Yarmo - rants

Flipper Zero and their "Limited" pledges

2020-07-31T11:13:30+00:00

The Flipper Zero project</h2>
I'm not going to lie, Flipper Zero sounds like a cool project for hackers. Here's a link to their website</a> which will lead you to their Kickstarter page.

What is going on on Kickstarter?</h2>
Something extremely scummy is going on right now! Have a look:

Looking good, lot's of stuff to read, let's take our time.

My word, they're almost out of Early Birds! Please, for the love of god, if you want to save some money, pledge now, only 9 left and it clearly says "Limited"!
One minute later</h3>

A person has just pledged! Where's my credit card?
Another minute later</h3>

Wait, 9 left? Someone bailed? Doesn't matter, I need this!
Yet another minute later</h3>

Wait, what?
And it goes on</h3>

And on</h3>

This needs to stop</h2>
Well, you get the point. Flipper Zero is having some employee continuously adding more "Limited" pledges to perpetually give the impression they are almost out of "Early Bird" kits.
That's extremely deceptive and manipulative behavior and should not be tolerated. This needs to stop right now.

State of the Keybase.io website

2020-07-03T15:23:38+00:00

Disclaimer</h2>
Two days ago, I launched Keyoxide.org</a> which provides a few similar functions as Keybase.io</a> but in an Open Source package. I've been wanting to write this post for a while but felt it could be perceived as disingenuous if posted before making my own project public. Therefore, I post this now.

The Keybase.io website uses non-optimized resources resulting in a slow pageload and 5+ year old versions of libraries with known and public security vulnerabilities.

The Keybase.io website</h2>
I have opinions about the Keybase service, but this post is not about that. This is about the facts behind their website, Keybase.io</a> and more specifically their encrypt</a> page, the one you use to encrypt private and confidential messages.
When you load that specific page, make sure to load it in a private session or window to eliminate cached resources. What do you notice?
It is slow. Really slow. I noticed so too and decided to run a Webpagetest (link to result)</a>. Out of three runs, we analyze only the median run (so not the best one, not the worst one).

keybase.io/encrypt

The content loaded</h2>
It takes 6.25 seconds to fully load the 2.9 megabytes that are used on this page. That is hefty for a page that is essentially a single form. I mean, look at it:

Why 2.9 megabytes?
That's a regular web form. What could possibly be 2.9 megabytes? The javascript?

How many requests? How many bytes?
Most requests are fonts. That makes sense. Earlier, we saw the page only makes 12 requests, so I could imagine a few of those being several fonts files. Fortunately, fonts are only 6.5% of the bytes loaded, so we'll forgive them.
90 percent of the bytes are due to javascript and images‽ That's 2.6 megabytes for a form! What images?
Javascript and image(s)</h2> Let's grab the waterfall</a> and see what is going on:

Run 1 waterfall
At two points in time, the loading of the website stalls. The first stall is 2.6 seconds for the file sitewide-js.js</code>. The second stall is 2.5 seconds for the file footprints_transp.png</code>. Let's go.
sitewide-js.js</h2> This file is 4.7 megabytes raw and 1.2 megabytes gzipped. Let us look at a random excerpt: Javascript excerpt This is not really optimized for performance: one could choose to minimize the javascript. Allow me to use @node-minify/cli</code>. JS_Parse_Error [SyntaxError]: Unexpected token: name «syms», expected: punc «;»</code> Hmm… Let's remove that one line which simply initializes a variable (only fix I could find). I can no longer guarantee it works but let's assume it does. Old version: 4.7 megabytes raw and 1.2 megabytes gzipped. New version: 2.5 megabytes raw and 0.7 megabytes gzipped. First win! Well, I need to specify one thing: the website loads a gzipped version of the original file at a size of 1.23 megabytes. When I gzip</code> it on my local machine, the original file even becomes 1 megabytes. I don't know what causes this discrepancy, but while we were able to reduce the raw files by 2.2 megabytes, the reduction could only become 0.3 megabytes once gzipped (on my machine™).
footprints_transp.png</h2> Have you found the image yet? It's the little image at the bottom of the dog (?) following footprints. Cute :) Footprints image Dimensions on page: 330 x 90 pixels Dimensions of file: 2836 x 770 pixels That's only 8.6 times larger than it needs to be. The bigger crime is the size: 1.4 megabytes. Which is 50% of the website. You guessed it. This could be better.Using imagecompressor.com</a>, I can compress this full-sized image down to 398 kilobytes (reduction of 71%). And I'm even allowing the full 256 colors. And the dimensions are still 8.6 times larger than they need to be. Optimizing the compression and the image dimensions could yield even better results. I'm not going to bother. The devs didn't either. Still, second win! Anything else we can learn?</h2> The source code contains this: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ K E Y B A S E crypto for everyone because no one we know ever seems to have a public key. :-( No Google Analytics or other 3rd party hosted script tags on Keybase. And this has the added bonus that we'll never be able to serve ad code. \o/ \o/ keybase team ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ </code></pre> I like it when devs get creative. The third paragraph is a bit alienating, but that's my opinion. Anything else? Given that this is all cryptography related, maybe some security related issues? Security</h2> Webpagetest security score I've ran quite a few webpagetests on different website, but a 0 security score is new to me. What does that even mean? Well, it turns out</a> that the entire website is built using the following libraries: jquery v1.11.3 (from april 2015</a>)</li> bootstrap v3.3.5 (from june 2015</a>)</li> moment v2.7.0 (from june 2014</a>)</li> </ul> Besides the obvious aging, these libraries account for a total of six known and public security vulnerabilities, including cross-site scripting</a>, prototype pollution</a> and regular expression denial of service</a>. All six security vulnerabilities have remediations. Let the bootstrap v3.3.5 announcement</a> be a painful reminder: this is pushing it. Wrapping up</h2> This should give a nice overview of what could go wrong with a non-optimized and aging website. This could happen to any website. But this is Keybase, the company that promises "secure messaging and file-sharing". The same company that got $10.8 million in a Serie A funding</a>. The same company that won't allow us to see their server code</a>. To paint a full and fair picture, there has been an audit of the Keybase protocol [PDF]</a> which states that: [...] there were weaknesses in the Keybase implementation; these were quickly fixed. </blockquote> The audit didn't include the website. I'll just end with another quote from the same audit: Another common theme was the presence of legacy code. [...] This does not necessarily imply that legacy code is insecure, but complexity and security are intertwined – every new piece of code may contain a security vulnerability, and more code correlates with more risk. </blockquote>



