Feb 10, 17 / Pis 13, 01 12:38 UTC
Re: Could starting an Asgardian citizen based IT team be a possibility? ¶
Thanks for the info. The link is now made clickable.
Feb 11, 17 / Pis 14, 01 14:04 UTC
@pmwwal: Could you edit the title of this thread to "Proposal - ACIT - Asgardia Civic IT"? And also add the link of the proposal in your main post? Thanks ;)
Speakee and I have made some changes in the online Proposal.
Feb 11, 17 / Pis 14, 01 22:05 UTC
Any and all help is greatly appreciated, no matter how small it may seem at the time.
Feb 12, 17 / Pis 15, 01 09:28 UTC
have been wondering long: how 2 apply? am i blind or sth, saw no email, slack room or other contact ways, github shows no public repositaries or member. understand u good ppl r super busy, mostly multi thread, hope this question didn't wast much of your time. all best wishes, willing to support(show us a way, bro)
Feb 12, 17 / Pis 15, 01 10:01 UTC
We don't currently have a formal way to apply, it is more an open input session at this point. We are taking input and ideas here, as well as on the Proposal document:
The Proposal document is still being drafted, once finished it will be submitted to Asgardia Official. After approval we will begin deliberations on improvements and open source possibilities which will be open to the general public (being all Asgardian users). We are still working on a way to "Select" official team members, which is one of the things that is currently being discussed. The proposal link leads to the current rough draft of the official proposal that will be submitted to Asgardia Official, and it is open to suggestions from users. Current users in charge of the editing of the proposal are Vadorequest and Speakee.
And no time wasted at all, I try to keep a close eye on this thread as well as the redirecting thread in the General forum to answer questions related to this proposal. A lot of it is still up for debate, so some answers may not be answered extensively just yet, but I will try to answer them to the best of my ability, as will the others currently working on it.
Hope this helped,
Feb 12, 17 / Pis 15, 01 10:51 UTC
ye, help a lot, good job, bro. i stupidly mistook acit volunteering for taking small missions split up by upstream coworkers in free time, but u guys r really systematic and responsive, proud of u all
Feb 12, 17 / Pis 15, 01 21:25 UTC
Thank you, we are hoping this allows for a more responsive and user friendly IT base.
Feb 13, 17 / Pis 16, 01 23:22 UTC
I believe that in Asgardia it will be possible to set up IT and internet companies, etc ... I think the free competition scheme will be installed as in many other countries. IT companies will be created and will give employment to Asgardian citizens as well as to foreigners. On the other hand, the government, once installed, should create its own IT department and even more specific space technology, or hire third parties, foreigners or citizens as long as it meets the government's goals in these areas.
So when the government is running a public tender to fill the programmer vacancies I would like to run. So when some Asgardian company is hiring staff for the programmer job, I would like to be able to send my resume. I'm out of work at the time available to travel too. Thank you.
As far as the election problem is concerned, I think they can occur outside the Internet, for security reasons, as in all other countries with paper ballots even distributed and returned by the post office. Why not?
Feb 14, 17 / Pis 17, 01 02:55 UTC
Even better would be to open source the lot.
The "government" can sanely operate on a model of "direct democracy" and by extension everything "official" would then be of citizen domain. There would be no "vacancies" - the things people want to happen get done by the people that can or want to do them. The bonus is you don't have to pay them.
Employment as it's currently understood should soon become an antiquanted concept thanks to the increases in automation and AI effectiveness. With this in mind, I don't predict it to be a stable foundation to build on in Asgardia. Ofc, it will take some time for automation to replace "manual labour" but one by one it's doing it in every sector.
For elections, once my vote is in the post prove it's actually been counted and it wasn't just made up as you go along with a stack of pre-ticked votes done two months ago? Outside "the internet" is still possible, whilst still being "online". Things like VPN are excellent for this. However it should be possible to make these services secure enough to entertain the possibilty. It's possible to have a completely transparent and secure system that still protects the anonymity of the voter.
Feb 16, 17 / Pis 19, 01 12:30 UTC
I'm not sure a VPN has enough security to serve for use in a global election, maybe it can. But I also do not know if it will require such security because when we elect Dr. Igor the president was not so concerned about data security. The form was very simple.
Feb 16, 17 / Pis 19, 01 18:39 UTC
Yes, security is something largely overlooked.
Certainly a VPN can provide more than enough security, deployed correctly. The premise is once attached to the VPN a unique cryptographic tunnel is generated down which traffic passes to the end system. This tunnel is relayed to the machine using it as a seperate peice of networking hardware thusly it is possible to make services only "listen" for traffic on this hardware, and thus it is only possible to access this service via the VPN. This one simple act isolates it from the internet whilst still being "accesible online". The encryption allows it to traverse the interwebs as a medium and remain wrapped and prevent viewing of or adjustments to. Attempts to adjust will result in decryption errors. Viewing should only be possible by being in possession of the user's keys. By having the connection uniquely encrypted, per connection, any lapse in security for one party does not impact another.
Our elections should definitely carry the largest amount of security it is sensible to be deployed. If it was up to me this would mean PCKS-11 embedded into passports and readers with USB connectivity and bootable to secure operating systems supplied with the passports - but that's a little unfeasible at this time on a few fronts.
Feb 21, 17 / Pis 24, 01 19:58 UTC
With regards to security I would like to make the following observation.
We are not doing anything that needs be concealed, nor do I expect that this nation will ever have such great secrets that require concealment. As a result, I think that transparency, rather than concealment, should be the course of the day.
Security, therefore, should be used to allow each of us to know, with a high degree of certitude, that the person to whom they are communicating is, indeed, who they say they are. It must be easy enough for a common person with low intelligence and bad memory to use (lowest common denominator), but secure enough to be difficult for anyone to charade as someone whom they are not. This proof of identity would allow communications and voting to occur without worry that the individual is not who they say they are.
The methods for this proof of identity should not be singular. The login and password combination used on this site is not secure, and generally requires that only those who can recall their username and password can prove their identity.
I am reminded of those keys I got from a Blizzard event I attended that I needed to log into my Blizzard account. I have something similar for my Steam account on an app on my phone. They seem highly secure, but as I am not a security expert I cannot verify this. Two-factor authentication, however, should be part of this identity verification process.
There should be more than one way for a person to prove they are who they say they are, and any citizen be able to 'shut off' methods they will not or do not use, to prevent those methods being available to would-be villains.
Feb 22, 17 / Pis 25, 01 03:21 UTC
As previously mentioned, multiple times.
It's an "industry standard" way to authenticate. On the server side it requires no additional hardware or software, minor adjustments to current login code at best. If treated properly the private key will never be accessible to third parties, as it's use never requires it to leave the local machine and in the event of access being leaked then the passphrase should realistically prevent use, certainly until it can be revoked. Our system could potentially make use of an additional "duress passphrase" - wherin a state of duress this can alternately be released and it will automatically nullify the reaI key whilst granting access to a sandboxed profile to make it appear that the real key has been divulged to retain any fingers or other minor appendages that remain. It is incredibly simple to generate certificates and these can be entirely autonomously generated via a simple script the user executes. Ideally the data should be filled out manually, but the only thing that really matters of the input for this purpose, and the maximum it is sensible to reduce interaction to is the passphrase it locks to. Open source, active devel, easy to use and as bullet proof as authentication can get across the interwebs which is why it's used for serious things like frictionless SSH auth into remote servers.
Two-factor that relies on the authentication policies and procedures of a random third party reduces security in an otherwise secure model. Certainly this site's current polices are not secure, but relying on some other site's ability to remain secure isn't a sensible choice if adequately considered. Breech of this service will intrinsically lead to breach of ours and further allow third parties to draw links and take metrics they do not require to. Anything that transfers across the conventional telecoms network in an unecrypted form - like SMS which effectively piggybacks across the existing SMTP (email) infrastructures - isn't a particular secure way to do anything as it's just assured that multiple copies have just been made and stored. Intercept is trivial at mulitple stages.
"Shut-off" methods should be trivial to provide, revocation and signing requests for fresh keys should be trivial to handle, the CA should naturally be retaining a revocation list.