tombrossman

That's a good point and I don't know the answer.

I have a gigabit fiber (to the home) connection which terminates at a device with 4 Ethernet jacks. They all work, I've tested connecting directly to them with a laptop, but I plug a router into it and all devices connect through that router instead. It's the 'stateful firewall' aspect of using a router that I want for improved security. https://en.wikipedia.org/wiki/Stateful_firewall

Seconded, buy a decent non-stick pan and you can use and abuse it without worry. I have some Woll Nowo pans that see daily use with metal utensils and nested stacking with other metal pans. Never a scratch, no food sticking at all. Here's an example but shop around as many other brands offer similar construction: https://www.amazon.co.uk/Woll-Nowo-Saute-Detachable-Handle/d... I like the detachable handle because it stays cool, and I don't lose track of which pan just came out of the oven and accidentally grab its handle bare-handed.

When buying pans, look for commercial stuff (or at least make sure the box does not have a photo of a famous TV chef on it). They should be 2x-4x more expensive than the cheap stuff, usually cost less than the really high-end pans, but will last forever and produce great results.

> There is a great use-case for IPV6 for IOT where each device gets its own IPV6 address.

Do you really want your IOT devices to be directly addressable on the internet? It's my understanding that having devices behind a router is safer. I go a step further and disable UPnP on my routers and everything still 'just works' including network printing.

Tracking is the primary reason I use an ad blocker. The ads themselves aren't that obtrusive to me since I won't install Adobe Flash and I use NoScript and Privacy Badger with Firefox. Even using someone else's machine I can tune ads out pretty quickly and focus on the page content.

Troy uses Google Analytics on his site and has no privacy policy which means his site does not comply with the Google Analytics' Terms of Service.[0]

When I queried this on social media, he dismissed it as 'legal arse covering'[1] and indicates to me that while he's undoubtedly a bright and talented guy, he still doesn't 'get it' when it comes to privacy. Not at all.

Not everyone is wearing a tinfoil hat and worried that the big bad NSA is coming to drone them. Many of us are far more more concerned about corporate surveillance and data brokers tracking our online activity.

[0]https://www.google.com/analytics/terms/us.html

[1]https://twitter.com/troyhunt/status/651723191144976384

(Note I have a cronjob deleting most Tweets 30+ days old so my replies in that thread are gone. Old tweets are worthless and I see no need to preserve them...)

Yes, I regularly test the backups by restoring a random directory to my desktop and then opening a few random files to test. For things like photos which don't change (as opposed to a document which may have been edited) I'll do a quick spot-check of file hashes as well.

I'm picky about backups and have never had an issue where files were permanently lost. I'm to the point now where if I'm not sure I want a file I'll go ahead and delete it, and then if I need it later I restore from the Back In Time snapshot.

Storage is dirt cheap, so spend the time up front getting your backup 'idiot proof' and automatic and it's totally worth it in the long term.

Daily Duplicity snapshots that sync to S3, plus hourly snapshots via Back In Time to an internal drive, plus an occasional manual rsync to a portable USB drive off-site.

Probably overkill, but if one backup method ever has a flaw I'm still fine.

Might also be worth using a very long (1 week - 1 month?) TTL for your DNS MX records. This is no guarantee but it should buy you some extra time over the default which could be only an hour or so.

Curious, do security researchers typically liaise with the FTC when vulnerabilities are discovered? This and your parent comment seem to imply a 'yes' but this doesn't seem like an obvious connection (to me at least). I would expect the first point of contact at DHS to flag this for other agencies' attention if they felt it was necessary. Should DHS feel territorial about this and be reluctant to contact outside agencies that's on them, not the researcher.

I wonder if many security researchers know to routinely shop their findings to multiple agencies independently. It doesn't seem like this is common knowledge.

> finding out that Nebraska is basically one big corn field

Duluth, MN > Autin, TX is a straight shot down I-35 the entire way. There is definitely a lot of corn growing in Nebraska but you must have been very lost or deliberately going way out of route. Sounds like a fun trip though.

