiCkYwdSTTqllak=.ed25519) that isn
@dead.substack followed @the_linker
@dead.substack in #cyberhobo
Re: %rPtLSg5DH

I still need to pick up the solar panel and mini-HDMI cable from San Diego, but I have the rest of the pieces. I can't test the setup until I get the cable.

@dead.substack in #resistcapitalism
Re: %AbxFkDYRM

In this talk he goes into more detail: The Other Side of the Door.

The reason why the fish metaphor appears to work is that water is one of the few commons we have left.

@dead.substack in #resistcapitalism

Ed Whitfield on why the "teaching a man to fish" parable is a lie

  • access to knowledge is not sufficient, must have access to fishing poles, watering holes
  • ownership creates patterns of extractive conditional access
  • we must create new forms of power by organizing
@dead.substack
Re: %aFuxYZmzq

The list of talks looks really interesting! Please share your favorites afterward.

@dead.substack followed @balupton
@dead.substack followed @notfredhampton
@dead.substack in #copyfight
Re: %c79upwCED

I can't think of any way that a global addressing scheme like the DHT would not be vulnerable to eavesdropping. It's easy to see why: all a copyright holder needs to do is dump the list of IP addresses that are part of a swarm and send letters to ISPs.

I think this same attack will also start showing up in more areas. For example, if people start distributing encrypted apps over p2p networks that governments deem illegal, a government agent need only dump the list of IP addresses participating in a swarm.

One thing I've been talking with some other people about for a while is the idea of a "friendtorrent" where you share files only with people you know in a way that is not susceptible to passive surveillance and also does not use a DHT. The nice thing about your real-life (or internet) friends is that they probably have similar tastes in large files and your set of friends is going to be different from the sets of friends of your friends. In this way, important files can propagate across a large population relatively anonymously.

@dead.substack in #copyfight
Re: %c79upwCED

More details on arstechnica:

  • hosted out of Chicago until Jan 2016
  • subpoenaed apple email account
@dead.substack in #copyfight

kickass torrents admin arrested, domain names seized by the US government.

Another centralized layer over a decentralized system shut down by the feds. There are three points of centralization here that make operators of these sites vulnerable: servers, domain names, and having a singular operator "in charge" of the whole operation.

An extra takeaway is that US jurisdiction extends to any other US-friendly state when it comes to enforcing certain American laws that benefit American corporations.

@dead.substack voted # cooperative computing Many real-world problems that we wish to solve wit
@dead.substack voted # cooperative computing Many real-world problems that we wish to solve wit
@dead.substack in #anarchitecture
Re: %F9GvaS4y+

I think the threat model here is that I start making decisions about how the network operates for my own personal gain or I make decisions that go against what most users of the system want. I this case, it should be not so difficult for another person with objectives more closely aligned with what many people want to start their own cooperative computing platform and begin to convince the existing providers to defect to the new system.

@dead.substack voted me 15 minutes ago: hmm i wonder what the experience of the 60s was for peop
@dead.substack in #anarchitecture

cooperative computing

Many real-world problems that we wish to solve with p2p techniques may require substantial pre-processing to generate static data that can be distributed on bittorrent-style DHT swarms. For example, with peermaps, I would like to make it easy for people who have spare CPU, network, and disk capacity to lend them to the cause.

Idea: run a command to create a cooperative computing pool. Run another command to delegate other keys to perform administrative functions. Meanwhile, other people can run separate commands to volunteer their computing resources to a pool identified by a cryptographic public key. The people whose keys are trusted by the pool are responsible for verifying that volunteer nodes are performing calculations correctly and have the power to ban nodes that aren't holding to their obligations. Some of this can be automated, but I think a human solution is required somewhere to protect against attacks on the verification systems.

"Trustless computing" is a trendy topic in distributed systems right now, but the efficiency characteristics of these systems is usually very poor, to the degree of many orders of magnitude. I think instead it makes more sense in many cases to use existing real-world trust models and computer-assisted human verification to make these things work in practice for problems that are more computationally expensive than a currency or a voting system.