No to .io, yes to .xyz!
2020-06-18T13:09:19+00:00

TL;DR: I openly urge all FOSS projects and startups to reconsider registering .io ccTLD domains, opting instead for truly generic TLDs like .xyz</p>
</blockquote>
.io</strong> is dead, long live .xyz</strong>!</p>
UPDATE: Long live .xyz, .org, and many other gTLDs! Please see Update 2</a> below.</em></p>
Is that an exaggerated statement? Yes, yes it is. But all new projects (and startups?) should reconsider their choice of TLD.</p>
The case in favor of .io</strong></h2>
The de-facto</em> choice is .io</a>. Numerous startups use it as a way to make their offering more legitimate, due to the long history of it being used by businesses, starting in 1998 with levi.io, registered by Levi Strauss & co</a>. The appeal comes from the shortness of the TLD and, with regards to the high-tech sector, it being the abbreviation for "input/output".</p>
The case against .io</strong></h2>
But it doesn't mean "input/output". It stands for British Indian Ocean Territory</a> as it is indeed a ccTLD (i.e. country-specific) and not a generic gTLD.</p>
Look at the logo on the wikipedia page</a>. Looks techy, right? Everyone knows what the intended use was ("entities connected with British Indian Ocean Territory"), what the actual use is ("startup companies and browser games; little if anything related to the territory itself") and are happy to play along because $$$.</p>
.io</strong> is one of the most expensive TLDs out there (overview on domaincompare.io</a> and no, the irony is not lost on me ^_^). Stating the obvious, this is not due to the British Indian Ocean Territory having become such a hot property over the last decade.</p>
The tech industry has appropriated the .io</strong> ccTLD and everyone is cashing in on it. Everyone?</p>
Colonial history and .io</strong></h2>
In 2014, Gigaom reported in two separate articles (article 1</a>, article 2</a>) what shady practices happen behind the scenes of the .io</strong> TLD management. Afraid of not doing the story any justice with my words, I ask you to read both articles and make up your own opinion on the matter.</p>
The first one describes how the UK gets profits for .io</strong> while denying any claims from the Chagossians, the people native to the Chagos Islands</a> whom they expelled from the islands</a> (a matter which is still actual in 2020!</a>). The second article describes how, in response to the first article, the UK government denied receiving profits and therefore defended that no profits should be shared with the Chagossians.</p>
In january of 2019, The Guardian wrote</a>:</p>

