Keyoxide: aspe:keyoxide.org:KI5WYVI3WGWSIGMOKOOOGF4JAE (think PGP key but modern and easier to use)

  • 1 Post
  • 83 Comments
Joined 2 years ago
cake
Cake day: June 18th, 2023

help-circle

  • I cleaned it up. Your editor doesn’t like to nest formatting apparently. Using an editor that lets you write the markdown directly is probably better, and you are probably already familiar with markdown anyway, since it’s used all over the place.

    2025-07-09 “Sometimes, when one door closes (lack of code signing) in life, another one opens (vulnerability).”

    The sentence sumarizes well the situation in the previous version, 8.8.2.

    There were - and still are - many false-positives reported in the previous version v8.8.2, by the antivirus software due to the absence of Windows code signing certificate. How to install the root certificate:

    1. Double-click the certificate, it may tell you it’s invalid, ignore that and click: “Install Certificate…”.
    2. In the Certificate Import Wizard, select “Local Machine”, then click Next.
    3. If prompted by UAC (optional, depending on admin Previleges), click Yes.
    4. Choose “Place all certificates in the following store”, then browse and select “Trusted Root Certification Authorities”. Click Next.
    5. On the final page of the wizard, click Finish to complete the installation.For detailed instructions, see Notepad++ User Manual.

    We’re still trying to obtain a certificate issued by conventional Certificate Authorities, for a better user experience. But let’s be honest: it’s probably not happening. Notepad++ isn’t a business - it’s certainly not an enterprise - and apparently, that makes a popular open-source project invisible to their gatekeeping standards.

    If the “gatekeepers” won’t issue a certificate under the name we deserve - so be it. At least it spares us from wasting time and energy on a frustrting process that demands we beg for a new certificate every 3 years. The Notepad++ Root Certificate may not carry their approval, but it leads us to freedom.

    Edit (2025-12-03): Starting with v8.8.7, Notepad++ binaries - including the installer - are digitally signed using a legitimate certificate issued by GlobalSign. As a result, Installation of the Notepad++ root certificate is no longer required. We recommend that users who have previously installed the root certificate remove it.






  • The entire renewal process is fairly cheap, resource wise. 7 day certificates are already a thing.
    In terms of bandwidth you could easily renew a billion certificates a day over a gigabit connection, and in terms of performance I recon even without specialized hardware a single system could keep up with that, though that also depends on the signature algorithms employed in the future of course.

    The dependence on these servers is the far bigger problem I’d say.
    This shortening of lifetimes is a slow change, so I hope there will be solutions before it becomes an issue. Like keeping multiple copies of certificates alive with different providers, so the one in use can silently fall through when one provider stops working. Currently there are too few providers for my taste, that would have to improve for such a system to be viable.

    Maybe one day you’ll select a bundle of 5 certificate services with similar policies for creating your certificate the way you currently select a single one in certbot or acme.sh







  • Steadily improving. I set up my webserver with ech which is the next step, hiding even the domain. A solid chunk of the internet uses cloudflare as an intermediary, which also has ech and only leaves “someone connected to some cloudflare page at this time for that amount of data”.

    As more places roll out deep package inspection, I’m sure in due time more randomization for package sizes will follow, making even the amount of data uncertain.

    Most web metadata is at the http layer anyway and has always been hidden by https.


  • The UK is believed to hold more than £25 billion of Russian financial assets that were seized after the invasion of Ukraine […]
    Belgium holds €190 billion (£165 billion) worth of assets in Euroclear, the Brussels-based central securities depository, and France holds €19 billion (£16 billion).

    […] under a plan being worked up by EU and G7 leaders, countries would issue up to €172 billion (£149 billion) in loans to Ukraine by swapping Russian cash linked to the immobilised assets for zero-interest bonds. Ukraine would have to pay back the loan only if Moscow paid war reparations, which is considered unlikely.

    Instead of directly transferring the assets, they are using them as collateral for loans to strip the legal risk. The result should be indistinguishable as long as russia is eventually sentenced to pay reparations.





  • Yeah, I would expect it to be hard, similar to asking an llm to substitiute all letters e with an a. Which I’m sure they struggle with but manage to perform it too.

    In this context though it’s a bit misleading explaining the observed behavior of op with that though, since it implies it is due to that fundamental nature of llms when in practice all models I have tested fundamentally had the ability.

    It does seem that llms simply don’t use double spaces (or I have not noticed them doing it anywhere yet), but if you trained or just systemprompted them differently they could easily start to. So it isn’t a very stable method for non-ai identification.

    Edit: And of course you’d have to make sure the interfaces also don’t strip double spaces, as was guessed elsewhere. I have not checked other interfaces but would not be surprised either way whether they did or did not. This too thought can’t be overly hard to fix with a few select character conversions even in the worst cases. And clearly at least my interface already managed to do it just fine.



  • This seems to match up with some quick tests I did just now, on the pseudonyminized chatbot interface of duckduckgo.
    chatgpt, llama, and claude all managed to use double spaces themselves, and all but llama managed to tell I was using them too.
    It might well depend on the platform, with the “native” applications for them stripping them on both ends.

    tests

    Mistral seems a bit confused and uses tripple-spaces.