ufmace

It's not clear, which makes me skeptical that this is all that serious of an issue.

I'd like to know - can any devices actually put such a malformed message onto the carrier network? It probably requires at least a custom app that would never be allowed on an app store, if it's possible at all. And do any carriers actually let it go through their network and to a device like a normal message? It's entirely possible the malformed message would crash some software in the carrier's processing stack first and so never be delivered. And if it doesn't, they could easily add a check to block such messages. It's difficult to believe they don't already have some sort of protection against spamming tons of messages to any device. It's also entirely possible it works differently on different carriers, and some but not others might add blocks for this but not make a press release about it or anything.

This seems more like meh, minor bug, fix it quietly in the next Android release, not OMG the world is on fire to me.

I think the point is that this is completely the opposite of the narrative that was pushed about this bug - that there would be thousands+ of AI agents actively compromising every vulnerable site automatically regardless of value within minutes of the fix being released into the wild. Well, now it's 3 days after, and this has been up for 3.5 hours, and nobody has taken it yet.

I suppose it may not be there for actually taking it, but it does serve as a good demonstration of the realistic risk for average people running relatively low-value PHP sites. If nobody thinks it's worth the risk of exposure for a quick and easy $1k in Bitcoin (at the time I'm writing this), why would anybody bother hacking a site that's basically worthless, like the dinky little Wordpress blog I run?

This does effectively make the statement that, there probably are exploits out there for this, but even with a non-updated version, you're not at much risk unless someone with serious resources thinks they can make pretty big money from compromising your thing.

I was just checking them out as a possible place to move my DNS names to. Looks like it's a whopping $0.50/month if you use their nameservers per address, plus $0.40 per million queries, prorated, So probably tough to spend more than $1 a month on without having Google-scale and spending way more than that on servers.

I'm all "well shit" reading this, I must have missed all of these issues. I'm not 100% sure, but at the moment, I'm thinking, AWS.

I know, Amazon isn't super cool, and are imperfect in a bunch of ways. But at least it appears to be highly configurable and cheap, and Amazon ain't gonna get bought out by private equity and enshittified, legally bullied into oblivion, generally has pretty good quality and competent support, and has plenty of experience in not handing the keys to your castle of services to any random phone caller with a sob story.

I actually use both. Bitwarden with a strong password and auto-locking for anything that needs actual security, or can manage to keep a session logged in. Chrome's built-in password manager is nice for a few sites that are not really that important at all (a few forums and local activity groups), yet for some reason keep requiring password reentry all the time.

I don't work for Telegram, I just enjoy pushing back against the cryptography ideologues demanding that we put up with lower-quality apps for benefits that are somewhere between dubious and imaginary. Like all ideologues, they always devolve to personal attacks when you point out how bad their arguments are, which you have done right on cue.

> I might know something about this topic as I'm the only person who has created messaging system that gets around that issue.

And there it is. The only person in this thread "shilling" and "trying to control the narrative" for their own personal benefit is you. I'll refrain from being condescending about it the way you have though.

You're also going into straight conspiracy theory territory here. Telegram is allegedly a FSB op, or maybe NSA or whoever, even though the current Russian government doesn't seem to like Telegram or Durov, their CEO, much. Definitely don't worry at all about Signal's leadership and funding though!

>>I think it's simplistic and short-sighted that many tech people seem to think that "security" means E2EE and absolutely nothing else.

>In private messaging apps security begins with E2EE.

This may be clearer from a product point of view. Your apparent viewpoint, and that of Signal etc, seems to be that protection from the server (and admittedly whoever can coerce whoever owns the server) is the only thing that matters, no matter what other features you have to throw out to get it.

What I am calling out is that this is a fundamentally ideological point of view. You can believe that and act according to it if you want, but general readers should be aware of what they are losing in order to enact this ideology with benefits that seem to be a bit dubious in the real world.

It is well known that Meta is happy to hand over to any legitimate law enforcement agency any content they have. To the best of my knowledge, Telegram never has, and neither has Signal. The fact that Telegram potentially could someday seems more theoretical to me. Again, to the best of my knowledge, all actual leaks of messaging group content have been by various authorities compromising individual devices and/or their owners, which works equally well against Telegram and Signal.

Meanwhile, Telegram gives you a lot more practical security regarding what information to share with other users, and how to manage what other users can do in large chat groups, which seems like a much more real-world concern regarding actual dangers to users than what the company that owns it might potentially do at some future date.

