#cryptography?

[snailpebbles]

> 0.20330(30) - 14 - 340430(5)0.1033 - (40)013014034 - 340130140(40) - 14034 - 340(30) - 0.30(30)024011041034014024012 × <

[mostlysignssomeportents]

They were warned

Picks and Shovels is a new, standalone technothriller starring Marty Hench, my two-fisted, hard-fighting, tech-scam-busting forensic accountant. You can pre-order it on my latest Kickstarter, which features a brilliant audiobook read by Wil Wheaton.

Truth is provisional! Sometimes, the things we understand to be true about the world change, and stuff we've "always done" has to change, too. There comes a day when the evidence against using radium suppositories is overwhelming, and then you really must dig that radium out of your colon and safely dispose of it:

https://pluralistic.net/2024/09/19/just-stop-putting-that-up-your-ass/#harm-reduction

So it's natural and right that in the world, there will be people who want to revisit the received wisdom and best practices for how we live our lives, regulate our economy, and organize our society. But not a license to simply throw out the systems we rely on. Sure, maybe they're outdated or unnecessary, but maybe not. That's where "Chesterton's Fence" comes in:

Let us say, for the sake of simplicity, a fence or gate erected across a road. The more modern type of reformer goes gaily up to it and says, "I don't see the use of this; let us clear it away." To which the more intelligent type of reformer will do well to answer: "If you don't see the use of it, I certainly won't let you clear it away. Go away and think. Then, when you can come back and tell me that you do see the use of it, I may allow you to destroy it."

https://en.wikipedia.org/wiki/G._K._Chesterton#Chesterton's_fence

In other words, it's not enough to say, "This principle gets in the way of something I want to do, so let's throw it out because I'm pretty sure the inconvenience I'm experiencing is worse than the consequences of doing away with this principle." You need to have a theory of how you will prevent the harms the principle protects us from once you tear it down. That theory can be "the harms are imaginary" so it doesn't matter. Like, if you get rid of all the measures that defend us from hexes placed by evil witches, it's OK to say, "This is safe because evil witches aren't real and neither are hexes."

But you'd better be sure! After all, some preventative measures work so well that no living person has experienced the harms they guard us against. It's easy to mistake these for imaginary or exaggerated. Think of the antivaxers who are ideologically committed to a world in which human beings do not have a shared destiny, meaning that no one has a moral claim over the choices you make. Motivated reasoning lets those people rationalize their way into imagining that measles – a deadly and ferociously contagious disease that was a scourge for millennia until we all but extinguished it – was no big deal:

https://en.wikipedia.org/wiki/Measles:_A_Dangerous_Illness

There's nothing wrong with asking whether longstanding health measures need to be carried on, or whether they can be sunset. But antivaxers' sloppy, reckless reasoning about contagious disease is inexcusable. They were warned, repeatedly, about the mass death and widespread lifelong disability that would follow from their pursuit of an ideological commitment to living as though their decisions have no effect on others. They pressed ahead anyway, inventing ever-more fanciful reasons why health is a purely private matter, and why "public health" was either a myth or a Communist conspiracy:

https://www.conspirituality.net/episodes/brief-vinay-prasad-pick-me-campaign

When RFK Jr kills your kids with measles or permanently disables them with polio, he doesn't get to say "I was just inquiring as to the efficacy of a longstanding measure, as is right and proper." He was told why the vaccine fence was there, and he came up with objectively very stupid reasons why that didn't matter, and then he killed your kids. He was warned.

Fuck that guy.

Or take Bill Clinton. From 1933 until 1999, American banks were regulated under the Glass-Steagall Act, which "structurally separated" them. Under structural separation, a "retail bank" – the bank that holds your savings and mortgage and provides you with a checkbook – could not be "investment bank." That meant it couldn't own or invest in businesses that competed with the businesses its depositors and borrowers ran. It couldn't get into other lines of business, either, like insurance underwriting.

Glass-Steagall was a fence that stood between retail banks and the casino economy. It was there for a fucking great reason: the failure to structurally separate banks allowed them to act like casinos, inflating a giant market bubble that popped on Black Friday in October 1929, kicking off the Great Depression. Congress built the structural separation fence to keep banks from doing it again.

In the 1990s, Bill Clinton agitated for getting rid of Glass-Steagall. He argued that new economic controls would allow the government to prevent another giant bubble and crash. This time, the banks would behave themselves. After all, hadn't they demonstrated their prudence for seven decades?

In fact, they hadn't. Every time banks figured out how to slip out of regulatory constraints they inflated another huge bubble, leading to another massive crash that made the rich obscenely richer and destroyed ordinary savers' lives. Clinton took office just as one of these finance-sector bombs – the S&L Crisis – was detonating. Clinton had no basis – apart from wishful thinking – to believe that deregulating banks would lead to anything but another gigantic crash.

But Clinton let his self interest – in presiding over a sugar-high economic expansion driven by deregulation – overrule his prudence (about the crash that would follow). Sure enough, in the last months of Clinton's presidency, the stock market imploded with the March 2000 dot-bomb. And because Congress learned nothing from the dot-com crash and declined to restore the Glass-Steagall fence, the crash led to another bubble, this time in subprime mortgages, and then, inevitably, we suffered the Great Financial Crisis.

Look: there's no virtue in having bank regulations for the sake of having them. It is conceptually possible for bank regulations to be useless or even harmful. There's nothing wrong with investigating whether the 70-year old Glass-Steagall Act was still needed in 1999. But Clinton was provided with a mountain of evidence about why Glass-Steagall was the only thing standing between Americans and economic chaos, including the evidence of the S&L Crisis, which was still underway when he took office, and he ignored all of them. If you lost everything – your home, your savings, your pension – in the dot-bomb or the Great Financial Crisis, Bill Clinton is to blame. He was warned. he ignored the warnings.

Fuck that guy.

No, seriously, fuck Bill Clinton. Deregulating banks wasn't Clinton's only passion. He also wanted to ban working cryptography. The cornerstone of Clinton's tech policy was the "Clipper Chip," a backdoored encryption chip that, by law, every technology was supposed to use. If Clipper had gone into effect, then cops, spooks, and anyone who could suborn, bribe, or trick a cop or a spook could break into any computer, server, mobile device, or embedded system in America.

