HNHacker News
TopNewBestAskShowJobs

tombrossman

3,861 karma · joined December 14, 2012

Bailiwick of Jersey

tom at tom brossman dot com

submissionscomments
tombrossman··on Coronavirus patients start to overwhelm US hospitals
> Got my flu shot last year, still ended up with severe flu in February. The flu shot is not completely effective.

My understanding is that the 'flu shot' changes every year, in anticipation of the strains predicted to be the most prevalent that year.

In other words, flu shot producers say "we think flu strains A, B, and C will spread this year" and strains B, C, and D may be what actually spread.

It's still worth getting because even if you catch strain D, your immune system still easily defeated B and C when exposed and you didn't even notice.

tombrossman··on Why Your Static Website Needs HTTPS (2018)
My primary concern with Cloudflare proxied sites is that I have no way to assess the technical competency of the sites they proxy. I can check most HTTPS sites using an online tool such as SSL Labs or Mozilla's Observatory. For example I discovered a local mobile operator who had not bothered to patch their primary web server against Heartbleed an entire year after the exploit was discovered, which was a real shocker.

Cloudflare are technically competent which is great, but their clients are impossible to assess. I see a lot of formerly insecure local web servers switching over to Cloudflare (and HTTPS), and I know it's the same morons operating the web server. For me the safe default assumption must be that the site behind them is run by people who are not technically competent. I suppose Cloudflare could set a server header indicating the connection between them and the proxied site is HTTPS?

tombrossman··on Ask HN: Could EU residents comment on how the GDPR has improved their privacy?
I've used the new laws twice now to close online accounts with companies that were uncooperative or too 'clingy' (looking at you, OVH and Microsoft). Much easier to send a registered letter than waiting on hold or searching for an online option that was deliberately made hard to find, or which may not exist at all.

I have also used it to stop unwanted postal ads from local companies. I get to find out how they obtained my info, and also stop some junk mail.

For the sibling comments mentioning the GDPR popups / cookie notices, why not add a blocklist for these to your adblocker? At this point adblockers should be considered basic security software, like a firewall or antivirus. These lists exist are are pretty comprehensive.

As an American living in Europe I think it's a great law and I wish there was something comparable to protect my friends and family stateside. And as someone who administers a fair amount of business and client data, I do not find the law inconvenient to comply with. I am very pro-privacy and protective of user data, and I didn't have to make any major adjustments.

tombrossman··on Better password protections in Chrome
This assumes that someone from every site has a Google account and consents to their Privacy Policy and Terms. This is not a safe assumption, nor is it fair to make this a requirement.
tombrossman··on California is about to allow former felons to serve on juries
> if a juror is that certain, pre-trial, that a defendant is guilty, there is no way that the defendant can get a fair trial

Sure they can, one nutjob juror cannot convict.

I've also been seated on juries where some of my fellow jurors were quite obviously biased against the defendant, and this really hurt their credibility with me. I wasn't the only one either, other jurors challenged some of the statements they made and it was clear to me that they also picked up on the bias and rejected it.

My first time on a jury a pleasant looking retired white man said he wanted to be foreman, for a trial of a Hispanic youth, and the guy started with "well he's obviously guilty right?" and he was serious. This was met with total outrage from several others on the jury and the foreman sat there meekly for the rest of the deliberations. The rest of us carefully reviewed the evidence and the defendant absolutely received a fair trial.

tombrossman··on DoNotPay app waits on hold for you
That's a shame, what was their explanation? Did they say it's OK for Chase employees to lie to customers, or did they dispute the authenticity of your recording?

There's probably something in the fine print of your contract with them that lets them get away with whatever happened, but always escalate matters as it's pretty effective. Press them on social media, if there's arbitration try it or small claims court, and involve any local media or politicians that you can get on your side.

Basically, just be a huge pain in the ass and do not give up or go away until they back down. This can take a while and you must document everything, every interaction.

tombrossman··on DoNotPay app waits on hold for you
Curious, what call recording app do you use now please, and does it properly record full duplex audio from the line (so not using speaker/headset/other workarounds)?

The last time I had this working perfectly was with a Nexus 4 and I find that call recording apps do not work on newer phones I've bought since. Any suggestions? Android or iOS, I don't care which platform as long as it works well.

I used to set the app to only record incoming calls from callers not in my address book, and on several occasions it was a huge benefit to have these to refer to later.

Companies really do not like it when you email them recordings of their employee lying to you, and will go out of their way to make things right immediately when that happens.

tombrossman··on China's New Cybersecurity Program: No Place to Hide
> Find me the American that doesn't have a Chinese-made TV, a Chinese-made phone, a Chinese-made laptop...

American living in Europe here, and while I realize this is a bit of a curveball I'd like to point out that it is not difficult to avoid Chinese made products. My TV is a Samsung made in Hungary, my phone made in Taiwan (I do have an old Thinkpad made in China though).

I try to avoid Chinese made products. Not because of any nationalism, but because better quality alternatives exist at nearly the same price point.