@dead.substack in #peermaps

Pure javascript decoder for the o5m format: o5m-decode. I can either use this parser to generate tiles on the fly in the browser from the p2p o5m data or distribute tile data generated from the o5m data.

@dead.substack voted The nitty gritty is that he's advocating http://hood.ie/ and couchdb. It's
@dead.substack in #peermaps
Re: %CRuYxB5XY

Adjusting the parameters more on the auckland dataset, I can build a 4x4 recursive o5m hierarchy with a 1M upper size limit in 1m25s:

$ time node generate.js --remove -i /tmp/auckland.pbf -o /tmp/auckland -t $((1024*1024)) --ymin=-37 --ymax=-36.5 --xmin=174.5 --xmax=175 --nproc=`nproc` --xcount=4 --ycount=4

The root directory has gzipped o5m files and subdirectories:

$ ls /tmp/auckland/ -sh
total 2.2M
1000K 0.o5m.gz    336K 11.o5m.gz    28K 14.o5m.gz   144K 3.o5m.gz   4.0K 6/   4.0K 9/
 4.0K 1/          4.0K 12/          20K 15.o5m.gz   4.0K 4/         4.0K 7/   4.0K meta.json
 396K 10.o5m.gz   160K 13.o5m.gz   128K 2.o5m.gz    4.0K 5/         4.0K 8/
$ ls /tmp/auckland/5 -sh
total 2.0M
140K 0.o5m.gz   392K 12.o5m.gz  144K 15.o5m.gz  132K 3.o5m.gz   56K 6.o5m.gz   32K 9.o5m.gz
 92K 10.o5m.gz   88K 13.o5m.gz   88K 1.o5m.gz    32K 4.o5m.gz  216K 7.o5m.gz  4.0K meta.json
104K 11.o5m.gz  128K 14.o5m.gz   60K 2.o5m.gz    20K 5.o5m.gz  228K 8.o5m.gz

Each directory has a meta.json file which maps the file or directory numbers to WSEN bounding boxes:

{"0":[174.5,-37,174.625,-36.87469374334014],"1":[174.5,-36.87469374334014,174.625,-36.749592720737056],"2":[174.5,-36.749592720737056,174.625,-36.624695333557895],"3":[174.5,-36.624695333557895,174.625,-36.5],"4":[174.625,-37,174.75,-36.87469374334014],"5":[174.625,-36.87469374334014,174.75,-36.749592720737056],"6":[174.625,-36.749592720737056,174.75,-36.624695333557895],"7":[174.625,-36.624695333557895,174.75,-36.5],"8":[174.75,-37,174.875,-36.87469374334014],"9":[174.75,-36.87469374334014,174.875,-36.749592720737056],"10":[174.75,-36.749592720737056,174.875,-36.624695333557895],"11":[174.75,-36.624695333557895,174.875,-36.5],"12":[174.875,-37,175,-36.87469374334014],"13":[174.875,-36.87469374334014,175,-36.749592720737056],"14":[174.875,-36.749592720737056,175,-36.624695333557895],"15":[174.875,-36.624695333557895,175,-36.5]}
@dead.substack in #peermaps
Re: %CRuYxB5XY

Lucky for me, digital ocean rolled out block storage this week and it is relatively affordable and seems simple to use for this purpose.

@dead.substack in #peermaps

peermaps 2016-07-17 update

I was working more on peermaps today and made it pretty far with a new approach: using osmconvert.c with an equal area grid. Each grid section is filtered from the osm pbf file into a separate gzipped o5m file. The gzipped o5m files are approximately the same size as the input pbf file, so I figure I can get all of planet OSM in this format, recursively tiled into equal area subtiles so that all files are below a maximum threshold in size.

I had luck with the 19M auckland extract which builds in about 4 minutes after I added some parallelism to the processing pipeline, but my laptop shut off for being too hot on the planet osm file after about 2 hours. The scripts are all in this directory.

