aroch

Probably want to disable the tmux keybinding for detach

So if we ignore more than half the world, 50% of users still don't get those improvement. If you're under the impression that Google isn't able to properly track devices that hit play services, that's an entirely different and more worrisome problem.

The pretty large plurality (if not majority) of Android devices in the wild don't have have Google's services installed and many of those also get no software updates -- so they're stuck on what old ROM they came with, probably Lollipop.

Less than ~25% of active Android devices are on Marshmallow or Nougat, which somewhat tempers the impact of this change.

iOS does offer a slightly nicer three tiered request strategy over Google's yes|no. iOS let's you grant location access only when the app is active

I think you're being rather uncharitable to the GP. Essentially no host, managed or unmanaged, has a 1 engineer:1 customer ratio.

Most of the big names in DDoS protection, looking only at enterprise tier support, have tens of clients per network support tech minimum.

Its a pretty old jazz standard by Nat King: https://en.wikipedia.org/wiki/Nature_Boy

There are tons of versions and variations of it

It does in fact show up in Moulin Rouge: https://www.youtube.com/watch?v=ekCvBztYs_A

It looks like all the audio files are stored as numbered mp3's on AWS, so those interested can grab all of them pretty simply.

My personal favorite is the, "Oh, for fucks sake": https://s3-eu-west-1.amazonaws.com/clickclickclick.click/Voi...

There's a song as well: https://s3-eu-west-1.amazonaws.com/clickclickclick.click/Voi...

I swear to god, Air France bakes all their "bread" for the year during whatever month wheat is cheapest. Half the food they serve you is brick-like rolls with frozen butter or cheese-product.

How often are you validating email addresses for localhost!? Those are pretty much never a valid email for >>>99% of applications

I would think you'd use: /.+@.+\..+/

This seem to sum it up

https://web.archive.org/web/20080827140005/http://www.wired....

Ghostery allows you to OPT IN to sending your browsing data [1], which may be sold as part of services offered by their parent company to improve ad ROI for their customers. They also tell you that they're collecting the request data [2].

I think knowingly sharing your data (with a positive affirmation) is significantly different than having your data collected and sold without your knowledge

[1] http://imgur.com/a/ugglB

[2] https://www.ghostery.com/support/faq/ghostery-add-on/What-da...

We were talking about security...

But yes, it's almost like DCs were built with this in mind. Wh would've guessed...

>It's not like you can walk up, knock the door in with a battering ram, and then have access to everything inside.

Well, I mean, yes you can. The actual doors/gates used aren't 'milspec' intrusion rated. They're `better-than-home-depot` doors (all steel, steel door frames, reinforced). Cage door are often hilarious flimsy (thing metal sheet/bars).

Certainly breachable by even modestly equipped attackers.

The reason you pick real DCs and not the basement of your fortified house is because there's human security in addition to the physical security measures. Which means, some one will notice if you try to bust down the door

For anyone using Virgin Media as their ISP, the Dublin DC will perform more predictably, if not faster, because of VM's "give preference to data originating inside the UK/Ireland and don't give two shits about anything else" attitude.

If you run a data heavy service, PoP inside the UK or Ireland is a must if you want to avoid throttling and heavy-handed traffic shapping.

NSS can forcibly set trust bits for certificate chains -- so in theory they could set the codesigning only trustbit.

ButI'm pretty sure Windows is not using NSS as its truststore for those checks. So its up to Microsoft to deal with the de-trusting (which may or may not be modular, I have no idea).

They definitely use the voicemail transcription feature as training/test data for their NLP stuff

Last I checked, the US didn't invent Imperial units, there's nothing proprietary about them (they easily and readily inter-convert with metric) and Fahrenheit was Polish/German.

The DarkSky team is based in and focus is also the US and (partially) UK.

Because taxis don't do this??

If you use Alfred, you can setup a workflow (edit, this is the one I've used in the past and works currently: http://www.alfredforum.com/topic/4524-safari-reading-list/ ) to do this with a key combo

exiftool [1] can remove all metadata (-all flag) from a whole lot of file types

[1] http://www.sno.phy.queensu.ca/%7Ephil/exiftool/, seems to be down currently though

https://web.archive.org/web/20160816014908/http://www.sno.ph...

Buckling springs are more of a deep clack instead of the sharper click you get from the MX blue / red, or a dull click you get from clears

Should be fine, you may need to update the bios on your mobo, but other than that looks good

I run several hackintoshes + real Macs as my primary work machines and personal use. Getting Facetime/iMessages to work is relatively straight forward and easy if you'd like them (even easier if you have a real Mac too).

Machines:

Dual Xeon | 64GB RAM | GTX960 | 4x4TB HDD, 3x5000GB SSD

(My oldest) Core i5 | 24GB RAM | GTX 680 | 3x4TB HDD, 150/250/500 SSDs

Intel Nuc i3

I'm happy to answer any questions!

At which point we're back to my original point of why does the information disclosure matter?

That doesn't prevent domain enumeration for your application though. Once you publish an application, anyone using it can find the address its hosted behind

Unless all your subdomains are unique (e.g. coming out of a PRNG) AND there are no public DNS entries for them, subdomain enumeration by DNS or IP space is super easy. Not using SAN because of info disclosure concerns is security through obscurity.

RE: Linux, You're correct, they're provided through the ca-certificates package[0]:

"It includes, among others, certificate authorities used by the Debian infrastructure and those shipped with Mozilla's browsers. "

RE: OSX - If you can get into Mozilla's trust stores, it's the same steps (and pro forma, more or less) [1]

[0] https://packages.debian.org/wheezy/ca-certificates

[1] https://www.apple.com/certificateauthority/ca_program.html

If one had, say, 1-2PB in unused mag tape but no longer has the hardware to actually write to them -- is there some way to get them put to use?

I can understand Identity, SMS, Camera, and Device ID/Call info.

Identity: Find or manage any Live/O365/MS account on your device

SMS: Read enrollment text message or backup texts (e.g. no network) for pushing auth requests

Camera: Enrollment via QR code

Device ID / Call info: Needed to reliably push notifications / send SMS + get phone number for verification texts whatever

Android's permission system is sort of obtuse

It isn't a "public" API, it's Facebook's API that they're making available to the public. They have the right to control access to their API, be it by password authentication or telling someone to stop using it.

Not that I necessarily agree with how this case turned out, but Facebook is under no obligation to support the business model of another company...