When Clinton was told – over and over, in small, easy-to-understand words – that there was no way to make a security system that only worked when "bad guys" tried to break into it, but collapsed immediately if a "good guy" wanted to bypass it. We explained to him – oh, how we explained to him! – that working encryption would be all that stood between your pacemaker's firmware and a malicious update that killed you where you stood; all that stood between your antilock brakes' firmware and a malicious update that sent you careening off a cliff; all that stood between businesses and corporate espionage, all that stood between America and foreign state adversaries wanting to learn its secrets.

In response, Clinton said the same thing that all of his successors in the Crypto Wars have said: NERD HARDER! Just figure it out. Cops need to look at bad guys' phones, so you need to figure out how to make encryption that keeps teenagers safe from sextortionists, but melts away the second a cop tries to unlock a suspect's phone. Take Malcolm Turnbull, the former Australian Prime Minister. When he was told that the laws of mathematics dictated that it was impossible to build selectively effective encryption of the sort he was demanding, he replied, "The laws of mathematics are very commendable but the only law that applies in Australia is the law of Australia":

https://www.eff.org/deeplinks/2017/07/australian-pm-calls-end-end-encryption-ban-says-laws-mathematics-dont-apply-down

Fuck that guy. Fuck Bill Clinton. Fuck a succession of UK Prime Ministers who have repeatedly attempted to ban working encryption. Fuck 'em all. The stakes here are obscenely high. They have been warned, and all they say in response is "NERD HARDER!"

https://pluralistic.net/2023/03/05/theyre-still-trying-to-ban-cryptography/

Now, of course, "crypto means cryptography," but the other crypto – cryptocurrency – deserves a look-in here. Cryptocurrency proponents advocate for a system of deregulated money creation, AKA "wildcat currencies." They say, variously, that central banks are no longer needed; or that we never needed central banks to regulate the money supply. Let's take away that fence. Why not? It's not fit for purpose today, and maybe it never was.

Why do we have central banks? The Fed – which is far from a perfect institution and could use substantial reform or even replacement – was created because the age of wildcat currencies was a nightmare. Wildcat currencies created wild economic swings, massive booms and even bigger busts. Wildcat currencies are the reason that abandoned haunted mansions feature so heavily in the American imagination: American towns and cities were dotted with giant mansions built by financiers who'd grown rich as bubbles expanded, then lost it all after the crash.

Prudent management of the money supply didn't end those booms and busts, but it substantially dampened them, ending the so-called "business cycle" that once terrorized Americans, destroying their towns and livelihoods and wiping out their savings.

It shouldn't surprise us that a new wildcat money sector, flogging "decentralized" cryptocurrencies (that they are nevertheless weirdly anxious to swap for your gross, boring old "fiat" money) has created a series of massive booms and busts, with insiders getting richer and richer, and retail investors losing everything.

If there was ever any doubt about whether wildcat currencies could be made safe by putting them on a blockchain, it is gone. Wildcat currencies are as dangerous today as they were in the 18th and 19th century – only moreso, since this new bad paper relies on the endless consumption of whole rainforests' worth of carbon, endangering not just our economy, but also the habitability of the planet Earth.

And nevertheless, the Trump administration is promising a new crypto golden age (or, ahem, a Gilded Age). And there are plenty of Democrats who continue to throw in with the rotten, corrupt crypto industry, which flushed billions into the 2024 election to bring Trump to office. The result is absolutely going to be more massive bubbles and life-destroying implosions. Fuck those guys. They were warned, and they did it anyway.

Speaking of the climate emergency: greetings from smoky Los Angeles! My city's on fire. This was not an unforeseeable disaster. Malibu is the most on-fire place in the world:

https://longreads.com/2018/12/04/the-case-for-letting-malibu-burn/

Since 1919, the region has been managed on the basis of "total fire suppression." This policy continued long after science showed that this creates "fire debt" in the form of accumulated fuel. The longer you go between fires, the hotter and more destructive those fires become, and the relationship is nonlinear. A 50-year fire isn't 250% more intense than a 20-year fire: it's 50,000% more intense.

Despite this, California has invested peanuts in regular controlled burns, which has created biennial uncontrolled burns – wildfires that cost thousands of times more than any controlled burn.

Speaking of underinvestment: PG&E has spent decades extracting dividends for its investors and bonuses for its execs, while engaging in near-total neglect of maintenance of its high-voltage transmission lines. Even with normal winds, these lines routinely fall down and start blazes.

But we don't have normal winds. The climate emergency has been steadily worsening for decades. LA is just the latest place to be on fire, or under water, or under ice, or baking in wet bulb temperatures. Last week in southern California, we were warned to expect gusts of 120mph.

They were warned. #ExxonKnew: in the early 1970s, Exxon's own scientists warned them that fossil fuel consumption would kick off climate change so drastic that it would endanger human civilzation. Exxon responded by burying the reports and investing in climate denial:

https://exxonknew.org/

They were warned! Warned about fire debt. Warned about transmission lines. Warned about climate change. And specific, named people, who individually had the power to heed these warnings and stave off disaster, ignored the warnings. They didn't make honest mistakes, either: they ignored the warnings because doing so made them extraordinarily, disgustingly rich. They used this money to create dynastic fortunes, and have created entire lineages of ultra-wealthy princelings in $900,000 watches who owe it all to our suffering and impending dooml

Fuck those guys. Fuck 'em all.

We've had so many missed opportunities, chances to make good policy or at least not make bad policy. The enshitternet didn't happen on its own. It was the foreseeable result of choices – again, choices made by named individuals who became very wealthy by ignoring the warnings all around them.

Let's go back to Bill Clinton, because more than anyone else, Clinton presided over some terrible technology regulations. In 1998, Clinton signed the Digital Millennium Copyright Act, a bill championed by Barney Frank (fuck that guy, too). Under Section 1201 of the Digital Millennium Copyright Act, it's a felony, punishable by a five year prison sentence, and a $500,000 fine, to tamper with a "digital lock."

