1,414 karma · joined September 13, 2010
Launching a personal-use ephemeral cloud instance running OpenVPN to hide your personal traffic from your ISP is absolutely nowhere the same as running a paid VPN service for millions of users across the world.
1. You have to keep two ports locked down. If you can secure your own laptop, you can secure a cloud instance. The cloud instance you're basically just using as a proxy is a lot less important than what's on your phone or computer.
2. Only you are using the system, and you're not logging. Have an issue? Tear it down and start another. Automated scripts out there generate unique keys every time.
3. A commercial VPN is a honeypot in a way -- it's a ripe target. Many people are tunneling through it, doing sketchy things that certain parties want to track -- and your traffic could get caught in a dragnet (this, of course, depends on your use case: you may want to blend in).
4. Your ISP tracks and sells your data. I mean, the entire reason I use a VPN is because I was sick of my ISP routing my searches through their servers before my intended search destination, snagging my Netflix info and using it to create advertising profiles. Why would you trust them?
5. It literally takes less than 10 minutes (5:59 from an iPhone, the last time I launched one) to launch and connect to your own VPN instance to play with (https://github.com/jenh/sevenminutevpn is mine, but there are others, like Streisand or Algo) -- if nothing else, you become a more educated consumer and can better understand your threat model AND what to look for in a paid provider.
Anyone can do this, it’s not nearly as complicated to launch and secure as some would have us believe. (https://github.com/jenh/sevenminutevpn)
You do lose anonymity with personal VPN, but it all depends on your use case.
If a married man is dressed poorly, it's his wife's fault. If a married woman is dressed poorly, who in their right mind would blame her husband?
It's crazy the expectations we put on men and women and how differently-loaded they are...we as a society typically have such low expectations of men, some people don't think men can handle a 9-5 job AND a single load of laundry or changing a diaper, which is totally insulting. We say it's too hard for them to do both...and then we put them in charge of everything.
It's no wonder we're in the messes we're in.
As far as many users are concerned, they're talking to Alexa. The third party app is Alexa, too.
And because of the opaque single-dimensional nature of voice interfaces, even a savvy user doesn't know who's really receiving their intent -- there are enough glitches where you think you're sending to the active skill, but you're back in Alexa's lobby again, so the inverse case the researchers are playing with is a good vector.
I think they could solve some of this because Amazon/Google are gatekeepers -- they get user input no matter where it goes -- they could easily automate detecting anomalous user input and flag for review (that would of course miss the first victims, but it's better than nothing).
I think the "Who's listening?" part is a little harder to solve. Maybe by forcing the third party app to always announce itself as itself? But that does add some friction to the "experience" they want to provide...however, a little friction is better if it means protecting your users.
One thing Amazon or Google could do here for voice apps, though, that Apple and Google (Android) can't for standard phone apps, is audit voice responses for anomalies or user input that matches a suspicous pattern and flag apps that trigger it.
They can do this because every utterance a user sends a voice assistant passes through Amazon or Google systems. If an app has access to user PII, they could add some automation to flag suspicious user responses or anomalous activity that differs from x days previous and pass it up the chain for review.
One thing I do like about Alexa development is that if you, as a developer, are privacy-minded (and don't need nor want user data for anything), you can protect your users by configuring your apps not to collect any of your users' info . As a developer, you don't even get IP addresses as everything goes User > Amazon > Developer > Amazon > User.
You always get session and Amazon-assigned user id, but they're typically pretty anonymous unless the user says "I am Jane Doe" -- which, I guess we should be honest, probably does happen more than it should, and this is what the OP researchers are exploiting.
It's got a small couple-second buffer (enough to store "Amazon" or "Computer" or "Alexa" or "Echo") where it takes what it hears and compares it with its internal model for a match.
If there's no match, the buffer is overwritten with the next bit of noise. Once the device gets a wake word match, it transmits the statement that follows to home base to transcribe and handle.
Apple, Google, and Amazon encrypt their data in transit, I have an ongoing customer relationship with them and I keep abreast of their privacy policies. I’m not happy, but I generally know what they’re doing with my data.
Not so with my flippin’ toaster or my computer monitor. And TV manufacturers have a very bad reputation when it comes to shipping everything they can get unencrypted back to home base.