For example I have a German made fridge and it's exceptional. It is difficult to get excited about a fridge but when I disassemble the shelves and bins to clean it I notice carefully finished edges beneath cosmetic covers that most customers would never see. The plastic parts haven't gone brittle and do not crack or chip. The glass shelves are thick and heavy and tempered. There are thoughtful touches that come from superior engineering and quality raw materials. It only cost a tiny bit more than similar Chinese models and I expect it will outlast them while retaining all of its original functionality.

tombrossman··on Ask HN: Which email software do you use on Linux?
"Activity tracking is built into Mailspring so you get notified as soon as contacts read your messages and can follow up appropriately."

"How contacts engage with your content gives you insight into what's working and what's not. Mailspring can notify you when your links are clicked so you know what's generating interest."

That's something I would actively avoid or circumvent if I discovered it. Do you tell people who you email about this, or hope they don't notice (or care)?

tombrossman··on Pi-Hole 4.3.2
See also https://www.i-dont-care-about-cookies.eu/ for a larger and more specific blocklist.

I found it worked better for me because the annoyances list was too broad and blocked too many legitimate page elements, such as the <div> containing the play button for NPR podcasts.

tombrossman··on Google bans family cafe for offensive content for posting photo of British dish
American living in Britain here, and I have this page bookmarked (and must refer to it frequently): https://en.wikipedia.org/wiki/Glossary_of_British_terms_not_...
tombrossman··on How Apple's Apps Topped Rivals in the App Store It Controls
I agree with you about the trackers, but I just assume ads=tracking. I cannot see any app marketplace saying their apps contain tracking in the main description (it's always buried in the fine print).

My understanding is that GrapheneOS[0] is the successor to CopperheadOS, and I think that's what I'll try next. There isn't an Exodus Privacy or F-Droid for iOS and these are sorely missed.

[0]https://grapheneos.org/

tombrossman··on How Apple's Apps Topped Rivals in the App Store It Controls
The advantage to using Google Play is that apps containing ads are clearly labelled as such. Apple won't tell you this in advance. (This was my biggest surprise, recently switching from Android after the CopperheadOS meltdown)
tombrossman··on Curl Cookbook
I saw a similar curl post last week and was inspired to add this to my ~/.bashrc for basic timing and headers info:

  wwwinfo()
  {
  printf "##\n# PAGE INFO\n##\n"
  curl \
  --silent \
  --output /dev/null \
  --user-agent 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36' \
  --write-out \
  "    Remote IP: %{remote_ip}
           Port: %{remote_port}
    Name Lookup: %{time_namelookup}s
   Connect Time: %{time_connect}s
  TLS Handshake: %{time_appconnect}s
     Total Time: %{time_total}s
     Down Speed: %{speed_download}B/s\n" \
  "$1" &&\
  printf "##\n# HEADERS\n##\n"
  curl --head "$1"
  }
(It spoofs Chrome latest + Windows 10 user-agent, but this is optional.)
tombrossman··on No More Cheap Shipping for Chinese Sellers
Did you contact Amazon or the seller, and what was the outcome? You received a defective item and your out of pocket costs should be nothing. You should dispute the return costs with both Amazon and the seller, and the seller may tell you to dispose of the damaged item and refund you the purchase price.

You are better off finding a local framing shop to custom make something for you. They don't charge too much unless you opt for fancy frame material and matting.

tombrossman··on What happens when you launch Google Chrome for the first time?
This is an interesting (closed) bug filed against their SSL config generator. https://github.com/mozilla/ssl-config-generator/issues/8

It demonstrates that support for Google Analytics is not unanimous within Mozilla, and even if someone removes it from a product page that action is detected by others and reversed.

Privacy aware users should block this sort of thing at their router using a hosts file, or Pi-hole, which is far more effective than calling companies out on Twitter and hoping for the best.

tombrossman··on South African bank advises against the use of password managers
In Firefox you can override this and re-enable pasting by toggling dom.event.clipboardevents.enabled to 'False' (in about:config).

https://developer.mozilla.org/en-US/docs/Mozilla/Preferences...

tombrossman··on DuckDuckGo Expands Use of Apple Maps
I was in Scotland last month, using Apple maps with a rental car, and it was not reliable. I'd look up an address and when near the destination I would get instructions like "park the car here and continue on foot" to waypoints out in the wilderness, for the Helensburgh area. That's not a huge city but it displays correctly in Apple Maps and seems like it should work until you actually try it.

I reverted to the HERE maps app for navigation which worked perfectly, but does not appear to be compatible with CarPlay yet, so I had to use a mount for the phone.

tombrossman··on The PGP Problem
> Do you feel like PGP is a good way to cold email people in practice?

Not OP but I can definitely say that's a yes from me after doing this repeatedly. I cold email people once a month or so, and if it is to do with anything sensitive I'll check to see if a public key is available for them (on their website is best, else I check a public key server and use that key as long as there is only one listed).

