Recent submissions

Comment · 7 years ago
Last time I was in a Silicon Valley Hotel, I had to sign a waver that I accepted that there was an Alexa in my room. Of signed it, and unplugged it (as well as the TV). I will not have these horrible things near me. The hotel claimed they would charge if you unplugged it. They didn't.
Comment · 7 years ago
There are several things going on here -- Today, banking controls the monetary supply through creation of new dollars to be loaned. Being fully backed has less meaning in a continuously inflating fiat currency world. Being backed by gold, by computation, by proof-of-stake -- these are all much stronger measures than JP Morgan Chase's core banking database.

Libra is control over monetary flows. Offend zuck, watch your public key added to the block list. Watch the balance drained from your account as the producers use 'admin' transaction powers to remove funds. Maybe the ledger maintainers simply block your transactions from being committed.

And then we have currency controls in places other than the US, like India and China. Suddenly 'stablecoin's are more useful than bank account backed dollar holdings (outside the US). This is a power grab for the future currency of developing nations. The endgame is control of planet Earth's M1 currency supply.

Comment · 7 years ago
It really isn't killing kids, and I would challenge that they are 'targeting them'. As an adult vape user, I love the fruit flavors. They are for my (adult) use only. I would never let someone under 21 get access to this. Why should I be penalized because lots of kids are breaking the law?

The recent (adult) deaths from Vaping are due to black market THC cartridges filled with vitamin e acetate. It is very likely the kids are obtaining (safe) retail product, which is a failure in retail process, not the manufacturer. While it is a bad thing that school aged children are illegal acquiring Juul -- how is this different (or even worse) than Alcohol? We should investigate alcohol vendors for making tasty beverages too. Can't have flavors that adults might like...

There is a combination of events occurring simultaneously that is making it hard for folks to objectively understand the problem, and if there is actually a problem at all.

Comment · 7 years ago
There was no Apple data breached. User endpoints were attacked, using various well crafted exploits against their software. This isn't a GDPR (privacy) issue, no company data was leaked, its end user data from their device. Apple tries to protect your data on their devices, but all software has bugs. Bad guys will try to exploit these bugs to reach their goals.

Google does research into making it hard for attackers to compromise user devices. That is the purpose of PZ team. There are no numbers because nobody has these numbers except for the attacker. I am guessing Google has some ball park numbers based on search traffic or web analytics.

If you want to know if you were affected, you need to ask yourself if powerful adversary wants access to your data, possibly because of civil unrest occurring in their territory; and if you visit strange websites related to this. Only the adversary knows for sure, not Apple, Not Google.

Comment · 7 years ago
Grabbing rootkit artifacts that could be on the device?

Its just that its not Facebooks place to do this. I wouldn't expect a app linux binary to upload the contents of /usr/lib, or a windows app to start sending system32 dll's off system.

FB can try to sell this as a 'lite-AntiVirus' type service, but that is not its place. There is no indication the app is doing this. Its FB being creepy as usual.

If Google did it, it would be less creepy, just like how Microsoft can grab malicious files detected by Defender -- but they write, support and protect the OS! FB is just an app. It shouldn't be harvesting its users operating system files!

Comment · 7 years ago
Or whomever has hacked the source control / build environment to replace the "5 magic HSM public keys" with one or more of their own public keys -- See Juniper Incident with Dual-EC DRBG (https://eprint.iacr.org/2016/376.pdf)

This story should be repeated whenever anyone brings up 'solutions' involved with key escrow. Bruce warned us in 2006 this was a backdoor, ten years later, we find that not only was it implemented by Juniper, the backdoor was backdoored by unknown (and potentially malicious) actors. Really, this should be the last word on why this key escrow and general cryptographic backdoors are a terrible terrible idea.

Comment · 7 years ago
The point, yes, but it is not the case in reality:

2015: https://cryptosense.com/blog/the-untold-story-of-pkcs11-hsm-...

2017: https://cryptosense.com/blog/infineon-rsa-key-generation-bug...

2019: https://cryptosense.com/blog/how-ledger-hacked-an-hsm/

Stop trying to build scenarios where key escrow solutions are technically sound. They are not. This is an intractable problem that is not solved by these half cocked technical measures. Key escrow cannot by definition be secure, and wasting time trying to invent solutions just confuses the matter, weakens security and leaves us all vulnerable. Basically, Sssssssh, or the politicians might actually believe this fantasy.

Comment · 7 years ago
they say 'tip in cash', but I never have the physical cash to tip. This always brings me anxiety when I dont have the physical small bills to provide. I would ensure I use a platform (as mentioned in the article, like grubhub or seamless) that doesn't garnish the electronic tips for pay.
Comment · 7 years ago
I don't think it is that clear -- he is selling access to a data set containing PII (email address or account names). Its stolen data. One can make a case that free and open access to this data set is a common good, however once money is involved, one is conducting business with data that one did not legally obtain. It is not 'perfectly legal'.
Comment · 7 years ago
And the local pawn shop has expenses too. Just because they have to pay rent and electricity costs does not make selling a stolen item legal.
Comment · 7 years ago
He can try to justify it however he likes -- its selling stolen goods. Just because you sell stolen goods under their value, or under your costs to provide does not suddenly make it ok.
Comment · 7 years ago
So fencing stolen goods is not illegal if someone else stole it? I don't think so. Stolen is stolen -- nobody has any right to sell it.
Comment · 7 years ago
I'm not following your logic? Are you saying I should join FB because everyone else is? Everything in life is ephemeral. Trends and apps come and go. This too shall pass.

My goal is to get people to question the relevance, time drain and impact to humanity that FB imposes on the world. I believe that if people did the calculus they would see the horror for what it is.

Comment · 7 years ago
I don't think you can make this claim without understand the motivation or threat models of the billions of non-facebook users. I use Google services, I do not use Facebook services. Am I the exception to the rule? How many are in this exception group?

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton