Hacker News Reader

ganton Police raid at Zwiebelfreunde: Donor data compromised

Last I checked DE-CIX is still in a never ending legal battle with the BND and courts seem to consistently rule in the favor of the BND.

ganton Police raid at Zwiebelfreunde: Donor data compromised

As always with great (/s) solutions proposed on HN, it's neither simple, nor are there any great incentives for providers or is there consumer demand. The average protonmail user doesn't care and/or know why using a credit card could be a problem.

ganton Police raid at Zwiebelfreunde: Donor data compromised

laughing intensifies

I tried that when I got raided and had all my stuff taken. The only thing that happened was the officer that suggested the warrant as his first measure got barred from promotions for a year, maybe, they weren't so clear about specifics.

ganton Twitter ‘smytes’ customers

Solid track record. Especially the part about spamming suicidal people on Reddit.

https://www.reddit.com/r/SuicideWatch/comments/5jin1q/warnin...

https://www.reddit.com/r/SuicideWatch/comments/5x60f0/update...

ganton MacOS Caches Data from Encrypted Hard Drives

Yes, from encrypted non-system partitions or encrypted external drives to an unencrypted system partition.

ganton How the modern containerization trend is exploited by attackers

qemu

ganton IPVanish “No-Logging” VPN Led Homeland Security to Comcast User

Problem with Riseup is, that they're invite-only and at the same time becoming the most centralized email service for anonymous left-learning political use.

Personally I can recommend Autistici/Inventati. More smaller services/servers seems like a much better way to go.

ganton Introducing DNS Resolver for Tor

Hey, that's pretty cool, glad you sorted the second one out. Never heard about the first one and the third, well, double edged sword.

ganton Introducing DNS Resolver for Tor

>Still, the exceptionally privacy-conscious folks might not want to reveal their IP address to the resolver at all, and we respect that.

Who was it again that puts ReCAPTCHA on so many popular websites when using Tor, which could be used for traffic correlation? Oh. Cloudflare.

Ref: https://news.ycombinator.com/item?id=12122268

ganton Introducing DNS Resolver for Tor

They have an intermediary CA. I wasn't sure too when they launched, but IP addresses as common names aren't against spec / Mozilla CA guidelines.

ganton Will Kubernetes Collapse Under the Weight of Its Complexity?

I think people misunderstand why Kubernetes exists. It is the reverse OpenStack. Kubernetes has the potential to be the one unified API of the cloud. A middleware for proprietary cloud APIs. A few resources, like load balancers, are already at a point where you barely have to care about the underlying cloud provider. With operators and aggregated API servers (especially if they'll be offered as a service) provisioning resources could follow one well-known standard. Calling it now, within the next 2 years cloud database providers like Compose will offer a way to CRUD resources via CRD/apimachinery-compatible services. Few more years and we'll have a generic yaml spec for these resources that work out of the box on multiple providers (probably with a bunch of annotations that are vendor specific).

ganton Will Kubernetes Collapse Under the Weight of Its Complexity?

As someone who uses minikube every day to work on an aggregated apiserver, my impression is that minikube is incredibly fragile. I have to reset the VM more than a few times a week. Which isn't that bad considering getting back up and running is pushing one big yaml file down kubectl, but still. It could be much better.

Same with kubeadm. It's pretty okay for a test cluster, but it can't even do a HA setup out of the box. That's an absolute must-have if you have a project big and serious enough to warrant using kubernetes.

ganton Why I'm leaving Linux

I didn't specify which operating systems, which makes it ironic that Windows was not involved at all in that process. I've used WSL, but on my Windows-only desktop that mostly runs games. See, my work machine never ran Windows. Good job going on a rant about it though.

ganton Why I'm leaving Linux

Very few cases can't be covered by either WSL or a VM, and having dual-booted for years I can tell you that after a few days you get into the habit of only booting the more convenient OS most of the time. It's twice the maintenance and 5-15 minutes of context switching every time you need to do something else.