Last February the International Court of Justice (ICJ)</strong></em>, the principal judicial body of the United Nations, issued an advisory opinion that found the UK was in unlawful occupation of the islands</strong></em> and demanded that they be returned to Mauritius as quickly as possible.</p>
The UN general assembly endorsed the opinion</strong></em> in May and set a deadline for implementation of 22 November 2019, which the UK ignored</strong></em>.</p>
</blockquote>
One may not agree with me, but it is my interpretation that, since the Chagossians aren't seeing any profits for the ccTLD that corresponds to the land they lived on but were forcibly removed from, by buying .io domains, one directly supports the still-actual behavior of the UK government defending their colonial history and acts against human rights</strong>.</p>
FOSS and .io</strong></h2>
Why do we make FOSS software? Because we believe in openness and equality. It doesn't matter who you are, you can use my software, you can modify it, you can redistribute it.</p>
Everything that has happened with the Chagossians and the .io</strong> TLD is in stark opposition to the core principles of the FOSS community.</p>
The case in favor of .xyz</h2>
The .xyz TLD</a> is fun, small, refreshing, funky, a whole lot cheaper and you don't support colonialism.</p>
Final words</h2>
If you choose to make your projects FOSS, you choose to uphold and respect certain principles and human rights, such as the Four Essential Freedoms of Free Software</a>.</p>
It is my opinion that buying a .io</strong> TLD domain directly opposes all a FOSS developer stands for.</p>
I openly urge all FOSS projects and startups to reconsider registering .io</strong> ccTLD domains, opting instead for truly generic TLDs like .xyz</strong>.</p>
Disclaimer</h2>
I have bought .io domains in the past. I did not have the knowledge of what was going behind the .io</strong> TLD. Now that I do, I will let them expire and NOT renew them. I will also never buy a ccTLD again if its use exceeds the intended use, namely to represent the territory it is associated with.</p>

Update 1</h2>
There is also the issue of the .io</strong> TLD's future</a>:</p>

But the UK faces significant international pressure over the Islands, and in the event that they are returned, control over the .io TLD would likely pass to the Mauritian government.</p>
</blockquote>
Who knows what will happen to your domain registration when control is passed to the Mauritian government? Why risk the future of your domain just so you can associate your brand and/or product with the words "input/output"?</p>

Update 2</h2>
It has been pointed out by many that this post focuses too much on the .xyz</strong> gTLD. This was not my intention. In fact, any gTLD will do just fine, after all they are generic. A non-exhaustive list of gTLDs that could perfectly replace .io</strong> (assuming .io</strong> simply stands for "input/output"):</p>

.net</li>
.org</li>
.tech</li>
.site</li>
.link</li>
.systems</li>
.computer</li>
</ul>
What is important is that you can identify with the TLD, be it .net</strong> or even .ooo</strong>.</p>
I would also like to point out .io</strong> is not the only ccTLD that is often "misused" (IMO) as a gTLD. Think of .ai</strong>, .tv</strong>, .to</strong> and .ly</strong> to name just a few. The reason I single out .io</strong> is because this one in particular has a lot of controversy around it that has lasted for forty years and is still active. I haven't found the same levels of conflict with the other ccTLDs. If there are, do let me know, I read all links to discussion below.</p>

Yarmo - rants

Flipper Zero and their "Limited" pledges

The Flipper Zero project</h2>
I'm not going to lie, Flipper Zero sounds like a cool project for hackers. Here's a link to their website</a> which will lead you to their Kickstarter page.</p>

One minute later</h3>
</p>
A person has just pledged! Where's my credit card?</p>

Another minute later</h3>
</p>
Wait, 9 left? Someone bailed? Doesn't matter, I need this!</p>

Yet another minute later</h3>
</p>
Wait, what?</p>

And it goes on</h3>
</p>

And on</h3>
</p>

State of the Keybase.io website

No to .io, yes to .xyz!

Yarmo - rants

Flipper Zero and their "Limited" pledges

The Flipper Zero project</h2> I'm not going to lie, Flipper Zero sounds like a cool project for hackers. Here's a link to their website</a> which will lead you to their Kickstarter page.</p>

One minute later</h3> </p> A person has just pledged! Where's my credit card?</p>

Another minute later</h3> </p> Wait, 9 left? Someone bailed? Doesn't matter, I need this!</p>

Yet another minute later</h3> </p> Wait, what?</p>

And it goes on</h3> </p>

And on</h3> </p>

State of the Keybase.io website

Security</h2> Webpagetest security score</em></p> I've ran quite a few webpagetests on different website, but a 0</strong> security score is new to me. What does that even mean?</p>

No to .io, yes to .xyz!

The Flipper Zero project</h2>
I'm not going to lie, Flipper Zero sounds like a cool project for hackers. Here's a link to their website</a> which will lead you to their Kickstarter page.</p>

One minute later</h3>
</p>
A person has just pledged! Where's my credit card?</p>

Another minute later</h3>
</p>
Wait, 9 left? Someone bailed? Doesn't matter, I need this!</p>

Yet another minute later</h3>
</p>
Wait, what?</p>

And it goes on</h3>
</p>

And on</h3>
</p>