HNHacker News
TopNewBestAskShowJobs

n0nc3

186 karma · joined November 14, 2020

Mechanical Engineer.

Crypto enthusiast since reading "Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2".

submissionscomments
n0nc3··on Hire people who give a shit
If you are doing anything more complicated than gluing a pair of APIs together, it is very likely that the marginal value of work past 60 hours is negative. Reaping what you coded during a 3am espresso binge is rarely a happy experience.

But yeah, if all you are trying to do is build out Facebook before some other social network gets there maybe it makes sense to pull 100 hour weeks.

n0nc3··on A group of recent Princeton graduates has won more than $6M in 66 lottery wins
Rules to one of the mentioned lotteries. [0] It looks like prize counts are fixed in advance, so any information about redemption changes odds. Blacklight also shows that the lottery website is riddled with trackers, so it is possible they are inferring redemption from advertising data.

[0] https://hoosierlottery.com/getmedia/33f6f7bf-f0e6-4265-bcbe-...

n0nc3··on Thunderbird 78.x is great but has issues for advanced PGP users
An axiom of cryptographic tool design: there are no advanced users. Designs that ignore the axiom will always create dangerous failure modes.
n0nc3··on TSMC and Google push chipmaking boundaries with 3D 'stacking'
Why can't America build anymore? Is this a cultural problem, or a failure of public policy?

Healthcare, rail, aircraft, automobiles, shipping, pharmaceuticals, and now semiconductors. We can't make any of these things at scale anymore.

They turned GE into a financial institution. They sold Bell Labs off in pieces. Boeing can't safely update 1990s vintage air frames to accommodate modern engines. And yet, the market is on a tear. This is not sustainable.

n0nc3··on Metal monolith found by helicopter crew in Utah desert
Not just a court case though, an investigation or a "psych eval" are enough to ruin someone. Take a look at Russ Tice.

Also, read Ronan Farrow's piece from the New Yorker last week. They targeted a straight-laced DOJ lawyer with >20 years of experience. These organizations are out of control and pose a very serious threat to our freedom.

https://en.wikipedia.org/wiki/Russ_Tice

https://www.newyorker.com/magazine/2020/11/09/how-a-cia-cove...

n0nc3··on Microsoft 365 has employee surveillance and analytics built in
"Former JPMorgan colleagues describe the environment as Wall Street meets Apocalypse Now, with Cavicchia as Colonel Kurtz, ensconced upriver in his office suite eight floors above the rest of the bank’s security team." [0]

What really scares me is the number of people that adopt this strange Panglossian view dismissing every abuse of power as a one-off that cannot possibly reveal widespread systemic failures.

[0] https://www.bloomberg.com/features/2018-palantir-peter-thiel...

n0nc3··on Microsoft 365 has employee surveillance and analytics built in
Given that its already deployed in academic contexts, I suspect that the more invasive employers are already using it. Finance, defense, etc.
n0nc3··on Synthetic-Aperture Radar Imaging
There's a link to another article about the hardware at the bottom. There are good entry points for overcoming the SDR/DSP learning curve for this article to make sense.

[0] https://news.ycombinator.com/item?id=25060152

n0nc3··on Apple’s head of security indicted in Santa Clara County CCW case
A related historical anecdote. The Mulford Act was the first law on the path towards California's strict CCW regime. Whatever your policy preference, it is history worth knowing.

https://en.wikipedia.org/wiki/Mulford_Act

n0nc3··on Douane: Linux personal firewall with per application rule controls
For us mortals, SELinux is a synonym for "complicated, scary thing that I don't know how to use properly".

Can you link to something with minimal working "mark and block" examples?

n0nc3··on Douane: Linux personal firewall with per application rule controls
Then create a separate chain with the "partial connectivity" rules you want and jump to that.

Not everyone is comfortable running random github code as root.

n0nc3··on Douane: Linux personal firewall with per application rule controls
Privacy tooling should not come from a page that does not work without javascript. Moreover, this functionality is easy to achieve using user groups and the iptables owner module.

Here's an example that prevents atom from leaking telemetry.

    # add group atomblind
    sudo groupadd atomblind

    # add your username to atomblind group
    sudo usermod -a -G atomblind <username>

    # do not allow outbound traffic from group atomblind
    sudo iptables -I OUTPUT -m owner --gid-owner atomblind -j DROP

    # overwrite atom binary with a hook
    # atom_binary is absolute path to your atom binary
    echo "#!/bin/bash" > atom_hook
    echo "sg atomblind -c 'atom_binary'" >> atom_hook
    chmod +x atom_hook
    ./atom_hook
n0nc3··on Cover Your Tracks
Take a look at the linked case. The prosecutor made a big deal of the fact that the defendant used a subversion server for version control. It was doubly evil because it was a subversion server in gasp Germany.

https://www.vanityfair.com/news/2013/09/michael-lewis-goldma...

n0nc3··on Cover Your Tracks
If you told an American in 1995 that AT&T was selling their call records, or that Visa was selling their transaction records, they would have gone ballistic.

