mrsteveman1

Replying to myself after doing some additional testing.

I've now seen multiple examples of Pinterest hosting images with the "original link" being a Google Images search result page, complete with the huge URL query string intact.

While it's possible users who don't know how to find the original URL for an image are pinning Google Image pages instead, the accounts that have pinned them do not look like real people.

It really makes it look like Pinterest is crawling Google Images for specific search terms, auto-generating pages to match the results, and then manipulating Google to get their own pages to show up in Google instead.

They seem to have gone to a lot of trouble to insert themselves between the site users visited intentionally to find what they were looking for (Google), and the site that actually provided what they were looking for.

They've essentially become a large MITM attack on Google Image results.

Edit: just tried a few arbitrary search strings on Google Images, it seems improved compared to the past few weeks/months, somewhat.

For some searches, Pinterest results didn't appear at all. For "esp8266 enclosure", only 1 out of 15 on the "front page" points to Pinterest, but the original image is still from Tindie, not Pinterest. The person who supposedly pinned that image describes themselves as "Creative Digital Marketing, Web designer, WebDev, crazy SEO".

Ok, maybe a real pin from a real person, maybe.

Then I decided to see what happens with a handful of more "NSFW" search terms. The number of Pinterest results varied but significantly increased overall.

For some terms, in the 3 rows of images visible without scrolling, there were 19 images, and 11 of them (57%) pointed to Pinterest. None of them were images originally posted on Pinterest, they all have a hover link to the original site.

However, even though Pinterest is providing a link to the original site on top of the image, clicking it doesn't always take you there.

A good bit of the time, Pinterest has chosen to redirect you to a "blocked site" page instead, and only after they have already displayed an image from a site that they deemed "inappropriate". And then shortly afterward a giant popup prompting the user to login or create an account filled the screen.

[1] (safe for work) https://i.imgur.com/XuOvwvi.jpg

> the built-in wireless on the 3 and Zero W was game changing

Definitely, the Pi Zero W is now my go-to controller for almost anything that needs one. The fact that Microcenter frequently sells them for $5 seals it.

I pair them with a $15 aMLC (MLC in SLC mode) industrial MicroSD card[1], and they've been rock solid, no FS corruption on power loss, no Wi-Fi drop outs.

The ability to add the Pi Camera board and have a tiny full HD networked camera with trustworthy "firmware" is a killer feature though, pre-made IP cameras at any price tend to have outdated insecure or even malicious firmware that may or may not be replaceable.

[1] https://www.digikey.com/product-detail/en/atp-electronics-in...

> It's not considered faulty, more like degraded over time.

> I rather have shorter battery life with same performance so it's more noticeable that I need to replace the battery.

I agree, but something is odd about this whole situation.

I have an iPhone 6, iPhone 5, iPhone 4, a 2nd generation iPod Touch, and several Android phones.

The iPhone 6 is the first one I've seen randomly turn itself off when the battery level was below 30%, all of the others would run normally even when the battery condition was poor. I could continue using them normally while the battery indicator ticked down to 1%.

While my iPhone 6 no longer randomly turns itself off, it frequently doesn't respond for 15+ seconds when typing a letter on the keyboard or tapping a text field, it's essentially just as unusable as if it had turned itself off.

What makes me suspicious is that I have a 2nd iPhone 6 here at the moment with a similarly aged battery in fairly poor condition. It doesn't randomly turn off, and the performance difference is immediately noticeable, it's actually usable. The only real difference I can identify is that it is still running an older version of iOS.

Rebooted one of my AMT machines so I could take a video of what you see on the physical screen during boot while the remote console is active: https://youtu.be/GDD8os3ZeCI

I suspect they'll be patching this one, but I don't know if they have updated the ME firmware in the past.

However, Intel's own platform tools (MEInfo and MEManuf running in a UEFI shell) can't even communicate with the ME on my 2015 Macbook Pro, so I would be quite interested to know what exactly they have done differently with regard to configuring the platform.

People have been archiving every version of the ME firmware for each chipset, and it would appear there are some versions that may be specific to Apple hardware. I'm not sure what is different, if anything, but you can see (and download) the particular firmware versions here: https://www.win-raid.com/t596f39-Intel-Management-Engine-Dri...

> my Java plugins in Safari have stopped working. Now those are required for VPN connection.

Is it common for VPN access to be handled this way?

