The best articles by Ciro Santilli Updated 2024-12-15 +Created 1970-01-01
View more
These are the best articles ever authored by Ciro Santilli, most of them in the format of Stack Overflow answers.
Ciro posts update about new articles on his Twitter accounts.
A chronological list of all articles is also kept at: Section "Updates".
Some random generally less technical in-tree essays will be present at: Section "Essays by Ciro Santilli".
Read the full article
Hide top bar on Ubuntu Updated 2024-12-15 +Created 1970-01-01
View more
This has annoyed Ciro Santilli for many years, it is just too wasteful of screen space on laptops!
Or likely more generally, on GNOME desktop, which is the default desktop environment as of Ubuntu 22.10.
Read the full article
Silk Road (marketplace) Updated 2024-12-15 +Created 1970-01-01
View more
Ciro Santilli has become slightly obsessed with this story, and the main mastermind Ross Ulbricht.
Figure 1.
Ross Ulbricht's open laptop shortly after his arrest at the Francisco Public Library
. Source. He was running some GNOME based distro, could be Ubuntu from that photo, and likely is given that Ross once recommended Ubuntu to his flatmate.
The best article available so far is: www.theregister.co.uk/2019/01/29/how_i_caught_silk_road_mastermind (archive) which summarizes what one of the investigators said in a 2019 French computer security conference.
The key living posts are:
The big question is of course how libertarian free market ideologically motivated the website was, and how purely criminal greed it was.
The magnitude of the early operational security mistakes does make Ciro think that Ross did it "because he could" and "for the lolz" in a real world Breaking Bad way.
The entry in Ross' diary does resonate a lot with Ciro and any entrepreneur, full diary at: www.wired.com/2015/01/heres-secret-silk-road-journal-laptop-ross-ulbricht/ (archive).
[i]n 2011," [I believe I will be] "creating a year of prosperity and power beyond what I have ever experienced before,
Silk Road is going to become a phenomenon and at least one person will tell me about it, unknowing that I was its creator."
Having this kind of feeling, is the greatest thing any human can have, and what motivates all great things.
Capitalizing in illegal things though is a cheat, big things take longer than a few years to reach, but reaching them is that much more satisfying as well.
Other interesting quotes:
I hated working for someone else and trading my time for money with no investment in myself.
which Ciro also feels, see don't be a pussy, and:
Everyone knows I am working on a bitcoin exchange. I always thought honesty was the best policy and now I didn't know what to do. I should have just told everyone I am a freelance programmer or something, but I had to tell half truths. It felt wrong to lie completely so I tried to tell the truth without revealing the bad part, but now I am in a jam. Everyone knows too much. Dammit.
Also very worth reading is the San Francisco flat mate account: www.vice.com/en_us/article/ae3q8g/my-roommate-the-darknet-drug-lord (archive).
The murder for hire allegations are also interesting: mashable.com/2013/10/03/silk-road-hits, he paid 80k dollars to undercover DEA agents!
Except for the fact that Ross was an 80 million Dollar drug lord, those accounts sound exactly like what you would expect from any other nerdy startup founder! The:
  • "just do it" strategy effectively going to a minimal viable product (manual transaction management!), while making many mistakes along the way, including hiring mistakes and successes when scaling is needed
  • the hardship of self bootstrapping your own social network (here with some kilos of mushrooms)
  • the variety of periods, from relatively calm, to hair pulling stress during big changes
It is also amusing to see very concretely the obvious fact that the FBI can get a subpoena for all accounts you ever had, e.g. they knew his laptop model from Amazon and brought a corresponding power cable to the arrest! If you are going to be a cyber criminal, don't use your real name, ever!
Should justice be blind? Maybe. But it does hurt for mere non-blind men to see it sometimes. Especially when drug liberalization is involved.
Video 1.
One Mistake Took Down a 29-Yr-Old Dark Web Drug Lord by Newsthink (2022)
Source. Wow nice video, covers most of the interesting annecdotes and the (alledged) investigation procedure.
Read the full article
Symmetric encryption Updated 2024-12-15 +Created 2024-10-12
View more
Symmetric encryption is a type of encryption where you use a password (also known as a "key") to encrypt your data, and then the same password to decrypt the data.
For example, this is the type of encryption that is used for encrypting the data in our smartphones and laptops with disk encryption.
This way, if your laptop gets stolen, the thief is not able to see your private photos without knowing your password, even though they are able to read every byte of your disk.
The downside is that that you have to type your password every time you want to login. This leads people to want to use shorter passwords, which in turn are more prone to password cracking.
The other main type of encryption is public-key cryptography.
The advantage of public-key cryptography is that it allows you to send secret messages to other people even an the attacker is able to capture the encrypted messages. This is for example what you want to do when sending a personal message to a friend over the Internet. Such encryption is especially crucial when using wireless communication such as Wi-Fi, where anyone nearby can capture the signals you send and receive, and would be able to read all your data if it weren't encrypted.
Easily sending encrypted messages over the Internet is not possible with symmetric encryption because for your friend to decrypt the message in that system, you'd need to send them the password, which the attacker would also be able to eavesdrop and then decrypt the message that follows using it. The problem of sharing a password with another person online is called key exchange.
Advanced Encryption Standard (AES) is one of the most popular families of symmetric encryption algorithms.
OpenSSL is a popular open source implementation of symmetric and public-key cryptography. A simple example of using OpenSSL for symmetric encryption from the command-line is:
echo 'Hello World!' > message.txt
openssl aes-256-cbc -a -salt -pbkdf2 -in message.txt -out message.txt.enc
This asks for a password, which we set as asdfqwer, and then produces a file message.txt.enc containing garbled text such that:
hd message.txt.enc
contains:
00000000  55 32 46 73 64 47 56 6b  58 31 38 58 48 65 2f 30  |U2FsdGVkX18XHe/0|
00000010  70 56 42 2b 70 45 6c 55  59 38 2b 54 38 7a 4e 34  |pVB+pElUY8+T8zN4|
00000020  4e 37 6d 52 2f 73 6d 4d  62 64 30 3d 0a           |N7mR/smMbd0=.|
0000002d
Then to decrypt:
openssl aes-256-cbc -d -a -pbkdf2 -in message.txt.enc -out message.new.txt
once again asks for your password and given the correct password produces a file message.new.txt containing the original message:
Hello World!
This was tested on Ubuntu 24.04, OpenSSL 3.0.13. See also: How to use OpenSSL to encrypt/decrypt files? on Stack Overflow.
There is no provably secure symmetric-key algorithm besides the one-time pad, which has the serious drawback of requiring the key to be as long as the message. This means that we believe that most encryption algorithms are secure because it is a hugely valuable target and no one has managed to crack them yet. But we don't have a mathematical proof that they are actually secure, so they could in theory be broken by new algorithms one day.
Read the full article