bjornedstrom

If you look at the article I linked, you can clearly see that the satellites are visible from the ground (the photo from Germany). If you search for "starlink" on Flickr you can see more examples.

This is light pollution.

If you look at the second animation closely you can see that there's a piece of spring steel one one side. In the animation it's only a 1-or-so pixel line. But that piece of spring steel open in one direction, but in the other direction it's stiff enough it will push the arm instead of bending.

I feel bad for the author for publishing this article.

If your (the author) mindset is that "everyone else is an idiot", be it management, or regulators, auditors or some other group that is not your group (engineer?), then unfortunately you have an attitude problem.

If furthermore you maliciously misinterpret the other group, saying "they want us to be compliant, not secure", based on misunderstanding the domain expertise _of your own group_ (!), then you are a liability to your business and should be kept at arms length from external auditors.

Because the author clearly has no clue what he is doing, and based on his technical shortcomings he is speaking down on others who are _actually_ doing their job correctly: the auditors.

Why is the author comparing bcrypt using 32 iterations with sha512crypt with 5000 iterations? Why not increase the sha512crypt iteration count by orders of magnitude if he want the hashcat test to fair equal or better under the testing methodology in use? Why is he using hashcat and basing decisions solely on that tool? Why is he using shacrypt at all and not a a proper KDF, such as PDKDF2, plugging in SHA2?

That "#:~:text=" highlighter is so annoying it has made me switch from Google Chrome to Firefox.

I've lived in the inner city parts of Stockholm most of the time (Östermalm/Norrmalm, Södermalm, Kungsholmen).

I would definitely not wear 500-600 USD headphones in any of those areas.

But I think crime in Stockholm is a bit off topic. However I don't think the inherent risk of being robbed - wherever you are in the world - is off topic for the discussion.

People rob kids of Airpods all the time, because it's a status item. These new Airpods will be a status item too. This will increase the risk of robbery - be it in Europe or the US or elsewhere.

I'm sure there are larger cities in the world where the likelihood of getting robbed is low (Tokyo?), but that'd be the exception rather than the norm.

A bit off topic, but if you wear those around Stockholm, Sweden where I live, you will probably be robbed.

I never really understood the combination of noise cancellation and home use only. I think noise cancellation really shines when out and about in public, like the subway. But I can't imagine anyone using those things on the go, at least not where I live.

As a security professional I 100% agree with the author.

The comments here on Hacker News seem to have tripped on the examples given (keywords: politicians, journalists) and turned this into the more generic and politically loaded discussion whether it's desirable to "cryptographically verify" what politicians write.

But that's not the point! The point is that DKIM is technically not designed for this use case and the way people misuse DKIM for this unintended purpose is highly problematic from a cryptographic and engineering perspective.

I think the best way to think of DKIM is that it's a "cryptographic protocol" in the sense that git is a "cryptographic protocol" because it uses SHA1. If you think "PGP" (not the best example :-)) or "Telegram" you have the wrong idea: DKIM is a bunch of cryptographic primitives haphazardly bolted on email to solve a specific problem. It's not good cryptographic design because good cryptographic design anticipates unintended usecases and deal with them appropriately.

1) Read the DKIM RFC.

First of all the only field that it's required to sign is the From: header (see RFC, section 5.4). So you could still forge an email but have it pass a DKIM signature check.

If people believe that DKIM "cryptographically signs" e-mails in the sense of PGP, then that's a problem, because that's not true. A DKIM signed email doesn't actually say anything: you have to look at the signature which part of the message are signed, which is not standardized.

So you could have this situation when people, like journalists or even people on Hacker News, think a forged email is valid because it has a valid DKIM signature (but the signature is over the From: header only). E-mail is complicated as it is without having to explain to people who have binary classified an email as "forgery" or "not forgery" based on a specific combination of email-headers and DKIM signature specification. Let's not do that.

2) Look at what mail providers actually do with their DKIM keys.

For legacy reasons due to DNS providers and length of TXT records, many large internet providers use DKIM keys that are 1024 bit RSA.

Already 10 years ago, most standard bodies started to recommend against the use of 1024 bit RSA. It's deprecated. Like MD5-deprecated.

The fact that many service providers use the same key for all emails for all customers and reuse that key for years, increasing the likelihood of the key being leaked, is another case against trusting DKIM for this purpose.

Didn't expect to find one here at Hacker News. 698... so you must have started around the early 00:s or thereabouts?

Unfortunately I share your same statistics: I was very active in the early 2010:s and in that period I lost about 10 friends/acquaintances. Since then even more people I've hung out with are gone.

So yeah: wingsuiting is dangerous. But BASE itself can be done "reasonably" safely I think: personally I was always more fond of slider down (low) stuff, like buildings, and in my mind that's a safer sport than wingsuit BASE.