That means that if HP uses a digital lock to prevent you from using third-party ink, it's a literal crime to bypass that lock. Which is why HP ink now costs $10,000/gallon, and why you print your shopping lists with colored water that costs more, ounce for ounce, than the sperm of a Kentucky Derby winner:

https://pluralistic.net/2024/09/30/life-finds-a-way/#ink-stained-wretches

Clinton was warned that DMCA 1201 would soon metastasize into every kind of device – not just the games consoles and DVD players where it was first used, but medical implants, tractors, cars, home appliances – anything you could put a microchip into (Jay Freeman calls this "felony contempt of business-model"):

https://pluralistic.net/2023/07/24/rent-to-pwn/#kitt-is-a-demon

He ignored those warnings and signed the DMCA anyway (fuck that guy). Then, under Bush (fuck that guy), the US Trade Representative went all around the world demanding that America's trading partners adopt versions of this law (fuck that guy). In 2001, the European Parliament capitulated, enacting the EU Copyright Directive, whose Article 6 is a copy-paste of DMCA 1201 (fuck all those people).

Fast forward 20 years, and boy is there a lot of shit with microchips that can be boobytrapped with rent-extracting logic bombs that are illegal to research, describe, or disable.

Like choo-choo trains.

Last year, the Polish hacking group Dragon Sector was contacted by a public sector train company whose Newag trains kept going out of service. The operator suspected that Newag had boobytrapped the trains to punish the train company for getting its maintenance from a third-party contractor. When Dragon Sector investigated, they discovered that Newag had indeed riddled the trains' firmware with boobytraps. Trains that were taken to locations known to have third-party maintenance workshops were immediately bricked (hilariously, this bomb would detonate if trains just passed through stations near to these workshops, which is why another train company had to remove all the GPSes from its trains – they kept slamming to a halt when they approached a station near a third-party workshop). But Newag's logic bombs would brick trains for all kinds of reasons – merely keeping a train stationary for too many days would result in its being bricked. Installing a third-party component in a locomotive would also trigger a bomb, bricking the train.

In their talk at last year's Chaos Communications Congress, the Dragon Sector folks describe how they have been legally terrorized by Newag, which has repeatedly sued them for violating its "intellectual property" by revealing its sleazy, corrupt business practices. They also note that Newag continues to sell lots of trains in Poland, despite the widespread knowledge of its dirty business model, because public train operators are bound by procurement rules, and as long as Newag is the cheapest bidder, they get the contract:

https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure

The laws that let Newag make millions off a nakedly corrupt enterprise – and put the individuals who blew the whistle on it at risk of losing everything – were passed by Members of the European Parliament who were warned that this would happen, and they ignored those warnings, and now it's happening. Fuck those people, every one of 'em.

It's not just European parliamentarians who ignored warnings and did the bidding of the US Trade Representative, enacting laws that banned tampering with digital locks. In 2010, two Canadian Conservative Party ministers in the Stephen Harper government brought forward similar legislation. These ministers, Tony Clement (now a disgraced sex-pest and PPE grifter) and James Moore (today, a sleazeball white-shoe corporate lawyer), held a consultation on this proposal.

6, 138 people wrote in to say, "Don't do this, it will be hugely destructive." 54 respondents wrote in support of it. Clement and Moore threw out the 6,138 opposing comments. Moore explained why: these were the "babyish" responses of "radical extremists." The law passed in 2012.

Last year, the Canadian Parliament passed bills guaranteeing Canadians the Right to Repair and the right to interoperability. But Canadians can't act on either of these laws, because they would have to tamper with a digital lock to do so, and that's illegal, thanks to Tony Clement and James Moore. Who were warned. And who ignored those warnings. Fuck those guys:

https://pluralistic.net/2024/11/15/radical-extremists/#sex-pest

Back in the 1990s, Bill Clinton had a ton of proposals for regulating the internet, but nowhere among those proposals will you find a consumer privacy law. The last time an American president signed a consumer privacy law was 1988, when Reagan signed the Video Privacy Protection Act and ensured that Americans would never have to worry that video-store clerks where telling the newspapers what VHS cassettes they took home.

In the years since, Congress has enacted exactly zero consumer privacy laws. None. This has allowed the out-of-control, unregulated data broker sector to metastasize into a cancer on the American people. This is an industry that fuels stalkers, discriminatory financial and hiring algorithms, and an ad-tech sector that lets advertisers target categories like "teenagers with depression," "seniors with dementia" and "armed service personnel with gambling addictions."

When the people cry out for privacy protections, Congress – and the surveillance industry shills that fund them – say we don't need a privacy law. The market will solve this problem. People are selling their privacy willingly, and it would be an "undue interference in the market" if we took away your "freedom to contract" by barring companies from spying on you after you clicked the "I agree" button.

These people have been repeatedly warned about the severe dangers to the American public – as workers, as citizens, as community members, and as consumers – from the national privacy free-for-all, and have done nothing. Fuck them, every one:

https://pluralistic.net/2023/12/06/privacy-first/#but-not-just-privacy

Now, even a stopped clock is right twice a day, and not every one of Bill Clinton's internet policies was terrible. He had exactly one great policy, and, ironically, that's the one there's the most energy for dismantling. That policy is Section 230 of the Communications Decency Act (a law that was otherwise such a dumpster fire that the courts struck it down). Chances are, you have been systematically misled about the history, use, and language of Section 230, which is wild, because it's exactly 26 words long and fits in a single tweet:

No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

Section 230 was passed because when companies were held liable for their users' speech, they "solved" this problem by just blocking every controversial thing a user said. Without Section 230, there would be no Black Lives Matter, no #MeToo – no online spaces where the powerful were held to account. Meanwhile, rich and powerful people would continue to enjoy online platforms where they and their bootlickers could pump out the most grotesque nonsense imaginable, either because they owned those platforms (ahem, Twitter and Truth Social) or because rich and powerful people can afford the professional advice needed to navigate the content-moderation bureaucracies of large systems.