I think for real security, it's better to pay attention to the business model of the company that runs it. Meta's business model is indeed to basically sell your data to advertisers. Telegram does not do this, and shows no signs of wanting to. Instead, you can pay for premium, and they allow advertising as messages in public channels, and they're doing some semi-dubious stuff with cryptocurrency. Signal seems a little weird, they are apparently funded by some sort of donations from unknown parties. It seems to work okay for now, I guess, but is their financial future any more secure?

>>so you're screwed if you lose that.

>No you can keep backups in the cloud these days to recover your account. Unlike Telegram, the backups are actually encrypted so that the service provider can't read them.

I wasn't talking about that, but about the ability to de-auth your mobile device (the one probably most likely to someday get lost) from another device, since no one device is the "primary". Yes, an attacker could potentially lock you out if they get into your Telegram on the compromised device before you get on one of your other devices. But on Signal, you're screwed if it's your mobile, and fine if it's any other device.

Though since you mentioned backups, I think Telegram's way is arguably more secure. Individual user backups, even encrypted, means all your communication security is at the mercy of whoever in your group has the weakest encryption keys and backup storage location. With a centralized system like Telegram, it's never anywhere but their servers.

Telegram has way, way more features than Signal. First-class clients on every OS, much better behavior for large groups, far more sophisticated and granular permissions system for admins in groups, voice and video messages, folders for chats, etc.

It also has way more security features too, such as the ability for any session to de-auth any other session, while on Signal, only one mobile device is your "primary", so you're screwed if you lose that. Also tons of detailed permissions for who is allowed to see what information of yours and add you to groups. The only thing Signal actually does better is E2EE for groups. I think it's simplistic and short-sighted that many tech people seem to think that "security" means E2EE and absolutely nothing else.

How to "fix" it depends a lot on exactly what your goals are.

It's pretty spooky if you ask me.

If an AI tool could possibly replace Photoshop with a prompt and a few bucks worth of tokens, do we really need the app at all - why not just ask the AI directly to do whatever it was you were going to do with the app?

But then one step further, why should any of us have jobs at all? If AIs can do almost anything a person at a keyboard can do, maybe 85% of the quality, but instantly for anything for a few bucks or less, is there any point in paying any of us at all to do anything we could do at a keyboard?

I wonder if it's going to come to that in 10 or 20 years.

Pretty much the same for me, except I'd say it's probably for the best. I'm also not thrilled about Chromium's total dominance, but I don't think Kagi, small as they are, are going to be the ones to break it. I don't have particularly high hopes for it as a pure open-source project either, but best of luck to whoever picks up that torch I guess.

What's the ratio of press releases announcing their intention to switch to actual computers running NixOS being used by low-level bureaucrats reliably for their day-to-day work?

Actually, we better invert that ratio, dividing by zero doesn't work very well no matter what OS you're using.

I've used and defended ChromeOS for power-users for a while now, though I'm rather less interested in it after the last year or two, and especially with this "Googlebook" push.

The good of it is, you get a state-of-the-art browser, constantly auto-updated against any security vulnerabilities and locked down against any type of hacking or malware, with first-class support for audio, video, bluetooth, and things like that that have tended to be hit-or-miss with Desktop Linux on bare metal. Contrary to lots of tech community noise, UBlock Lite continues to work fine and is perfectly adequate for blocking ads. You can indeed save local files and use them fine.

You also get a full Linux OS with command-line and desktop apps working fine. Pretty much everything you could want to do Linux-y works. Android apps work locally too, if that's helpful to you. So it seems, or seemed, like the best of both worlds to me.

Alas, nowadays, Google seems rather less interested in it, and Googlebooks sound much more limited to me. Meanwhile, Apple also discourages, though has not blocked (yet?) installing apps outside their App Store, and wants you to keep all your data and messaging in the Apple ecosystem. Microsoft is trying to do the same regarding apps, and apparently, at least some configurations of Windows 11 will force you to log in to a OneDrive account and then upload your files to it, delete them locally (!), and try to bill you to access them if they take up more than a gig or something.

I already decided months ago anyways that my next laptop is going to be a Framework running native desktop Linux, since it's much easier to troubleshoot in the LLM era, and it seems like every other desktop OS just keeps getting worse.

I don't understand why it's so common for Europeans to act like they speak for the entire rest of the world outside of North America.