tombrossman

I'm surprised to see this topic on HN but if you are looking for some more interesting WW2 history, I am (slowly) making and releasing video interviews with survivors of the German Occupation of Jersey and posting them to YouTube: https://www.youtube.com/c/CIOSJersey

Jersey is a British island off the French coast and was taken by the Germans and used for propaganda value. As an American living in Europe I find this sort of thing fascinating, there aren't many people who experienced this left but I can still go hang out with someone who lived under Nazi rule and hear what daily life was like. Surprisingly ordinary at first, then pretty bad towards the end. They could see and hear the D-Day activity late in the war, but still had another long year ahead of them, cut off from both Britain and France and left to starve.

If you are in London or Paris and want to visit some amazing bunkers feel free to get in touch, we are about an hours flight away and contact info is in my profile.

Agree one selling point of the devices is ease of use, however for someone like me who is equally concerned about privacy, streaming video from my front door is a non-starter. In your scenario, "anyone else who cared to watch" includes anyone with an internet connection, versus some random prowler at high risk of being spotted casing your place due to their physical proximity.

If some rando gets my ring doorbell footage and figures out where I live, that's hard to undo. If someone steals my stuff and gets away with it because I didn't have a ring doorbell, that's annoying but much easier to recover from. We are talking about the difference between an insurance claim and moving house.

The right product for me may not exist yet, but I'd love to have a video doorbell system that I self-host. If I need remote backup I already have that covered, I'm on gigabit FTTH and use client-side encryption for data backups. I'm pretty nerdy and would enjoy setting this up but can't make it a priority now.

Neither your points nor OP's conflict, I think you each just have different criteria and values for privacy and security.

Has Google Analytics finally begun blocking referrer spam? I know Piwik/Matomo have been doing this by default for a while: https://matomo.org/blog/2015/05/stopping-referrer-spam/

The blacklist is on GitHub and is useful for other analytics software, such as GoAccess which is what I use.

You can run Pi-hole on a VPS and set that as your DNS provider on portable devices, or (depends on ISP and what ports they leave open) run it at home on a fixed IP and allow the traffic through your firewall. It can be done but is not that practical. I run Pi-hole in a LXC container on my home router (a Turris Omnia) and use ad-blocking software on portable devices that I use elsewhere. This works well enough.

> My usage of manpages would increase by orders of magnitude if I knew there were examples of actual working commands in the first page.

Try adding ManKier as a custom search provider for Firefox or Chrome, it is online man pages beginning with TL;DR examples at the top of each web page, followed by the traditional man page entry below. Here is a fuller explanation with links to instructions for adding it to your browser: https://www.mankier.com/about

I use it almost exclusively now, and only refer to my distro's man page in a terminal if I need to check on something that isn't standardised (such as sed -i.bak or something like that).

Custom browser search is pretty handy, try adding a dictionary and map provider too, or 'caniuse' if you do front-end work.

Installing an under-sink replaceable inline filter is a surprisingly easy DIY task if you want better tasting water. Parts are not expensive. Skip the thin white ones used for refrigerator/ice makers, and go the next size up.

Spend a little extra on a shut-off valve with a handle and install that first, just upstream of the new filter, to make changing filters easier (every 3-6 months, depends on water quality & volume). You will still have excellent water pressure at the sink, even if you use the newer thin and flexible 'push fit' tubes and couplings. I don't really have any plumbing experience and did not have any difficulty. Visit a professional plumbing supply business, explain what you are doing, and ask them to give you every single part you need. You may be pleasantly surprised at how simple it is. I think I spent the equivalent of about $80 for everything, including an upgraded valve and clear filter housing (to make visually inspecting the filter possible).

Don't forget the little bleed valve at the top of the filter container! After you turn the house water back on, it should hiss as the air escapes. When water dribbles out just hand tighten and you are done, no leaks.

You shoudn't have any downtime. Copy your current DNS records for your transferring domain(s) and input them at the destination Registrar, then initiate the transfer, and done. It is surprisingly easy.

The only edge case to check is if you are using non-standard or less common DNS record types (ALIAS, CAA) then first confirm with the destination Registrar that they support the record types you need.

Or if you want to keep things really simple, switch to a third-party DNS host before transferring and use the same name-server settings.

And yes, paying the target Registrar should extend your registration time. For example, say you bought a domain last year and paid to register it for five years (so four years remain). Now you transfer it to Gandi.net and pay their transfer fee. You used up one year originally, transferred, and it's yours for five years again. Your unused years at the outgoing Registrar 'roll over' to the new one.

Not OP but I have to assume they are referring to Content Security Policy headers: https://content-security-policy.com/

Related question, anyone know how to grant access to S3 objects via CloudFront only, since CloudFront bandwidth usage is cheaper than S3 objects accessed directly?

I've got it working for top level documents using Origin Access Identity, but subfolders (example.com/test/index.html) doesn't work. I'm surprised this use case isn't better documented because it saves you money and you don't need to make your bucket public.