I get a better response rate from PGP/GPG users too, I can only recall one not responding to an encrypted message and I sent a follow-up message unencrypted which they responded to.

I think it's important to send PGP messages for ordinary communications whenever possible, because this normalizes it and may increase the workload for those trying to defeat it.

tombrossman··on Rsync, GUIs, power, control, design, and decisions
I recommend also trying Grsync (released in 2005), which is mostly the same thing and is available with multiple languages support. http://www.opbyte.it/grsync/
tombrossman··on Nearly all 2020 presidential candidates aren’t using a basic email security
Try an online generator such as https://dmarcian.com/dmarc-record-wizard/ to create one. No affiliation, just a well done generator I have used that walks you through the process.
tombrossman··on ICANN urges adopting DNSSEC now
If you are buying a domain through Route 53, there is a good chance the purchase is actually being handled by Gandi[0]. Gandi supports DNSSEC[1] (it's literally a check box in the options, very simple) so you may as well skip buying the domain through Route 53 and get it directly from Gandi.

No affiliation with either company, just a happy customer of both.

  [0]https://aws.amazon.com/route53/domain-registration-agreement/
  [1]https://docs.gandi.net/en/domain_names/advanced_users/dnssec.html
tombrossman··on The Cold War bunkers that cover a country
> It would be such a little thing to dump the earth they excavated when building the bunker back on top of the thing and spread it around so grass grew etc, hiding the damn thing.

Easier said than done, and I don't think camouflaging them was ever a priority. Even today, you can see the excavated material spilling down the hill in front of large bunkers 70+ years later, which makes them fairly easy to locate: https://www.cios.org.je/assets/images/other/noirmont-headlan... (this location is also easy to spot in wartime RAF reconnaissance images that I've seen)

tombrossman··on Smartphone Apps Are Filled With Trackers
> Working on this. It is very tricky to do for iOS in an App Store compliant manner, but doable. Apple has already approved it.

This is very welcome news, please do a "Show HN" or post a link to the announcement when it's ready.

For now, before I install an iOS app I run the Exodus Privacy tool on the Android version and must assume the same trackers are present on both platforms. What is worse, Apple fail to label which apps contain ads in the store so I can't even tell which ones are adware before installing (apps with ads are clearly disclosed in Google Play).

tombrossman··on Opening up BBC Sounds to others’ podcasts and commercial radio
For the avoidance of doubt, they do not automatically match up TV licences to your BBC iPlayer account. When you go to the website to watch a video, you are redirected to the login page. From there, you are asked whether you have a TV licence, and only then does the video start. I can only assume the forced login is to enable user tracking?

I don't mind paying the TV license fee as the content is excellent, but I browse the website and download what I want to watch with youdube-dl, because I categorically reject their creepy tracking, which they refuse to properly explain. If youtube-dl stops working, I'll keep paying the licence to support the programming, but will look for torrents of the shows to download instead.

tombrossman··on Ex-Mozilla CTO: I was grilled for three hours at US airport by border cops
On a related note, car rental places now email me the contract and rental documents by default, I receive no paperwork unless I remember to ask. The problem didn't register with me right away (It was so similar to what hotels do when you travel, all paperless now) but the last time I returned the car I asked them what I was supposed to do if I was stopped for a traffic violation. "You can open the email from us on your phone and give it to the officer" they suggested. I recommend everyone ask for a printed contract instead.

As an aside, on iOS, the airline apps I have used work like the Wallet app and are visible on the lock-screen, the device must be powered on but remains locked when you display your boarding pass, etc.

tombrossman··on Kdenlive: an open-source video editor
Same here, I struggled for years with basic editing and tried numerous packages with poor quality results. I had to film and edit a series of interviews last year, and Kdenlive was the first video editor I was able to produce good quality output with.

I wish I had tried it earlier but I think the KDE dependencies put me off, fortunately it's also released as an AppImage and runs perfectly on my Ubuntu desktop.

tombrossman··on Pi-Hole – A black hole for Internet advertisements
Yes, easily. What problem did you have using it on a gigabit network?

I'm using it for two years now on my gigabit FTTH connection, running in a LXC container on my router. No problems to report.

tombrossman··on Count the people around you by monitoring wifi signals
Not legal in Europe? That's a bold claim, can you cite any documentation please? I'm in Europe and I know of many local shops, plus at least two pub chains that do this right now.

The pub chains are registered with our Information Commissioners office and I am struggling to understand how every one of those people (including the ICO!) could have missed this.

I note Bluetooth also uses MAC addresses, so this issue is not limited to WiFi. Spoofing your WiFi MAC on a mobile phone with Bluetooth may not be making you as anonymous as you hope to be.

tombrossman··on 35-year-old vulnerability discovered in scp
Yes, it is probably in /etc/ssh/. What type of key depends on your distro and version, but here is a helpful explanation for Ubuntu: https://askubuntu.com/a/76388
← PreviousPage 2 of 25Next →