We know exactly what the internet looks like when platforms are civilly liable for their users' speech: it's an internet where marginalized and powerless people are silenced, and where the people who've got a boot on their throats are the only voices you can hear:

https://www.techdirt.com/2020/06/23/hello-youve-been-referred-here-because-youre-wrong-about-section-230-communications-decency-act/

The evidence for this isn't limited to the era of AOL and Prodigy. In 2018, Trump signed SESTA/FOSTA, a law that held platforms liable for "sex trafficking." Advocates for this law – like Ashton Kutcher, who campaigns against sexual assault unless it involves one of his friends, in which case he petitions the judge for leniency – were warned that it would be used to shut down all consensual sex work online, making sex workers's lives much more dangerous. This warnings were immediately borne out, and they have been repeatedly borne out every month since. Killing CDA 230 for sex work brought back pimping, exposed sex workers to grave threats to their personal safety, and made them much poorer:

https://decriminalizesex.work/advocacy/sesta-fosta/what-is-sesta-fosta/

It also pushed sex trafficking and other nonconsensual sex into privateforums that are much harder for law enforcement to monitor and intervene in, making it that much harder to catch sex traffickers:

https://cdt.org/insights/its-all-downsides-hybrid-fosta-sesta-hinders-law-enforcement-hurts-victims-and-speakers/

This is exactly what SESTA/FOSTA's advocates were warned of. They were warned. They did it anyway. Fuck those people.

Maybe you have a theory about how platforms can be held civilly liable for their users' speech without harming marginalized people in exactly the way that SESTA/FOSTA, it had better amount to more than "platforms are evil monopolists and CDA 230 makes their lives easier." Yes, they're evil monopolists. Yes, 230 makes their lives easier. But without 230, small forums – private message boards, Mastodon servers, Bluesky, etc – couldn't possibly operate.

There's a reason Mark Zuckerberg wants to kill CDA 230, and it's not because he wants to send Facebook to the digital graveyard. Zuck knows that FB can operate in a post-230 world by automating the deletion of all controversial speech, and he knows that small services that might "disrupt" Facebook's hegemony would be immediately extinguished by eliminating 230:

https://www.nbcnews.com/tech/tech-news/zuckerberg-calls-changes-techs-section-230-protections-rcna486

It's depressing to see so many comrades in the fight against Big Tech getting suckered into carrying water for Zuck, demanding the eradication of CDA 230. Please, I beg you: look at the evidence for what happens when you remove that fence. Heed the warnings. Don't be like Bill Clinton, or California fire suppression officials, or James Moore and Tony Clement, or the European Parliament, or the US Trade Rep, or cryptocurrency freaks, or Malcolm Turnbull.

Or Ashton fucking Kutcher.

Because, you know, fuck those guys.

Check out my Kickstarter to pre-order copies of my next novel, Picks and Shovels!

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2025/01/13/wanting-it-badly/#is-not-enough

[galadriel1010]

Hey, cryptographers of Tumblr. If anyone is bored and fancies a challenge, please could you have a go at deciphering this message and tell me how long it takes you? It's for a fic I'm writing, and I need to know if it's realistic for my characters to get the answer late enough for my pacing but quick enough to catch the killer.

[nyancrimew]

Thoughts on Snikket? End to end encrypted XMPP server/client kinda like signal, but decentralized and self hosted with OMEMO encryption instead of signals deal (though apparently OMEMO is based on Signal or something?) and the only E2EE xmpp client with iOS support that I’ve seen

Also doesn’t use a phone number (since it’s self hosted they don’t need to protect against signup abuse and let server admins manage invites) which seems to be the only thing the government can use to know you were using it with all of signals warrants for phone numbers, though I guess it doesn’t matter much since they can’t see your messages either way

ironically the advantage signal has over most other (usually more decentralized) solutions including xmpp is that signal requires (and thus stores) significantly less metadata due to being centralized, a federated system requires metadata for servers to talk to each other and given usually servers only have a small number of users on them each simple traffic analysis between servers can reveal a lot about who might be talking to whom which can be all you need to know. matrix kind of suffers from similar issues where privacy is only really guaranteed if you run a small server that does not federate and only communicate within this same server.

[sylvanas-girlkisser]

Listen to me current and future visitors to Copenhagen:

DO

NOT

Take the intercity train to the airport. I know google maps is telling you to do it, but google is wrong. The train is going to be crowded, and you're going to be stressed about the fact that if you miss that train its going to be an hour before the next one.

Instead you should take the M2.

Take the M2.

The M2 metro line, for Copenhagen Airport.

The M2! The yellow one!

It runs every 5 minutes (every 3 minutes during rush hour).

"Well I don't know how to get to-"

If you have been in Copenhagen, for more than 24 hours, you have been to either Frederiksberg, Nørreport, or Kongens Nytorv.

You wanna guess what departs from all 3 of those stations?

The M2 line, for Copenhagen airport.

No more worrying about missing your train, no more crowding the platforms, no more squinting at the information screens waiting for a me to take pity on you and ask if you need help.

If you are currently on Copenhagen central station, wondering which train goes to the airport:

Go to track 9/10

Take, literally any train

Get off at Nørreport

Take the stairs down, follow the signs.

And

Take

The

M2 LINE, FOR COPENHAGEN AIRPORT

[notbecauseofvictories]

I'm cautiously gearing myself up for a conversation with bff where I tell her that we need to recalibrate our relationship, and....I genuinely don't think I've ever had a serious, emotional conversation with someone I care about before.

I've never been a Conversation Haver; I tend to take the approach that people can't significantly change without meaningful reason, and since I am not and never have been someone's Reason, I cannot prompt change. Therefore, my choices are (a) live with what is; or (b) end/limit the relationship.

But....this is my best friend in the world. I do love her. I just can't keep on as we've been going, where it's less a friendship and more ten minute intervals where I talk about my life, after which the focus switches. I once sat in a bar for two hours waiting for her; afterwards, she asked if I wanted to stay in her hotel room like I didn't have to get up in another 5 hours and drive to work. She texted me during my recent trips, and when I said I was traveling she asked no further questions. Said nothing unless it was about what she was reading, what she was doing. I'm not even sure she realized I was traveling at all, just unavailable to her.

I can give a high-level summary of her PhD thesis. I'm not confident she knows where I work.

Truthfully, part of this is that we simply have different social styles....but still. Coming back from my family trip, I said I was tired and trying to get work straightened out, she should go ahead and plan something for the holiday! I was free! Only for me to text a week later....and promptly have her join me, for my previously standalone plans. Oh, and she asked me to bring my camera, because she wants headshots for her new job.

I still love her very much, but if this is the kind of relationship we're going to have? I need less of it.

