Marc Bevand

We are at 2 TX/sec because, well, people simply don't transact more than that. Bitcoin CAN support a much higher transaction rate with ZERO increase in mining resources. All we need is (1) more transactions and (2) a block size increase. Let it be clear: the only "dumb" thing is not the system itself, but Bitcoin developers who have not yet agreed on increasing the block size. Secondly, seeing the mining resources as spent only validating transactions is failing to see the whole picture. Miners sustain a system that is already a net benefit to the economy. Venture capitalists invested more than $1 billion into at least 729 Bitcoin companies which created thousands of jobs. Is all this worth the 150+ megawatt of (practically all) clean energy used by miners? Hell yes! This argument (and others) is explained in detail in: http://blog.zorinaq.com/?e=82

Microsoft has been shipping steaming crapola for decades. Their unwieldy and unmaintainable codebase is their own fault. This should not be news to anyone who is unfortunate enough to have to use their awful products. They sought to dominate the market by means other than having the best talent and shipping the best software. It worked but now they have a problem. And who can forget this? http://blog.zorinaq.com/?e=74 Developers developers developers. Any vulns I find will not be dealt with in such a charitable manner. (i.e. you have exactly zero days to fix your shit). Why on Earth are Google wasting their own resources doing Microsoft's work for them? Tiny, tiny violins, Microsoft. Tiny, tiny violins.

I've said that before about the NSA taking over 51% of the network. Unfortunately it seems I was wrong. User mrb gives useful information in this post (https://news.ycombinator.com/item?id=5330343), linking to (http://blog.zorinaq.com/?e=14) Someone somewhere linked to a bitcoin information page showing how much computing power is in the blockchain, and it's an amazing amount. More than all the top500 combined. (But remembering that we're comparing non-similar computing units.)

Reminds me of the 'I contribute to the windows kernel. We are slower than other operating systems.' article: http://blog.zorinaq.com/?e=74 "Another reason for the quality gap is that that we've been having trouble keeping talented people. Google and other large Seattle-area companies keep poaching our best, most experienced developers, and we hire youths straight from college to replace them. You find SDEs and SDE IIs maintaining hugely import systems. These developers mean well and are usually adequately intelligent, but they don't understand why certain decisions were made, don't have a thorough understanding of the intricate details of how their systems work, and most importantly, don't want to change anything that already works. These junior developers also have a tendency to make improvements to the system by implementing brand-new features instead of improving old ones. Look at recent Microsoft releases: we don't fix old features, but accrete new ones. New features help much more at review time than improvements to old ones. (That's literally the explanation for PowerShell. Many of us wanted to improve cmd.exe, but couldn't.)"

> The problem comes when we are so focused on proven stuff... I sympathize with your overall point, but there's a really good reason why the focus should be on proven stuff: because it's been proven. You are building an application which will be responsible for safeguarding some of its users' information. You should typically want to do that using a proven approach. If nothing else, it's a cover-your-ass situation: if it turns out that the proven approach has a flaw, you can at least say that you followed standard practices. If your invention has a flaw, you hold all the responsibility. I hate to fall back to argument-by-analogy (but I have to, since I'm not a cryptographer), but you're somewhat in the situation of installing a fire suppression system for someone, and you're saying, "Well, I don't want to use halon for this, even though it's what all the experts say I should use, because I don't want to deal with the company selling the halon equipment. So let's just use lots and lots of kitchen fire extinguishers instead. They do the same job, and if I use lots of them, it will work just as well." Maybe. Maybe it will. But, if it doesn't, you will be responsible for having made a decision that flies in the face of lots of advice from lots of very smart people, and the consequences of that decision will affect not just you but also anyone that uses your system. edit: On the more technical side of things, maybe nobody has yet pointed you to Bruce Schneier's 2005 article…

No more because of things like http://blog.zorinaq.com/bitcoin-electricity-consumption/ It's a long read to go over multiple years worth of posts and comments but gives you a measure of the man.

> like at https://blog.zorinaq.com 2013, Bitcoin hits $1k: https://blog.zorinaq.com/1-bitcoin-1000-us-dollars/ "Sure a crash that would bring it back down to below $1,000 is possible or likely, but it would not change its long-term prospect, a few years from now, from being valued between $5,000 and $50,000 and possibly more." from then, 4 years to $5k, 8 years to $50k.

This is actually a pretty common tactic among Internet censors. The Chinese have been using this for a few years; whenever it detected an unknown protocol that looked like tunneling or VPN, it just throttles it (introducing high packet loss) without necessarily completely cutting off the connection. Here's someone's experience: http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china…

> It is the only VPN that I am aware of that works out of the box with softether. I have not tried it yet. I currently use Astrill. Astrill is not cheap but works pretty well to circumvent censorship. A disadvantage of Astrill is that it often leaks DNS like a motherf.... Should also keep in mind a few years ago Astril was using weak keys like ExpressVPN. That really makes me wonder what they know about running VPN servers. I think you only get one chance with your reputation on things like this. http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china…

I know this is only tangentially related, but could you verify the famous HN post by an anonymous Windows kernel developer explaining why Windows is so much slower than Linux http://blog.zorinaq.com/i-contribute-to-the-windows-kernel-we-are-slow… It's one of the most insightful posts I've seen on this site, and if true, would certainly help to explain why Windows is so much worse than other operating systems :)

I am genuinely interested in rebuttals of bitcoin. The second section is where I stopped reading, calling it a crime against humanity due to power use. It trots out the same piece of work from digiconomist to claim it uses a countries worth, of coal-fired power station generated, electricity to run the network. A claim that has been questioned and IMO debunked rather thoroughly [0] or more recently here [1] [0] http://blog.zorinaq.com/serious-faults-in-beci/ [1] https://hackernoon.com/the-reports-of-bitcoin-environmental-damage-are…

