rphlx

13 ms·

61.
by rphlx 9y ago
A day may come when your politics differs from theirs, and then you will discover the problem with aggressive political censorship. In any case, I disagree with the premise that "no ads means no value" for YT. Instead of ads they
62.
by rphlx 9y ago
> Liberalism was the view that people are equals, that there are no 'special' people imbued with an inherent superiority that entitles them to ruling over and guiding others against their will, and any 'greater' organ
63.
by rphlx 9y ago
In capitalism it's mostly the customer's responsibility to switch when a company becomes too-evil in some way. Depending on your politics you could, perhaps, argue with some truth that network effects make that extremely difficult
64.
by rphlx 9y ago
I am frankly shocked at how many people wanted to nail CTS to a cross for the method of disclosure while granting something like an "it's cool bro" to AMD. These are truly serious flaws that, IMO, greatly undermine the &quo
65.
by rphlx 9y ago
In their defense I believe they do tend to host that stuff on domains that do not set or retrieve the regular google tracking cookies. Though there are other tracking methods that they might still be using.
66.
by rphlx 9y ago
I don't know of any way currently. :-\ You'd probably have to write a browser plugin or get one of the existing ones like uBlock to implement it.
67.
by rphlx 9y ago
They certainly do make it as addictive as possible, but IMO that still does not mean users are there involuntarily. Persuasion is not the same as coercion.
68.
by rphlx 9y ago
That's a fair point but I would put much of the blame for that on the US government for not having proper EU-like privacy laws which make it illegal, or at least mandate an opt-out mechanism.
69.
by rphlx 9y ago
The network effect is strong but it does not make FB use necessary or involuntary. You will not be put in a cage, fined, beaten, fired, etc, for not using FB.
70.
by rphlx 9y ago
In general blacklists are a better choice overall for non-technical users. Do you really want an angry text message or phone call every time $FAMILY_MEMBER has some site that's rendering poorly because they haven't properly whitel
71.
by rphlx 9y ago
A lot of sites pull in popular js libraries from google; the idea being that they'll already be in a user's cache and even if they're not, google has a better (cheaper, faster and/or lower latency) CDN than the site auth
72.
by rphlx 9y ago
I don't use FB and definitely do not like their business model, but it's also true that their users are there voluntarily and most of them are at least vaguely aware that they're being aggressively data harvested by an amor
73.
by rphlx 9y ago
Block all accesses to non-local (192.168, 10., etc) IP-based URLs. Will break some legit stuff, but, not that much for most users, and they can just whitelist that as it comes up. IP whitelists could also be aggregated and shared on githu
74.
by rphlx 9y ago
I agree with that. But that point is orthogonal to the (in)validity of the "CAs are effectively regulated by browser vendors" argument I was commenting on.
75.
by rphlx 9y ago
In many cases (such as Let's Encrypt) the CA verification process is merely "controls some DNS resource" or "controls some HTTP response that directly depends on DNS". In that case it is theoretically impossible for
76.
by rphlx 9y ago
> Mitigations include browsers firing CAs and severely impacting their business (so effectively, there is regulation) Nit: Not when the browser developer and CA are part of one entity. Excepting some major change to corporate structure,
77.
by rphlx 9y ago
Technically, this does not absolutely have to be a SEP vuln. It's possible that the PIN is being stored (not properly zero'd-after-use) somewhere outside the SEP, i.e. a pinpad entry buffer or something. Often criminals do not t
78.
by rphlx 9y ago
Humans being abysmal PIN and password generators, a decent fraction of phones can probably be unlocked within 5 attempts by just trying 123456, 123123, 111111, 654321, 000000. Unless/until the phone forces the user to learn rather th
79.
by rphlx 9y ago
There's a decent counterargument - take it or leave it - that this kind of research is extremely difficult and expensive, and upon success, privately weaponizing it and/or selling it to organized crime or nation state-level actors
80.
by rphlx 9y ago
> a strictly IMU-only approach to lengthy navigation is, AFAIK, impossible This is true when using very-low-cost (i.e. consumer MEMS) sensors but as a general statement it's false; many military and civilian space- and aircraft syst
81.
by rphlx 9y ago
> if OS updates slow down older phones these days On the Android side, it's sorta debatable whether Google Services is really part of the OS or not, but in any case, a Galaxy S4/5 with the latest google SW is a performance disa
82.
by rphlx 9y ago
The US is particularly bad but there is no nation in the world where the telecom system is entirely secure against all threats. SMS adds an unnecessary trusted third party to 2FA, something that really should be a two-party system.
83.
by rphlx 9y ago
> You can’t cycle to a new set unless the authoritative server is still responding with the key. Yes - during a refresh you'd (re-)add the key to an authoritative server that you control, query it from X open resolvers that you do n
84.
by rphlx 9y ago
Nit: Kissinger was actually tried as a war criminal in Spain under the principal of universal jurisdiction. Assuming he did not visit Spain he was immune to actual punishment, of course, but "winning" did not make him immune to be
85.
by rphlx 9y ago
Yes - Israel used this rather famously on ex-Nazis that they "extralegally imported" from around the world, even though a) the accused was not an Israeli citizen, b) none of the victims were Israeli citizens at the time of the cri
86.
by rphlx 9y ago
Without commenting on the other arguments-#3 seems ludicrous. Claiming that a country's local law applies to an institution in another country "because it's named after someone who lived in our territory" seems a pretty
87.
by rphlx 9y ago
I'll be the first to admit that to a DNS expert my original phrasing was not fully precise or fully complete, but calling it "factually not correct" is unfair. As the GP hints the idea is that you cycle through a large number
88.
by rphlx 9y ago
Many years ago someone (possibly/probably Dan Kaminsky) suggested storing your gpg-encrypted+signed full device encryption key in the global DNS cache. If you don't do a lookup every X days, it'll expire from the cache and th
89.
by rphlx 9y ago
You will still be trusting Apple to securely use your entire password rather than always truncating it to, say, 3 characters, and/or "backing up" some or all of it to their cloud - things that are rather difficult to independ
90.
by rphlx 9y ago
Though I agree rate limiting should be done (and done carefully), it is not very effective in all cases. As just 1 example, a determined attacker who wants to pop any account can make 3 attempts on hundreds of thousands of accounts, using

More ›