zrm

43 ms·

451.
by zrm 7y ago
> Plus, since a NAS isn't going to be doing any desktop-OS things, the software for it can be slimmed down enough to run on lower-specced hardware, making the appliance itself much cheaper than the sort of machine required to run Se
452.
by zrm 7y ago
Which still doesn't give them the location of your GPS receiver. It also applies even less to Tor, because they "turn off" GPS by encrypting it so that only their own receivers can use it. Doing the same thing with Tor both d
453.
by zrm 7y ago
Video chat is something like 1.5Mbps. Even phones can do chacha20 at >1000Mbps these days. It's not that expensive. Where people start to feel it is if you want the server in the middle to be decrypting and re-encrypting everything,
454.
by zrm 7y ago
By this logic GPS is "not secure" because the US government pays for that too. But GPS receivers don't even have to transmit anything, they calculate your position by receiving broadcasts made by satellites with timestamps an
455.
by zrm 7y ago
> If the server is compromised, the attacker could replace the public key and TLS would not barf at it. Equivalently, how do you know the public key that came with your iPhone wasn't compromised? It could have been if it was imaged
456.
by zrm 7y ago
> Neither Debian nor Signal audit 3rd party applications in the way that Apple does How do you mean? Almost everything Debian packages is authored by third parties. Debian aren't to my knowledge the original authors of LibreOffice o
457.
by zrm 7y ago
It's not really a matter of privacy record. In general manufacturers don't do it on purpose. For example, it was discovered that it's possible to extract keys from Intel SGX enclaves using certain speculative execution vulner
458.
by zrm 7y ago
It's probably the same answer to both. Demand is still high but TSMC has finite 7nm fab capacity and the APUs have lower margins. What's the hurry to release lower margin APUs if the fabs are still busy making higher margin CPUs?
459.
by zrm 7y ago
A package signed with the Debian signing keys proves it is approved by them. A package signed with the Signal Foundation signing keys proves it is approved by them. It's substantively the same thing, you're just enabled to trust m
460.
by zrm 7y ago
> The AppArmor + vendor-provided profiles doesn't work, because it means that you have to give most applications access to the user's full home directory. It works fine. Its purpose is to solve a different problem than this. &g
461.
by zrm 7y ago
> So, how do you suggest how to verify a public key for a third-party repository at scale ? We already have infrastructure for this. Here's that first line for the Signal installer: > curl -s https ://updates.signal.o
462.
by zrm 7y ago
Such a system would require all devices to be secure against key extraction. Otherwise the attacker need only choose the most vulnerable device, extract a signing key from it and sign their deepfakes with it. It would also allow any devic
463.
by zrm 7y ago
Packages have signatures on Linux. They're validated during install rather than execution, but validating them on execution wouldn't cause meaningful problems as long as the device owner can install additional signing keys. Not be
464.
by zrm 7y ago
> e.g. constantly having to allow applications access to files outside the initial default sandbox. Any system that has ordinary users trying to do this for ordinary software will fail. Things like apparmor can work well because the auth
465.
by zrm 7y ago
> I believe it's called Rust :) Yes, but no. When people design a language which they know is going to be incompatible, they tend to go all the way with it. If we're breaking it anyway then might as well do a better standard li
466.
by zrm 7y ago
Things like this work great for your own network, but you often want a VPN specifically because the network you're connected to isn't yours, especially for iOS (or Android) devices because they're mobile.
467.
by zrm 7y ago
> Every site that successfully resumes via a session identifier after the VPN is turned on can now use the session identifier and their logs to match up my real IP address and my VPN IP address. This would already be the case if the site
468.
Intel CSME bug is worse than previously thought(zdnet.com)
3 points by zrm 7y ago|0 comments
469.
by zrm 7y ago
> You're conflating privacy with trust. Confidentiality and authentication are two different things, but the things that provide confidentiality here also provide authentication. DNSSEC only provides authentication, so then you need
470.
by zrm 7y ago
DNSSEC is the least useful of the lot. It only authenticates, doesn't encrypt, so it's not enough on its own, you have to use it in combination with a VPN. But the VPN would be enough on its own between the client and the recursiv
471.
by zrm 7y ago
People keep talking past each other on this because somehow DoH got conflated with Cloudflare. DoH is a protocol. It has better security than unencrypted DNS. (So do several others, like DNSCurve, DNSCrypt, or routing your DNS queries over
472.
by zrm 7y ago
Internet gateways commonly give out the gateway's IP address as the DNS and then forward requests upstream from there. How does the application know which DNS the gateway is configured to use?
473.
by zrm 7y ago
> If your "security controls" depend upon other people volunteering to use some protocol then those weren't "security controls" they were more like "guidelines". It isn't really a matter of securit
474.
by zrm 7y ago
You don't have to refuse to take an ARM license (although RISC-V is also a thing). You may not even have to design your own chips at all -- they could just pay an existing manufacturer for design specifications and then both audit the
475.
by zrm 7y ago
Not using something that actually improves security because people might think that it actually improves security is a crappy argument. If your phone is insecure for two separate reasons you should fix both of them instead of using each as
476.
by zrm 7y ago
> good luck getting rid of that one without building your own hardware and drivers from scratch. For an individual that is obviously infeasible. For the continent of Europe as a whole, it obviously isn't. Why shouldn't they p
477.
by zrm 7y ago
You get a little more information from the DNS queries than the IP headers because of shared hosting, but it's largely the same information, so using two different providers doubles your exposure. If they're different parties, eit
478.
by zrm 7y ago
> Without a VPN sure, with a VPN,highly recommended even with centralized DoH. With a VPN, DoH is essentially redundant because the DNS query is already encrypted and authenticated by the VPN, assuming you're using your VPN provider
479.
by zrm 7y ago
> That 1% of applications is probably not performance critical and would work fine under emulation. Each application having 1% of the users doesn't mean it's 1% when you add them all together. And they're all different app
480.
by zrm 7y ago
> “All the applications” don’t matter. Getting the most popular applications is the easy part, the hard part is the long tail. Only 1% of people may use a particular obscure application, but when there are a thousand such applications, t

More ›