Tested and working well with the latest Firefox (v63). Nice work, this is handy!

Not directly related to the article, but for a neat visualisation of all the objects in Earth orbit right now see http://stuffin.space/

Android apps that contain ads are clearly labelled in the Google Play Store. The text "Contains Ads" appears right at the top of each listing by the title. There is no such standard in Apple's App Store, and this could easily be remedied by Apple if they cared.

Like others here have already stated, I'm happy to pay for apps. One-off purchase, subscriptions, whatever. I used exclusively Android since the first device (T-Mobile G1) and finally switched to iOS earlier this year, and this has been the biggest obstacle so far. I'd like to install more apps but my phone is pretty much stock since I have no way of knowing whether apps are full of ads.

I am more than a little sceptical of Tim Cook's fiery "data industrial complex" speech last week as he's still not yet ready to take that first baby step and begin warning privacy-conscious users about adware. How do you overlook this as CEO? The other security features on iOS are first-rate, why deliberately overlook adware? I don't get it.

Ubuntu/Debian users, put this in ~/.local/share/nautilus/scripts to have it accessible from your right-click menu:

  #!/bin/bash
  align_image_stack -a BATCH -C $(echo -n "$@") && enfuse -o ~/Desktop/align-and-fuse-$(date '+%Y-%m-%d-%T').tif BATCH*.tif && rm BATCH*.tif

Prerequisites are align_image_stack and enfuse packages (Hugin users already have them or do it manually) and after that, just shoot bracketed and multi-select each set of bracketed photos > right-click > Scripts > run script. A timestamped finished image in TIFF format will output to your desktop. I usually open these in Darktable for minor post processing, then final export to JPEG.

Also see "Certificates for localhost" from Certbot/Let's Encrypt documentation:

https://letsencrypt.org/docs/certificates-for-localhost/

Direct link, for those who prefer not to click on affiliate/referral links: https://www.amazon.com/gp/product/1250107814/

Interesting that you mention the privacy risk of tracking, as this[0] just appeared in my Twitter feed at about the same time I was reading HN.

"Tracking Users across the Web via TLS Session Resumption"[1]. A snippet from the abstract: "Our results indicate that with the standard setting of the session resumption lifetime in many current browsers, the average user can be tracked for up to eight days. With a session resumption lifetime of seven days, as recommended upper limit in the draft for TLS version 1.3, 65% of all users in our dataset can be tracked permanently."

Not exactly looking forward to TLS1.3, it appears to be a move forward in security but with no (or worse) privacy benefits that I've seen so far.

[0]https://twitter.com/durumcrustulum/status/105293632402455757...

[1]http://front.math.ucdavis.edu/1810.07304

Auditability is important, especially given how wildly inaccurate* some of these 'speed detection' machines are. Most of the ones I have seen are pretty close, but some are clearly malfunctioning and would basically generate speeding tickets for 100% of the vehicles passing them until they are fixed.

*https://i.imgur.com/NF6eYb9.jpg

This happened to me too, and what I learned is that the Omnia uses the Knot DNS resolver, which re-enables itself after updates and this breaks everything if you have made certain customisations.

The fix is to disable this with "echo 'Uninstall("knot-resolver", { priority = 60 })' >> /etc/updater/conf.d/user.lua" over SSH so it stays disabled. You can do this for any service you modified or disabled, and the documentation barely mentions this (it's a real showstopper bug until you diagnose it - no connectivity whatsoever).

The inefficiency isn't the problem, it is a symptom of the real problem, which is lack of trust.

It's been a while since I drove trucks but I recall the absolute worst loads were deliveries to grocery warehouses. Because of DOT Hours of Service restrictions, it sometimes made economic sense to refuse these loads and instead sit idle a day with no work. You had to carefully budget your working hours over a rolling 8-day window and wasting hours at a grocery warehouse kills your earnings for days afterwards.

Grocery warehouses took forever, mostly because of their insistence that I wait while they counted everything and broke down pallets of stuff and re-stacked it. The actual unloading was quick, it was the hours afterwards before they would acknowledge receipt of goods and sign your paperwork to release you. They also used 'lumpers', third-party laborers (who they also did not trust) to count and re-stack correctly so their own employees would have to come double-check everything. Some would expect me to pay the lumpers, which I would always refuse to do, which further delayed things. I think some drivers just paid to get out of there faster.

Contrast this with more sophisticated operations such as a Wal-Mart distribution center where you could drop your loaded trailer and collect an empty one, then leave immediately for your next load. Wal-Mart wasn't worried about under-counted freight or breakage, they are big enough to just declare it unchallenged and the supplier accepts the loss and moves on. Trust doesn't factor into the process.

