HNHacker News
TopNewBestAskShowJobs

aj3

731 karma · joined June 6, 2020

submissionscomments
aj3··on How to prevent email spoofing, using an unholy combination of silly standards
3rd party bulk senders likely know more about mail delivery than you do. Also DMARC aware recipients will treat ~ALL in SPF exactly like -ALl.
aj3··on How to prevent email spoofing, using an unholy combination of silly standards
No it doesn’t, unless said intermediaries are modifying contents and are not DMARC aware.

Many European countries are forcing DMARC adoption for government infrastructure and it works just fine.

aj3··on How to prevent email spoofing, using an unholy combination of silly standards
It’s definitely not set and forget. In the past year alone there where multiple 0day attacks against Exim and MS Exchange servers.
aj3··on How to prevent email spoofing, using an unholy combination of silly standards
Outsourcing security is a very stupid thing to do. Of course copying a line you don’t understand into your DNS isn't that much better but at least you control it.

In this case configuration is handled by an unknown entity that you no contractual obligations to you. Don’t do it.

aj3··on Email Authenticity 101: DKIM, Dmarc, and SPF
Subnet level blocking is certainly a thing, but I’m setting up new domains routinely and Outlook works fine. Even with cheap / free domains.

Lack of verbose feedback / delivery errors makes debugging issues in your own really hard, so you might want to contact someone who knows a thing or two about emails for help.

aj3··on Email Authenticity 101: DKIM, Dmarc, and SPF
No, domain reputation does not solve the problem of spam (and especially [spear]phishing).
aj3··on Email Authenticity 101: DKIM, Dmarc, and SPF
That’s a very controversial standard as it can be abused for tracking and does not really protect end users from spoofing.
aj3··on Unifying iPadOS and macOS
You can hack macOS using macOS, but kids won’t be able to get that level of understanding how OS works on iPadOS.

This is bad for IT. Maybe not as dramatic as an existential crisis but it’s certainly a lost opportunity.

My friend's daughter is 10 and she could pass job interview for a junior software developer any day simply because her first PC was running Ubuntu (it’s Arch now).

aj3··on What if Planet 9 is a Primordial Black Hole? (2019)
You're wrong despite your confidence. Cage will have zero net gravitational effect on the black hole (assuming the cage is perfectly symmetrical), but that just means it won't by itself exert gravitational force on the black hole (and vice versa) causing it to move in any direction.

Cage's material will still get attracted to the black hole and close to the event horizon structural forces exerted by gravity will be hard / impossible to counteract with current materials: https://en.wikipedia.org/wiki/Strength_of_materials

aj3··on Apple's child protection features spark concern within its own ranks: sources
No, you’re not allowed to do crime even if you kill all witnesses and destroy all evidence.
aj3··on Twitter's new font, Chirp, is apparently giving some users headaches
Explanation and comparison between platforms: https://mobile.twitter.com/mcclure111/status/142590242262759...
aj3··on Robert Graham evaluates Mike Lindell's data
Github repo with data that was provided to researchers (looks like garbage to me): https://github.com/robertdavidgraham/cybersymposium
aj3··on American parents are sending their kids to 'Russian math' (2017)
Eh, I've studied in a "respected" post-Soviet school as well and can't related to this at all. Teachers were awesome and passionate, had really thorough understanding of math (and physics, and chemistry), without any hint of elitism.

It's almost as if there are good and bad math teachers (in all countries).

aj3··on Messaging and chat control
Users need backups to protect from a device loss scenario. Apple needs to have keys for that to work. They also can’t rely on key derivation because users forget their Apple ID passwords all the time.

