apecat

No, I find them to be a lot more ambitious than that. Worth browsing around the site, and you'll see it's not spammy at all.

If you run a serious web project, ownership of domain names is critical asset management, especially if you care for privacy. If the current domain was to get hijacked by someone's commercial ambitions, the site would probably be reworked towards the kind of BS VPN blabbering you described.

I don't agree with all of PrivacyTools' angles and priorities, making a lot of their advice pretty impractical for most people. But the purist approach is also interesting to follow, even if one doesn't jump on the bandwagon.

Actually, here's an online ABX blind test set with several modern codecs at high bitrates, as well as the bad old mp3 garbage that ruined the reputation of lossy compression.

I really challenge you to reliably detect the lossy sample in the tests for Apple iTunes AAC ~256 kbps and Spotify high quality. http://abx.digitalfeed.net/list.html

The guy who created the Vorbis codec explains why this really isn't the case and why high sampling rates with ultrasonics actually are bad for playback quality. https://web.archive.org/web/20120306150922/https://people.xi...

I would really encourage blind testing of one's assumptions about audio quality. Foobar2000 has this super nice ABX plugin that can handle automatic conversation to different codecs and or PCM sampling rates and depth from lossless sources. https://www.foobar2000.org/components/view/foo_abx

I can personally recognize full bitrate mp3 (this ancient codec maxes out at 320 kbps where it still sounds colored). This is a well-made pre-configured test https://www.npr.org/sections/therecord/2015/06/02/411473508/...

But move on to anything more modern than mp3, such as Apple's AAC encoder (there's a ton of bad AAC encoders out there) or Vorbis with VBR settings averaging at 256-320 kbps. You'll find it very hard to spot the lossy encodes in a blind test. Opus is astonishingly good at even lower bitrates.

How well does this work compared to AirDrop?

AirDrop was hopeless when first released, then I didn't even try it for a few years. Two years ago it worked well a couple of times when I needed it, but last week it didn't work.

Hardly scientific, but the point is that AirDrop is one of those things I'm aware of as being available in my Apple-centric household. But experiences have turned "send it over AirDrop" into a go-to "talk to the hand" joke between myself and my SO.

I looked up the obvious stuff: process isolation and sandboxing, fully expecting not to find any good info on that or security support/lifecycle. Instead, this actually seems pretty interesting. https://qutebrowser.org/doc/faq.html

"Most security issues are in the backend (which handles networking, rendering, JavaScript, etc.) and not qutebrowser itself.

qutebrowser uses QtWebEngine by default. QtWebEngine is based on Google’s Chromium. While Qt only updates to a new Chromium release on every minor Qt release (all ~6 months), every patch release backports security fixes from newer Chromium versions. In other words: As long as you’re using an up-to-date Qt, you should be receiving security updates on a regular basis, without qutebrowser having to do anything. Chromium’s process isolation and sandboxing features are also enabled as a second line of defense."

And the best thing is that with Office 365, you have to pay for obscenely priced license tiers to get access to logs of mailbox activity.

Wanna know if that attacker downloaded all of an inbox? You should've thought of that and paid $35.00 user/month (and that's the lower yearly commitment price) https://www.microsoft.com/en-us/microsoft-365/enterprise/off...

You have a point, but my main concern is just the inevitable internet-connected app ecosystem for expensive and cool devices that are going to have a security patch lifecycle of 18-36 months with an expected lifespan of 15 years for second and third owners

Can't wait for Roland, Yamaha et al. to build awful Android-based touchscreen UIs for all upscale music gear with built-in control dashboards

Do you know what kind of price range would that be?

@invaderFizz: oh, this is useful to me, thanks!

So does Debian https://security-team.debian.org

I claim no deep expertise on this, and I assume Canonical has more money to throw at this. Or are there contributions to Debian security in the form of paid personnel?

This is actually quite interesting to me, anyone with real knowledge of the subject is welcome to interject.

> What are the track records of the claim?

I claim no deep expertise on this, but for a distribution of 56k packages, this looks quite good https://security-tracker.debian.org/tracker/status/release/s...

To anyone here who's worked secops and has to track these things, I'm really interested to hear opinions about how well Debian follows up on this

match made not in heaven but on Oracle Cloud

Are there any license traps in Oracle Linux?

Writing like this makes me very wary of putting Oracle Linux anywhere near my employer's systems

https://www.computerworld.com/article/2992597/law-firm-warns...

https://blog.dbwatch.com/how-to-avoid-oracles-licensing-trap...

Then there's the famous lawn mover quote from Bryan Cantrill https://news.ycombinator.com/item?id=5170246

I would agree that BSD systems are nicer to look at, and FreeBSD supporting major releases for five years, with forcing people to install point releases once a year is really quite nice.

But I don't see BSD becoming practical as a platform to run (commercial enterprise) Linux software, when it's already a pain to get packages and support for anything that's not RHEL/CentOS.

But LEAP is only supported for 36 months? https://en.opensuse.org/Lifetime

That's pretty weak sauce even compared to the five years Debian and Ubuntu offer. And Debian actually supports all their packages, unlike Ubuntu which tricks people into installing unpatched garbage from 'universe'

@syshum, yes, but it's not exacly RHEL, and it's not distributed outside AWS https://news.ycombinator.com/item?id=25347232

But the point is indeed that there are resources and infrastructure, so one might be hopeful that there will be a good outcome.

