wepple

25 ms·

331.
by wepple 3y ago
CVEs aren’t a significant datapoint… In this case, a single-packet pre-auth root code exec is about as bad as it gets. I don’t recall the last time a major vendor had a doozie like that. Bugs happen, but having them wildly exploitable isn’t
332.
by wepple 3y ago
Law Enforcement Officers. The O maybe wasn’t necessary here
333.
by wepple 3y ago
> Whithout having read any deeper I guess … May I suggest an antidote to this?
334.
by wepple 3y ago
Yeah exactly. Being a tech lead for the next iPhone and being tech lead for some HR system that organizes people’s 401k contributions are both experiences of “being a SWE at apple” but probably overlap in infinitesimally small ways. A lot o
335.
by wepple 3y ago
There seems to be 1-2 posts per week about how terrible $FAANG is to work for (google is in the hot seat this month) If google has ~200k (I don’t have exact data) employees, there are surely a significant number of people who either don’t h
336.
by wepple 3y ago
I’d be interested to see the data that shows cookie notifications have had a useful impact.
337.
by wepple 3y ago
Is that 22LR?
338.
by wepple 3y ago
You make some fairly reasonable points, but it’s very clear you’re talking explicitly about cities which is a small (but significant) part of the problem. Realistically if you’re trying to get rid of vehicles, most modern cities are already
339.
by wepple 3y ago
I simply can’t see cycling as the answer. Public transport, 100% yes. But when people suggesting cycling I feel like they’re asking for their hobby to be taxpayer subsidized. How does it work for those who aren’t fully bodily abled? When it
340.
by wepple 3y ago
Repairing crashed drones, so maybe nothing fancy. If I’m doing precise SMT I prefer to be at a desk
341.
by wepple 3y ago
If they’d charged me $85 I’d be a very happy buyer. But I paid like $45 or something crazy? The one downside someone pointed out is that replacement tips are pricey because they seem to include the actual heating element, but even then it’s
342.
by wepple 3y ago
This isn’t a backdoor in the baseband. It’s code in the kernel which allows the baseband to effectively execute code in said kernel. Definitely not ideal, but (especially without seeing baseband code) not something you can call a backdoor.
343.
by wepple 3y ago
CVEs have absolutely nothing to do with finding out whether our devices are backdoored. CVEs come out of Mitre, but lots of countries have equivalent systems or tracking codes. Further, large companies are pre-allocated blocks of CVEs to us
344.
by wepple 3y ago
Can’t speak for the OP but having USB C devices is far tidier, and allows you to go portable. I’ve always had a 110 soldering station, but recently bought a Pinecil portable iron for soldering in the field, and damn that thing is so conveni
345.
by wepple 3y ago
> to make an obscure point which only tech nerds care about. You’re making some huge assumptions here, as if people are on some kind of wild protest. I don’t use Facebook just like I don’t own a boat or go to church. It’s not valuable to
346.
by wepple 3y ago
Nobody is forcing them to call you; if it’s too much effort they don’t have to include you. Sounds like they’re “forcing” you on to a platform and aren’t prepared to be friends with you if you’re not on it.
347.
by wepple 3y ago
Same on iPhone; clicked away immediately
348.
by wepple 3y ago
You’d be surprised the challenges that crop up when a company grows to the size of a FAANG. For all the bad press they get, Timmy’s little acronym.io startup doesn’t have to have entire teams to deal with nation state actors trying to use p
349.
by wepple 3y ago
With repercussions. If they’re estimating a lifespan extension and later go back to the original estimate, they’ll have huge one-off depreciation charges, no?
350.
by wepple 3y ago
That’s an utter nightmare of a situation I’d never considered, or prepared to defend against. I hope the “prankster” ends up caught and in prison
351.
by wepple 3y ago
Unless you’re a tiny company, there are legal/regulatory requirements to disclose breaches. When it comes to AuthN, the right number of breaches is 0. Same argument for password managers, and why I advise people to stay clear of lastpa
352.
by wepple 3y ago
Except “inaccessible” != “vpn” There are a bunch of things folks forget when talking down zero trust; EG if it is done properly then the endpoint the user is using has to AuthN too, and be in good health. That solves cookie/token theft
353.
by wepple 3y ago
> what if you lose access to it We’ve been working very hard on this problem, and recently devised a scheme known as backups. It’s like a whole copy of your data someplace elsewhere! Snark aside; popular password managers have extensive
354.
by wepple 3y ago
Even worse, you’re putting ALL of your “passwords” in 100 different places!
355.
by wepple 3y ago
curl|bash is possibly worse in one minor way; the binary can be dynamically generated or swapped out based on analysis of the target. Downloading directly from GitHub or apt-get is a tiny bit safer in that regard.
356.
by wepple 3y ago
Perhaps this is a case of “something against my expectations occurred” and that’s true; but only because it was extremely obvious and we spotted it.
357.
by wepple 3y ago
At first sniff this felt dodgy to me, but then when I thought about it: a software update pushes arbitrary code to your machine that you willingly execute. You either take the risk and live with it or don’t.
358.
by wepple 3y ago
Most of the world. People that don’t use HN or work in tech.
359.
by wepple 3y ago
There is haveibeenpwned as mentioned, but you could also just use a password list of common passwords and ban those completely. It would stop more attacks, like standard password guessing attacks.
360.
by wepple 3y ago
I wonder if there is a way to host known (ideally known-but-disabled) malware, and get the parent frame site on browser blocklists, without getting the sqword domain blocked? Probably not, but that would be even better than a goatse troll..

More ›