jamesmotherway

I've used favicons (along with analytics IDs) to identify related malicious sites. You can also apply this to detect brand abuse and phishing pages.

See the "Data categories and encryption" section:

"The table below provides more detail on how iCloud protects your data when using standard data protection or Advanced Data Protection."

https://support.apple.com/en-us/102651

Sorry, I overlooked part of your post earlier - I'm tired. As I previously alluded to, I don't use passkeys due to concerns about their implementation. Whether passkeys are better than TOTP really depends on the individual user's circumstances.

Which service is it? Do they ever use that password?

If I were used to signing in with a passkey, I'd find a password prompt suspicious. While the average person might not, it's also possible they would have forgotten the password entirely. There are other services that force TOTP even with hardware keys enrolled. Technically they can be phished, but it would not be successful in all cases.

Unfortunately, varying behavior and support for multifactor protocols (along with risky reset flows) makes it hard to give blanket recommendations.

Hardware keys and passkeys are better because they can't be phished. In the case of hardware keys, one should register multiple to prevent lockout. Most implementations of passkeys seem to be portable, letting them exist on multiple devices (something that gives me pause).

If an adversary can successfully phish someone, they can often also trick them into providing TOTP codes or approving push notifications. However, TOTP remains significantly better than the alternatives, as it prevents credential stuffing attacks and SMS-related compromises while potentially limiting any account breach to a single session.

If the vault requires a hardware key and master password to access the encrypted password and token, would you still describe it as single-factor authentication?

China-nexus threat actors tend to be focused on espionage, including intellectual property theft. "Prepositioning" is a more recent observation, but it doesn't mean a war is inevitable. While it would be useful in that scenario, in others it may act only as a deterrent. Everyone should hope a war does not occur.

The NSA and CIA are neither able nor authorized to defend all privately-owned critical infrastructure. While concerns about agency oversight are warranted, I can assure you that spying on the population is not their top priority. It's abundantly clear that foreign threats aren't confined to their own geographies and networks. That can't be addressed without having the capability to look inward.

Secure by Design is an initiative led by CISA, which frequently shares guidance and threat reporting from the NSA and their partners. Unfortunately, they also can't unilaterally secure the private sector overnight.

These are difficult problems. Critical infrastructure owners and operators need to rise to the challenge we face.

Is your system configured to share analytics and diagnostics? I disable both, and when a crash occurs, I receive a dialog with an "ignore" option.

Bad actors frequently use BuyVM's services, also known as FranTech and Ponynet. Their popularity with Tor operators probably doesn't help how their network traffic is perceived either. As a result, organizations may handle traffic from their ASNs unfavorably.

I don't have a personal opinion about the company; however, email is important enough that it's worth considering edge cases and future scenarios.

I'm assuming by "significant" you mean an attack on critical infrastructure.

That's a strategic capability that very likely requires multiple attack chains, not a single exploit. For Western countries, cost is probably the least significant factor in deciding to use it.

One would want to be certain that option is available, but only when absolutely necessary. Using it on a random Tuesday would take that particular option off the table forever. Best case scenario, Russia discovers the means by which the attack was carried out. Worst case, they retaliate with nuclear weapons.

Globally, I believe there are only a few countries capable of executing such a plan.

The X230 is still relevant for those who want a ThinkPad that supports Libreboot (an alternative firmware without proprietary components). I personally found this demonstration interesting; users of these devices often believe they're at risk of targeted attacks.

I'm inclined to believe it. If someone managed to prove Apple's lying about it, there would be serious reputational (and other) risks to their business. I also can't imagine how they would benefit from such a fabrication.

That said, I still use "Nanoblock" webcam covers and monitor for when either the camera or microphone are activated.

"All Apple silicon-based Mac notebooks and Intel-based Mac notebooks with the Apple T2 Security Chip feature a hardware disconnect that disables the microphone whenever the lid is closed. On all 13-inch MacBook Pro and MacBook Air notebooks with the T2 chip, all MacBook notebooks with a T2 chip from 2019 or later, and Mac notebooks with Apple silicon, this disconnect is implemented in hardware alone." [1]

[1] https://support.apple.com/guide/security/hardware-microphone...

Threat actors don't create malware to impress people; they do it to accomplish their goals. Apparently, this sample was sufficient for them.

Security companies attribute activity based on their observations. ESET- a Slovakian company- is no exception.

The NSA publishes excellent cybersecurity resources:

https://www.nsa.gov/press-room/cybersecurity-advisories-guid...

I've highlighted advisories that may give you some perspective, listed in chronological order:

Iranian Cyber Actors’ Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations

Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure

North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs

PRC MSS Tradecraft in Action

I understand where you're coming from, but Apple Intelligence is labelled as a beta feature.