[dansemacabre]

are you stuck trying to decode the book of bill but you don’t want the keys handed to you? i was in your shoes literally three days ago! i failed and looked up codes on reddit (because a good grade in book of bill is a normal thing to want and a possible thing to get) but now you don’t have to!! here are some BOOK OF BILL CODEBREAKING HINTS designed to kindly shove you in the right direction!

my credentials are: one summer cryptography class i took in high school, autism, weirdly good pattern recognition (probably because of the autism), and a desperate need to make things make sense. sorry in advance if any of this seems patronizing. hints below the page break!!

general tips:

- A and I will become your bestest friends. like 99 times out of 100 any single letter is a or i. try those out first

- the apostrophe will also become your bestest friend- especially x’x, which will almost always be i’m (except there’s one place in the book where it is not. don’t make my mistakes.)

- themysteryofgravityfalls.com is SO so helpful. for non-symbolic ciphers u can lowkey put in codes and button mash caesar and atbash. godsend. devilsend? idk someone sent it and it’s wonderful

- call every phone number, visit every website. they bought those domains for a reason! i think!

- any list of numbers 1-26 is a1z26. like that’s simply a truth

cipher specific hints now !!!

RUNES (characters taken from norse runes)

- there is a key for this one in the book! maybe u spotted it right away but i did not lol, so look for an instance of 26 rune-y characters!

- the rune code on the inside cover is a graffiti joke- translates to a common thing people write on walls or carve into books made out of brain matter ig

THERAPESE (found in the last few pages during bills court-ordered therapy)

- bill’s picture is labeled in this section, so those characters translate directly to “bill cipher” ! once you have those, you can apply them to other instances of the code and go from there

- the rest of the names of the… things around him on the inpatients page are puns, titles, and/or weird words. they might look wrong until you have Every Character- trust ur key! use the rest of the instances of this code to find the missing letters first, make sense of it and laugh at the clever little joke later

BROSCODE (only two instances, found in journal 3 lost pages)

- the name is a hint by itself- this is stanley and stanford related! both stans use it once somewhere in the book!

NEWBILL (the most common symbolic cipher in the book)

- if you have journal three, the characters are VERY similar to a code there- not the same though, so don’t try and use that key. but like journal three, this code will (almost) always be bill speaking.

- ok lowkey i think the best way to explain this is just to give you one answer. i cracked this by randomly guessing that the small writing by the galaxy drawing on the journal three page “a voice form the past” translates to “forget the past”. go from there my loves

- that being said. everything else from journal three uses the same characters, but a different code. haven’t cracked it yet. looking for advice tee bee haych. i’ll edit this once i find it out

- also: dipper uses this code in his section. that’s pretty helpful to get most of the rest of the characters!

now some page specific hints!:

silly straw page. Oh god

- damn that themysteryofgravityfallsdotcom sure is helpful! Anyway,

- the numbers code is Weird. but the number don’t equal letters. notice the spaces between number groups- pair the groups, try and add a dash somewhere within the first group and a colon somewhere within the second group. you’ll have to use your resources a little

- if that made zero sense: “uhvrxufhv” phdqv brxu idyrulwh ghhsob ohjdo wy vkrz ylhzlqj zhevlwh. ru brxu kxox dffrxqw

- sorry for the vagueness but i really don’t want to spoil this one- i got it spoiled but i think figuring it out on your own would be really rewarding and worth your Time

messages on your tv

- there are strange boxes on the bottom of the page. gonna be so honest don’t know how they mean anything at all to anyone but allegedly it’s a code! i’ll look into it. idk man

okay. i think that’s all i’ve got? please comment if u have questions for me or other folks on here or suggestions on how to sound less like a fucking nerd talking abt this shit. idk i love that people are set on cracking this book asap but i hope this helps ppl who prefer The Thrill Of The Chase and also like to feel smart and important and so very talented

[audliminal]

It's Just a Game, Right? Pt 1 Redux

Masterpost

"It's like. Crazy, y'know?" Bernard's says, voice only a little tinny through Tim’s headset. "Like, when they started posting, I was kind of unimpressed, honestly. I figured it was worth watching the channel, in case the story was interesting, but it wasn’t really worth it for the sake of the actual puzzle-solving. I mean, the first video was just, like, a slideshow of pictures with a handful of Caesar ciphers and some creepy music. That’s practically the platonic ideal of Baby’s First ARG, but now? They're using literally everything! The current drop is like. The simplest part is the spectrogram! And I think it's intentional."

"Isn't it supposed to be intentional? I thought that was like, the whole point of an ARG." Tim smiles despite himself. He can always count on Bernard to distract him from the stress of work; in all the time they’ve known each other, his boyfriend has never been without some curious new obsession, and he’s always happy to ramble in Tim’s ear, while Tim works on whatever.

Right now, Tim is halfway through the tedious process of upgrading the processors in his cowl. The layers of casing and protection alone take forever to remove properly, and the actual components he’s working with are extremely small, so he has to be very careful not to damage or lose them as he works. This means he can’t exactly listen to anything that might fully distract him, but listening to Bernard explain the new ARG taking his internet communities by storm is more than welcome.

"No I mean, like. Yeah, obviously the clues are intentional,” Bernard explains. “But like, the way the difficulty curve is increasing? I don’t think that’s just a thing of convenience, and it’s happening too quickly to feel like it’s them learning about all this stuff. Hell, early on there were all these red herrings and stuff, and basically everybody just sort of wrote them off as a cheap way to increase the difficulty. But the further we get, the more their choices seem intentional. Which doesn’t exactly match with the idea of somebody who’s dropping red herrings to confuse and pull attention away from the actual plot."

"You think they aren’t actually red herrings?"

"What if they aren’t? That would tie in with the whole ‘dig deeper’ thing. Like, if I were making it, I’d be pretty annoyed if people just looked at the immediate surface level clues and ignored everything that didn’t immediately fit together."

"Yeah, telling you to dig deeper, sure makes it sound like they want you, maybe, dig deeper." Tim chuckles, carefully pulling a filter out of place, and adjusting wires, so he can start unscrewing the first processor.

“God, it’s driving me crazy!" Bernard’s voice cracks just a bit, and Tim pauses, gripping the screwdriver tightly. Getting stuck solving a riddle is always annoying, but Bernard sounds more frustrated than he usually is about these sorts of things. Mentally he rolls back over the last few weeks, quickly realizing that they really haven’t spent much time together lately. Both his day and night job have been pretty busy lately, and he knows Bernard gets it – he may not know about his night work, but he knows Tim has a lot on his hands, but Tim also knows Bernard has a bit of a tendency to get a little too into things. It’s one of the many things they have in common; one of the reasons they work so well together.

