eh78ssxv2f
Joined 10 years ago
Karma
531
Submissions
162
Member since
Dec 11
Recent submissions
Comment · 5 years ago
Comment · 5 years ago
Do we know the reasoning behind the bias?
Comment · 5 years ago
I don't understand how gnucash is more critical than Arduino, wine or nginx. Is gnucash very widely used?
Comment · 6 years ago
Exactly.
Besides privacy and obvious web-centralization issues, there are bunch of security issues associated with proxying the traffic. Apple and Mozilla brought these issues to the attention of Google during SxG spec discussions. At that time, Google's rebuttal was that SxG is a opt-in feature for sites.
Quoting from [1] (Mozilla's official position on SxG): "Sites opt-in to using this mechanism, and in doing so need to be aware that this comes with some risks, but in doing so they enable a new feature".
This time, Google really did not handle any of the previously discussed security/privacy concerns. Instead, they just went ahead and started proxying the user's traffic without the opt-in from the users or the sites.
[1] https://docs.google.com/document/d/1ha00dSGKmjoEh2mRiG8FIA5s...
Comment · 6 years ago
I commented on [1] too, but it's worth mentioning here as well as it clearly shows the stark difference between Google and Apple/Cloudflare.
Apple/Cloudflare are working on privacy-friendly protocols that reduce the amount of information exposed to them [1].
At exactly the same time, Google here is working on proxying non-Google browser traffic through them without consents from either the user or the publisher.
Comment · 6 years ago
What a stark difference between Google and Apple/Cloudflare.
Apple/Cloudflare are working on privacy-friendly protocols that reduce the amount of information exposed to them.
At exactly the same time, Google is working on proxying browser traffic through them without any consents [1].
Comment · 6 years ago
How do you guarantee anonymity to the users filling out the survey? The surveyor could send different increment URLs to different users.
Comment · 6 years ago
For Enterprise Android devices (i.e., the one owned by the employer), the employers always had the option to install device management policy and disable parts of the phone based on those policies (e.h., remotely disable phone of an employee that was terminated). The other evergreen use case is for the parents to remotely disable/control/set policies for the phone for kids.
In this case, the telcos are just using the same device management policy. They can do so because they own the phone (have physical access to it and their legal contacts allow them to do it). I don't think Google did something specific here to enable this feature for telcos.
Note that the iPhones also has similar feature. So, switching is not going to help.
Comment · 6 years ago
> A search engine from a non-advertising-supported company is great news.
Currently, Apple actually gets money from Google for selecting the latter as its default search engine. Not only Apple will lose that money but would also need to dump money in developing + maintaining the search engine.
May be their goal is to just provide a more privacy-sensitive search but I'm a bit cynical about that motivation. So, the economic model is still unclear to me.
Comment · 6 years ago
> No the concern is they aren't subject to the laws of our land
What specific laws of the US land are they not subject to?
Comment · 6 years ago
Agreed. In my mind, if the server is using plain HTTP, and the attacker has control over parts of the network, then plain-old DNS is not the only attack model. The attacker does not need to hack DNS, they can just manipulate the content on the wire.
Recent examples: Google tracking users per Chrome installation ID [1], Chrome exempting Google sites from user site data setting [2], Chrome experimenting with silently proxying user traffic through their servers [3].
[1] https://news.ycombinator.com/item?id=22236106 [2] https://news.ycombinator.com/item?id=24817304 [3] https://news.ycombinator.com/item?id=25337995