It is relevant because this requirement necessarily conflicts with strong e2ee. And since Apple is designing devices for end users that don’t necessarily even know or care what e2ee is, it seems completely reasonable to have defaults that will optimize for the problems that are relevant for the majority of users (losing decide and forgetting your password) while making strong e2ee a few clicks away to those who need it (and understand associated tradeoffs).

aj3··on Apple’s Mistake
1. Previous submission (http://www.hackerfactor.com/blog/) claims that PhotoDNA is reversible to 26x26 grayscale

2. What’s more important is you can reverse engineer algorithm that’s used locally to compare these hashes. Unlike with cloud-based searches other providers run, this puts significant limitations to what Apple or LEA can do on your phone. E.g. they can’t extract strings from PDF or grep through image metadata or request all images of certain users without knowing what these images would depict in advance. The frequency of hash database updates even if opaque will still provide more insight into what is being searched for compared to current status quo where public has zero insights because all search / aggregation queries are run on the server.

aj3··on Apple’s Mistake
The problem with rummaging through someone’s drawers is that this is done by people who in that process will inevitably find out much more about your life than binary “has CSAM / does not have CSAM in their possession”. There’s no viable way of limiting scope of such rummaging and there is no way to make individual officers forget what they’ve seen.

Apple’s system on the other hand provides such guarantees, so I don’t see how it can be compared to these hypothetical rummaging operations.

aj3··on Apple’s Mistake
That's a pretty idealistic view. I guess the issue boils down to whether you believe there are things in digital realms that are illegal to possess.

For comparison, it's pretty obvious that there are certain things in physical realm that citizens shouldn't have. So it would be wrong to claim "my things are mine and no one should be able to inspect them or take away from me, no matter what those things are". Examples for things citizens should not posses: weapons of mass destruction and slaves.

Apple et al argue that CSAM should be digital content that nobody ought to possess. So while you're obviously technically capable of storing it, it shouldn't be legal.

aj3··on Apple’s Mistake
On the other hand, Google can run arbitrary queries over your data (published to their cloud) while Apple uses the same algorithm and hash database for everyone (which probably will get reverse engineered and audited by next BlackHat).
aj3··on Apple’s Mistake
Meh. Dropbox and Google Drive can run arbitrary queries over your files stored there. iCloud (assuming they finish e2ee transition) will have to push the same hashes to everyone. It's not transparent and we don't have a way to inspect what exactly are they searching for, but at least there's a way in principle to reverse engineer the algorithm and to monitor how often hash database gets updated.

In my book that's a step in the direction of privacy, compared to old status quo.

aj3··on Messaging and chat control
Nirvana / perfect solution fallacy: https://en.wikipedia.org/wiki/Nirvana_fallacy
aj3··on Messaging and chat control
Analogies between IT and physical world are often less than helpful but before digital photos most people would be developing photos in specialized studios. If these studios noticed what they thought was CSAM they would report it to police. One could of course develop photos themselves (like one can selfhost everything today), but as soon as other parties get involved they can (and should) report problematic material to police.
aj3··on Messaging and chat control
This option is transparent to the user and easy to change. Also, anyone who has done IT support will appreciate that yeah regular users actually want / need backups enabled by default, it's often a life saver for them.
aj3··on Messaging and chat control
Meh. Compared to 10 years ago we still live in a bright future where e2ee is available to everyone who needs it. Yeah, you might need to enable some options (like in Telegram) or disable some other options (like iCloud in iMessage), but it's still there.

Even with this on-device CSAM thingy, Apple knows less about you than they did 10 years ago and random staffers at FAANG can't just go and spy on their spouses (the way they could not that long ago).

aj3··on Messaging and chat control
Try stuffing pendrive there and going through airport securiyt. We're already checking for this (effectively).
aj3··on Messaging and chat control
AFAIK, ML image classification is used for checking user-generated content on social networks, forums, etc. Cloud storage, email and IM providers will continue using hashes (either exact or perceptual) to lower false positives.
aj3··on Stupidity is a specific cognitive failing
Now we have cyber domain where this is definitely not true.
aj3··on Apple’s new abuse prevention system: an antritust/competition point of view
Reviewing potential matches sounds like an awful job. Retention might be even lower than in those FB abuse centers.
aj3··on Apple’s new abuse prevention system: an antritust/competition point of view
[citation needed]
aj3··on Apple’s new abuse prevention system: an antritust/competition point of view
I'm pretty sure child abuse is a criminal offense everywhere. That's quite a disincentive.
aj3··on SAML Is Insecure by Design
Well, it is de facto standard in Microsoft world. Honestly, I don’t actually share author's opinion, but it is well presented.
← PreviousPage 3 of 9Next →