libdjml

This entire piece and author lost me within the first paragraph.

“and soon Google” links to a complete unsupported fluff piece from November, drawing a loose connection to an activist investors letter.

That would be a terrible business strategy.

If someone comes forward with legitimate good security vulnerabilities and you don’t pay out, you’re massively encouraging them to go to shady brokers next time.

The twice-linked brief article states that basebands have full OS memory access, which is not true in 2018. And the article is completely uncited.

Fortunately, Australia doesn’t make any phones or popular e2e software.

Agreed. If anyone thinks it’s a legitimately bad book, feel free to discuss why.

There are a load of criticisms you could call out about google, but suggesting that their “one primary platform and single focus (social media)” is about to collapse is not valid; they’re far too broadly invested (from mobile phones to search to email) to claim they’re about to become irrelevant.

> Just go sit somewhere and turn your attention inwards

Perhaps you were born with a natural instinct for what meditation is, what to do when thoughts arise and you go off track, how to sit comfortably, what you’re aiming for and what you’re not.

But I didn’t, I needed to read books to start my development. I absolutely don’t think children should know this.

Given the posted article is about the poor security posture of most home routers, has anyone inspected ubiquiti?

I gather they have a bug bounty which is a good start, but so do Netgear and their routers are still full of bad vulns.

Yeah it seems like RCE in the context of Chromium, but not SQLite? I know it’s pedantic but if this is RCE in SQLite because it’s exposed to the network via other software, every vulnerability is “remote” because you may expose it via other software.

Remote implies it can be accessed remotely, is that true, or did they mean “remote if an attacker can remotely send data to SQLite”?

Good question, to which I don’t know the full answer. But if you look at their motto “move fast and break things”, insistence on pushing new features as fast as possible, and the recent clash and resignation of their CSO, I’d say google are just more mature about security, and understand their products are entirely reliant on trust of their users.

Agreed. If you’re trying that hard to build a relatable hook, maybe what you’re writing about just simply isn’t that important/useful?

I highly doubt this is a off the shelf Wordpress install. In fact, a standard WP is not > 1gb of data, which the post describes.

There will be a massive amount of customization, so revealing source code probably is a security risk. I’m willing to bet a competent code auditor could find secondary vulns in that code.

There’s IBB; the internet Bug Bounty. But it’s for widespread open source software. Typically FOSS that isn’t well funded yet is critical to massive parts of the internet. Popular libraries, email & DNS infrastructure etc.

Ebay being a private company with boatloads of money is definitely not a part of that.

> I still don't understand what this has to do with blockchain.

Funding from VCs?