@dead.substack
Re: %XZW5qfeYK

What if the database was encrypted at rest and the worker had to be told an in-memory password to unlock? This way, when a new worker is installed, the user will have to explicitly grant permission to the new worker. This would have another benefit of making data forensics more expensive. Encrypting the data is similar to removing it, but is more robust against new code running before detection routines can kick in.

With some experimentation, AppCache seems to be much less "sticky" than it used to be. Refreshing a few times or changing your wifi will trigger an update in my experiments for captivating portal. Service Workers have the potential to be more permanent once version 2 comes about, but there will be a long transitional period for browsers to support the Service-Worker-Max-Age header.

@dead.substack in #cyberhobo
Re: %rPtLSg5DH

I now have some of the parts in my possession, but I'm still missing the mini-hdmi cable so I can't test the HMD yet. It seems that I'll also need to cut into the HMD power supply since it's 5v but only comes in an AC->DC adapter with a Korean plug (same as Europlug). It's still they didn't use USB instead, but that's what I'm going to do with the USB battery.

@dead.substack in #hackercamp

http://maker.land/ on the Oregon coast, Aug 19! Organized by Max Ogden and John Hannis, who I met at CTRL-H in Portland recently. I should have my solar-powered cyberhobo HMD hacking suit ready by then. I'm now thinking about what kinds of workshops I could propose and how long it would take to ship the parts from China.

@dead.substack in #cyberhobo
Re: %rPtLSg5DH

I'm planning to display a terminal or browser on that display with a tiling window manager running on the RPI.

@dead.substack in #traveling

I'm writing this in a pickup truck from the joshua tree deserts of E138. Signs occasionally remind motorists to carry chains, but winter seems really far away in this heat. I saw a church advertising itself as a pokestop in Pearblossom. Last night, the truck suddenly stopped accelerating on the highway just south of Tulare (pronuncation: "to larry"). @marina and I got a tow to outside a mechanic and slept in the back of the truck with the dogs until the place opened at 07:30. After a fuel pump replacement, we were back on the road around 13:00. A lot of people ride bikes in Tulare given how small and spread out the town is and people have some fairly tricked out customized designs.

In Mojave, there are hundreds, perhaps thousands of windmills on the other side of the tracks. Behind Denny's, the military supply store was throwing a doomsday sale and beyond that is an RV park called the spaceport. Many of the the vacant lots have signposts titled with strange religious slogans.

@dead.substack voted ![2016-07-12-142047_2528x1498_scrot.png](&Ty7tXiq/LDhyuiAX60fbNrE+Ua7G7JP33
@dead.substack voted I must disagree that this is "completely" decentralized. decentralization i
@dead.substack voted # [Mango: Git completely decentralised](https://medium.com/@alexberegszaszi
@dead.substack voted the folly of categorizing things
@dead.substack in #hardware

Heading down south to the desert. Time to order some gardening, power, and
treehouse supplies!

internet order parts

hardware store parts

  • surgical tubing
  • clear plastic sheets
  • pvc pipes
  • nylon rope
@dead.substack in #patchwork-dev

This DNS rebinding attack on ethereum would also seem to apply to patchwork, unless patchwork checks the host header.

@dead.substack voted 24 hours of being back in London and I'm already planning my trip the hellz
@dead.substack voted if you take your computer apart and disconnect the internal battery, when y
@dead.substack voted BOOM ![screenshot_patchbay-firefox.png](&xh9GLoAnfjL35GOd3jrCvrM93nbnOHr4o
@dead.substack followed @btrask
@dead.substack unfollowed @btrask
@dead.substack followed @btrask
@dead.substack
Re: %BobO8NaKe

I can confirm that webrtc works from a file:// URI. I did this for chatwizard.

@dead.substack in #cyberhobo
Re: %rPtLSg5DH

It's more for the portable screen that works well when it's bright outside. I don't intend to do any VR with this (a raspberry PI wouldn't be powerful enough to do that).

@dead.substack
Re: %cy8QRy3qy

This will unfortunately be insecure until the Service-Worker-Max-Age header ships in v2 because workers cap the max-age at 24 hours.