The fact that all this tracking is still hush-hush means that most people would not react kindly if they were aware of the true scope of the tracking, and how widely distributed the data is.

n0nc3··on Cover Your Tracks
The practices should be banned. It's a federal felony to wiretap or open someone else's mail. In almost all states, it's a crime to record conversations without consent from at least one party. Earlier generations passed those laws because they viewed mass surveillance as a fundamentally Soviet activity with no place in a free society.

According to some footnotes in Shoshana Zuboff's book, the FTC was on the path to ban these practices in 2001 but then 9/11 happened.

n0nc3··on Cover Your Tracks
https://en.wikipedia.org/wiki/NoScript
n0nc3··on Cover Your Tracks
You make yourself non-unique by looking like others. In that sense your privacy is limited by the precautions that others take.

Turning off javascript is a very good thing to do. The more people that do it, the stronger a protection it will be.

n0nc3··on Cover Your Tracks
Browser fingerprints are turning up in court cases now. Probably not wise of EFF to frame it as "covering your tracks". It's more like "closing your blinds".

https://www.theregister.com/2019/07/17/exmicrosoft_engineer_...

https://regmedia.co.uk/2019/07/17/us_v_kvashuk.pdf

n0nc3··on Facebook’s experimental hate-speech policy seems to be working
I would say that Facebook is similar to a 18th century tavern. It's a place where people meet and talk. Fortunately for 18th century humans, there were many pub owners who exercised varying degrees of control over the activities of their patrons. Some banned radical politics, and some did not. In our present era of concentrated control, we have a small handful of pubs controlled by a similarly small number of wealthy oligarchs.

Recall that the Green Dragon tavern was the unofficial headquarters of the American revolution.

n0nc3··on Facebook’s experimental hate-speech policy seems to be working
This is an extremely lazy argument.

Our generation has seen entire sectors of the economy subsumed within monopolies. The consolidation is unprecedented in the modern era. These monopolies have a degree of political influence that makes them hard to distinguish from government in anything but a formal legal sense. We have seen what the financial sector has chosen to do with its political influence. Why would we expect anything different from new media companies like Facebook?

People need to stop and ask themselves if the core enlightenment principles of toleration, free expression, and free association are worth protecting. Once abandoned, they will not be easy to resurrect.

n0nc3··on Mozilla DNS over HTTPS (DoH) and Trusted Recursive Resolver (TRR) Comment Period
Is it possible to add root CA's for DoH only, so that I can intercept requests at the gateway and terminate the TLS connection there?

Can anyone link to the part of the source tree containing their DoH implementation? I would like to test whether it is possible to distinguish Firefox DoH from unbound.

n0nc3··on ‘Extremely aggressive’ internet censorship spreads in the world’s democracies
It is my understanding that toleration, free association, and free expression are core enlightenment principles that enable a civilization to be governed by reason. These are threatened by the censorious attitude of boomers and aging gen-xers with home equity to protect.

It is not unusual for older, wealthier elements of society to question the value of free expression for the masses. [1]

[1] https://www.amazon.com/democratic-enlightenment-philosophy-r...

n0nc3··on ‘Extremely aggressive’ internet censorship spreads in the world’s democracies
You can't just toss out core enlightenment principles because a handful of loud simpletons latch on to bad ideas. Not without explaining why.
n0nc3··on ‘Extremely aggressive’ internet censorship spreads in the world’s democracies
Conversely, it has never been easier to inject true claims that are inconvenient for gatekeepers. What tilts the balance of equities in favor of censorship for you?
n0nc3··on DEA Pursues Vast Expansion of Patient Surveillance
Naming them won't add any credibility to my claim.

There are many companies that offer the data for sale. The example I link seems to require HIPAA authorization from the individual, but the authorization is not actually required by law. It also raises the question how the vendor is able to acquire the data without HIPAA authorization.

The data is advertised as "real time".

For what it's worth, my money is on "deanonymizing" guids. Hedge funds want to track sales in real time to have an edge in earnings forecasts.

https://www.rxhistories.com/irix/prescription-data/

n0nc3··on Your Computer Isn't Yours
Ironically, Chromebooks are the "freest" hardware you can get. They all support full-featured coreboot, including measured boot and verified boot.

https://www.coreboot.org/

n0nc3··on AMD Radeon RX 6800 and RX 6800 XT Review
You are right for now, but Julia already has an experimental ROCm stack. Rolling out full featured ROCm support could be a huge win for Julia user growth (and AMD).

https://juliagpu.org/

n0nc3··on DEA Pursues Vast Expansion of Patient Surveillance
No idea.

All I know is that there are at least three hedge funds with the ability to acquire individualized prescription histories. I don't know if they are able to "deanonymize" guids in a large database, or if they query based on the individual.

Congress should start asking questions.

n0nc3··on DEA Pursues Vast Expansion of Patient Surveillance
Prescription histories are already available for purchase.
n0nc3··on Ok Google: please publish your DKIM secret keys
Put the company you work for in your threat model, and this becomes relevant to you.

The corporate world is mired in zero-sum competition, and some of your colleagues are willing to do things that will shock and appall you if it increases their chance of "winning".

Try working in defense, finance, or security as a closet anarchist. Have a few Chomsky books in your Amazon purchase history? Good luck climbing the Amazon corporate ladder.

Page 1 of 2Next →