ranger_danger

I should have clarified... when I said "proxy TLS" I meant while retaining the typical features that reverse proxy providers offer like those I mentioned here: https://news.ycombinator.com/item?id=49662319

If for example Cloudflare decided to offer this SNI-based TLS passthrough, they could no longer give you adequate DDoS protection, caching, analytics etc.

> Actually, you could proxy based on SNI alone

If you assume the origin speaks TLS and holds the cert/private key, and isn't using ESNI/ECH, then I suppose in a limited way it's possible. But...

> because they want to intercept all your traffic so the NSA gets a copy.

I don't believe that is the reason. I believe it's for features.

You need actual TLS termination to do most things CDNs and reverse proxies offer, such as:

- caching and compression

- WAF / bot detection

- URL-based routing

- header manipulation and redirects

- application-layer DDoS filtering

- analytics

- edge functions and content transformation

Previous discussion less than a month ago: https://news.ycombinator.com/item?id=49341411

The comments on that post were not nearly as favorable as this one for some reason.

Depends on what you want "without AI" to mean... is it just stories about AI, or anything that an AI has touched at all? Or purely vibe-coded projects?

Even if it is, the software on the device could theoretically do whatever it wants with the data before it's encrypted/uploaded, and if it's sent to Apple, they could do whatever they want with it too.

I mean, anything with a microphone or camera (and some things without) can theoretically be used to listen to/record you at any given time for a myriad of reasons.

If you are worried about such a device being on your person, I think the easy solution is just not to wear or buy one.

Lately for me it's "anything employing calm and rational critical thinking against a hivemind already dead set on misinformation gets downvoted."

I would assume you could make big enough differences in color/contrast/brightness and especially 3D rotation (similar to taking a photo of a screen) would make such a signature unreadable... but I would love to be proven wrong.

Yes in multiple ways, and there's probably more than this:

It's relevant that a screenshot doesn't have a signature, in the case that you want to remove any "proof" or tracking info from a real photo when uploading an image. Maybe I don't want people to know what brand/model of camera I use.

And it's relevant if a screenshot did have a signature if you want to "prove" that the screenshot itself hasn't been tampered with after the fact.

Most traffic on the Internet flows unencrypted through a portion of some reverse proxy MITM-as-a-service provider's gear like Cloudflare, Cloudfront, Akamai etc.

You can't proxy TLS for people without having the ability to see the decrypted data somewhere inside the server software/RAM. They (or a government) may or may not be looking at it or storing it, but the possibility is there.

There will always be a way around it. There are even open-source alternative/hacked firmwares for professional DSLR cameras where tampering with the signing may be possible.

And this still doesn't help any other kind of image e.g. screenshots, photo of a screen etc. that can make the camera signatures largely pointless depending on the context.

There's also MPTCP (multipath TCP) which is even supported on mobile devices these days. So for example if your device has both a wifi and a cellular connection, and both ends of the stream support MPTCP, you can increase throughput/failover by combining multiple interfaces.

> I would've expected a single TCP connection to be able to saturate a line

There's several factors at play that make this (usually) not the case.

Besides physical latency (which includes those added by any VPNs/tunnels/etc., some of which may be internal to an ISP along the route and outside of your control), there's other things like the TCP window sizes / window scaling option[1] that can affect single stream performance, and those type of parameters can differ by OS/interface type on both ends.

Also for SSH specifically, it has its own fixed buffer size that also limits throughput unless you're using the HPN-SSH fork[2].

[1] https://en.wikipedia.org/wiki/TCP_window_scale_option

[2] https://www.psc.edu/hpn-ssh-home/introduction/

That is exactly what I am claiming is false. Later LG even came out with their own statement saying basically the same thing I did.

What is this separate feature you claim that is not the same as the one I refer to?

Agreed... the realization I had recently was that if I've got boxes that I haven't touched in years, then I won't really miss them as much as I think I will if I get rid of it.

Do you have a source for this claim?

My ISP seems to frequently rotate IPs with other people who can't behave, so my IPs always have garbage reputation... that probably has a lot to do with it as well.

How do I know this? I have received reports from various websites (and manually queried some public block lists/RBL/etc.) that my IP range was blocked due to all sorts of different things like open proxies, CSAM etc. even if I've never visited that site before, and I know just from being a neteng that that such traffic is not originating from my devices/router and I don't have any observably compromised devices or suspicious traffic when monitoring it.

Agree 100%, your outlook on life is completely in your control.

You can literally just "choose" to be happy, assuming there are no big mental health barriers in the way.

Or rather, you can choose behaviors and perspectives that influence your emotional state, even when you can't directly command the emotion itself.

No, it's not easy. Controlling your emotions can be very difficult, but that is actually how it works if you think hard enough about it.

My understanding is that's basically all this does.

Thousands of lines of text just to add one sentence to the prompt.

This is a known feature that is not hidden which is not automatically turned on by default.

You must set your TV to a different standby mode and enable LG voice control.

When you do this, it very plainly tells you that it can listen with the screen off so you can control the TV with voice.

Failure of User Awareness, not some nefarious spyware.

Sometimes a fandom site I come across is legitimate and has tons of great information, and other times they completely make up fake games or features and just act like it was always real.

The last time I tried to use LibreOffice, I made three hours worth of comments on a Word document.

As soon as I saved the document, they all vanished.

Then the developers mocked me for complaining.

Now I just use real MS Office in a snapshotted virtual machine, because it works every time and loads just as fast.

I cannot visit most crimeflare sites because I just get endless captcha loops.

I'm more concerned about crimeflare's own incentive to analyze our traffic that people already willingly let them MITM, and somehow sell it to the highest bidder.

Yes but used how? What is the exact configuration and details for reproducing this?

How was it actually factored though? Where is the code for that? How was the private key created and how are the new certs issued?

Right, and unless enough people are personally affected, I don't see there being one.

I think this was an inevitable outcome of western culture's individualism being inherently selfish.

Yes that's what I'm saying this could be used for. Browser generates a client-side key (or any kind of identifier, possibly derived from the site's TLS cert/domain or some other info) for the current browser/user/device/whatever and just offer that to every website as an extra header so that whoever wants to track you, can.

This is a known feature that is not hidden which is not automatically turned on by default.

You must set your TV to a different standby mode and enable LG voice control.

When you do this, it very plainly tells you that it can listen with the screen off so you can control the TV with voice.

Failure of User Awareness, not some nefarious spyware.

There are some projects that only release sources as a flat tarball at the same time as a new release, no git history/repo is available.