← Back to context

Comment by dontbenebby

3 years ago

This is very cool OP! I interviewed to be a privacy engineer with Wikimedia a while back.

I suggested that my goal would be to add a v3 onion service. They actually had listed years of "homomorphic encryption" as a requirement. I phoned up the recruiter and basically said it's ok if there is a personality conflict, but the role as written was impossible to fill, and it scared me that very good suggestions for privacy as well as the health of the Tor network were discarded.

(If you set up a dot onion, that frees up traffic on exit nodes, whose capacity are limited.)

Big thanks to the OP for being willing to share this work, it's very cool and I'm about to read your eprint.

I'm excited about the potential of homomorphic encryption, though I worry about things like CPU cost -- I recall when folks had to really be nudged not to encrypt huge blocks of data with PGP, but instead use it to encrypt the passphrase to a Truecrypt volume using a symmetric cipher like AES.

(I'd love how to know we got to a point Twitter added an onion service then banned me, but Wikipedia continues to not even support MFA for logins -- I recently registered an account intending to eventually upload some art to the commons, but the perpetual refusal to allow folks to make healthy choices disturbs me.

In fact, after reading articles like these ones[1][2], it makes me question the integrity of the folks I interacted with during the interview process.

On my end, it was especially disturbing since prior to enrolling in my PhD, the alternative path I discussed was becoming an FBI agent focused on counter intelligence in the "cyber" realm.

The agent I spoke with told me I'd serve "at the needs of the bureau", so that would mean probably not using my computer skills, which would then languish, then after a couple years I might still not get my desired position, and gave me a card, which I eventually lost.

Years later, prior to the insurrection, I had to walk down to Carnegie Mellon and ask if anyone had his contact information, and was shocked that folks refused to even point me at a link to the lecture, which had been listed as open to the public.

I'm someone who reads Wikipedia, not really edits, but the vast majority of users are readers not editors, and this perpetual pattern of refusing to enable privacy enhancing technologies, paired with using privileges access to make hiring decisions against folks who lack the physical ability to make good privacy decisions offended me on a deep, personal level, and is why I often post in brash, erratic manner.

Because I see zero incentive to stay silent -- if I'm quiet, people will slowly drain my bank account.

If I post, there is a chance someone will see what I say, notice my skills, and offer full time employment. So I have to continue risking offending folks until I find a full time job, which I have not had since I left the Center for Democracy and Technology under duress following a series of electronic and physical attacks, paired with threats and harassment by staffers in the organization.

TL;DR: Great research, but I hope they also add an onion service rather than jump straight to using this :-)

[1] https://lists.wikimedia.org/hyperkitty/list/wikimedia-l@list...

[2] https://slate.com/technology/2021/10/wikipedia-mainland-chin...

I tried, but I simply can't follow your train of thought. You keep going back and forth between criticizing Wikimedia hiring and technology choices, advertising yourself, and deliberating over onion services. And it all seems extremely tangential to the article (which is really not about the future of Wikipedia, or Tor, or your career).

  • My bad!

    I worry they have insider threat issues that remain unsolved.

    I hope they add an onion service.

    I think the tech is cool, but issues about untested code aside, I worry about CPU overhead.

    (However, on the last point, I suspect much like when we worried about CPU overhead,

    I often feel like I have to speak exhaustively and at length to get my point across, but that may be a side effect of a large chunk of my professional network being K Streeters - they like to misunderstand on purpose then complain you explained things at length.

    Is the above better? I can skip marketing myself if that's the issue - I just notice a persistent issue that folks say they need certain skills, I know I have them, but folks disbelieve me. Short of being arrested for a CFAA violation I'm not sure how to prove it to those types at this point, and I don't intend on doing that, LOL.

    If you actually care, it's painful to see people destroy the things you care about.