madez

57 ms·

541.
by madez 9y ago
The evidence for a backdoor by the government vs a programming mistake or backdoor by somebody else is weak, I think. Also, what would change even if?
542.
by madez 9y ago
Regarding the first point, I don't positively state that governments do covertly subsidize backdoored products, but it's realistic and a real attack vector. Even if for example the state were totally benign right now, we need to b
543.
by madez 9y ago
The web of software has inherent unsolveable security issues and leads to an ecosystem where less and less software lies under the direct or indirect control of the user. Proprietary apps are not the solution to this either, of course. We n
544.
by madez 9y ago
So we must also demand that we be able to change the software. For hardware, we could demand that universities get paid to look at samples of hardware to find backdoors, maybe.
545.
by madez 9y ago
A relevant but still more general question: How can we protect ourself against backdoored products that are covertly subsidized by governments? Sure, demanding the sources is a necessary first step. But what happens when the manufaturer blo
546.
by madez 9y ago
When you use proprietary solutions you have it coming.
547.
by madez 9y ago
It makes the use-case for this type of code deployment wider and it's more effective at what it's already used for. These are two reasons why developing and supporting WebAssembly is finally against the interest of the users.
548.
by madez 9y ago
You might be talking about the following article: https://www.theguardian.com/world/2013/jul/11/russia-reverts... Even in Germany high officials hinted at using mechanical typewriters: https:/&#x2F
549.
by madez 9y ago
Oh, you don't have to be another person just for taking care of your computer security hygiene.
550.
by madez 9y ago
Code, that is unreviewed, unaccounted and executed automatically. Now it shall be high-performance, too? Does the sandbox work? Does it really work? Are there no side channels? Are you sure? How do you make sure you don't take part in
551.
by madez 9y ago
I'm astonished at how fast websites are without JavaScript. I just turned it on today to make an order on EBay and I was immediately annoyed by how slow and sluggish it was. Why aren't there programs to buy stuff on the internet?
552.
by madez 9y ago
At least the second part, the system of the two computers and the checker, is compared to even the very simplest parts of a modern computer laughibly simple.
553.
by madez 9y ago
Only if you run proprietary software or unaccounted code like JavaScript/WebAssembly. If you have a completely foss system and don't execute random code from the internet, you can very safely still enjoy the full power of the hard
554.
by madez 9y ago
If you stay with a system that is as open as possible from the lowest levels of the hardware to the highest level of the software, and if you airgap, and audiogap, and RF-gap the system permanently until it ceases to exist, you are pretty f
555.
by madez 9y ago
> We don't all profit from it, it's a total distraction for most people. Collectively we do, just like we do from mathematics or museums. Also, imagine what the FOSS ecosystem could be if the underlying technologies where funde
556.
by madez 9y ago
> Wait, what? Why should governments step in to back FOSS? Because we all profit from it and there is little market incentive to back them. The government funds museums, mathematics and a lot of other things for less reasons compared to
557.
by madez 9y ago
Because governments don't back FOSS like they should.
558.
by madez 9y ago
The argument of national security goes a long way.
559.
by madez 9y ago
I think we need more architectures in wide use because a monoculture is bad for many reasons. One reason not so often mentioned is that it's then harder to distribute proprietary binaries.
560.
by madez 9y ago
The responsibility to document the quirks and necessary workarounds lie with the manufacturer of the hardware. If the manufacturer doesn't provide the necessary documentation, then that's exactly that: insufficient documentation t
561.
by madez 9y ago
It's not uncommon for natural languages to have homonyms, so people are used to deal with them. The context allows deciding which is the correct meaning.
562.
by madez 9y ago
Do you seriously think that winning the market equals being right? "The market" is a horribly ill-idealized model full of wrong assumptions. Uninformed customers, unfair practices and outright illegal behaviour need to be expected
563.
by madez 9y ago
A perfect occasion to invite others into my current exercise of using the web without JavaScript.
564.
by madez 9y ago
Even simple .png pictures are not displayed on imgur.com without JavaScript.
565.
by madez 9y ago
There is rarely a submission here on Hacker News that has comments of such bad quality as this submission has. I see a similar phenomenon with press. They "hype" something they barely understand, change parts of the story to make
566.
by madez 9y ago
There are other issues Intel does not fix (backdoorable hardware outside of the control of the owner). This is part of Intel's image. So, there's that.
567.
by madez 9y ago
Come on, stop spreading nonsense. These huge primes are irrelevant for cryptography.
568.
by madez 9y ago
These numbers are for as far as we know irrelevant for mathematics.
569.
by madez 9y ago
Why is it an issue to need a different kernel image for each device? I don't see a problem as long as there is a simple mechanism to specify your device to generate the right image. It's already like that with coreboot/libreb
570.
by madez 9y ago
The CCC stated also that they observed that companies take a more reactive rather than proactive stance regarding their IT security because they believe that they will be notified of vulnerabilities prior of public disclosure or attacks. Th

More ›