One possible outcome would be increased demand and resources for Debian and/or Ubuntu and I definitely wouldn't mind that (five years of support isn't all that much in IT). Realistically though, a lot of people need RHEL for free and I suspect there will be a way.

Oh cool. As for CloudLinux, "not free" probably scale for some hosting environments, including non-managed cloud instances.

But something like Springdale, given resources, might be able to provide. They're still tracking RHEL 7, though.

Debian and Ubuntu, which offer five years of Long Term Support are the next best thing available, and that's already kind of tight for long-term deployments of self-hosted, old-fashioned business software.

Debian is particularly impressive, since they, on paper, aim to support all packages with security fixes, whereas Ubuntu's main repo is a lot more limited.

OpenSUSE Leap versions seem to get three years, which really isn't enough software that needs to just work for a long while.

Well, GoDaddy, or heh, AWS are The Man.

My best hope is that the major hosting vendors, or maybe some industry consortium might offer resources for this.

Wonder if the web hosting industry will rebel and build another RHEL clone project that just gets the 10-year supported patches. Red Hat still has to release the patches, right?

A really big chunk of the world's traditionally shared hosted websites run on CentOS, because most commercial control panel packages and hosting automation systems are built for that. A rebadged CentOS is also AWS's default distro.

Wonder of the hosting industry, AWS included, will build a new stable clone of RHEL 8's upstream security patches. There are some big companies, like GoDaddy in there, whose business models are unlikely to accommodate for RHEL support subscriptions.

This is truly a bummer, and if someone doesn't pick up the pieces and continue offer RHEL rebranded, there's no(?) open sauce operating system with a decade-long support lifecycle. I wonder if this might cause an increase in unpatched servers and appliances when the alternatives offer five years at best.

And last time Greenpeace did a checkup of this, it seemed like it was only Fairphone and Apple that even had attempted to work on their processes to limit the environmental impact of their products. It's really hilarious, especially considering the limited user serviceability of Apple products https://www.greenpeace.org/usa/reports/greener-electronics-2...

iPhones have actual resell value, too.

I switched to iPhone in 2012 after I got super annoyed about the poor quality of and lack of software support my HTC Desire Z was receiving. Since then, every phone I've had, has served out its full 5 or 6 year lifecycle with family members.

I generally switch iPhones every two years, and as of late, the only reason I do it is to prevent family members from ending up with garbage Androids. From iPhone 6s forward, I feel that the 'useful lifespan' of these products for someone who wants something snappy, has only increased.

Here in Finland, one can buy phones from carriers unsubsidized, but with years of interest-free installment. After two years, the market price of my old phone is pretty close to the remainder of my installment.

I've noticed the same thing.

I admittedly do have an obsession with ranting about Android, but I find that there are fewer reasons to rant than five years ago. So I rant less.

As the Android platform has improved over the years, I find that the main reason I don't want people around me to use Android is the ridiculously short product lifecycle of many Android phones, and the risk of non-techies using unpatched devices.

I honestly think Apple's recent 5-6 years is unsustainable, but the three-year(?!) promise that seems to be a best case for Android is just obscene.

Someone at work said it's partially due to SoC manufacturers not providing drivers for new Android kernels for very long, but I might have misunderstood.

Deezer has reportedly been trying to switch. Not sure how it's going https://www.rollingstone.com/pro/news/deezer-launches-initia...

In terms of giving some kind of supply chain assurance it's not a bad idea by itself. I'd prefer a non-bricking variant with a red boot screen warning about non-original spare parts, or something to that effect.

Recent Apple laptops have a separate SoC dedicated to secure boot as well as making sure macOS has no direct control over that camera indicator light, and more

https://appleinsider.com/articles/19/07/29/what-apples-t2-ch... https://en.wikipedia.org/wiki/Apple_Silicon#T_series

The levels of absolute dogshit thinking that goes into what's described in the OP is astounding.

Imagine that you're processing confidential customer data and you use something like https://hubstaff.com to take screenshots randomly. You're literally uploading PII to some professional spyware provider that works on a freemium model.

As a starting point for real numbers, Guru3D has run Basemark GPU 1.2 on 20 GPUs, on Windows https://www.guru3d.com/articles-pages/basemarkgpu-benchmark-...

Wonder if this exploit worked with the Mac App Store version of WhatsApp and the extra sandboxing layer(?) that whole ecosystem provides.

Out of sheer hope and ignorant superstition about the wonders of sandboxing, I tend to install the App Store versions of crap like WhatsApp and Slack whenever possible.

Not only that, but JavaScript can get you owned, and any code loaded over a non-https connection could be rewritten in transfer. Remember: all Tor exit IPs are publicly known. Tor users are easy to target.

If you use .onion services for anything... interesting, you should also be aware that the first step an advanced attacker might do with a compromised site is to try and completely own all browsers visiting.

If you run JavaScript, you're just waiting for someone to poke a hole in whatever sandbox protections the Firefox base of Tor Browser can provide. Example: https://threatpost.com/tor-browser-update-critical-flaw/1458...

While it looks frivolous, that's probably some kind of attempt to attract... common people to the news front page. We don't have access to BBC's analytics so it's hard to determine if this technique manages funnel the unwashed masses towards quality content.

If you open up something like the World section (and subsections), you'll get a lot of good reporting.

https://www.bbc.com/news/world

I also find the shows From Our Own Correspondent the Global News Podcast to be world-class news sources.

https://www.bbc.co.uk/programmes/p002vsng

https://www.bbc.co.uk/programmes/p02nq0gn