What's the advantage over issuing a certificate or just using a username+password?

Every time a new kernel version is released, I really look forward to reading these posts on Kees's blog. They're short and easy to read.

Thanks for writing them Kees :)

> my main sorrow with the clearly misleading wifi-switch is to fall prey to those nasty mac-adress tracker in shops.

Aren't they randomized now?

> nice! can you talk more about Rust's tooling? How do you debug? What IDE or text editor do you feel comfy with? Do you have/use/need autocomplete?

For writing code, I've been using IntelliJ with the Rust plugin for the past year.

Autocomplete works pretty well, there is Cargo integration so you can edit your dependency file in IntelliJ and things will automatically update so that autocomplete and documentation (go to definition) for the newly added dependencies start working immediately.

There is also simple build/check/run support, with build and test output appearing in the lower panel inside the IDE. There are some quirks, but they have been very minimal.

I've never used IntelliJ to debug Rust itself, because in most of the projects I've worked on, the Rust code has been designed as a completely separate library with a semi-public API, intended for embedding in another language like Swift or C#.

So the debugger has almost always been Visual Studio or Xcode, but it works exactly as I would expect even without using any sort of Rust plugin for either one.

The other day I was stepping through the call stack to find the source of a crash (one that I caused by failing to keep the P/Invoke signatures up to date with our Rust functions), and Visual Studio switched right from C# to Rust from one frame to the next, showing the source code and the line where the crash occurred in Rust.

Really I can't think of anything that has been even a moderately significant problem, it's been great all around.

Very nice tool, I hadn't seen that before thanks!

There should be a service similar to Mozilla's TLS configuration generator[1], but for SSH.

Mozilla does have a wiki page with modern and intermediate SSH configurations[2], but I'm not sure whether the advice is still current, and a configuration generator page would probably be more accessible. I wonder if they would be open to creating one.

[1] https://mozilla.github.io/server-side-tls/ssl-config-generat...

[2] https://wiki.mozilla.org/Security/Guidelines/OpenSSH

Keybase is just another Git remote you can push to, one that transparently encrypts whatever is pushed to that remote.

The Git repo itself is completely normal in every other respect, so if you push to Github, everyone can still see the entire repo.

This is a good design as it lets people move repos easily and avoid too much lock-in, but it may (will...) come back to bite people soon, who push things to Github thinking they were "encrypted by Keybase", which is not what's going on.

They support PGP keys, but I don't think anything in the keybase UI or proofs will reflect key certifications made in PGP's web of trust. You can "track" people, but that's not the same thing.

It should be possible to augment the existing proofs with the WoT relationships, which could be valuable in a small number of cases.

However, it wouldn't surprise me if more people started using Keybase because of this one blog post, than have ever used PGP's web of trust features.

Hey, already love Fork after just a few minutes. Rebase support, stashes, sub-modules, tabs... this is fantastic :)

You may actually get me to delete SourceTree, which is a high bar to clear. Despite all the major issues with SourceTree, like locking the main thread for 3 minutes, pinning the CPU to 100% just because a file was staged, and refreshing the diff view 100 times in a single minute, I haven't been able to switch away from yet.

P.S. your Cartfile is being copied into the resources folder :)

> What if I cut a piece of my body and eat it, is that cannibalism?

I think at that point, you're likely to be involuntarily committed anyway :)

Well, that depends on whether CI is a logical AND, or a logical OR. No accepted medical use AND high potential for abuse? Or can it be "any of the above"?

21 U.S.C § 812[0] doesn't say anything at all except to give the list of findings:

> (A) The drug or other substance has a high potential for abuse.

> (B) The drug or other substance has no currently accepted medical use in treatment in the United States.

> (C) There is a lack of accepted safety for use of the drug or other substance under medical supervision.

This is a little surprising because the "trailing AND/OR" is fairly common in other areas of the law. Makes me wonder if it's ever been clarified in court.

There is some precedent for having a single active ingredient listed in multiple schedules though, the one that immediately comes to mind is hydrocodone.

Until very recently, we listed hydrocodone in both CII and CIII, depending on which other active ingredients it was combined with.

If it was in a pill loaded with acetaminophen, which would supposedly deter addicts from eating 20 of them at a time, it could be in CIII, otherwise it was strictly CII. Because naturally, anyone getting ready to swallow 20 Vicodin at a time is going to know that acetaminophen can cause acute liver failure and make the rational choice to avoid it.

