thefr0g

> All the problems with security seem to come from JavaScript exploits intrinsic to the engine

Yes the classic memory-related bugs come from the engine, but the comment explicitely mentioned leaks and I don't think that was about the memory ones. Many of the new "features" turned out to leak sensitive or at least identification-enabling information. Imo having remote code execution without a big red warning that this is stupid and you should not do it that users can't click away without being forced to think about it just isn't a good idea, even if it is sandboxed. At the very least we should have a permission-based system where users need to authorize every single Javascript API, for every single connection/file/database/whatever and be unable to ignore it without disabling the APIs. That would imo be the best compromise since web-devs would be forced to think about what they are doing to users computers¹ while still allowing applications to be built.

¹ My hope being that they wouldn't include [bullshit fontend framework] except when absolutely necessary

> do we tell people "Don't use a mobile phone?" because at that point we're simply seen as Luddites in the eyes of most people and we lose the opportunity to help others.

That's what I always tell people when they ask me how to do x in a secure and/or private manner on their phone and after some discussion most of them get it. Of course it's not practical but imo people need to be sensitized to how shitty almost all software actually is and that you can only have compromises. Also you can't just get someone to use FLOSS for tactical reasons, they have to know about the why and how or some of them will poison the community. I've seen way too many people acting entitled to have some feature they think is missing build immediately when they don't intend to pay the developers or do the slightest bit of work themselves. FLOSS isn't about being an alternative to commercial software but about enabling users to do whatever they want with their machines and this has to be communicated to new users that aren't familiar.

> From a security/compliance perspective, I don't think it's unreasonable to do your work on a locked down machine if you are able to do your job

Not at all. But from a security perspective I think it's also not unreasonable to request that my data isn't exfiltrated to some shady anti-virus company and my personal details aren't stored in a rancid (active) directory service.

It's a religion, it's based on a work of fiction. Everyone can gatekeep it to their liking, that doesn't mean they are right. You said it yourself, it all depends on interpretation.

> Christianity has a code of ethics [citation needed], they vary by interpretation

Maybe we could just use something that can't be stolen. Something like a shared secret that is exchanged through secure channels beforehand and then only resides in the users permanent memory. The second party could even use some kind of novel mathematical function that maps arbitrarily sized secrets to a seemingly random fixed size value that is both sufficiently different for similiar inputs and big enough to avoid collisions. That would allow them to not store the secret in plain text as they could just compare the output of the function with the previously saved one to verify that the secret the user gave is most likely correct.

I don't think someone like this would actually get hired…

> The treatment of school children during the pandemic in Germany is a disgrace.

Why? This seems pretty safe compared to other countries.

> If you don't mind me asking, how do you handle 2FA and companies that require a phone number(eg. my bank)?

I'm note vertis, but I wont give out my cell phone number, so: Companies that require 2FA via phone just don't get my business and about all banks in germany offer chipTAN. The chipTAN devices are all made by shady companies and are less than open but I still trust them more than any smartphone or the mobile network.

> On problem with this method is that is has made me hate webapps, including PWAs

Javascript is the new Flash...

I don't get why people litter their browser with tabs. I pretty sure I never used more than 30 at the same time. I just close them if I don't need them anymore. At the latest when I can't read the titles anymore the garbage collection runs. If I might still need it I just bookmark the page. (It helps to sort your bookmarks and have proper syncing)

> its also blown waaaayy out of proportion.

Can confirm, media likes to report on it because it gets a lot of clicks. It's a loud minority that knows how to use (online) media for their means and profit.

> The "police brutality" used against the QAnon, Nazis, and the so called "Querdenker" demonstrators here in Germany is laughable, when you compare what the police does against left-leaning demonstrations here in Germany on a regular basis.

Initiators of (not only) left demonstrations like to cry about the oh-so brutal police but there is definetely truth to this. I've never seen protesters get away with so much bullshit in germany.

> Depressingly, I'm sure most people won't care. But hey, I can hope.

I'm afraid you're right. Nobody cares about their photos being searched for whatever by shady organisations and corrupt agencys.

