jakejarvis

Agreed about VMs in everyday use, and I'm wondering if the new Windows 10 Pro/Enterprise sandboxes would be a sufficiently safe alternative in these scenarios. After skimming this white paper it seems like they would, but I'm no expert in this area:

https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern...

Not quite sure what you mean by imagination... Of course Toyotas aren't limited to terrorist groups, but it's definitely been a long-standing trend – so much so that the US Treasury Department asked Toyota to open an inquiry internally regarding ISIS and the dozens of Tacomas and Land Cruisers their propaganda videos:

https://abcnews.go.com/International/us-officials-isis-toyot...

The entire decades-long overseas diversion saga surrounding American Toyota pickups has always fascinated me.

Top Gear did an episode [0] trying to destroy a Toyota Hilux (similar to the Land Cruiser) and literally couldn't, which explains why it's so popular with terrorists. It's a worthwhile watch if you want to see truck survive after being drowned in water, fire, and the rubble of a demolished skyscraper. Say what you want about Toyotas, but that's quite the engineering feat in my opinion!

[0] https://www.youtube.com/watch?v=xnWKz7Cthkk

I just put in my own Cloudflare-enabled website and it came back negative as well.

Ditto! For some reason I used to think the more tray icons the better.

But not as bad as when I tried to delete C:\Windows before it would try to stop you. (For science, of course.)

Not at all! I'm really glad you mentioned it, since I wrote this in the mindset of small to medium VPSes used for personal projects and I'll make that more clear in the intro. Backups (like everything else, unfortunately) definitely get exponentially more difficult the more successful you become.

Absolutely. Maybe I should have noted that this is more of a guide to make your existing backup procedures more redundant, which implies that you already have local "backups" being made of whatever you want to redundantly store in S3 or B2 or anywhere externally.

In that case, it does become as simple as just copying files elsewhere. (For example, using the Restic steps in my post to backup a folder of hourly database dumps, like you mentioned.) Replicating databases (and other methods made specifically for DBs) is certainly a much, much better route for mission-critical and/or enterprise data.

Covering every permutation of different types of data to backup would have made a long post much longer, but I'll add writing a part two to my to-do list covering rudimentary database backups since that has been brought up here a few times.

Thanks for the feedback! :)

Good question. I have the same setup on one server hosting GitLab, Pi-Hole, Plex, etc., and I have Restic (and its cronjob) installed on the host and only backup the files that I mount to each Docker container, which are all stored in /srv/docker.

In theory, you need to be ready to literally delete every container at any time and pull them from scratch and be 100% fine, since all of your actual data should be stored on the host and mounted as Docker volumes [0]. It's a good Doomsday test if you're looking for one. ;)

[0] https://docs.docker.com/storage/

Similar story here, but instead of a phishing email it was a legit Find My iPhone email six months later saying her phone pinged from Morocco.

So yup, sounds like they’ve either resorted to stripping them for parts or selling them whole (and still firmware-locked) to innocent buyers in places where you’d have practically no legal recourse — who then become victims to the theft as well, ironically. And by then, of course, you’ve likely had a new phone for long enough to not lose much sleep over it.

Honestly, Cloudflare choosing not to hastily slap a band-aid on a problem like this just makes me feel more compelled to continue using 1.1.1.1.

I hesitate to compare this to Apple calling themselves “courageous” when removing the headphone jack, but in this case, I think the word is appropriate. I’ll happily stand behind you guys if you take some PR hits while forcing the rest of the industry to make DNS safer – since it is understandable, admittedly, for users to conclude that “Cloudflare is blocking websites, sound the alarms!” at first glance.

Same for the back of my iPad Pro at times, too. I appreciate this post – thought I was crazy!

TIL that this quick trick [1] also would have prevented this:

  ${STEAMROOT:?}

...where :? throws an error if the variable is unset or empty. (Still far too scary for my taste, though!)

[1] https://github.com/koalaman/shellcheck/wiki/SC2115

Yikes. Like I said, domains are still far from fail-safe. The Madonna theft was almost 20 years ago, when trademarks seem to have reigned supreme in court, so hopefully more judges are better informed today and know this is unacceptable and not how the internet operates anymore...

...but I am often told I'm too optimistic.

I have to agree that it's the better option.

Certainly not a 100% fail-safe solution – I see people already listing domains that were seized for various inexcusable reasons – but the Nissan.com case [0] (Nissan the car company vs. Mr. Nissan the run-of-the-mill computer sales guy) comes to mind as a classic (and fascinating) counterexample.

[0] https://en.wikipedia.org/wiki/Nissan_Motors_vs._Nissan_Compu...

Seconded. Argo is also great and makes this even easier (for $5/month).

https://www.cloudflare.com/products/argo-tunnel/

Sounds a bit like what Google / Alphabet / Jigsaw are already doing with Outline, but I still think there’s major opportunity there for a transparent and decentralized one-click service. Especially when you add in #4.

For some reason, Outline is still mega-targeted at journalists and activists when it could be so much more — it’s been an absolute joy to use so far, and being powered by Shadowsocks certainly doesn’t hurt.

https://getoutline.org/en/home

Yikes.

"But all my customers love and trust me!" == "I'm just an above-average con man."

"But I was just doing this to support them without bothering them!" == "I'm clearly not ready to take responsibility and fess up to anything because I thought my deceptively named functions would fool everybody (and still do)."

