breser

* He died because a police officer knelled on his neck after he was already in handcuffs for 9 minutes and 29 seconds. https://web.archive.org/web/20210410114811/https://www.start...

* They had him in the car but then pulled him onto the ground and started kneeling on him. There were 4 officers present at that point. They did this despite calling for EMS. They did this despite Floyd saying he couldn't breath. They did this despite bystanders pointing out that he couldn't breath. The position continued even after he was clearly unconscious. They only got off his neck when EMS arrived and told them to. With EMS on site and asking for Fire Department help, the police didn't direct the Fire Department to Floyd, delaying their help for 5 minutes. https://www.youtube.com/watch?v=vksEJR9EPQ8

This behavior was so shocking that these officers were convicted of crimes for their behavior. It is VERY rare for police officers to be indicted, let alone tried and convicted for killing someone. I seriously doubt that they would have been tried and convicted if it weren't for the shocking video showing them kneeling on his neck for a long period of time.

I find it impossible to reconcile police refusing to do their jobs with a VERY rare conviction for misconduct that is so utterly shocking. If you don't want what happened to those officers to happen to you, simply don't kneel on someones neck for a long period of time. Carrying out a search warrant for a laptop is unlikely to result in that sort of situation. Simply because there's not really a good explanation for any of the behavior that resulted in Floyd's death on the part of the police.

Maybe they choose not to do their jobs for the other reasons you gave. But the facts of the George Floyd case do not support your conclusion.

Comment · 4 years ago

For what it's worth the phone portion is a voice call where you have to enter a number with touchtone.

Comment · 4 years ago

You do not have to even talk to AWS to remove the MFA from the root account. You simply need access to the phone number on the account (though there are ways around the phone number, see below) and the email address for the root account.

It's been a little over a year since I've done it but as I recall this is how it goes. You receive an email with a link that takes you to a site that starts a verification process via the phone. You get a number from the site that you are prompted to enter when they call you on the phone. Once that's done you can log into the account with the MFA device and then even remove the MFA device entirely.

The email address I believe can only be changed by AWS (and at least the last time this was an issue for me can't ever be reused for a new AWS account).

The phone number can be changed by anyone with aws-portal:ModifyAccount, which probably means someone with admin access. It is NOT restricted to being modified by the root account.

So if you have a working access to an account with that permission and access to the email you can change the phone number to one you have access to and go through the whole process. Meaning if you have the above permission you really only need access to the email.

Link to the documentation for this flow: https://aws.amazon.com/blogs/security/reset-your-aws-root-ac...

Comment · 4 years ago

How excellent the ASN.1 tooling is depends on which subset of ASN.1 you're using. Some of the tooling supports one iteration of ASN.1 or the other. To the degree that the IETF had to write a document on how to deal with this since some of the standards use the older ASN.1 and some use the newer ASN.1: https://tools.ietf.org/id/draft-ietf-pkix-asn1-translation-0...

Interoperability with ASN.1 is very fragile at best.

Comment · 4 years ago

I know of at least one problem with ASN.1. The string encodings other than UTF-8 are terrible. Most of the string encodings are very limited and weird subsets of ASCII that nobody actually uses anymore. ASN.1 itself doesn't define the encodings and just refers to other standards.

The problem with this is probably most notable with the T.61 encoding which changed over the years and since ASN.1 references other standards nobody is quite sure exactly what you have to support to have T.61 actually work right.

Within X.509 certificates though nobody bothers to actually implement T.61 and just uses the T.61 flag for ISO-8859-1.

There are a bunch of gory details around this mess in this (now quite old) write-up here: https://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt

Since that write up I believe UTF-8 is pretty much the expectation for character encoding for X.509.

I documented some of the quirks around 6 years ago when I took an existing X.509 parser and improved it for use in certificate trust management in Subversion: http://svn.apache.org/viewvc/subversion/trunk/subversion/lib...

Basically ASN.1 wasn't well defined and it only works well when people agreed to only use certain features or to interpret things in a particular way when ambiguous.

It's also notoriously difficult to parse well. It's very easy to have bugs in your parser, even if you're implementing a subset of it that's needed for X.509. Especially if you're doing so in a non-memory safe language.

I can't speak for why Google invented Protobufs, but I can't imagine anyone sane picking up ASN.1 for anything modern and deciding that this is what they want to use.

Comment · 5 years ago

There is an option in the settings to make it not actually call unless you press a further UI button on the iPhone.

In Settings go to Emergency SOS. Uncheck Auto Call

Comment · 5 years ago

I think you need to turn on the power button clicking 5 times feature by turning on the "Call with Side Button" option in Settings under Emergency SOS. I'd also suggest turning off Auto Call if you want to use it like this.

Yes this is kinda buried and not clear at all that this function also disables FaceID but it does.

Comment · 5 years ago

At least on iPhones though they have a way to activate a mode that prevents the use of TouchID and FaceID. If I press the power button on my phone 5 times in a row that turns that off.

Yes I still run the risk of my device being unlocked against my will if I'm caught by surprise. But I'm able to disable this functionality in places where I think the risk of that may be higher, e.g. while traveling.

I'll still take the trade off of longer password (not just a few numbers) on my phone while using a biometric test for normal access.

Of course not everyone may have the same threats to consider and others may make different choices. Doesn't make either of our choices wrong.

Comment · 5 years ago

Could be. I don't believe the old fobs were bluetooth.

For what it's worth I also didn't mention that at least the old fobs also had an RFID in them that if the battery was dead you could just hold them up to certain spots on the car to open/drive it.

Comment · 5 years ago

No the car does not require a remote connection to work. See my detailed explanation here: https://news.ycombinator.com/item?id=29283262

Comment · 5 years ago

There are 4 ways to unlock a Tesla.

* Via Bluetooth from your phone. Model 3 and Y used this as the primary way of unlocking. This does not require a Tesla server. It's just local communication between the car and the phone. The car and the phone are paired.

* Via a key card. Model 3 and Y use this as the method when you get the car until you pair it with the phone and what you use if you want to give someone temporary access to the car (e.g service, valets).

* Via a key fob. Model S and X used this in the past (not sure if the latest refresh changed this but older S and X vehicles didn't support Bluetooth or Key cards) as the primary method.

* Remotely via the phone app. As in you make an API call to Tesla with your Tesla credentials and Tesla sends a remote command to the car. This requires Internet access for the device making the request and to the car in order to receive the command. This last bit is what's broken. Given the requirements this has never been very reliable and nobody would want to use this on a day to day basis.

So I seriously doubt very many people are locked out of their cars. I am able to get into my 2015 Model S via the key fob and my 2018 Model 3 via Bluetooth from my phone.