“Literally every fucking drop,” Bernard continues, oblivious to Tim’s running thoughts. “The same exact words are hidden somewhere in one of the layers! Like it’s low-key become an Easter-egg hunt on the forum! People keep joking about sending prizes to whoever can find it first, whenever anything new drops. Nobody really seems concerned by it, though. I think they all just assumed it was another sort of Red Herring, just one that’s more thematic than actually distracting. Meanwhile I'm literally on the verge of going back to the beginning of the whole thing and solving it from scratch, because I think we're missing a lot." Tim smiles, as Bernard finishes his rant with a huff. It’s not really anything they usually do, but if Bernard is frustrated enough to go back to the beginning, it presents Tim with a bit of an opportunity. And he did finally solve the Stone case the other day, so he actually could take some time away from the nightlife right now.

“Hey, what if we tried to solve it together?” Tim asks, before Bernard can wind up again.

“What, the ARG?”

“Yeah. We haven’t exactly had much time together lately, and I love a good mystery, so why not?”

“Dude,” Bernard says, voice dropping down a register. “Babe. Are you serious? Because I really need you to tell me now if you aren’t serious because I would fucking love to walk you through SARA.”

“Is... that the name of it?”

“Yeah. Actually that’s the other thing. Nobody’s been able to figure out why the channel is named that. And I think you can agree that it would be weird to have the actual name of your channel be irrelevant.”

“How does Friday sound?”

“It’s a fuckin’ date!”

[slack-wise]

Sol LeWitt

[curioscurio]

the edible hit different tonight

[mostlysignssomeportents]

Apple's encryption capitulation

I'm on a 20+ city book tour for my new novel PICKS AND SHOVELS. Catch me in NYC on TOMORROW (26 Feb) with JOHN HODGMAN and at PENN STATE THURSDAY (Feb 27). More tour dates here. Mail-order signed copies from LA's Diesel Books.

The UK government has just ordered Apple to secretly compromise its security for every iOS user in the world. Instead, Apple announced it will disable a vital security feature for every UK user. This is a terrible outcome, but it just might be the best one, given the circumstances:

https://www.bbc.com/news/articles/cgj54eq4vejo

So let's talk about those circumstances. In 2016, Theresa May's Conservative government passed a law called the "Investigative Powers Act," better known as the "Snooper's Charter":

https://www.snooperscharter.co.uk/

This was a hugely controversial law for many reasons, but most prominent was that it allowed British spy agencies to order tech companies to secretly modify their software to facilitate surveillance. This is alarming in several ways. First, it's hard enough to implement an encryption system without making subtle errors that adversaries can exploit.

Tiny mistakes in encryption systems are leveraged by criminals, foreign spies, griefers, and other bad actors to steal money, lock up our businesses and governments with ransomware, take our data, our intimate images, our health records and worse. The world is already awash in cyberweapons that terrible governments and corporations use to target their adversaries, such as the NSO Group malware that the Saudis used to hack Whatsapp, which let them lure Jamal Khashoggi to his death. The stakes couldn't be higher:

https://pluralistic.net/2025/02/04/citizen-lab/#nso-group

Encryption protects everything from the software updates for pacemakers and anti-lock braking to population-scale financial transactions and patient records. Deliberately introducing bugs into these systems to allow spies and cops to "break" encryption when they need to is impossible, which doesn't stop governments from demanding it. Notoriously, when former Australian PM Malcolm Turnbull was told that the laws of mathematics decreed that there is no way to make encryption that only stops bad guys but lets in good guys, he replied "The laws of mathematics are very commendable but the only law that applies in Australia is the law of Australia":

https://www.eff.org/deeplinks/2017/07/australian-pm-calls-end-end-encryption-ban-says-laws-mathematics-dont-apply-down

The risks don't stop with bad actors leveraging new bugs introduced when the "lawful interception" back-doors are inserted. The keys that open these back-doors inevitably circulate widely within spy and police agencies, and eventually – inevitably – they leak. This is called the "keys under doormats" problem: if the police order tech companies to hide the keys to access billions of peoples' data under their doormats, eventually, bad guys will find them there:

https://academic.oup.com/cybersecurity/article/1/1/69/2367066

Again, this isn't a theoretical risk. In 1994, Bill Clinton signed a US law called CALEA that required FBI back-doors for data switches. Most network switches in use today have CALEA back-doors and they have been widely exploited by various bad guys. Most recently, the Chinese military used CALEA backdoors to hack Verizon, AT&T and Lumen:

https://pluralistic.net/2024/10/07/foreseeable-outcomes/#calea

This is the backdrop against which the Snooper's Charter was passed. Parliament stuck its fingers in its ears, covered its eyes, and voted for the damned thing, swearing that it would never result in any of the eminently foreseeable harms they'd been warned of.

Which brings us to today. Two weeks ago, the Washington Post's Joseph Menn broke the story that Apple had received a secret order from the British government, demanding that they install a back-door in the encryption system that protects cloud backups of iOS devices:

https://www.washingtonpost.com/technology/2025/02/07/apple-encryption-backdoor-uk/

Virtually every iOS device in the world regularly backs itself up to Apple's cloud backup service. This is very useful: if your phone or tablet is lost, stolen or damaged, you can recover your backup to a new device in a matter of minutes and get on with your day. It's also very lucrative for Apple, which charges every iOS user a few dollars every month for backup services. The dollar amount here is small, but that sum is multiplied by the very large number of Apple devices, and it rolls in every single month.

Since 2022, Apple has offered its users a feature called "Advanced Data Protection" that employs "end-to-end" encryption (E2EE) for these backups. End-to-end encryption keeps data encrypted between the sender and the receiver, so that the service provider can't see what they're saying to each other. In the case of iCloud backups, this means that while an Apple customer can decrypt their backup data when they access it in the cloud, Apple itself cannot. All Apple can see is that there is an impenetrable blob of user data on one of its servers.

