g_p

43 ms·

391.
by g_p 5y ago
One approach I've been thinking about in the past (at least as a rough concept) is for the back-end to round both users' location to an "area" (probably city level or similar), then compute the distance between the centr
392.
by g_p 5y ago
An interesting blog post from the UK Government digital team on progressive enhancement, suggesting from their findings that 0.9% of visits to a national government site are from people without functioning JavaScript, who haven't inten
393.
by g_p 5y ago
One downside of TOTP is that there's no phishing protection - a TOTP credential can be phished, relayed and replayed in real-time.
394.
by g_p 5y ago
Scrolling through their incident feed, it seems to be a bit more frequent than "extremely rare". Remember that critical industry is a sector where patching software is viewed as risky, because changing anything when it works is se
395.
by g_p 5y ago
One issue in the critical infrastructure space is that many of these MFA solutions are less robust and resilient than no MFA. Anything based on calling out to an external service (Duo, for example) is likely to be less resilient [1] than th
396.
by g_p 5y ago
> I am assuming they do not have a legal basis for doing so or courts would have granted/ordered such access. It's also possible that they have a lawful basis and warrant, but realise executing a physical warrant won't get
397.
by g_p 5y ago
I would have thought the same, but the existence of this "ask" certainly would suggest there is indeed demand from a market dynamic perspective. Pidgin is cross-platform, and you could conceive that it was being used by people for
398.
by g_p 5y ago
I am surprised they've never tried to introduce some kind of erasure coding or error correction coding. A 4th word from a finite set could act as a "check word" that would detect wrong order of words, mis-spellings of words e
399.
by g_p 5y ago
In addition, the user knows their own location by virtue of having access to a GPS device - for W3W to work they've used a GPS and it's really just an in-band voice protocol for exchange of location. It strikes me that W3W will ev
400.
by g_p 5y ago
This sounds like CNAME cloaking perhaps? ( https://medium.com/nextdns/cname-cloaking-the-dangerous-disg... )
401.
by g_p 5y ago
One of the challenges with this is that much of the best practice has evolved over time with guidance from national regulators and guidance from the EDPB. Latest EDPB guidelines I'm aware of are at https://edpb.europa.eu&#x2
402.
by g_p 5y ago
Is the phrase "audit" a specific Americanism, or is it more widely used? I've never encountered it (beyond the context of American colleges referring to sitting in on lectures in the US system of building credits yourself tow
403.
by g_p 5y ago
It would seem so, as that would be a situation which threatens the safety of the aircraft, which is a pretty good definition of an emergency. I've not gone through the detail yet, but depending on altitude of the aircraft at the time o
404.
by g_p 5y ago
I wonder why this is - is it as simple as SEO? (I can't see how unrelated keywords would help with your SEO really, if anything they might hinder it by triggering spam filters) Another comment here suggests it could be around copyright
405.
by g_p 5y ago
At least in the context of platform-to-business interactions, the EU has done much of this (in the context of kicking someone off a platform they sell through) in Regulation 2019/1150. https://eur-lex.europa.eu/legal-co
406.
by g_p 5y ago
Your software based key is exposed unencrypted to the host OS and any software running on it. It likely sits in memory unencrypted for some period of time. Malware that steals your key can "clone" it. A dedicated hardware device n
407.
by g_p 5y ago
I've not had much experience with modern allegedly "secure" FPGAs, but the scenario I see here is if your synthesis tools get compromised by a bad update (or another attack), they could add a little bit of "side logic&qu
408.
by g_p 5y ago
> Anyone got stats on how FPGA ecosystems have fared vs. MCUs over chipageddon? No data I can offer as such, but anecdote from several suppliers who integrate some big name FPGAs into their products. They've seen supply dry up like
409.
by g_p 5y ago
Interestingly, it looks like (some) insurers may be responding to this. > In an apparent industry first, the global insurance company AXA said Thursday it will stop writing cyber-insurance policies in France that reimburse customers for
410.
by g_p 5y ago
I think you're right - as I said on a sibling comment, if beans are all you count, and bean-counters rule the roost, you can write this off as a one-off, and point out you had 30 years without a ransomware, and therefore we don't
411.
by g_p 5y ago
I think you're spot-on here - the ransom is seen as a "cost of doing business", and until recently security was seen as "a problem that happens to other people". Sadly my experience is that organisations like this w
412.
by g_p 5y ago
> The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the “social sector” (defined a
413.
by g_p 5y ago
In the EU there is a (little known) law that does as you suggest - https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32... This regulation specifically looks at platform-to-business relationships, and
414.
by g_p 5y ago
https://www.scmagazine.com/home/security-news/ransomware/pol... By targeting the insurers themselves (their cyber isn't magically better....), and getting a customer list.
415.
by g_p 5y ago
And insurers themselves are good targets, as they give you a validation list of covered businesses to go after, as they're likely to pay out...
416.
by g_p 5y ago
When you introduce the functionality to disable a traditional safety product, you have to think about the dependency chain and how you design that system to prevent issues. Vehicles with a switchable airbag tend to display a fairly prominen
417.
by g_p 5y ago
Don't forget their secure boot measures on the onboard microcontroller, to stop malware or a rogue Bluetooth device doing an OTA DFU update to swap around the GPIO pins to indicate "activated" and not actually arm the system.
418.
by g_p 5y ago
Sounds like that's a nice route to forcibly obsolete this well before the end of its usable life by turning off the API servers and saying "it's for your own safety... We have a better newer device now available for only $800
419.
by g_p 5y ago
> The vest won't tell you it's functional and then stop working while you ride. The functionality and payment check happens before you ride, if you read their product description. https://www.klim.com/Ai-1-Airba
420.
by g_p 5y ago
Has there been any suggestion as to what happens when the company behind this inevitably goes bankrupt (all companies will eventually fail) or is "acquired" and scuttled? Or they cease to desire to provide the API backend for the

More ›