vngzs

21 ms·

151.
by vngzs 5y ago
The entire point of these devices is to provide a window for the corporation into your home, so that Amazon can better sell you things. They're not doing you a favor by making the product; the product is an excuse to uniquely position
152.
by vngzs 5y ago
With only the pdf to go on, I address the "flaw" in more detail in these comment threads [0] [1]. In short, I believe the "flaw" is likely to be "we used SMS for identity verification, without additional necessary s
153.
by vngzs 5y ago
I haven't been able to verify these sort of claims any more than I've been able to speculate it was blanket telco Letters-of-Authorization (LoAs) [0][1] or classic SIM swaps that resulted in the account takeovers. I'm not cla
154.
by vngzs 5y ago
I agree. From Coinbase's perspective, they ought to defend their infrastructure against fraud, whether that is a direct attack on the users, an attack on the users' telcos, or insider activity directly. From the telco's persp
155.
by vngzs 5y ago
There is some speculation in another comment that their SMS verification server may have actually had a technical flaw, and the issue was not a lack of separate identity verification on SMS [0]. However, around the time of the breach date (
156.
by vngzs 5y ago
I bet that control of email address + SMS 2FA was sufficient, alone, to recover the Coinbase account password. Lots of systems permit this kind of recovery, and while I may tell a technical crowd "if you use SMS for 2FA, that's on
157.
by vngzs 5y ago
Anyone care to speculate what the flaw in their SMS recovery flow actually was? It's hard for me to think there's even a safe way to implement SMS based account recovery. They would be smarter to just turn it off.
158.
by vngzs 5y ago
In the linked PDF, Coinbase does not claim to have knowledge of a vulnerability in their system (edit: though it does note "the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process," I interpreted that a
159.
by vngzs 5y ago
Coinbase made everyone whole, and the attackers stole the credentials (not because of Coinbase's fault) ahead of time, and the attackers had to perform a "SIM swap" type attack on the users. "Breach" may be the requ
160.
by vngzs 5y ago
Unclear to me whether "better languages" is the issue or just better type systems. We should be able to express "untrusted input" in any sufficiently extensible type system (e.g., Rust would probably let you express this
161.
ValidScript – a modest proposal for app security(blog.thestateofme.com)
1 points by vngzs 5y ago|2 comments
162.
by vngzs 5y ago
I am generally conservative about these things, but recently the consensus appears to be that unprivileged user namespaces are stable enough for GA. If you work in a targeted environment (e.g., you are a reporter covering civil liberties),
163.
The one ring problem: abstraction and power (2018)(tedinski.com)
1 points by vngzs 5y ago|0 comments
164.
by vngzs 5y ago
Just tried this. I had to talk to a support staff on the website, and they made one attempt to offer me a lower rate for a year (which I declined). In my opinion, it should be as easy to unsubscribe as it is to subscribe. I interpret anythi
165.
by vngzs 5y ago
See also: historical Unix system manuals, in web format [0]. [0]: http://man.cat-v.org/unix-1st/
166.
by vngzs 5y ago
Stop allowing email providers to control the domain of your email. Buy a $10/year domain and point it at GitHub pages (so it gains some trustworthiness). Send your email to that domain, and point the MX records at a mail provider (Fast
167.
by vngzs 5y ago
I'm pretty sure this is the joke in multiple John Oliver web segments [0]. It's pretty well-understood that the YouTube design is not conducive to long-form discussion. [0]: https://www.youtube.com/watch?v=knbw0gJH
168.
by vngzs 5y ago
The price goes down as a target is in more breaches. If your SSN is previously leaked, it's worth less.
169.
by vngzs 5y ago
From Flashpoint's analysis [0], in 2019 a SSN is $5. [0]: https://go.flashpoint-intel.com/docs/pricing-analysis-of-goo...
170.
by vngzs 5y ago
Yeah, but trading volume is not liquid cash. It's not the exchange's money. They make money on fees / commissions, but they can't just dip into the customer funds and use them to pay the government.
171.
by vngzs 5y ago
You have an army of volunteers backporting patches, in the case of Debian. It's been done, but it takes a certain amount of support.
172.
by vngzs 5y ago
GrapheneOS, lacking MicroG in the default install, is therefore more private than CalyxOS. Keeping Google out of the loop entirely is necessary for true privacy.
173.
by vngzs 5y ago
I know people who made it to the final rounds of interviews at Calyx. They are the real deal. I don't think much of anything could get them to compromise their values about privacy [0]. Might they miss something because they're a
174.
by vngzs 5y ago
Sad the high DPI displays didn't go well. My eyes can't take the 1080 vertical pixel displays that are still so common on open laptops nowadays. But I really want to like the Librems; there aren't many trustworthy laptops wit
175.
by vngzs 5y ago
I love 3:2 displays. They're wider than 4:3 but maintain the vertical height necessary to see a bunch of code onscreen. If I only get one display (for portable use), I'll pick 3:2 every day.
176.
by vngzs 5y ago
Ryzen tends to get better battery too. I read an article complaining about high temperatures and bad battery life, both of which tend to be significantly better on AMD hardware. Honestly, it's the only thing keeping me from ordering on
177.
by vngzs 5y ago
This seems to integrate tech from Steam Controllers. I.e., dual touchpads on a gamepad style layout. They went through many prototypes [0] attempting to create something as portable as a console controller but as accurate as a mouse. I cert
178.
by vngzs 5y ago
Not with a TCP proxy. To establish a HTTPS tunnel, the client needs to know the identity of the remote end for certificate validation. Randomizing remote ends with a naive proxy would lead to TLS errors. So you'd likely configure your
179.
by vngzs 5y ago
I do believe it's reasonable to draw a distinction between what we're doing now (which is essentially just "statistics") and what Musk warns about. It's a mistake to believe strong AI will just be a more powerful it
180.
by vngzs 5y ago
Not just "new," but also interesting. An approach must be both new and interesting to be novel.

More ›