ganton Google's Plan to Make Tech Less Addictive

Still, why does YT need to default to autoplay on every time I load a watch page?

ganton EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

Pretty much. Should have that as default anyway to avoid sending tracking beacons to spammers.

ganton Google's Plan to Make Tech Less Addictive

If Google really wanted to help here, why don't they just, you know, make every part of YouTube less optimised for maximum view time. Remove autoplay, turn down the recommendations. Nah, we're gonna throw some optional, possibly ineffective shit into our mobile OS instead so we can say we did something.

ganton Who and what is Coinhive?

Just because Denic doesn't allow private domain registrations doesn't mean you're supposed to go after people and dump their personal info into your popular blog. Large parts of the information was historical data persisted by third parties that'd be hard to expunge. There's a good reason for pr0gramm admins to want to remain anonymous - cha0s initially quit the site because he received an 80kg steel oven as sort of a threat. The post includes names and contact information of volunteer moderators that weren't even part of their company.

But Brian Krebs' private information - which is definitely out there - is to be kept out of public view? I'm sure he'd pursue legal action if I put that on my blog with some half-baked accusations

It's wrong, plain and simple, which is why pr0gramm moderators have been removing posts with both their own private information and krebs'.

ganton Telegram Login for Websites

Took a while for me to reinstall it, this is what it looks like (just after SMS auth):

https://i.imgur.com/BAnddlg.png

I counted the asterisks, they do in fact reveal the length of the password.

ganton Telegram Login for Websites

Fine. They call it a passcode:

https://telegram.wiki/desktop/tdesktoppasscode

ganton Telegram Login for Websites

If you don't have a 2FA password enabled and you're not online on another device you can login with your phone number.

ganton Telegram Login for Websites

Telegram can layer a password on top of your mobile number in a sort of reverse-two-factor way, but it's kind of a bad joke as I've mentioned above.

ganton Telegram Login for Websites

Telegram's security is a joke. They show the first and last letter of your password and the length (the number of asterisks they put in the middle changes) when you sign in. Next to some pretty bad implications (do they store the password in cleatext or just the length and two letters?) , that password is down to about 1/5 of its original entropy. Told them a year ago, they don't seem to care.

EDIT: Yes, Telegram uses passwords if you enable them. This is what the questionable query looks like: https://i.imgur.com/BAnddlg.png

ganton LineageOS for microG – Access Google services without closed software

A lot of banking apps store cached transaction data and authentication tokens on the "protected" (not accessable to non-root from other apps) part of the data partition. If you run without encryption or with either unlocked bootloader or TWRP installed, someone could just pull that from a device in recovery mode. That's also why unlocking the bootloader wipes your data partition usually.

ganton New York Subway X-Ray Area Maps

Not even close to being that good, but parts of the Frankfurt Metro have basic station maps on the platforms.

Of-Marktplatz: https://dl2.pushbulletusercontent.com/lxmCMsRFcz6eOy53QqHHzk...

Of-Kaiserlei: https://dl2.pushbulletusercontent.com/BEJXV2Cp8UDZ1dbbXVRPZe...

ganton Gnome is still the best Linux desktop environment

Xfce display switching has yet to let me down.

ganton Pass: A standard Unix password manager

Why doesn't it work? From the top of my head, QtPass with gpg4win should work.

ganton Open source electronic lab notebook

Yeah, it seems to say the same thing 3 times - we got TLS.

You and everyone else buddy.

ganton Duplicacy: Lock-free deduplication cloud backup tool, with “fair source” license

Depends, if it's something likely to be customized, AGPL might work.

ganton SecureLogin Authentication Protocol 1.0

Plus, if you do request the encrypted TOTP seeds from Authy you have a choice of 1. getting the download approved by another device already linked or 2. a 24 hour wait period during which Authy will send you an email every 6 hours.