That was one of the primary reasons Vicodin has been handed out like skittles for every little injury, it's every bit as powerful as the others in CII, but it could be prescribed with less oversight.

In that light it's not too surprising to have GHB listed in more than one schedule, but it's still absurd that one of them is CI, given that as far as I'm aware, there is nothing particularly abuse-resistant about Xyrem.

[0] https://www.law.cornell.edu/uscode/text/21/812

> A valid descriptor would be "Encrypted".

Someone should conduct a poll with a mockup of a URL bar that says "Encrypted" instead, asking a wide variety of users to describe what it means.

When users look at that part of the URL bar, there's an implicit question being asked of the UI.

Describing a URL as "Secure", "Private", or even "Encrypted" is a partial answer, users will infer the rest and they'll get it wrong a lot of the time.

> language that is as similar to Python as possible without requiring a global lock

Something like Pony[0] or Nim[1]? I'm not very familiar with either one, but Nim says it is inspired by Python, and on the surface Pony appears to be as well.

[0] https://bluishcoder.co.nz/2015/11/04/a-quick-look-at-pony.ht...

[1] https://nim-lang.org/features.html

> Is there any elaboration on what "effectively controls access" means

Apple Inc. v. Psystar Corp.[1] involved circumvention of a system that "effectively controls access" to Mac OS X, preventing it from being installed on non-Apple hardware.

Apple's anti-circumvention system is (in part) that some of the important system binaries are encrypted, the kernel transparently decrypts them when they are executed.

The key isn't secret (in fact it's a constant that hasn't changed in 10+ years), but it is only distributed inside the SMC chip on the main board of a real Mac.

There's no question that encryption is generally an effective access control method, it can't be circumvented without either having the key or breaking the encryption system in use.

The court found that regardless of how trivial it was to obtain the key, the fact that it was encrypted made it "effective":

> Psystar contends that Apple's anti-circumvention technology was ineffective because the decryption key for circumvention is publicly available on the internet. This argument fails.

> "The fact that circumvention devices may be widely available does not mean that a technological measure is not, as the DMCA provides, effectively protecting the rights of copyright owners in the ordinary course of its operation." Sony Computer Entm't Am., Inc. v. Divineo, Inc., 457 F. Supp. 2d 957, 942 965 (N.D.Cal.2006).

> Generally, measures based on encryption "effectively control" access to copyrighted works. Here, when the decryption key was not employed, the encryption effectively worked to prevent access to Mac OS X. And that is all that is required.

> See Universal City Studios v. Reimerdes, 111 F. Supp. 2d 294, 318 (S.D.N.Y.2000) (noting that when a decryption program was not employed, the encryption worked to control access to the protected work).

> Accordingly, Psystar has violated the DMCA by circumventing Apple's protection barrier and trafficking devices designed for circumvention. Apple's motion for summary judgment on its DMCA claim must be granted.[4]

[1] https://www.courtlistener.com/opinion/1557201/apple-inc-v-ps...

> The domain in question is a part of a copyrigth protection scheme. Blocking access to it is a circumvention of copyright protection scheme and it is illegal under DMCA.

You're asserting things to be true that are very much in question, and the assertion borders on the absurd.

Is it also a DMCA violation to add firewall rules to ones own network equipment?

If you rounded up every person even suspected of having committed voter fraud in the past few elections, you might have enough staff to run a McDonalds in a small town.

But even if it were an actual issue rather than a manufactured one, Judicial Watch is not a legitimate source of information.

It feels like a step backward to be designating specific sets of files as being unworthy of encryption despite using a FDE setup.

It's also annoying to have more than one system partition to deal with when all of the pieces of software and hardware involved are perfectly capable of working normally with a single encrypted partition.

Boot is a special case to some extent as most people aren't going to care if the few files in there are readable, but then again the initrd is in there, and that could contain things that would otherwise be encrypted if they were on root.

For example, some people set up dropbear sshd in the initrd, so it's possible (even likely, depending on the tutorial being followed) that it may have a real, unencrypted copy of the sshd host key(s) the main OS would be using, once it boots. Whether you care depends on the deployment, of course.

I suspect that in some obscure cases, allowing unknown parties to see the kernel binary may count as an info leak that could be used for other attacks, potentially even against other more secure systems that happen to be running the same kernel binary.