We bought one of the last "non-smart" TVs available in the store just a few years ago and one of my great (arguably ridiculous) regrets is that when we went on the road this last time, we sold our place furnished, giving up that beautiful, giant, "dumb" TV to buyers who I'm sure don't appreciate its value.
synclient PalmDetect=1 && synclient PalmMinWidth=4 && synclient PalmMinZ=60
It’s starting to finally show its age, I switched to a Dell for a week after my adapter died, but went straight back to it once I was able. 13” screen and I still preferred it over the Dell (speed & comfort may have been an issue, too). Probably will be replacing it with a similar model (matte screen, though, this time, for sure).
Negatives: Required a lot of customization to get the trackpad right on Ubuntu so I’ve got that to look forward when I upgrade, I hate glossy screens, and it can act wonky if exposed to extreme humidity changes.
It’s fast, it’s light, it doesn’t typically get too hot, I’ve treated it like garbage and it still delivers —- I’m starting to look around for a new one and will probably stick with the line, but want something with a matte screen this time for less annoying outside work, they’ve got a few models available.
"The FSF should have nurtured and grown new leaders a long time ago, leaders who looked into the future, understand cloud and mobile computing and their threats to a free society.
...
I never heard anyone at the FSF ask what it means for a digital society that Facebook has been legally using free software to develop algorithms that modify human behavior. Quite the opposite, the problem was javascript in the browser for apps like Gmail."
I wish the author had taken his own titular advice, though...the post would be better for it.
Personally, I'm likely to stick with Gnucash until or unless it becomes completely unsupported, but Intuit needs some real competition and it would be great to have more choice available.
gledger looks like a neat project, will check it out!
Good luck with your application -- I, for one, think there's a need for it. I've wished for years that someone would put something like a secure, web-based Gnucash out into the world.
My comment stands:
> Yeah, you've gotta hand it to them, they really commit to the long-term hollowing out of the economy and the wringing of money from poor stones: none of this short-term loot 'em and flip 'em mentality for BH!
https://www.seattletimes.com/business/real-estate/minorities...
Think about the useful information for an attacker in messages like that: Recent transaction details can help an attacker auth on a call, account numbers can do the same. And large transactions are catnip, alerting attackers to worthwhile victims.
We've traveled all over the country and have personally encountered it everywhere -- from Oregon to New York to central Florida...it's all over the midwest, in the Great Lakes -- seems to be anywhere there's farming.
I'm not sure what you do for that, though -- not sure it can be filtered, and boiling just makes it worse as it's toxic when it's dead. I'm honestly more terrified of cyanobacteria than PFAS, and it's everywhere.
"To know if a filter is NSF certified for the removal of PFOA and PFOS look for NSF P473 or NSF Certified to Standard P473 on the product, packaging, or specifications. Two types of filters recommended are granular activated carbon (GAC) and reverse osmosis (RO) filters."
(https://www.canr.msu.edu/news/list-of-household-filters-appr...)
In Satellite Beach, Florida, the contamination from Patrick AFB was discovered after a group of Satellite Beach High alumni realized they all developed cancer around the same time and decided to start digging. [https://pfasproject.com/2018/08/08/satellite-beach-florida-f...]
They dumped everything in a trench...not realizing there was an underground waterflow there. :/
If I couldn't spoof my mac address, I couldn't use Apple TV when traveling -- you have to set your computer's MAC to the Apple TV mac, connect to wifi, log in, switch back, then turn on the Apple TV. And for most hotels/gated wifi hotspots, you have to do this every. single. day. Luckily I use Ubuntu as my primary, but still...
Here's to hoping they rethink this and add a feature to allow wifi login pages on AppleTV...
I will say that the people with the best eyes I know (one was a fighter pilot, and still has great eyesight into his 70s) spent a lot of time outside tromping through the woods and read a lot -- so had a habit of switching back and forth between close-reading and far-gazing.
Whether it helps or not (and I believe it does, when I forget for a few days, my glasses seem too weak), it isn't the worst idea to look up from the phone or laptop and focus faraway a few times an hour.
I don't know if you can fix presbyopia, though...I think that's something that just happens like clockwork at 40. :/