DethNinja

Sorry, it was meant to be USSR (Union of Soviet Socialist Republics).

- Hired a journalist on some mid-size news company to tarnish the company’s reputation. I never imagined they would bother to do this, but I was wrong.

- Used an APT for hire but I don’t believe they did succeed , still it is quite insane. I was lucky enough to catch a targeted rootkit but issue was quickly remediated. I’ll eventually find a consultant to analyse the Win 11 rootkit. They were definitely not script kiddies.

- Some black hat SEO and shills for hire, but that is expected.

I’m really surprised by hired journalist / APT aspect. Something I never imagined would happen, but apparently it does happen.

On the other hand, my first self-funded startup got destroyed by a VC funded venture. They had a worse product but far better marketing and they used every dirty trick in book to tarnish my company’s reputation.

There is no way I’ll start another startup unless I receive backing from a huge VC company.

Current economic paradigm is more similar to centralised/controlled economies of USSR. Thus if you want to succeed, you will need friends with connections to central banks.

So was the company the best in their field? I sometimes see small / badly managed companies pull such interview processes and it is ridiculous. You would expect they would hire 100x engineers with these tasks but I wonder what they are exactly looking for.

Do a16z invest in small scale AI companies? Or are they only doing series B+ investments?

C++ - Botan

C - Redis

It is just a precaution measure, some of the malware like DDOS Bots might persist more than 6 months.

Honestly, an immutable OS would be more ideal but it isn’t very realistic. If you are adventurous, it would also be possible to setup a system where host image gets rebuild every night and persistent data gets pulled from a git repo.

This is a pretty good guide.

I also recommend manually reading/checking the the BIOS EEPROM and re-installing the OS from scratch at least every 6 months. This should mostly eliminate most of the advanced threats.

You can setup an ansible script to re-install everything so it can automated.

You should absolutely never release a commercial binary to public with debug symbols.

There are ways to convert symbol names on the crash report server, so the claim that you can get better crash report with debug symbols is not correct.

Why you shouldn’t release debug symbols:

* It helps patent/copyright trolls litigate you easier.

* Makes it easier to reverse engineer your binaries, which will help malicious actors and competitors.

* You might lose some trade secrets.

If you are a startup owner, please ensure to never release commercial/close-source binaries with debug symbols. You can thank me later.

How did they target the group though, did they just scan the internet traffic and said, oh wow there is a group of people who only talk through Signal, or were there another precedence?

YouTube is horrendous, I keep reporting couple of animal abuse videos but platform just keeps them.

Some of these videos especially with small animals like hamsters have millions of views, so I guess there is a monetary incentive for them to keep such videos.

Flatpak isn’t ideal and it has lots of room for improvement but what is the better alternative?

I would say that at least Flatpak is on the right direction.

What is the use case? I’m guessing just to store secrets but then why not just use a HSM or even yubikey.

Are shadows really that annoying, I’m willing to bet that most of the gamers would just glance over these defects.

Allow your software to display ads, and other people purchase them directly.

It might be hard to implement it in a week but a hastily put AWS & stripe solution might work.

If you do ever implement it, do mention it on HN, I would definitely buy couple of slots.

Animals definitely do dream, any cat or dog owner can tell that but even smaller animals like rats do also dream.

We are vastly overestimating the cognitive capacities of humans, we should in fact have higher respect for other intelligent species living with us.

Is it possible to build a system where nobody owns private property but is happy? Very unlikely but theoretically possible.

Main problem is that current ruling class is mostly comprised of psychopaths and what they actually mean is that “We will own everything, you will own nothing, and you will be happy or else!”

I think “You will own nothing, and be happy” can be utopic but we will first need to eliminate genes that cause psychopathy first.

But you can just issue an identical certificate to an existing website's certificate via the private key, it doesn't even need to enter to CT logs, it will have 100% identical fingerprint to original certificate, no?

You can then intercept everything through the ISP gateway. It would be theoretically possible to fragment the entire internet this way via coordinating with the ISPs.

In my opinion, most of the governments must have obtained access to numerous Certificate Authority private keys by now. As a result, they would not only be logging DNS records but also the entire unencrypted data transfer.

I think lesson to be learned here is that centralized systems such as the internet, due to CAs (including Cloudflare) and ISPs, are unsuitable for private communications.

It is so sad that so many people won't experience late 1980s and early 1990s era of the internet, which was devoid of extensive surveillance and censorship.

Hopefully, humanity will somehow figure out a superior, decentralized communications platform to ensure privacy. However, the current internet offers no such guarantees.

My recommendation at this stage is to assume that government and supranational organizations control the entirety of the internet and act accordingly as if internet had no privacy.

I’m new to Linux kernel programming & eBPF (just started last week) and I’m having major troubles with eBPF verifier. I honestly feel like it would be easier for me to write a kernel module than eBPF code.

I do wonder if this is the case for many people. It seems verifier is a bit unpredictable and makes eBPF programming quite painful.

If MSI ever updates the BIOS of your motherboard with new / assumed to be unleaked Intel keys, then you will need to reflash it with the new BIOS.

So, you need to do a manual BIOS update to fix it.

I guess lesson learned here is:

Always self-sign the secure boot keys, do not use any third-party keys.

Unfortunately, this complicates the kernel & boot loader upgrade process as one shouldn’t keep private keys in the same machine.

It is so funny to me that every time BTC price rises, FUD articles come out of the woods.

I wonder if somebody built an automated process for this, or there is still a human element to it.

If OpenAI has no moat, how come nobody has built a better alternative to GPT-4 yet?

AI can definitely help remediate the bugs but it is all about incentives. One would hope browser and OS vendors would use AI to remediate vulnerabilities but vast majority of software vendors won't ever use it.

Also, automated vulnerability finding is very much real and already used today. This isn't something that has just become viable via LLMs, but I guess LLMs can enhance it:

https://github.com/angr/angr

How do you propose we fight government/corporate astroturfing?

At least LLMs will democratize the astroturfing.

Why is PIN insufficient? Assuming encryption algorithms are sane, a 20 character long PIN should be able to achieve adequate entropy to keep the data safe.

It is just common sense.

Traffic correlation: All the large state actors are well capable of recording every single IP transaction between devices. You can create detailed correlation maps from these transactions. Considering that this wouldn't cost much for state actors to implement, one has to assume such traffic correlation systems currently exists.

Node compromise: It costs less than 5 dollars a month to create a TOR node. There are currently ~8000 TOR nodes/relays in existence. That is 40k USD per month (at most). Do you really believe state actors can't afford 40k USD per month to compromise the vast majority of TOR nodes? Even a single millionaire can compromise the vast majority of TOR nodes.

Another problem is that TOR is an outdated privacy tech. considering modern state actor capabilities. Mixer networks + network jitter is necessary to protect privacy at this stage, yet no such project exists yet.

TOR is not a good option for privacy. Currently only valid option for privacy is external Wi-Fi jacking and ensuring you don't send any private info like CPUID.

Or alternatively, you can hack routers/computers and put your own TOR nodes in them, then you can only use these known nodes.

Anyone on HN working on CBDCs? Would you be willing to give us some insider info about it’s inner workings and how similar it’s architecture is to existing cryptocurrencies?

Hash verification is extremely important to protect against supply chain attacks on apt.

Also, apt itself is supposed to be protected by distro’s key, but did any distro ever wrote how master keys are securely stored? Is there any other reasonable way to know that apt and entire Linux supply chain hasn’t been compromised already?