g_p

19 ms·

151.
by g_p 4y ago
Since they're tied to people's account details, address and similar, I'd imagine quite aggressive blackmail opportunities going forward if the data gets to the hands of criminals. Think postal letter named and addressed, givi
152.
by g_p 4y ago
Normally not, as historically traffic from roaming users has been "home routed". That is, it was sent over a tunnel (think IPsec or similar) back to the user's home network, where it left through their usual infrastructure. E
153.
by g_p 4y ago
This isn't the OTA signing key, although on some cheap devices I have seen the platform key also be used to sign OTAs...
154.
by g_p 4y ago
In the world of Android, apps are signed (including system/platform apps) through a trust-on-first-use system. There's no PKI with roots and intermediates which could support easily enabling a quick fix. On Android, an updated app
155.
by g_p 4y ago
> I'd like to see tailscaled run with far fewer privileges. Yeah - I have a dislike for services running as root when it's not necessary, and then getting users to escalate to root to interact with them routinely. One thing I w
156.
by g_p 4y ago
My understanding is that this is the "elephant in the room" right now on federated social platforms. I set one up as an experiment, and the "out of box experience" wasn't great - there was no equivalent of a default
157.
by g_p 4y ago
There was a recent bug fixed, specifically on YouTube, due to ad-blocking causing a constant loop fetching and reloading an icon or something to that end, I believe - it was fixed in a recent release. I suspect that was what you were seeing
158.
by g_p 4y ago
I think if you can assume some level of trust in your search provider (i.e. through payment - let's get to that in a minute), without which you should probably be looking for a new search engine, then you can trust the search engine to
159.
by g_p 4y ago
This is an interesting example, and perhaps pushes part of the blame and dislike for A/B testing onto tech companies' incentives. If you're building a tool to make life easier for the user, something that gives them a better
160.
by g_p 4y ago
The risk here would presumably be people unwittingly purchasing an old version? Neither way seems ideal though. I've seen some devs create a bundle as a way to do upgrade prices, but that's not perfect either.
161.
by g_p 4y ago
I believe the Mac OS networking APIs go a little bit of the way there - in Lulu, an open source alternative to Little Snitch, the connection prompts tend to contain (and let you filter) by the URL visited (including the query after the doma
162.
by g_p 4y ago
For anyone interested in blocking or looking at what is happening through Windows, the "Restricted Traffic Limited Functionality Baseline" may be worth looking at. It's a set of group policy settings that can be used to manag
163.
by g_p 4y ago
I believe this is covered by the "Optional Connected Experiences" option. On Mac, this is accessible via the App's main menu > Preferences > Privacy. Looks like these instrucitons should help you check: https:/&#x
164.
by g_p 4y ago
From a DNS privacy perspective, ODOH (Oblivious DNS over HTTPS) seems to achieve this at protocol level, with interoperability between providers. While there are tunnelled VPN (separate entry and exit), they always seem to be with the same
165.
by g_p 4y ago
Just thinking aloud here - would you need to disable all automated updates on iOS before doing this, lest the device do a reboot for a system security update, and end up on the lock screen? There's probably some interesting failure mod
166.
by g_p 4y ago
Indeed - this is one of the positives of Go, as all the dependencies get linked statically, giving nice portable "single binary" solutions. Grepping function names seems a reasonable approach, as long as you're not trying to
167.
by g_p 4y ago
If you're using distro packages, their own "packaging policy" should offer some level of assurance via policy about static linking (since as far as I know, all major distros dynamically link, to make this kind of bugfix easie
168.
by g_p 4y ago
In a security test of a bespoke password reset platform, I came across something quite similar, so you're not alone. The JSESSIONID of the unauthenticated request for a password reset (as exposed to the client as a cookie) was used as
169.
by g_p 4y ago
There doesn't seem to be a good reason for the slowness, but a reasonably good technical write-up on the update mechanism is available at [0]. The time spent rebooting does seem excessive, especially when using image-based updates. [0]
170.
by g_p 4y ago
A few things to consider here, so you can see this from a carrier perspective. 1. What are they actually leasing? Are you leasing them land, or a pole, or the right to install equipment on a pole? If it's either of the latter of the tw
171.
by g_p 4y ago
> But then in the early 2000's when we switched to cell phones, filtering turned "not talking" into absolute dead silence, no background noise. As a matter of interest, the background noise generated on a digital squelched
172.
by g_p 4y ago
This appears to be using the PIV "smartcard" applet. I believe one option on each certificate in the PIV applet is whether or not a "button press" is required for its use. I believe it is recommended that the device atte
173.
by g_p 4y ago
Yes, to an extent, but given the state of certificate revocation, some might say this is "by design". There are 2 main ways to revoke a certificate - one is by listing it on a certificate revocation list (CRL), whose URL is inside
174.
by g_p 4y ago
Something I have noticed is that a few Mac services related to spotlight have a propensity to be very heavy on the system writes. corespotlightd and suggestd in particular seem to do some kind of indexing operation after some trigger, which
175.
by g_p 4y ago
The database password is irrelevant unless your database is exposed to an attacker - if it is, you've not set your system up correctly. Your first line of security should be the perimeter - preventing access to services which aren&#x27
176.
by g_p 4y ago
I think you're absolutely right - my worry is that while passkeys are very usable, they also effectively create inescapable inertia and friction to ever changing browser or device ecosystem. Today there is no migration path from one Ma
177.
by g_p 4y ago
I believe you could do relaying like this, if suitably determined. You would need to do it in near real-time, and no doubt the endpoint giving PATs will be rate-limited. At some point the amount of manual effort to automate this (do you hav
178.
by g_p 4y ago
My concern isn't either, although both are interesting discussions - 1 in particular is relevant but understandable, as this prevents you from pairing tokens so you can maintain an off-site backup you don't have to retrieve every
179.
by g_p 4y ago
The technology is safe enough to use, as long as you stick to hardware tokens - I have accumulated a few of them over the years (quite affordable), and you can get USB-A, USB-C and NFC versions. You shouldn't get locked in with a USB h
180.
by g_p 4y ago
This is a shame to see - it's understandable that there are some technical challenges in it, but it does seem possible (via a mutual auth handshake) to introduce portability. Kudos to you for arguing the case though! Before "cloud

More ›