Buge

Even Microsoft created a video criticizing gmail privacy: https://www.youtube.com/watch?v=9x4_dozWkq0

That doesn't tell us how he was assigned to that group. It might have been a dice roll. Or maybe he chose to be in that group.

To me "would of" and "would've" are pronounced exactly the same.

If I said "would ev" that would sound weird. It would sound very similar to "whatev":

https://www.urbandictionary.com/define.php?term=whatev

I've always heard that cold boot attacks like that require the ram to be frozen before the computer turns off (or the ram is removed).

This specific implementation doesn't brick it. It just locks the screen (or you could make it shutdown).

Are there many talks about a single person's vim config? That seems like a poor topic to me, and I'm not sure how many people would consider it a good idea.

See news articles about it from the time, and a petition telling Google to stop:

https://usatoday30.usatoday.com/tech/news/2004-03-31-google_...

https://web.archive.org/web/20040604175545/https://www.priva...

And a Microsoft ad criticizing Google for it:

https://www.youtube.com/watch?v=9x4_dozWkq0

1. Forcing people to use registry edit hacks is not an acceptable UI. There's no guarantee that those registry hacks won't stop working tomorrow. There needs to a real documented way to do it.

I have Windows 10 Pro. I used to disable Windows search doing web search with the Policy Editor (forcing me to do that was already boarderline unacceptable). Now that has stopped working, and even though I enable/disable many things in the Policy Editor, web search still happens. I will be switching to Linux.

> the CIA surely has sufficient internal incentives to fix privately disclosed vulnerabilities.

Do they? Also various people could have different definitions of "sufficient". They might previously have had 3 people spending half their time on it, and this might cause them to increase it to 5 people working full time on it.

Do major tech companies (Apple, Google, Microsoft) have less internal incentives than the CIA?

This XSS vulnerability apparently took a year to be fixed: https://www.openbugbounty.org/reports/164180/

I wonder if Tesla gives different service for Model S vs Model 3.

It could also aid the CIA in making a more secure virtual fencing solution. It's similar to the debate about full disclosure vs coordinated disclosure. Some companies pay for bug bounties.

Additionally it could convince the CIA to distribute less weapons.

I don't think drawing a random tarot card will help me write a better postmortem. If I started doing so my colleagues would probably start to doubt my judgement. Maybe skimming through all the tarot cards in order to pick relevant ones might be useful though.

Or how about tarot cards for interviews? After I conduct an interview I read the tarot cards to figure out how to judge the candidate.

I said "might be", and someone might estimate a word to have 10 bits of entropy. And you previously said dictionary words, not random dictionary words, so a human choosing those words might choose words that relate to each other.

But the 10 dictionary words might be less secure than 16 random characters. xkcd estimates a word has 11 bits of entropy.

Possibly attending but not graduating (Bill Gates and Mark Zuckerberg come to mind).

>Otherwise they could have just liquidated the Bitcoin to legal tender before donating thereby relieving the recipient institutions of the challenges associated with it.

Pine's money is likely in a not-fully-legal status. That's why Pine needs to donate bitcoin, and needs to donate it anonymously, and doesn't care about receipts from the charities. If the money is not-fully-legal, it's going to be hard to convert it to dollars.

Where is that citation from? Are you quoting from somewhere? I can't find it in the article.

It's possible to criticize one part of the article (calling people amateurs) without criticizing other parts of the article.

Ruining access to a 0day sounds like a good thing to me. I don't want people to have access to 0days.

Some people dislike the term "responsible disclosure" and believe it's not a moral imperative:

https://hn.algolia.com/?query=author:tptacek%20responsible%2...

Of course what Ibrahim did wasn't full disclosure either, so he shouldn't be fully congratulated. But bragging about it was better than keeping silent about it in this case.

Yes, but the overturn wasn't based on urls, or scraping, or disclosure, or security, or damages, it was based on him being charged in the wrong state. The court system still thinks everything else about the case was fine.

> it got closed to his egregious usage.

Hopefully it wasn't just closed to him, but closed to everyone else too.

> Is this considered normal or ethical behavior for a security researcher?

weev did something similar (scraped 100k phone numbers from Apple, then shared them with a journalist) and was convicted and sentenced to 41 months in prison for it.

What was ruined? And who ruined it?

> The paper also suggests a potential change to regulation—making individuals within a company responsible for what goes wrong within that company’s IT systems. “When you personally are liable, and you can be made bankrupt or sent to prison, it changes [the situation] a great deal, including the amount of attention paid to it,” Warren says. “You treat it very seriously, because it’s your personal wealth and your personal liberty at stake.”

Being sent to prison for buggy code... that's quite extreme. Are people even fired for buggy code? If we want to get more extreme than firing, how about losing 1 year's compensation in addition to being fired.

>filters 90% of the bullshit.

Why would Apple want to filter out people from integrating with sign in with Apple? I can see they want to filter out junk from the App Store, because junk on the App Store (like junk on Something Awful) reduces the signal to noise ratio. But I don't think there exists a signal to noise ratio when it comes to sign in with Apple. A user wants to join a website, and that website either supports sign in with Apple or it doesn't; there's no noise to wade through.

If something has a default password, default private key, or trusts a default public key, and that isn't clearly documented, that seems like a backdoor to me. It would be an undocumented way of Huawei or random hackers taking over your device.

And even if it's documented, although it's not a backdoor, it's still generally bad for security. Any device with non-unique default passwords or default keypairs will generally have hackers scanning the internet to compromise them. The keypair should be randomly generated on first use. The device should prompt for what password to use on first use.

> simply being L5-L8

The article says he applied to many companies, and they all turned him down because he was too suspicious.

> Now the blog posting is inaccurate here as well, it is not the application which needs to make an interpretative dance of some kind. We actually are doing it in the kernel,

Yeah, I was thinking the article looked inaccurate there. Thanks for confirming.

How is that relevant? Why would working for a military contractor with guards and guns mean you should use an image from thispersondoesnotexist.com instead of an anime picture? Especially when your 100 friends also use an image from thispersondoesnotexist.com , drawing attention to a weird group of people who then all become admins of the same groups.

So you're saying there are hundreds of people who all create accounts at the same time, all use the same type of profile picture, all join together to be admins of political groups, and then all spend all day spamming links to thebl.com ? That's beyond belief. It's very unrealistic to think so many people would behave so identically.

SSE can deliver out of order? Is that within a single EventSource or across multiple. I thought that within a single EventSource all messages were in order.