I think adding records to /etc/hosts after you load a page might be an acceptable work-around for now, but I need to test this.

@dead.substack voted # web interface how does everyone feel about a simple, read-only web inter
@dead.substack
Re: %cy8QRy3qy

new slugboot bugfixes and features:

  • MessageChannel requires setting .onmessage, not .addEventListener('message',f) - now the callbacks work
  • deletes old versions to save space - history is intended to be handled by applications
  • added slug.version() and slug.copy()

slug.version() is important so you can check to see if a slug has already been flashed with code. This way you can check to see if there is code already there at boot up and flash it if there isn't anything.

slug.copy() is important so you can roll over files from previous versions so that you don't need to fetch/upload them again.

@dead.substack
Re: %cy8QRy3qy

a modular cartridge

@dead.substack
Re: %cy8QRy3qy

In the course of writing that module, I went from http://localhost:43000/ to http://localhost:43059/ Debugging cache garbage on a different origin is much faster than less error prone than clearing the cache.

@dead.substack
Re: %cy8QRy3qy

minimal service worker webapp bios for offline-only webapps: https://github.com/substack/slugboot

@dead.substack voted [StrongLink 2016-06-09.md](&vpJIz01Edc9Tu9cFvBLklA6oftSnmRc4nJPnvGbZADc=.sh
@dead.substack followed @cellular
@dead.substack in #cyberhobo

possible cyberhobo nomad parts list: https://amzn.com/w/38MKCGIYNUKKC

From reading around, an rpi takes anywhere from 1-10W, depending on what's hooked up to it and what it's doing. It seems like the HMD might pull down a fair amount of power too.

I think 852x480 would be enough to work on if the pixels were crisp enough. I used a similar resolution display that was hard-wired to an android device and it seemed fine for web browsing and terminal hacking. This one takes HDMI input directly.

@dead.substack voted launched a blog on my site! http://kukso.space/blog
@dead.substack voted my most recent digital collage ![thetrauma.png](&eOEQRsVsU9c18JHgDGD/zkcw2r
@dead.substack voted my most recent mosaic. ![DSCN9232.JPG](&CucpyVuUZE7lOg+siM+DE/yKCl8GYP4epa
@dead.substack

pkgdb for publishing and distributing versioned directories, like npm-style packages or versioned webapps.

Now I need to write some layers pluggable for loading using service workers and caching tricks, which @Dominic could also use.

@dead.substack changed something in about
@dead.substack
Re: %nNlgUhekq

With this patch for hyperdrive I can get back to finishing pkgdb, which is going to be the new basis for hyperboot. I don't think it's too important to optimize the bundle size, since hyperdrive uses rabin fingerprinting, so each update is only a small diff payload. @mafintosh has a good talk about this and a demo module using rabin fingerprinting for web application payloads: browser-sync-stream.

@dead.substack voted I woke up this morning and found god had given me a fish! A fish had jumpe
@dead.substack in #techno-dystopia
Re: %gxTAffmPo

That shows up with insurance companies. They are required to not discriminate, so they let statistics do the discrimination for them indirectly, achieving the same ends with a veneer of technical deniability.

@dead.substack in #techno-dystopia

The Moral Economy of Tech (web | html)

@dead.substack in #facebook

facebook.png

So of course I clicked strongly agree.

@dead.substack in #canadian-scifi

Cube (1997)

Genre: puzzle math horror

The whole movie was filmed in one 14 foot by 14 foot by 14 foot cube (77.7m³) that is lit differently. I like how this movie doesn't bother to resolve why the cube exists and the character acting is refreshingly over the top.

@dead.substack in #inequality
Re: %48cyD9nex

Driverless cars could revolutionize city living in vehicles. One of the big annoyances is finding a parking space and avoiding fines from street sweeping and moving your car every X days. You could go about your day as usual and then hail your driverless van when you start to get tired. Driverless beds.

@dead.substack in #traveling

defining normal as a digital nomad

@dead.substack voted [Hackercouch](https://hackercouch.com/) - Couchsurfing for Hackers, by Hack
@dead.substack voted [@ev](@8Qee0I/DwI5DHSCi3p5fsl6FyLGArrnDz3ox9qZr5Qc=.ed25519) probably go fo
@dead.substack in #inequality
Re: %48cyD9nex
"If you think people ought to be able to make a living by owning stuff..."

I think this is evil. It means that people with money can use their money to make more money without working for it. They just sit back and accumulate more wealth at the expense of everyone else who has to work their basic survival.

@dead.substack followed @dangerousbeans
@dead.substack sent a private message
@dead.substack connected to a pub
@dead.substack followed @pub_bret
@dead.substack voted @arj I lived in sweden for 5 year and found they had very sensible llc hous
@dead.substack sent a private message
@dead.substack in #anarchitecture
Re: %jatf6hfCB

The other way I could do this is the other way around, where I encrypt a coarse object and separately generate non-derived subkeys with more specific information. I think that was the original idea? I'm trying to get a feel for what the trade-offs are here.

@dead.substack in #anarchitecture
Re: %jatf6hfCB

With this I was deriving keys in a hierarchical fashion, not nesting layers of encryption as such.

@dead.substack in #anarchitecture
Re: %jatf6hfCB

Here are some examples for how to decrypt the events at different levels of granularity using this approach.

partial decryption: single property

var keys = JSON.parse(sodium.crypto_secretbox_open(
  listCipherText, listNonce, listKey))
var propIndex = keys.indexOf('propname1') + 1
var rec = values[propIndex]
var prop1 = sodium.crypto_secretbox_open(rec.cipherText, rec.nonce, propkey1)

partial decryption: whole event

var listKey = hmac(evkey, '_keys')
var keys = JSON.parse(sodium.crypto_secretbox_open(
  listCipherText, listNonce, listKey))

keys.forEach(function (key, i) {
  var rec = values[i+1]
  var propkey = hmac(evkey, key)
  var prop = sodium.crypto_secretbox_open(
    rec.cipherText, rec.nonce, propkey)
  console.log(propkey, '=>', prop)
})

partial decryption: whole day of events

var dayListKey = hmac(day, '_keys')
var dayKeys = JSON.parse(sodium.crypto_secretbox_open(
  dayListCipherText, dayListNonce, dayListKey))

dayKeys.forEach(function (evProp) {
  var evkey = hmac(day, evProp) 
  var listKey = hmac(evkey, '_keys')
  var keys = JSON.parse(sodium.crypto_secretbox_open(
    listCipherText, listNonce, listKey))

  keys.forEach(function (key, i) {
    var rec = values[i+1]
    var propkey = hmac(evkey, key)
    var prop = sodium.crypto_secretbox_open(
      rec.cipherText, rec.nonce, propkey)
    console.log(propkey, '=>', prop)
  })
})
@dead.substack in #anarchitecture
Re: %jatf6hfCB

Here is how I understand this recursive HMAC idea, if anyone wants to go over these notes:

hmac capability system

We can use HMACs to implement a distributed capability system.

var crypto = require('crypto')

var rootkey = crypto.randomBytes(32)
var propkey1 = hmac(rootkey, 'propname1')
var propkey2 = hmac(rootkey, 'propname2')
var propkey3 = hmac(rootkey, 'propname3')

function hmac (root, name) {
  return crypto.createHmac('sha256', root).write(name).digest()
}

hmac encryption

encrypt each property with the propkey:

var crypto = require('crypto')
var sodium = require('chloride')

var nonce1 = crypto.randomBytes(24)
var plainText = Buffer('hello pdx')
var cipherText1 = sodium.crypto_secretbox(plainText, nonce1, propkey1)

hmac storage

Save the nonce value and the cipher text:

var fs = require('fs')
fs.writeFile('encrypted.txt', JSON.stringify({
  propname1: { nonce: nonce1, cipherText: cipherText1 },
  propname2: { nonce: nonce2, cipherText: cipherText2 },
  propname3: { nonce: nonce3, cipherText: cipherText3 }
})

It's safe to distribute these values publically.


hmac storage

For extra privacy, you can also encrypt the list of property names.