They can definitely detect it: http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china…

For a long while shadowsocks/shadowsocksr (the latter being more actively developed) has been preferred way to bypass the GFW although what works is constantly changing. This was an interesting write up passed a couple years ago where a dev tries out various methods for bypass on a China trip: http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china…

It's worth noting that this Bitcoin Energy Consumption Index (BECI) is not without controversy. A more detailed analysis is this one: http://blog.zorinaq.com/bitcoin-electricity-consumption/ and the author of that has specific criticisms of the BECI calculation: http://blog.zorinaq.com/serious-faults-in-beci/

It's possible to detect even if the packets can't be decrypted (there are commercially available solutions for corporate firewalls as well). This post gives some interesting insight into some of their blocking capabilities.[1] [1] http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china…

It’s pretty sophisticated at detecting tunnels, but presumably still possible to evade. This post was on HN recently: http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china…

Yes, deep packet inspection with ML, read for example here [1] [1] http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china…

This is just false. China has a massive censorship operation, of which their wry advanced anti firewall technology is a critical piece. Start here: http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china…

The GFW is apparently quite sophisticated[1] and likely uses machine learning among other things such as TLS side channel attacks. [1] http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china…

You can get around the statistical analysis by randomly padding small packets: http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china…

Put simply, AFAIU, it's the pattern of TCP packet sizes. OpenVPN, for example, has a very recognizable handshake that makes it prone to detection. This post goes into some of the network-level details (not OpenVPN-specific): http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china

Dont know the situation now, but this was posted some time back : http://blog.zorinaq.com/?e=74

Hey mrb, I miss your blog posts. (For those curious: http://blog.zorinaq.com/ )

It may not be a process & quality question, but simply staffing with very highly experienced and smart people. Some analyze that the Windows kernel has that problem[1]. [1] http://blog.zorinaq.com/?e=74

You do realize that cracking unsalted SHA1 passwords isn't that hard, right? Perhaps you should educate yourself on the wonderful world of GPU password cracking and the enormous speeds a handful of consumer-grade video cards working in concert can utterly smash through a database like this. edit: Here's a blog post about being able to brute force 33.1 billion MD5 hashes a second using GPU's: http://blog.zorinaq.com/?e=43

> To be fair the DEK-Info IV should be different for each key generated, so rainbow tables and other common precomputation attacks are pretty much out of the question. That's valid; however, when you can compute 33.1B MD5 hashes a second, who needs rainbow tables? http://blog.zorinaq.com/?e=43 Six and seven digit passphrases are easily brute-forced.

> You're looking at more like 5+ billion/sec today. Sounds about right http://blog.zorinaq.com/?e=43 And a few times more if it's md5.

The original kernel from which Windows evolved was written in assembler by Dave Cutler for the VAX architecture. After his DECWest team was hired by Microsoft, they reimplemented it in C. The MIPS architecture was the first fully complete port, I believe. This is documented in Zachary's Showstoppers book: https://www.flyingpigbooks.com/book/9780759285781 It appears that performance and architecture improvements are very hard to get accepted (and the kernel suffers for it): https://blog.zorinaq.com/i-contribute-to-the-windows-kernel-we-are-slo… It is a great piece of engineering, but it is likely for a developer that is more comfortable making small changes within the hierarchy than for any revolutionary ideas (unfortunately). If Cutler hadn't found his way to Microsoft, then they probably would have ended up on a BSD kernel, as Apple did. As it was, Microsoft sold their Xenix business around the time of Cutler's arrival.

Yet you can do a few simple thought experiments. What would those fast-dev do in a vacuum? Or with only clone of themselves coworkers. What happens when one of those fast-dev quit? -- If everything is/would be fine, then yes, they are truly rockstars (in all the good meanings of that word and none of the bad). Or maybe merely decent among mediocre ones. Otherwise, there is a free-rider aspect in their approach. -- Also it can work only depending on the criticality level of the industry. Ship broken crap quickly (but fix it quickly too)? Good if you are creating yet another social website maybe. Less good for e.g. medical devices. -- One more point: the business value approach is not necessarily the only one to apply esp. if there are tech infrastructure components in what you ship. You can easily be stuck in local optimums too far from global ones, and fossilize some aspects of your product. See for example the classical http://blog.zorinaq.com/i-contribute-to-the-windows-kernel-we-are-slow… that includes some example of death by thousands cut. What I mean is that moving fast is partly in the eye of the evaluator. Maybe you implement what PM wants quickly, and that's cool, but maybe also doing only what PM wants is not the best thing for the project. -- If you are easily able to plan things, have a good data model, and can develop quickly, probably you don't have a real code quality problem to begin with. At least not in the parts you…

Wow, I see. I must admit, I do very much wonder what kind of environment Microsoft would be if teams were less segregated. I found http://blog.zorinaq.com/i-contribute-to-the-windows-kernel-we-are-slow… in the comments, which seems to hint at the same sort of theme somewhat - particularly the bit about contributing to teams other than your own. There's a strong notion of isolation. This is just thinking out loud, a response is not required. Everywhere has pros and cons. I'm (even with all this moping) actually less hesitant about MS as a whole than the rest of FAANG (except for N, which I also don't see a problem with) - not because of the whole "new MS" thing, or GH, but because everyone else seems to have fewer scruples than I consider to be a viable baseline. So there's that. :) It's just kind of sad to see these kinds of inefficiencies, and it would be cool to eliminate them. Of course, it'd unleash organizational chaos for a while, but of course it would be totally worth it.