tkems

I got one not too long after the official launch and I've used it a decent amount (granted I am in cybersecurity and have a more real-world use cases then the average person). My favorite use case is the IR remote since phones no longer have IR blasters. It's saved me twice so far in having to buy/find a remote for something.

One thing people don't realize is that the custom firmware [0] that you can run allows you to receive and transmit on a wide range of frequencies under 1Ghz. Lots of things use that range (garage doors, gates, fan remotes, etc.) and are not very secure. I think that this will be a time looked back on where it's possible to interact with those devices without having to buy a custom PCB transmitter or somewhat expensive and complex SDR.

[0] https://github.com/DarkFlippers/unleashed-firmware

This sounds like a hold-over from an older system. I've heard stories of certain universities and banks using old mainframe systems for central authentication. In one instance I've heard that passwords were stored in plaintext and truncated to 8 characters, uppercase only.

The main reason, that I've heard at least, for not upgrading these systems is cost and complexity. Why upgrade a system that is working for $$$$ when we can restrict passwords and add some basic 'security' for $.

First time I realized this was possible was in the TV show Mr. Robot [0] and I thought it couldn't have been that easy. However, after my experience within the cybersecurity sector, I can see this happen easily. Old processes that require implicit trust don't work in the modern, connected world.

We already have the technology (PKI with smartcards) to fix this, but unless something really bad happens, there doesn't seem to be a rush to do so.

[0] From Mr Robot Season 2 Episode 9 https://www.youtube.com/watch?v=5qTSoCzp-LY

While I get the appeal of having networked devices that you can access from anywhere, I want local control for everything. Sure, a cloud option on top is nice, but local first!

I feel that the current solution to "control from anywhere" is the laziest and most privacy invasive. Also, when XYZ company shuts down there service in 2 years and abandons your product, you might not even be able to use it anymore. What a waste.

From my understanding, the copyright is held by the photographer unless you have a contract stating such. I was shocked that most wedding photographers consider giving up copyright a deal breaker (unless you pay a huge amount more): https://www.reddit.com/r/WeddingPhotography/comments/10esy2i...

edit: If you are working as a employee (think W-2), it is different. Just hiring someone to take pictures (think 1099/contractor), I think is not covered under the same rules.

I agree that patents are very broken, but I think that copyright and patents are different for these reasons:

1) Patents can cover broad topics. Copyright doesn't have a similar standard (from what I've seen). You can't just copyright all images of a sunset, but your specific image can be copyrighted. See the EFFs article for examples of broad patents: https://www.eff.org/issues/resources-patent-troll-victims

2) Patents have a complex application process. Copyright shouldn't require this level of complexity as the technology exists to detect similar or exact copies and can be streamlined for everyone (think of a simple web form with your information, copy of the work, etc).

Another issue I've personally run into is historic and family photos. Since the person who took the photo is often the copyright holder, often times old photos with no known information can cause some issues with publishing or archiving.

A more detailed example: I was scanning some family photos (for backup/archive/family use, no publishing as of now) and noticed that several have small stickers marked with copyright notices of the small town photography company that took them. I asked my family members and they said the company is no longer in business, but I worry that those photos will never be able to be published until after well over 100 years after it was taken. How can I track down the copyright for such photos?

I can see the issue with larger corporations having an easier time protecting works they create, I think a system where registration is simple would solve most of the issues. Patent applications are a complex process and I don't think we should base any new copyright system on that. We have the tools today to improve the registration system.

I also think that some compromise needs to be made. Saying that all small, independent artists would be "massively more screwed" doesn't give them much credit. Having their work protected and documented as such should give them more protections if someone infringes on their work. A fast and simple process can be designed to allow everyone to register their works without limiting it to large corporations.

Everytime I see complications with copyright I think that it should be similar to patents. Short length of time with an optional renewal if the work is valuable enough. I don't think it would be too much to ask for rights holders to be required to apply for copyright (for a small fee, let's say $5/work) and provide a central authority with a copy of their work. This would solve issues such as

1) when copyright ends for a work and a source to compare claims against

2) Orphaned works without known owners that are nearly unusable until expiration

3) Everything under the sun is copyrighted for absurd lengths of time. Does a macaroni art piece I made when I was in 1st grade need copyright for 70 years after I'm gone? I don't think so, but I understand that the newest movies need some protection.

4) Archiving of expired works would be easier

While this sounds like a cool idea, my first thought is: What happens when someone is able to remotely gain control?. Does the plane not accept commands other than "Please fly to point X. If you can't contact me again, land at Y." or can you send more complex instructions like "Fly at this altitude and heading"? If it's the latter, that is basically "joystick level" control but with more steps.

There will always be vulnerabilities in hardware and software and when they used the term "encrypted satellite", I worry that there is vulnerability in there somewhere. Even something as simple as a phishing attack of pilots could lead to dangerous outcomes.

Nevertheless, I'm sure there will be a Defcon village for it in the next few years.

