tgragnato

> a giant golden cage where debt-laden poor people look at exagerated external events and told that at least in America they can starve while speaking out

Making the Chinese population believe that by enduring the deprivation of their freedoms they would obtain a better economic condition is what has brought the Chinese Communists where they are.

Seeing this model exported to Hong Kong is already quite depressing, it’d be better to consider this kind of argument for what it is, at least as far as any western country is concerned.

Classifying IP sets is a fantastic idea, I’ve seen mail bounce for the ASN. That parameter is unchanged between IPv4 and IPv6. Certainly, you can do it only when the provider is a classic spam heaven.

It is the most practical solution to make sure there are no leaks to G.

The most annoying thing is that reCAPTCHA stop working: more website administrator should consider migrating to hCaptcha.

Funny thing is that they used zcombinator[.]co for one of their C2

The real difference is in latency: I tend to use the same operator on the fixed and mobile line, with Wireguard. SSH, SMB and Matrix respond almost as if you were in LAN.

If I add the cost for bandwidth and storage of a data center, then the economic choice is obvious.

iAd is still alive in Apple products, but it’s not an ad network anymore.

https://developer.apple.com/support/iad/

Did I miss some other product?

> How do both parties determine the keys used during a conversation?

They don’t: public key cryptography is not initially used.

The sender generates a random AES-256 key, applies it in CTR mode and uploads the encrypted blob to GCS.

Every receiving device gets a message with the key, the URI, and the SHA-1 of the blob. These messages are encrypted as usual and sent via APNS (<n>-courier.push.apple.com:5223)

> you’d think they would wrap it so at minimum they could tweak the underlying infrastructure without requiring every client to update

Apple does this: two other endpoints are *.blobstore.apple.com and the Chinese Guizhou-Cloud Big Data.

In my logs blobstore is used less than 1% of the time.

No? https://cloud.google.com/storage/docs/access-control

It just means Google may provide access to metadata outside of Apple’s control. Those metadata could be useful to do classification of anomalies on the basis of pattern of life analysis, or similar.

On one occasion the traffic to google cloud is systematically not proxied: every time one sends an attachment in iMessage, the file (or the media) is encrypted on device and sent to gcs-{eu,us,asia}-00002(?).content-storage-upload.googleapis.com, received from gcs-{eu,us,asia}-00002(?).content-storage-download.googleapis.com

This should be pretty visible to Google, the rest of the traffic is handled better.

I think that in this context the meaning of the term trust is different.

Any code executing in privileged mode can bypass security, and is therefore inherently part of a system's trusted computing base (TCB). (Linux is a monolithic kernel running in ring 0)

Most companies are not Linux contributors, they are trusting the kernel developers to write bug free, secure code.

Minimizing the TCB and opting for an auditable open source TCB are really useful concepts in security.

But the cause of these breaches is much more trivial than what you are worrying about: these companies are basically installing whichever piece of software can decrease their costs without thinking about what they’re doing.

Dating at work is especially a bad idea.

Things could be perfect, but (with high probability) a relationship will abruptly end and managing every social aspect can be difficult.

Or the botnet was DDoSing, and someone decided they had enough. (it would not be the first time)

> Speculative, and likely contains errors, misconceptions, and omissions; thoughtful, informed comments are welcome. Intended for a general scientifically curious audience, not requiring much detailed specialist background.

I enjoyed the reading, it is well written. Like you, I think there is a bit too much speculation to consider it an article suitable for a "scientifically curious audience". From my point of view the parallels and the "connections" between phylogeny, elements, matter and physics make it very little pseudo-scientific and too metaphysical.

The situation is a little better compared to Windows, but it's not perfect.

I always disable telemetry, but iphonesubmissions.apple.com:443, radarsubmissions.apple.com:443 and securemetrics.apple.com:443 are still contacted.

People messing with ocsp.apple.com:80 (https://github.com/StevenBlack/hosts/issues/1460) also need to be aware of ocsp2.apple.com:443.

The iAdSDK setting is somewhat respected, but all the Siri subdomains are pinged even if Siri is turned off.

> safety of its HTTPS filtering feature

Please don't terminate your TLS, they have extensions for every major browser. With the extension + AdGuard DNS your coverage should be pretty good.

> relaying to an IP block in Russia

In Russia? Care to elaborate more?

The linked publication https://www.scottaaronson.com/papers/giqtm3.pdf speculates that the universe and our brain are "quantum Turing machines".

Given the assumptions, we need to count in the fundamental limits on computation. https://en.wikipedia.org/wiki/Limits_of_computation

It's safe to deduce our brain can't simulate the universe, but only a "less powerful" description/representation of it. Otherwise the assumptions are inconsistent, and a paradox arises.

Obviously, since we don't know how the brain nor the universe work... It's all speculation

Many care that macOS is Unix-like, I doubt anyone cares about the certification.

I think Apple would need to ship a different OS in China.

