lrvick

44 ms·

901.
by lrvick 1y ago
That was clearly just a joke meant to indicate they are not a security professional.
902.
by lrvick 1y ago
That is exactly what we do in StageX on which ReprOS is based. Given all builds start from hex0 you can build from an Arch Linux host and I can build from a Debian host and we are still guaranteed identical results every time. Every altered
903.
by lrvick 1y ago
MacOS is closed source centralized trust so it is not even trying to have accountability. If you add in Homebrew you -also- add trust in hundreds of unvetted internet randos pushing and merging unsigned commits without strict review require
904.
by lrvick 1y ago
That is why we made StageX, which allows you to generate bootable web server images or containers bit for bit identical every time so prod is predictable and accountable. https://stagex.tools
905.
by lrvick 1y ago
Not yet, although Turnkey and Stagex are in the process of integrating it for automated reproductions as part of their CI for everything. It will no doubt mature a fair bit more through this process
906.
by lrvick 1y ago
Since writing the post you link, I finally threw my hands up and made a new distro with some security engineer peers that prioritizes supply chain security and mandates 100% full source bootstrapping and determinism: https://stag
907.
by lrvick 1y ago
Encouraging the use of Nix in production is wildly irresponsible. I am really surprised to see Google do this given their generally high security bar. Maybe this team operates in a bubble and gets to prioritize developer experience above al
908.
by lrvick 1y ago
IMO you need an immutable appliance-like OS that is deterministic and full source bootstrapped to do reproductions with minimized trusting-trust attack risk. We built ReprOS to solve this problem: https://codeberg.org/stagex
909.
by lrvick 1y ago
https://www.gameanalytics.com/market-intelligence Straight up spyware developers embed in games. Several competitors exist too.
910.
by lrvick 1y ago
No Steam API access or public data needed. Major game studios include analytics suites (bspyware) which also tend to collect information on what other software you have installed, can harvest data from Steam client side, etc etc. That data
911.
by lrvick 1y ago
I would never use BTC purchased directly from an exchange to make anonymous payments. If a vendor only accepts BTC and I want privacy I normally swap it for monero then back for BTC again to remove any connection to me.
912.
by lrvick 1y ago
If you give an LLM any trust at all to write or execute production bound operations without human review, then anything bad that happens is -your- fault. I forgive occasional human error, but a human handing off prod control to a third part
913.
by lrvick 1y ago
As someone with a neodymium magnet in his finger, failing to disclose this to an MRI tech could rip it out, which would be unpleasant. Always be hyper aware of ferrous metal near an MRI machine.
914.
by lrvick 1y ago
They tried making examples of a few people for piracy too and adoption only went up. Stopping cryptocurrency is as hard as stopping end to end encrypted messaging or banning porn. You either allow access to the open internet or you do not.
915.
by lrvick 1y ago
Because governments always follow rules and never change them? Private spending and communication are the beating heart of a healthy democracy and must be run directly by the public and decentralized or aspiring tyrants will co-opt them. Th
916.
by lrvick 1y ago
I use it to donate or pay for legal things online I wish to keep anonymous like I would use cash for in person. Most people in the US do not value privacy, but for those few of us that want to purchase online with privacy, or those in heavi
917.
by lrvick 1y ago
A key is just a 256 bit number. You can literally create one with paper and dice rolls. They will no sooner figure out who is holding most of these than they will figure out who is holding cash, or the identities of the 25m+ people download
918.
by lrvick 1y ago
You can say cryptocurrency is failed, but adult entertainers heavily rely on it because they have been censored by payment processors basically forever. Censorship has a way of pushing people to learn inconvenient technology, just like how
919.
by lrvick 1y ago
Data enrichment brokers cross index purchase times with other data from legal factory installed spyware found in cash registers, analytics tools in proprietary software you already have on your computer, etc etc. Every time you buy an over
920.
by lrvick 1y ago
Homebrew also takes a wikipedia style approach to package maintenance where any of hundreds of unvetted internet randos can push any unsigned changes they want to all users of that package with no review. When you install Homebrew you are l
921.
by lrvick 1y ago
But Alpine does not even attempt reproducible builds, maintainer signing, etc. Running Alpine means anyone with access to the git repo or build server can push any code they want to your system. Alpine is a musl research/hobby distro a
922.
by lrvick 1y ago
If there was ever an argument for the need of cryptocurrency, it is this. Dethrone the payment processors or they get to decide what is and is not allowed to be sold.
923.
by lrvick 1y ago
I worked on this project a bit back in the day as a teen. Bricked my first iPod trying to get a DIY uClinux kernel to boot on it within hours of getting it for Christmas. Took bricking 8 more warranty replacements before I finally got Linux
924.
by lrvick 1y ago
It is not entirely cyclical. We always have these one-step-back phases of the old guard clinging to power, then we make big steps forward again. Black people are not slaves anymore, women can vote, gays can marry, weed is mostly legal, etc.
925.
by lrvick 1y ago
Starting a security focused Co-op was the path that made me happy. I can make a living open sourcing everything I do and working on what I want. YMMV.
926.
by lrvick 1y ago
It is fixable, but we are going to have to wait until the mid-terms to slow down the insanity, so in 3 years we can roll it back and start the cycle over again, as is tradition.
927.
by lrvick 1y ago
While it is a view that seems to piss off most, I am becoming convinced capitalism and socialism are both equally doomed paths if taken to their unchecked extremes. An endless game of tug-of-war between the two is the best we can do, and ri
928.
by lrvick 1y ago
Someone who did not want to spend money for an apple logo could choose a $50 Android device and put F-Droid on it for 100% free tracking-free open source apps. People pay extra to be in walled gardens, presumably because they think it will
929.
by lrvick 1y ago
I detest Apple and would happily switch to a timeline where they never existed. That said, I do not think this is the way to fight them. Just do not make apps for iPhone, or pass the 30% Apple tax to the Apple fanboys. They enjoy being subm
930.
by lrvick 1y ago
Or just cut the power trace to the wifi chipset.

More ›