This is a pretty good idea, but does have an issue with shared passwords.

In most attacks, the data on that site is compromised and changing your password afterwards just prevents further exploitation by others.

What some password manager do is monitor for shared passwords (i.e. using the same password on Site A and Site B). This prevents attackers from cracking the password hash offline and trying the username/email and password in a bunch of different sites.

Even if passwords are salted and hashed, easily guessed passwords can still be brute forced (think password123). Even with good password hashing algorithms like PBKDF2 (I have no idea what Comcast was using, but this is what LastPass uses) with a high cost value, this can be attempted for the most common passwords fairly quickly.

This also occurs 'offline', meaning that an attacker doesn't have to attempt to login to the webpage to try to brute force the passwords, it happens all on the attackers machine because they have a copy of the database.

On top of this, lots of people reuse passwords which makes this an attractive target for such attacks.

Just as an example, my phone has 512gb of onboard storage and 16gb of RAM. I think it is safe to say that in the not-to-distant future, we will see the option to run multiple models on device with only a slight storage hit.

I think that running AI on device is the clear next step in the world of super powerful portable phones/devices. I have a 2021 model phone with very powerful specs (granted it is the high end model that I got used). With nearly the same RAM and storage as some of my laptops from a few years ago, I see that Apple might want to offload some of their expensive AI apps to these powerful user devices.

I see this also as a privacy win as I don't want any of my data being used for training. I also like to have control over what models I use and the ethics the models follow.

I remember this video [1] from bigclive about it. I had no idea it was so common to have live wires in contact with water. At least they are grounded sometimes?

[1] https://www.youtube.com/watch?v=cNjA0aee07k

While I think this is a great idea, I've seen these in public places and the USB-A sockets almost always get damaged. I'd be worried about having to replace a $40-50 receptacle every year or two if I happened to bump the cable and wanted to keep using the USB part. Still a good idea overall and I can see them being used in a few places around my home to save space.

Also, I'd love to see ones with 65w charging so I can charge my laptop and still have an outlet to use!

Meaningful or not, some companies and organizations don't understand the difference between a CVSS score of 2.0 and 10.0. Being in the cybersecurity industry myself, there is a wide gap of knowledge in the risk of vulnerabilities. Following a some-what standard way of reporting vulnerabilities is well documented. Begging for a bounty is not standard.

I also think that is perfectly fine to document the process in public so that everyone is informed.

Also, in regards to your comment on meaningful payouts, you could make the same argument for spam email. Occasionally it works for people in developing countries is, in my opinion, a terrible argument for allowing such behavior.

A gentle reminder that the Security+ and Security+ 2.0 RF protocols have been reverse engineered (https://github.com/argilo/secplus). While they are not the most secure thing in the world, you can build a custom RF transmitter (remote) that is network connected.

Having done some research into Chamberlain's products, I don't recommend anyone to use them if they have the choice.

Sure! I found this documentation from Clover (a payment processor like Square): https://docs.clover.com/docs/understanding-level-3-data

The Level 3 data isn't sent from all merchants, but I have a feeling that larger ones pass along the info.

I also was incorrect above, only Mastercard and Visa support level 3 data. However, level 2 data is widely supported and can contain some purchase info (Clover lists the SKU of an item for example).

I'd love to see a digital option not tied to identities, but I think that is never going to happen due to the KYC (know your customer) laws in place. I hate bring cryptocurrency into this, but even with "distributed" currencies, we are seeing KYC laws preventing true, anonymous payments (like Monero not accepted at large exchanges).

I recently started seeing advertising related to products that I had purchased at a large US supermarket. I did some digging on the payment card networks and found that they are sent a lot more data that I realized. Level 3 data (the highest and most complete) sends product data about what you bought to the payment network (Visa, Mastercard, Amex, etc.). I have no idea what they do with this data and who they sell it to. I love the protection of using credit cards, but if merchants go cashless, privacy goes with it.

I did some research after staying in a Vegas MGM property and the minibars [1] seem to use IR beams to detect if a product has been removed. They also can be hardwired via Ethernet or use wireless protocols like zigbee. It seemed that in my room it was wireless as the thermostat model supported zigbee. I also saw that the fridge could be locked remotely (!) on some models. [1] https://bartech.com/

In my opinion SafetyNet is no longer about security and is mainly DRM at this point. I think you are right on the money about the out of date devices too. I was going through my Dad's old phone collection this weekend and noticed that several old Android phones have specs that are not terrible today but are not useable due to no updates from the OEM. So now they are mostly e-waste. These are perfectly useable phones (maybe outside of an old battery) for basic tasks.

Agreed. I have never and will never enter my email into one of those popups. Just let me read the content in peace! I also hate that there isn't an X. While I now know that I can just click outside the box, my first time I had to read the entire box to figure out to click the "Continue Reading" link. Enraging to say the least.

Thanks, great site! My username is TKems