I've said this elsewhere, but I'm trying to help, not spam!
Please make sure to report evidence of blocking to PIA support, they do have some solutions available. Worst case, it gives them evidence that it's time to rotate IPs.
I would be very interested to know what you think a VPN provider could do to assure users that the servers are safe.
I've yet to see an example verifiable safe server configuration, but some people have claimed that SGX might do. I'm pretty sure that wouldn't work with stock OpenVPN or StrongSWAN today.
Are there any other practices they could adopt that would ease your worries?
This is actually less insane than it sounds. Most VPN providers rent space at traditional datacenter providers like Equanix. Search for "dedicated server hosting" and "colocation providers" for the exact same list of vendors that the VPN companies consider.
Please make sure to report that to PIA support, they do have some solutions available. Worst case, it gives them evidence that it's time to rotate IPs.
Very true! Unfortunately, your RPi is going to have only one user in responsible for traffic. Commercial VPN providers act as a multiplexer to hide who is responsible for what traffic. Ideally you'd have at least a Type III anonymous remailer mixing your traffic, but then you're dealing with much higher latency. As with everything, there is a compromise between the effort required to break a security system, the ease of detecting such a break, and the burden of using the system.
I'm not sure what point you're making about colo and transit costs. Are you saying that operating your own has higher costs? Or that a commercial VPN provider has higher costs? I'd be very interested in a price analysis that beats PIA while offering a remotely similar security profile. Keeping an RPi at your house provides defense against totally different threats.
I've set up scripts to convert an existing virtualbox/vagrant .box file to a vmware compatible OVF. I would use those to deliver to clients at my last employer. I know github is doing a similar process. Additionally there's mccloud, which lets you deploy to aws. If you need help getting any of these set up, let me know.
You should know that people have been trying reputation-style digital currencies since at least the early nineties. They require a ton of bootstrapping to get anywhere. That's because you end up with a trading system that's looks like a foreign exchange market with 7 billion different floating currencies. And that's assuming only individuals have them, excluding corporations. You'll notice old cypherpunks have a lot of skepticism toward the fiat-currency arguments against bitcoin. We've been trying to make fiat-currencies work. Keeping the rep net up to date is at least as expensive as mining bitcoins, but with none of the hard-crypto backing to the algorithms. And it's way more opaque. That's ideal if you're trying to soften shocks across a national economy. It's less ideal if you've got more self-serving interests than eyes.
Bitcoin isn't perfect. But we can test it, and if it breaks, we'll see quickly. Broken rep-net economies are like building markets on pyramid schemes: people have an incentive to pretend it still works until the damage is orders of magnitude larger than the economy proper.
And I encourage you to investigate what fractional reserve banking looked like in the days of specie-backed-currency. Banks still made loans and kept less than the entire value of their demand accounts on hand. It'll be weird, but there will be an M2 and an M1 in bitcoin, we aren't technically limited to an M0 money supply.
We thought so too! But then we realized that if you're going to download and install a miner, you probably want one that's actually fast. Browser plugins, which are almost all javascript these days, are basically the worst of both worlds from that perspective: slow and require manual installation.
Fortunately, that's not actually true. If the community agrees when the last valid block is, all the transactions before that will be accepted as trustworthy. The DHT (now moving to freenet) ensures that this transaction history is reliable up to the date of the exploit. Then it's just a social problem of converting into a less flawed system.
But social problems tend not to end up as near the worst case as is often feared. What you're describing is like saying that if we break the crypto underlying git repositories, you can trick the world into thinking you are the original author of linux. Obviously, no one would fall for that. But every git commit after the exploit, or from sources lacking a large consensus, would be of suspect authorship. It's a big problem, but not exactly the way you imply.
I'm one of the developers of bitp.it. We're still working on an opt-out cookie, but for now we encourage you to use adblock. I'll be throwing a howto up later this afternoon.
Not exactly. If you look a bit closer, you'll see that this isn't just a strict child, otherwise they might have managed by swapping a foreign key or something.
In a graph db, you'd still have to reconnect dangling edges that no longer make sense, like for comments and users. Also, the transaction rollback issue.
Which is to say: tanstaafl.
Way to build a short and beautiful step path to the land of Not Invented Here. It's one think not to write a tutorial to using one of the well supported OAuth gems. But you didn't actually commit to helping people either. If (and when) someone finds a bug in your implementation, they won't be able to fix it with a gem update, they'll just have to return to your gist for the lifetime of their app.
On the other hand, you've done a beautiful job at showing how simple OAuth can be. If I ever want to write a twitter client in Io or something, I'll definitely be ripping off your (apparently still copyrighted) code to do it.