The primary cause of that sort of thing appears to be the significant leaps forward[0] they've made with their ARM hardware every year.

At some point it will plateau the way PC hardware has, and new major OS versions won't be as much an issue.

[0] https://arstechnica.com/apple/2017/06/review-10-5-inch-ipad-...

To date, all of the discussion over what GRsec has done is about distribution rights, but it appears the GRsec agreement[0] also contains this:

> If the User has received pricing for the stable patches on a specific product, use of the patches on additional products without the consent of the Company will result in termination of access to future updates of grsecurity stable patches and changelogs.

So while the patches are derivative works of the upstream kernel, which is GPL licensed, they're attempting to restrict the use of the patched kernel source as well by requiring "consent" to use the combined work, the bulk of which was not written by the GRsec developers and has been licensed directly from the upstream kernel authors to anyone who receives it.

That directly contradicts freedom 0: the freedom to run the program as you wish, for any purpose.

[0] https://grsecurity.net/agree/agreement.php

[1] https://www.gnu.org/philosophy/free-sw.en.html

They've turned core infrastructure enhancements into what might as well be one of Microsoft's "reference source" deals, or a EULA.

I suspect this will just shift focus to the Kernel Self Protection Project[1].

It may end up being the best thing that could have happened for kernel security in the end.

[1] https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr...

That's not the same thing at all.

The 'P' taint flag exists because upstream kernel maintainers aren't interested in dealing with bug reports where the bug may have been caused by proprietary code loaded by end users, which often can't be examined or copied even for the purpose of discussing the bug. Total waste of time, so the flag makes those cases obvious to anyone reading the bug report. The user can be told upfront to remove the proprietary code and try to reproduce the bug again.

End users can combine proprietary code with GPL code if they want to, because end users aren't bound by the GPL unless and until they distribute something covered by it. You don't even have to accept the terms of the GPL just to run the program[1].

A company distributing a proprietary module for the kernel may or may not be violating the GPL, depending on what it does and who you ask.

In contrast to the module stuff, GRSecurity is a set of patches to very low level parts of the Linux kernel itself. It could never be licensed in a way that prevented the patch set or the resulting patched kernel source/binaries from being covered and distributed under the GPLv2. If that were the case, the kernel would effectively not be covered by the GPL at all.

[1] https://www.gnu.org/licenses/gpl-2.0.en.html#section5

Could be, it may be more like the ext3/4 -> BTRFS conversion process[1], where metadata for the new filesystem is written in the free space, but with pointers to the original data which isn't moved or re-written.

[1] https://btrfs.wiki.kernel.org/index.php/Conversion_from_Ext3

> This is no different from Apple having a whitelist for TRIM support of SSDs in earlier versions of macOS. People were under the impression that there was some good technical reason for this.

I used to force-enable TRIM on my non-Apple SSDs for years, it was irritating but I think they were right to be cautious. Disk controllers have a history of serious bugs being triggered by external commands.

My go-to example is my Samsung HD204UI drives, they shipped with a firmware bug[1] that led to write corruption whenever a specific command was issued to the drive. Samsung issued a firmware fix without bumping the firmware version, so even today several years later, smartmontools prints a warning every time it runs, because it's impossible to tell which drives have been fixed.

Stuff like that is so common[2][3][4] the Linux kernel maintains a list[5] of devices that certain commands shouldn't be used on for various reasons. One has TRIM completely disabled, several have NCQ TRIM disabled due to known corruption issues, including one I still own: the very same drive I used to force-enable TRIM on when it was in my Macbook.

[1] https://www.smartmontools.org/wiki/SamsungF4EGBadBlocks

[2] https://github.com/torvalds/linux/commit/cda57b1b05cf7b8b99a...

[3] https://bugzilla.kernel.org/show_bug.cgi?id=71371

[4] https://bugs.launchpad.net/ubuntu/+source/fstrim/+bug/144900...

[5] https://github.com/torvalds/linux/blob/master/drivers/ata/li...

It looks like you're right, Apple says you can't bundle dylibs outside of a Framework on iOS :\

What would be the difference though, why make the distinction?

> Dynamic libraries outside of a framework bundle, which typically have the file extension .dylib, are not supported on iOS, watchOS, or tvOS, except for the system Swift libraries provided by Xcode.

https://developer.apple.com/library/content/technotes/tn2435...