- Facebook: 2.8 billion active monthly users

- Google Mail: 1.8 million users

- iCloud: >850 million users

- Google Drive: about a billion users

- Dropbox: >600 million user.

> If it becomes mandatory for email providers to screen emails, will services such as Protonmail become illegal in the EU?

Protonmail should already be illegal in the EU because they operate under swiss mass-surveilance laws and cooperate with US-American law enforcement. Both of which violates the GDPR if they do business in an EU state.

> Since they don't have access to their users' email content because of encryption.

They still have access to all the unencrypted mail their users send and receive and to all the metadata of the enrypted communications.

> Bikers should realize they are driving a more dangerous vehicle.

So you think bikers should care more about making themselves save isntead of car owners about making everyone save?

I live in germany and even in "structually weak" eastern regions you can get by ok without a car unless you live in a very tiny village or are physically impaired. Public transport could be way cheaper though.

Imo many people in germany have still to realize that it's not feasible to make big bucks in the city while hiding from the fruits of their labour in the countryside.

> at least as long as city dwellers aren't willing to pay for government public transport to rural areas

Why can't the rural population pay for that themselves? If each of them can afford a car shurely they could collectively fund public transport themselves?

They bought a house or apartment and can't sell it or rent it out fast enough when they had to take a new job?

> It's the result of people only being able to afford single-family houses 1-2 hours away from their workplaces

Idk how this works in the USA but shurely if you can afford a single family house you could easily rent an apartment near to where you actually work?

Both your hypotheses are pretty far fetched. Your observations are anecdotal and shouldn't lead to such bold claims.

> I regularly come across online comments that are borderline word salad

If this was an actual trend, which I wouldn't want to assume, don't you think there are simpler explanations to this? I'd immediately come up with two:

- The internet has gotten way more accessible (+ most of the new users aren't native english speaker)

- ML Bots

I'm pretty sure that there is still quite some bad code out there that I posted to code-snippet websites when I was ~13 :/

So here's some advice I wish someone had given me back then:

Please try to at least read and understand OWASP top ten security risks¹ before writing applications that anyone actually uses. Also please be aware that you can write insecure code in any general purpose language. Most of the bad PHP code is around because it was a popular language with hobbyists, similiar to Javascript and Python today. Languages might be better (or worse) in certain aspects but they still can't protect you from bugs in your programs logic. Only diligent planning, understanding of best practises and proper communication can help prevent those.

¹ https://owasp.org/www-project-top-ten/

I'm really not against teaching spreadsheat software since it's a really useful tool. I just don't like that it's thought very microsoft specific and in depth. Students could benefit way more from some basic computer (science) literacy.

> Also it's nice to be able to see more code if you're into that.

I guess that depends on font scaling but if there is code that long there is usually something wrong with it :D

I like to have views side by side but the 3:2 doesn't really help with that either (at least for code on 13")

> Why don't you like that they are American?

That usually complicates payment and shipping (at least with smaller companies) plus I don't really like (indirectly) supporting a government that thinks human rights are for citizens only.

> written in python that used Excel behind the scenes

That's from my worst nightmares :(

> People aren't learning excel because Universities are part of some Microsoft conspiracy. They are learning it themselves, or from each other.

At least in germany children are often forced to learn excel in school because the official curriculum includes "office software" which is an euphemism for "microsoft product training". This has certainly not developed from necessity. Even someone who thinks school should only be a preperation for the job market would agree that employees who are able to help themselves are better than ones who know how to use a specific version of Excel.

> Giving a talk like this in North Korea is like teaching businessmen how to engage in moving criminal/ terrorism money without getting caught.

Since when is that problematic? Should we lock up CIA agents for 20 years too? I thought USA was the land of the free.

I mean why would someone want to visit your online portfolio if it looks like you didn't even put in enough effort to get a proper domain?

Are there other companies doing similiar projects? This is a good step in the right direction but there are some major drawbacks for me:

- 3:2 screen makes the laptop bigger and adds space thats pretty much useless except for video editing I guess

- No option without camera, mic and fingerprint reader

- Intel CPU

- Thin instead of robust

- American company