The alternative in many cases would be to install MDM software on one's personal device, which seems like the worse option to me.

Banks use various other services such as Early Warning. Still, it's absurd the lengths we need to go to for any level of assurance against fraud.

Thanks for your feedback. I posted this because I've seen many people stop their analysis when they find a site is on Cloudflare.

Were you able to solve the challenge at the end?

Satiety is precisely it, and I would not be so quick to minimize its effect.

Reasoning by analogy, most would accept that some people are better suited to extended release medication versus instant. A drug is defined as something that has an effect upon the body when it's ingested, especially in the context of the central nervous system.

Carbohydrates are the preferred fuel source of the body, the brain included. Glucose syrup is simple (C6H12O6). A simple carbohydrate like glucose needs minimal processing to become "active," and it tends to be provided without fiber which would ordinarily buffer the overall glycemic index (impact upon the body). As a result, a spike in blood sugar and insulin occurs.

The subsequent drop in blood sugar can lead to craving and excess consumption, and eventually insulin resistance over the long term. The reason why my initial comment seemed dismissive of "calories in calories out" is because it takes a myopic view of a complex system.

If we view insulin sensitivity (among other factors) as either a positive or negative multiplier of the "calories in calories out" metric, I believe we'd be closer to an accurate view of metabolism and its impact on human health. Sure, we can just take GLP-1 antagonists to curb that appetite, but we could curtail it at the source as well.

Just eat the damn sweet potato!

It's frightening to think about the implications of this when generalized toward mainstream topics.

It's certainly interesting, but he's not a hero.

Not everyone is doing coding interviews. Some might struggle with a particular language due to lack of muscle memory, but can dictate the logic in pseudocode and can avoid pitfalls inferred from past experience. This sort of workflow is compatible with LLMs, assuming a sufficient background (otherwise one can't recognize when the output diverges from your intent).

I personally treat the LLM as a rubber duck. Often I reject its output. In other cases, I can accept it and refactor it into something even better. The name of the game is augmentation.

There's zero evidence showing the harm of processed foods?

Consider that nutrition labels are largely focused on macronutrients. Carbs, fat, protein. Calories in and calories out.

What processed food tends to lack are micronutrients found in fresh, high-quality produce. This goes beyond vitamins (which are becoming scarcer due to agricultural practices). Anthocyanins, carotenoids, and other phytochemicals are produced by plants as protective agents. Those same chemicals help mitigate the entropic forces the body is subjected to over time.

Going back to macros, not all of them are created equal. Glucose syrup can have the same carbohydrate content as a sweet potato, but their glycemic index (how it impacts the functioning of the body) will vary. That doesn't get into the value of the fiber for the gut microbiome.

The differences are there when looking beyond the surface.

Thanks. I would suggest you reconsider deferring updates. Apple does not consistently backport security updates to prior versions of macOS.

Some people rise to the occasion during crises and find it rewarding. There's a lot of pop science around COMT (the "warrior gene" associated with stress resilience), which I take with a grain of salt. There does seem to be something there, though, and it overlaps with my personal experience that many great security operations people tend to have ADHD traits.

I came across this post while searching for something else.

This behavior is to mitigate the risk of abuse, plain and simple. Apple does not want ephemeral iCloud addresses sending out malicious content.

Yes, you can still theoretically do this with a regular iCloud email. However, it is rate-limited by the sign up process, which requires the threat actor to burn another email address or phone number (and a device ID, probably).

Use something like SimpleLogin instead. Even still, I find Hide My Email useful for Apple Pay, where I only receive transactional emails anyway.

I believe you're on the right track. To me, it only seems paradoxical when viewed in isolation. mTOR activation is conducive to growth, but unchecked growth is called cancer.

A person (and the processes in their body) goes through cycles on a daily and long-term basis. One is not constantly eating, exercising, and growing.

Muscle mass and strength are not the same thing, though they are highly correlated. I believe most studies on the elderly use measures like grip strength, which is a proxy for frailty.

The elderly don't have the same capacity for growth or energy. However, they can avoid wasting away by remaining active. They certainly benefit from autophagy as it clears senescent cells. Perhaps this shift is the body's way of reducing the risk of cancer.

As an aside, a curious data point is that men have shorter lifespans than women on average. There are likely several reasons for this, but I wonder if this has to do with the hormonal effect on mTOR. Perhaps our ability to grow is finite, and excessive activation of mTOR "runs out the clock" faster.

TL;DR: It's a balancing act.

Long sleep duration often presents with poor sleep quality, which negatively impacts cognition.

"Long total sleep time may suggest prior sleep deprivation, medical conditions, or effects of medications."[1]

[1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4246141/

I wasn't able to justify the potential cost of not having them.