2022 was very late for Apple to have added E2EE to its cloud backups. After all, in 2014, Apple customers suffered a massive iCloud breach when hackers broke into the iCloud backups of hundreds of celebrities, leaking nude photos and other private data, in a breach colloquially called "Celebgate" or "The Fappening":

https://en.wikipedia.org/wiki/2014_celebrity_nude_photo_leak

Apple almost rolled out E2EE for iCloud in 2018, but scrapped the plans after Donald Trump's FBI leaned on them:

https://www.reuters.com/article/world/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sour-idUSKBN1ZK1CO/

Better late than never. For three years, Apple customers' backups have been encrypted, at rest, on Apple's servers, their contents fully opaque to everyone except the devices' owners. Enter His Majesty's Government, clutching the Snooper's Charter. As the eminent cryptographer Matthew Green writes, a secret order to compromise the cloud backups of British users is necessarily a secret order to compromise all users' encrypted backups:

https://blog.cryptographyengineering.com/2025/02/23/three-questions-about-apple-encryption-and-the-u-k/

There's no way to roll out a compromised system in the UK that differs from non-British backups without the legion of reverse-engineers and security analysts noticing that something new is happening in Britain and correctly inferring that Apple has been served with a secret "Technical Capability Notice" under the Snooper's Charter:

Even if you imagine that Apple is only being asked only to target users in the U.K., the company would either need to build this capability globally, or it would need to deploy a new version or “zone”1 for U.K. users that would work differently from the version for, say, U.S. users. From a technical perspective, this would be tantamount to admitting that the U.K.’s version is somehow operationally distinct from the U.S. version. That would invite reverse-engineers to ask very pointed questions and the secret would almost certainly be out.

For Apple, the only winning move was not to play. Rather than breaking the security for its iCloud backups worldwide, it simply promised to turn off all security for backups in the UK. If they go through with it, every British iOS user – doctors, lawyers, small and large business, and individuals – will be exposed to incalculable risk from spies and criminals, both organized and petty.

For Green, this is Apple making the best of an impossible conundrum. Apple does have a long and proud history of standing up to governmental demands to compromise its users. Most notably, the FBI ordered Apple to push an encryption-removing update to its phones in 2016, to help it gain access to a device recovered from the bodies of the San Bernardino shooters:

https://www.eff.org/deeplinks/2016/02/eff-support-apple-encryption-battle

But it's worth zooming out here for a moment and considering all the things that led up to Apple facing this demand. By design, Apple's iOS platform blocks users from installing software unless Apple approves it and lists it in the App Store. Apple uses legal protections (such as Section 1201 of the US Digital Millennium Copyright Act and Article 6 of the EUCD, which the UK adopted in 2003 through the Copyright and Related Rights Regulations) to make it a jailable offense to reverse-engineer and bypass these blocks. They also devote substantial technical effort to preventing third parties from reverse-engineering its software and hardware locks. Installing software forbidden by Apple on your own iPhone is thus both illegal and very, very hard.

This means that if Apple removes an app from its App Store, its customers can no longer get that app. When Apple launched this system, they were warned – by the same cohort of experts who warned the UK government about the risks of the Snooper's Charter – that it would turn into an attractive nuisance. If a corporation has the power to compromise billions of users' devices, governments will inevitably order that corporation to do so.

Which is exactly what happened. Apple has already removed all working privacy tools for its Chinese users, purging the Chinese App Store of secure VPN apps, compromising its Chinese cloud backups, and downgrading its Airdrop file-transfer software to help the Chinese state crack down on protesters:

https://pluralistic.net/2022/11/11/foreseeable-consequences/#airdropped

These are the absolutely foreseeable – and foreseen – outcomes of Apple arrogating total remote control over its customers' devices to itself. If we're going to fault Theresa May's Conservatives for refusing to heed the warnings of the risks introduced by the Snooper's Charter, we should be every bit as critical of Apple for chasing profits at the expense of billions of its customers in the face of warnings that its "curated computing" model would inevitably give rise to the Snooper's Charter and laws like it.

As Pavel Chekov famously wrote: "a phaser on the bridge in act one will always go off by act three." Apple set itself up with the power to override its customers' decisions about the devices it sells them, and then that power was abused in a hundred ways, large and small:

https://pluralistic.net/2023/09/22/vin-locking/#thought-differently

Of course, there are plenty of third-party apps in the App Store that allow you to make an end-to-end encrypted backup to non-Apple cloud servers, and Apple's onerous App Store payment policies mean that they get to cream off 30% of every dollar you spend with its rivals:

https://www.reddit.com/r/privacy/comments/1iv072y/endtoend_encrypted_alternative_to_icloud_drive/

It's entirely possible to find an end-to-end encrypted backup provider that has no presence in the UK and can tell the UK government to fuck off with its ridiculous back-door demands. For example, Signal has repeatedly promised to pull its personnel and assets out of the UK before it would compromise its encryption:

https://pluralistic.net/2023/03/05/theyre-still-trying-to-ban-cryptography/

But even if the company that provides your backup is impervious to pressure from HMG, Apple isn't. Apple has the absolute, unchallenged power to decide which apps are in its App Store. Apple has a long history of nuking privacy-preserving and privacy-enhancing apps from its App Store in response to complaints, even petty ones from rival companies like Meta:

https://www.theverge.com/2022/9/29/23378541/the-og-app-instagram-clone-pulled-from-app-store

If they're going to cave into Zuck's demand to facilitate spying on Instagram users, do we really think they'll resist Kier Starmer's demands to remove Signal – and any other app that stands up to the Snooper's Charter – from the App Store?

It goes without saying that the "bad guys" the UK government claims it wants to target will be able to communicate in secret no matter what Apple does here. They can just use an Android phone and sideload a secure messaging app, or register an iPhone in Ireland or any other country and bring it to the UK. The only people who will be harmed by the combination of the British government's reckless disregard for security, and Apple's designs that trade the security of its users for the security of its shareholders are millions of law-abiding Britons, whose most sensitive data will be up for grabs by anyone who hacks their accounts.

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2025/02/25/sneak-and-peek/#pavel-chekov

Image: Mitch Barrie (modified) https://commons.wikimedia.org/wiki/File:Daytona_Skeleton_AR-15_completed_rifle_%2817551907724%29.jpg

CC BY-SA 2.0 https://creativecommons.org/licenses/by-sa/2.0/deed.en

--

Kambanji https://www.flickr.com/photos/kambanji/4135216486/

CC BY 2.0 https://creativecommons.org/licenses/by/2.0/

--

Rawpixel https://www.rawpixel.com/image/12438797/png-white-background

[upennmanuscripts]

LJS 51 is a 15th century collection of encrypted correspondence between the compiler and various correspondents. It is written using approximately 150 invented alphabets, accompanied by transcriptions of the letters in Arabic.