It wasn't all bad, you could offer to unload yourself for extra pay on some loads, but I only did this very rarely, once when delivering electric cars (GEM cars, like a super-deluxe street legal golf cart) to a warehouse. I drove them out of the trailer onto the loading dock and got paid an extra $100 for about two minutes of work! Easy to count too...

It may be more full-featured than you are looking for, but have a look at the Turris Omnia. It is extremely customisable and you can add an internal SSD to run LXC containers on (including one running Pi-hole, which is what I do).

Not cheap, and sometimes unforgiving if you don't know exactly what you are doing, but worth every penny in my opinion.

https://omnia.turris.cz/en/

> Semi drivers have this even worse.

There are some advantages to driving a semi in traffic:

- Lots of gears to choose from and massive torque in order to find that perfect 'idle forward' speed.

- Far more comfortable ride then a car, it's not even close.

- Radio communication with trucks ahead, so you know what's happening ahead and which lane to be in long before the cars figure this out.

- Visibility over the top of vehicles in front (except another truck, obviously).

I think the only thing better than a semi for heavy traffic might be a luxury car with adaptive cruise and a little roof-mounted drone-cam that you could launch to check out the view ahead (though this sounds like something Homer Simpson would dream up). Your own little personal traffic copter/R2D2, with a recharging dock on the roof. Someone please tell Elon Musk to make this a priority for new Teslas. It could even check out side streets in cities and find quicker routes.

No, I just list them and I do not send any follow-up message. Many do find out immediately though, because others tell them about it. I seem to get a lot of referral traffic from LinkedIn after doing updates, so I guess someone is posting about it over there.

I had someone well known in the local tech community call it "The most unprofessional thing I have ever seen" but later he was using it as a sales tool to persuade one of the companies listed to hire him to upgrade their site. I don't condone this but once the info is public I can't control what people do with it.

I'm doing this in the community where I live and I have discovered that it is super effective. I send an email to each company explaining a security problem with their site (currently focusing on simple lack of HTTPS for form data, and not mentioning the public disclosure because I want to see who fixes things because they care vs. those just avoiding negative publicity) and if they haven't resolved it or replied within a week, I list them publicly on https://www.insecure.org.je.

The site isn't winning me any design awards and needs expanding of the advice articles, but dozens of local companies are immediately spurred to action when they appear in the "Sites requiring extra caution" section. Thousands of local users have directly benefited by the added security, even though they are completely unaware of why it was upgraded.

The reaction from some business has been very predictable, with a mix of hostility, threats, confusion, outright lies, but enough respond politely and want to fix things, and I go out of my way to help those who want to learn.

Source is public and if you want to try this locally, I highly recommend it: https://gitlab.com/tombrossman/insecure.org.je

A reasonable compromise would be to have some way of determining which apps don't do this prior to installing them, such as a paid app that does not need to rely on ads and proactively declares this in the app description. Google Play clearly labels adware and I am genuinely surprised that Apple's App Store does not.

I am happy to pay for apps that do not contain adverts or unnecessary tracking, but I have no way of obtaining this information on iOS. For Android, I can look at the store listing, try F-Droid, or scan with Exodus[0]. For iOS, I'm not aware of any user tools at all. Is this information available anywhere?

[0]https://exodus-privacy.eu.org/

Not OP but I filed this Launchpad bug and the package developer responded the same day, even explaining how to recover data that had gone missing: https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/12602...

This may be the exception to the rule but I was really impressed.

Apple won't even warn you which apps are adware, which Google Play has transparently done for years, so there is room for improvement by everyone involved. Previous submission (which got zero interest): https://news.ycombinator.com/item?id=17489987

> Security by obscurity is not security.

Security by obscurity alone isn't security, but obfuscation is a great tool to add to your security toolbox. The concept is often derided, but it is very effective when used properly.

I think the thing to remember is that modern DSLRs are going to continue to produce decent images across challenging lighting conditions. A DSLR buys you more usable shots to select from later.

You are correct, On a sunny day both types of device will produce similar looking 1000 pixel wide web-ready exterior landscape shots. Now take them into a dark cathedral with high stained-glass windows, try for a quick portrait of a priest walking by holding a candle, and the DSLR will still get the shot, and it will look great. Smartphones cannot do this...yet.

> Why should any corporation let you visit their premises without suitable assurances?

Correct me if I am wrong please, but it sounds like you are saying it's okay to trust corporations who are the subjects of media scrutiny to be the 'gatekeepers' of information, setting ground rules and defining what may or may not go into a news article. This is a horrifically bad idea if you care about journalistic integrity.

No harm in the corporation asking for that level of control, but I do not believe savvy journalists would accept. It is their (or their editor's) call to make, they must decide what the story is, and where the public interest lies.

Fair point about Nikon though, I think if you have a top-secret part of your factory that's just got to be permanently off-limits. Why risk it?

You may have seen this already, but there is a Python utility that works with Speedtest.net called "speedtest-cli".

    pip install speedtest-cli

https://github.com/sivel/speedtest-cli