Cloud services offered there must store data in the country and be operated by Chinese companies. (Apple is complying with this)

But Chinese companies HAVE TO assist the authorities in obtaining systematic access to private sector data. (This is not possible with E2E for backups and photos)

I'd like to access their data and know which percentage of people can be targeted this way.

Maybe it had a higher success rate back then, today you can find sex with with an app, no money involved.

My suspicion is that they needed to trick people into those compromising situations.

I’m pretty sure EDRs play a role in the professional protection of 100k+ IP.

At home, OS and software updates combined with network monitoring should be sufficient for the more common threat models.

One needs to draw a line somewhere.

EDRs are complex and often fail to protect business systems when professionally managed. I do not believe it's worth wasting time on that at home.

A good starting point is to set up a network tap and analyze the logs, manually.

Obviously, it's one of those things that is rarely done by the people who use fancy security products.

.. because it’s hard

E.g.: Botnet traffic is often “strange” and easy to recognize

It's not public because of licensing. But it's a simple reimplementation of https://www.wsusoffline.net.

Source code here: https://gitlab.com/wsusoffline/wsusoffline

There are big differences.

Private relay is secure as long as Apple and the third party do not cooperate, but end to end flow correlation is much easier because streams are not isolated.

Onion routing is much more sophisticated than private relay: even end to end correlation is more difficult because of how virtual circuits are made.

"The main contribution in rationalism and empiricism are not French" does not equal "French speakers did not contribute relevant knowledge in rationalism or empiricism"

https://en.wikipedia.org/wiki/Empiricism https://en.wikipedia.org/wiki/Rationalism

Hindu and Greek philosophers, Islamic golden age, Italian renaissance, British empiricism, Scottish Enlightenment, Austrian/German empiricism, US Pragmatism, ...

I'm not trying to neglect French rationalists and empiricists. Of course they exist, ... together with the many other scientists, philosophers, mathematicians, ... from many other cultures. Each single culture contributed less than the sum of the others simply because rationalism and empiricism are the fruits of global knowledge.

When detailing reasons for pushing the adoption of French in Europe, Macron acknowledged the work of Victor Hugo, who "believed that French would be the language of Europe, would today perhaps be a little disappointed" and promoted the re-examination of past colonialism in Africa, seeking to use the language as a tool to "reset a complex history in the continent".

The reasons for pretending the use of French in Europe are nationalistic. In an incident, European diplomats defined "overly dramatic, a statement of anger that clearly need no translation" when a French diplomat left his chair empty after the Council decided to use only-English in a working group.

This development was foreseen in 2017 (pre-Brexit) when Mario Monti said "The EU, when the UK leaves, should take the decision of upgrading the use of the English language in EU affairs. I think we should upgrade the ways we use English and it should become the language of the EU. I exaggerate a bit - there should be a bit of French. It will be a very appropriate gesture to the UK. It would help us Europeans to become more competitive by using fewer languages."

The statements of Mario Monti was pragmatic, it defines an issue and propose a solution. The behaviour of French diplomats is stubborn and nationalistic.

Disclosing too that I'm Italian.

Please do not attribute to me things I did not write.

I did not mention positivism, which is not necessarily embedded in the political environment we have today.

The main contributions in rationalism and empiricism are not French.

German philosophy is not generally positivist, but that’s not what I wrote.

I'm quite disillusioned about the future of the Union because of ridiculous stunts like this.

Using English exposes people to a certain way of thinking that is more linked to a set of cultures or traditions. It's an undeniable fact, both semantics and linguistics teach us that.

But if the aim is to help politicians think from a different perspective, French is a bad choice. If that was the purpose, a reasonable choice would be to opt for languages related to cultures of more practical rationality.. German or Scandinavian languages

Of course it's the French politicians who have the nerve to try impose their language. Perhaps it has something to do with the fact that French culture is one of the most pedantic and nationalistic in Europe, to the detriment of the other members.

Last week I saw a friend using dot net software that scrapes the Catalog, automatically downloads all patches and applies them to the system. It's apparently common in enterprises without an ESU subscription... I was quite surprised and amused

> How long did it take to find Bin Laden?

Bin Laden used couriers in place of digital communications. And the trail that led to him began with his most trusted courier.

Allegedly, al-Kuwayti was uncovered, some of his communications were intercepted, and then he was followed up to Bin Laden's refuge.

> Who would download some random chat app that nobody uses?

The only thing that slowed the capture was using a courier network. Are you a criminal? Do not use a phone.

Seriously, criminals should know better, whether they are petty drug dealers or major terrorists.

Misplaced faith in cryptography is the gift that keeps on giving.

... https://en.wikipedia.org/wiki/Crypto_AG

Are there iOS apps that replace Photos with your own remote storage?

On most of my Linux systems Perl is only installed as a dependency of debconf or git.

I’m sure the Linux kernel community is still using it, but FreeBSD even managed to remove it from the base system.

It’s still ubiquitous… “standard”?