"But my girlfriend and I love cat memes!" == "Please, for the love of god, can we forget about all this and talk about cat memes instead?" [I honestly have no clue what he was trying to get at in the first six paragraphs...]

I think we’re on the same page. Maybe it boils down to the need for jokes that can be easily ignored by people who want April 1st of next week to be an ordinary Monday. In that sense, I’m all for banishing corporate pranks that aren’t 100% non-obtrusive.

I actually agree. I don’t want to be pranked/fooled by companies I rely on — in my opinion, companies who don’t understand that are the only ones who fall flat on their faces on April 1st and need to apologize for a PR disaster on April 2nd [0][1][2][3][4][5][and on and on...].

Big brands who want to participate should really think of it as April Dumb Tangential Jokes Day, perhaps!

[0] https://blog.google/products/gmail/introducing-gmail-mic-dro...

[1] https://lineageos.org/An-April-Apology/

[2] http://www.eurogamer.net/articles/2014-04-02-ea-apologises-f...

[3] https://www.bloomberg.com/news/articles/2018-04-01/elon-musk...

[4] http://hoaxes.org/archive/permalink/taco_liberty_bell

[5] http://www.buzzfeed.com/jarettwieselman/happy-endings-reboot...

> I believe we have more to lose than gain by attempting to be funny

Ouch... Seems like he’s just bitter about his engineers’ senses of humor?

I can name numerous Google pranks that were obviously stupid and legitimately made me chuckle and then move on with my day — their toilet-powered ISP, Rick Rolling YouTube viewers, Google Maps PacMan, even Contoso switching from O365 to Google Apps (there’s a list of dozens more of them on Wikipedia [0]).

Sure, some of them were a bust, like adding a mic drop GIF to outgoing Gmail messages without clear consent. Large corporations shouldn’t be literally pranking their users. But can anyone name a Microsoft joke off the top of your head?

Maybe I’m in the minority on HN, but I say if you’re confident that you employ some funny engineers who can limit themselves to obvious humor, especially if you’re a small company, why not keep this silly 500+ year tradition alive and well? :)

[0] https://en.m.wikipedia.org/wiki/List_of_Google_April_Fools%2...

Wasn’t this, in theory, one of the selling points for upgrading to a paid Google One account?

https://techcrunch.com/2018/11/02/google-finally-adds-consum...

I’d be interested to hear if anyone’s tried to take advantage of this, I’m upgraded to One for more storage but haven’t had a reason to test out their humanoids (yet).

[edit: I’m definitely not suggesting Google One would have helped with this particular Play Store publishing predicament, for the record!]

Palm rejection on the latest 15" MBP is impeccable, in my experience. I was pretty worried about that before purchasing, just because it's hard to imagine how they've perfected it on a touchpad that large, but they truly have.

Yup, that was a major barrier for us. Worth noting that they charge this much even if you want to use a Let's Encrypt cert [0].

[0] https://support.fastly.com/hc/en-us/community/posts/36004016...

I believe they used to benchmark via their own pool of test servers, but according to the sidebar they're now collecting "real user metrics" somehow:

> All results are based on RUM (Real User Metrics) data from users all over the world

> We gather and analyze more than 300million tests every day

> "RUM Uptime" shows the uptime of CDN providers as measured by real users. Due to bad Internet connections this number can contain false positives.

Agreed about Akamai, though — it appears to be clearly faster than those listed (they certainly had a HUGE head start). But also by far the most expensive. You get what you pay for in this industry!

Indeed, fantastic job!

Credit where credit's due to HackerOne co-founder jobert, too. Seems he's made a decent living [0] out of making GitLab more secure.

On the flipside, as a GitLab user, I'm glad to see you guys are so generous with bounties to encourage more detailed (and fascinating) reports like these. :)

[0] https://hackerone.com/jobert?order_direction=DESC&order_fiel...

They might want to finish up the "Clear History" feature he announced last May [0] first...

> "If you watch the presentation, we really had nothing to show anyone," said one person, who was close to F8. "Mark just wanted to score some points." [1]

[0] https://www.recode.net/2018/12/17/18140062/facebook-clear-hi...

[1] https://www.buzzfeednews.com/article/ryanmac/facebook-privac...

It's looking like lots of cars are switching to all-screen dashboards anyways... My new VW has one and I actually really like it.

Agreed... Original source: https://dfir.it/blog/2019/02/26/the-supreme-backdoor-factory...

That was taken wildly out of context....

Location: Boston, Massachusetts

Remote: Yes

Willing to relocate: Probably not, but it's possible ;)

Technologies:

- Front End: HTML5/CSS3, JavaScript (React [Native], Angular, Vue, jQuery, etc.)

- Back End: More JavaScript (Node, Express, etc.), Go, PHP, Ruby, Python, Java, Swift/Objective-C, MySQL, Postgres, MongoDB, WordPress

- Sys admin stuff: LAMP/LEMP/other Linux infrastructure, Docker, k8s, AWS, GCP, Azure

- Currently beefing up my infosec/pentesting skills for fun (and bounties!)

Résumé/CV: https://jarv.is/ (PDF: https://jarv.is/resume.pdf)

GitHub: https://github.com/jakejarvis

LinkedIn: https://www.linkedin.com/in/jakejarvis/

Email: jake@jarv.is