🔗:

[aviul]

hand to mouth

[angelofdumpsterfires]

BILL'S CONTRACT FINE PRINT DECIPHERED

I'm sure someone has beat me to this, but because I decided to decipher/translate all 1000ish words of the fine print on this here totally normal contract (by hand)

Bold code is theraprism substitution cipher, the rest is the author's substitution cipher, i've reformatted the text to be more readable but i've also made a version with the more accurate, original line formatting here

YOU ARE NOW TWENTY ONE GRAMS LIGHTER

THIS CONTRACT IS LEGAL AND BINDING, WE RESERVE THE RIGHT TO USE YOUR LIKENESS, FACE, VOICE AND SMALL TOWN PLUCK IN WHATEVER NEFARIOUS MANNER IS DEEMED NECESSARY.

SANS SOUL YOUR SOULMATE WILL NOT RECOGNIZE YOU AND WILL WALK RIGHT PAST YOU ON A COLD AUTUMN DAY, NEVER MAKING EYE CONTACT, NOT EVEN PROCESSING THAT YOU HAVE EYES AT ALL. NO AMOUNT INTERACTION WILL MOVE THEM TO A PLACE WHERE THEY CAN REMEMBER - IN FEELING THE THOUSANDS OF LIFETIMES YOU HAVE ALREADY SPENT TOGETHER, EACH TIME CHOOSING WHATEVER FORM WOULD KEEP YOU CLOSEST LIKE OTTERS HOLDING HANDS IN A TUMULTUOUS RIVER. YOU WERE BIRDS, YOU WERE TREES WITH ROOTS ENTWINED, DRINKING IN THE SUNLIGHT TOGETHER. WHEREVER WE GO NEXT, WHATEVER YOU CHOOSE, I WILL ALWAYS BE RIGHT THERE WITH YOU. -

THATS DONE BUDDY, CONGRATULATIONS YOU HAVE CHOSEN BILL INSTEAD.

MCDONALDS RESERVES THE RIGHT TO PUT A GIANT YELLOW M ON YOUR TORSO AND FOREHEAD AND SEND YOU WALKING THROUGH A CROWDED TIMES SQUARE WHILE YOU SCREAM “THE FRIES, THE FRIES, THEY DON'T DEGRADE IN NATURE… ITS AN IMMORTAL FOOD… THEY WILL BE IN THE LANDFILLS LONG PAST OUR DEATHS.”

GOOD GOD, THE THINGS S I’VE SEEN, ME. WHO AM I? OH BILL'S PREVIOUS LAWYER, HE PUT MY SOUL INTO A QUILL PEN SO I CAN WRITE HIS LEGAL DOCUMENTS UNTIL THE SUN SNUFFS OUT LIKE A CANDLE IN THIS SICK UNIVERSE. I USED TO BE SO HOT. I WAS SO FINE. NOW I'M FINE PRINT.

SPEAKING OF WHICH, BILL RESERVES THE RIGHT TO PUT YOUR SOUL INTO AN INANIMATE OBJECT, A STRANGE CREATURE, A CONCEPT, A SENTENCE, A TASTEFUL BUT RUSTIC MASON JAR WITH WILDFLOWERS IN IT.

IF AT ANY POINT YOU WISH TO HAVE VISITATION RIGHTS WITH YOUR SOUL YOU WILL BE SWIFTLY DENIED UNLESS YOU HAD A COOL DAY PLANNED FOR THE BOTH OF YOU, THEN BILL MIGHT COME ALONG.

BY SIGNING THIS DOCUMENT YOU FORFEIT ANY RIGHTS TO EATING SOUL FOOD, IT WILL TURN TO ASH IN YOUR MOUTH, A FITTING PUNISHMENT FOR A FOOL WHO SQUANDERED THE ONLY TRUE GIFT LIFE OWES YOU.

BILL RESERVES THE RIGHT TO DRESS YOUR SOUL HOWEVER HE DEEMS NECESSARY, ESPECIALLY IF YOUR SOUL WAS A NERD BEFORE ACQUISITION, SOUL MAKEOVERRR!

YOUR SOUL MAY BECOME FRACTURED AND PLACED INTO DIFFERENT OBJECTS. THIS HAS NO PURPOSE AND WILL NOT RESURRECT YOU WHEN YOU DIE.

SIGNEE HAS FORFEITED ALL RIGHTS OF ANY AFTERLIFE INCLUDING BUT NOT LIMITED TO: HEAVEN, HELL, PURGATORY, BIG CORNER, FLOW STATE, THE DREAM HOUSE, THE REINCARNATION PROCESSING CENTER, AXOLOTL'S TANK AND CONSEQUENCES HOLE.

SIGNEE CAN NO LONGER BOARD THE SOUL TRAIN AND IS ADVISED TO DISCARD ALL BELLBOTTOMS.

SIGNEE CAN NO LONGER HAVE A PUPPY AS A BEST FRIEND, THEY CAN SENSE WHAT IS GONE. CATS ARE INDIFFERENT.

SIGNEE MAY EXPERIENCE OCCASIONAL DEMON POSSESSION FROM HORCULUS THE RED, PLABOS THE MERCILESS, MORBUS SON OF MORTEM, PLAGA THE OOZING AND OTHER SUCH COMMON DEMONS ROAMING EARTH SEARCHING FOR WEAKENED/EMPTY VESSELS.

TIPS FOR RIPPING YOUR SOUL OUT: WATCHING YOUTUBE COMMENTARY CHANNELS, ATTENDING AN EXTENDED FAMILY EVENT WITH AN OPEN BAR, USING GENERATIVE AI AND ASSERTING THAT YOU ARE CREATIVE, TURNING A BLIND EYE TO HUMAN SUFFERING, AMASSING MORE WEALTH THAN NEEDED, PURCHASING A BLUE CHECKMARK.

[renegade-hierophant]

Branch Runes

Cipher:

left branches of the tree stand for the row

right branches of the tree stand for the column