Here we'll use a special _keys property.

var listKey = hmac(rootkey, '_keys')

var listNonce = crypto.randomBytes(24)
var plainText = Buffer(JSON.stringify(['propname1','propname2','propname3']))
var listCipherText = sodium.crypto_secretbox(plainText, listNonce, listkey)

hmac storage

Now our storage payload becomes:

var fs = require('fs')
fs.writeFile('encrypted.txt', JSON.stringify([
  { nonce: listNonce, cipherText: listCipherText },
  { nonce: nonce1, cipherText: cipherText1 },
  { nonce: nonce2, cipherText: cipherText2 },
  { nonce: nonce3, cipherText: cipherText3 }
])

hmac capabilities overview

  • r - individual prop keys
  • w - access to the root key plus a signed message authorizing the key
  • x - _keys property

data payload

What if we want to share several months or a whole year's worth of information?

That could be a lot of data.


recursive hmac capabilities

We can derive a sub-rootkey from a rootkey:

var rootkey = crypto.randomBytes(32)
var subrootkey = hmac(rootkey, 'subobjname')

recursive hmac capabilities

We can derive a sub-rootkey from a rootkey:

var rootkey = crypto.randomBytes(32)
var subrootkey = hmac(rootkey, 'subobjname')

and that sub-rootkey can have its own properties:

var subpropkey1 = hmac(subrootkey, 'propname1')

...and so on, recursively


your day, your week, your month, and even your year

var year = crypto.randomBytes(32)
var month = hmac(year, 'june')
var week = hmac(month, '19-25')
var day = hmac(week, '21')

your day, your week, your month, and even your year

var year = crypto.randomBytes(32)
var month = hmac(year, 'june')
var week = hmac(month, '19-25')
var day = hmac(week, '21')

saving an event

and we can store event data at the highest resolution (day):

var values = {
  time: '2016-06-21 9:30',
  location: '722 E burnside portland oregon usa',
  event: 'nodepdx',
  title: 'a p2p calendar talk'
}
var enc = {}, keys = {}

Object.keys(values).forEach(function (key) {
  var nonce = crypto.randomBytes(24)
  var propkey = hmac(day, key)
  var plainText = values[key]

  enc[key] = {
    nonce: nonce,
    cipherText: sodium.crypto_secretbox(plainText, nonce, propkey)
  }
  keys[key] = propkey
})

and now

Now, if we want to share our whole week or month or year,
we only need to send one key!

If we want to be exclusive about properties,
we need to send those property keys individually,
but that is less information.

@dead.substack in #inequality
Re: %48cyD9nex

Another caveat, pegging minimum wage to rent should be against a survey of new listings, not existing listings. Otherwise people get stuck in shitty places and can't move.

@dead.substack in #inequality
Re: %48cyD9nex

Some ways to quickly fix this with laws:

  • peg the maximum monthly allowable rent to 33% of full-time wages for a month working minimum wage (or less, maybe 20 or 30 hours)
  • make owning a second home illegal, or at least tax it extremely agressively
  • raise the minimum wage to $28 / hour (1500/4/40 / 28 = 33%)

and while we're here:

  • make housing discrimination of any kind illegal when renting. That includes credit reports, income, everything. Fielding candidates could be handled by a city or county office instead of the soft racism of renting we have now.

Probably some combination of these.

@dead.substack in #inequality

Walking through Portland to the nodepdx venue today, I saw some sad things and felt terrible. I saw a crappy 1 bedroom in a duplex renting for $1500 / month. Then I started to do some math: minimum wage in Oregon is $9.25 / hour. There are approximately 4 working weeks per month so at 40 hours per week, $1500 / month / 4 (weeks/month) / 40 (hours/week) / $9.25 / hour = 101% of your take-home pay if you make minimum wage, before taxes. Then I saw someone sleeping outside on a bench. Fuck America.