lima

72 ms·

841.
by lima 7y ago
> 1. Just let it be HTTP. Stupid browsers are stupid, but at least they don't prevent this page from working yet. This would be categorically worse than hardcoding the SSL key.
842.
by lima 7y ago
This. Yes, Netgear has a bad track record with security, but this is likely a calculated trade-off. Alternatives: - Self signed certificates. Users will learn to acknowledge the error and an attacker can just present their own self-signed c
843.
by lima 7y ago
Cars are not a common subject on HN, so it probably caused some anonymous readers with knowledge or opinion on the matter to create an account so they can chime in.
844.
by lima 7y ago
That would be a central point of failure and a ton of extra complexity without providing any kind of meaningful security benefit.
845.
by lima 7y ago
An attacker can just dump the unique key, impersonate the device and use that for a MitM attack. There's just no way to do this securely without completely locking down the devices using hardware key management (which would be unreason
846.
by lima 7y ago
It wasn't the researcher who disclosed the keys, it was the vendor who did, knowingly and purposefully (in their firmware updates).
847.
by lima 7y ago
Not my experience, either. Not a large account by any means, and support is excellent, both from a technical and business point of view. > people get wrongly banned from Google Cloud with no recourse all the time [citation needed] Ther
848.
by lima 7y ago
I also did this! Didn't call it Chatistics, though.
849.
by lima 7y ago
Heh - sorry for the hyberbole. At least in my country, Germany, fraudulent use of telecommunications services, public transport or paid events/facilities ("Erschleichen von Leistungen", § 265a StGB) is not just a civil matter
850.
by lima 7y ago
Nothing in the Snowden leaks suggests that RDRAND is backdoored.
851.
by lima 7y ago
Super illegal, AND all ISPs have bandwidth accounting that will quickly spot the manipulation.
852.
by lima 7y ago
... or use Chrome, which has a much better security track record.
853.
by lima 7y ago
PWAs use the (very efficient) system webview implementation rather than bundling a full browser runtime like Electron apps do.
854.
by lima 7y ago
> Nobody uses windows terminal server for anything serious, because of its reputation for security holes (which may or may not be outdated, but y'know, "java is slow" etc etc). Entire companies run on remote desktop. It&
855.
by lima 7y ago
IE has a much larger market share, so they probably spend a lot of extra time on IE special cases.
856.
by lima 7y ago
> There’s also the fact that google recently forced Javascript and specific browsers to be used in order to be able to login. So I was locked out of my account for a while until someone discovered that the “rules” are a little more lax
857.
by lima 7y ago
That's how a modern Windows Terminal Server/Citrix/whatever infrastructure works, smartcards and all.
858.
by lima 7y ago
Backwards compatibility at all costs is a main driver of insecurity. This change is a good example where the security benefits clearly outweigh the downsides.
859.
by lima 7y ago
It would break other features (like the "Watch Later" button) too. According to Occam's Razor, this is very likely to be a bug rather than a conspiracy against YouTube Premium customers.
860.
by lima 7y ago
Good points regarding HTTP, but XMPP is an excellent example on how decentralisation can be detrimental to the user experience. A large percentage of XMPP users are using a lowest-common-denominator client like Pidgin that supports only a s
861.
by lima 7y ago
Moxie's talk is a critique of decentralization, so how is this a "taste of his own medicine"?
862.
by lima 7y ago
It's a volunteer-ran event and mistakes happen. Probably as simple as "someone messed up the talk metadata and VOC wasn't aware that it shouldn't be recorded".
863.
by lima 7y ago
Given (2), it would be appropriate to remove this HN submission as well as a matter of respect. It's an excellent talk, though.
864.
by lima 7y ago
> You link your application directly to Linux and get a vmlinuz binary How does this work with proprietary applications and the kernel's GPL license?
865.
by lima 7y ago
Open Source code is the worst possible place to hide spyware.
866.
by lima 7y ago
That's because the person you talked to probably did not know, either. They were basically reading off a checklist.
867.
by lima 7y ago
> Panasonic holds an almost monopoly on aircraft inflight entertainment, especially on widebody planes. They run redboot Linux and have a pretty strict firewall between the plane and computer. All of what the author did was expected by t
868.
by lima 7y ago
Yeah, what's missing is first-party integration with the package manager (like Gazelle for Go) with proper dependency locking.
869.
by lima 7y ago
Large companies have plenty of safeguards against internal threats, especially when things like encryption keys are concerned.
870.
by lima 7y ago
This. Bazel is as close as it gets.

More ›