That's correct, the FBI hosted error messages and exploits after taking over, and supposedly did not distribute images of abuse. This point is conspicuously absent from the Ars story.

Motherboard passed on this story but it appears it was too sensationalist for Ars to resist. See thread here for more info: https://twitter.com/josephfcox/status/797070958205038592

> Perhaps that is because they are unable to join your advertising profile with your account, under various terms of services and agreements.

You should read this and reconsider. From the article: "The change is enabled by default for new Google accounts. Existing users were prompted to opt-in to the change this summer." https://www.propublica.org/article/google-has-quietly-droppe...

Disabling JavaScript (or if you are a NoScript user) usually 'fixes' the scroll override annoyances but try going to about:config and toggling layout.css.scroll-behavior.enabled to 'false' as well.

I started noticing some sites were hijacking scroll despite having them blocked by NoScript, however the above config change fixed that instantly. Turns out scroll can be hijacked by CSS now, not just JavaScript. Progress!

Didn't we try this same argument already with gun manufacturers? How well did that work?

The problem with holding manufacturers responsible for releasing a potentially dangerous product is that the manufacturers view compliance with regulation as an obstacle to maximizing profits, and seek to avoid it. Manufacturing is also centralized and they organize and lobby politicians to influence regulation.

Consumers are distributed and disorganized, and I predict that blame for not securing your IOT device(s) will stay with consumers for the foreseeable future.

I agree some standardized testing would be a good idea though.

> Whenever you buy a product from a company that advertises on facebook, google, whatever, you are effectively paying for it.

In my opinion, it's a bit more nuanced than that. When you purchase a product with cash, no personal data is exchanged. The transaction is final and complete. When you 'pay' for services by exchanging personal data and metadata about yourself, that transaction is persistent and the vendor continues collecting payment indefinitely.

With store loyalty cards and even in-store Wi-Fi tracking and other tactics, even cash payments can be viewed as less anonymous, because the vendors prefer to continue to reap the rewards of profiling and tracking customers. My point is that this isn't a black and white issue, but there are some important distinctions to make about payments in cash and payments in data, or a mixture of both.

> I personally got around this problem by compiling a build of CyanogenMod without root enabled, but with things like FDroid (with PrivilegeExtension) and adblock built-in to the ROM itself...

I just bought a Nexus 5x and loaded CopperheadOS on it, and to my dismay I see Ad-Away from F-Droid requires root to function (plus a couple other apps I really like). How much of a hassle is it really, because I absolutely want system wide ad blocking and I worry that I will be defeating the purpose of using a hardened OS in the first place?

Do you rebuild and flash each OS update as a new ROM? Is all your data on the phone persistent or backed up & restored each time?

> Dr. King was monitored by the NSA for "thought crimes". Is that "100% tinfoil hat mode"?

Probably 'yes' for you, 'no' for him.

Sorry, but a random HN commenter is extremely unlikely to be targeted for the level of surveillance and treachery that Dr King was. If he feared it, he had good reason. If you are some random IT worker building the next smart pillow you cannot expect them to prioritize spying on you, that's all I'm saying. Mass surveillance isn't the same as targeted.

Thanks, that's clearer to me now.

When marketers collect my personal info, it's far more likely to be distributed widely so I place a greater emphasis on protecting it from them. I don't like the fact that nation-states are spying on the citizenry, but I don't know what I can do about that. I DO know what to do about the surveillance capitalists.

A fair percentage of people (myself included) are far more concerned about protecting our data from marketers, advertisers, and data brokers, than we are about going 100% 'tinfoil hat' mode and worrying whether the NSA is monitoring my messages for thought crimes. These are two very distinct issues and not everyone is concerned about both equally.

Also available is primitive.pics. I'm surprised no one has grabbed these yet...

OP is from Scotland, same as my wife, and I can confirm 'short-sighted' is the correct usage in Britain for what most Americans call 'near sighted'. The term does not have the negative connotation in Europe that it does in America.

You can sit on one of the benches in the busier areas and easily spot the pickpockets and see them going in people's bags and backpacks and taking stuff. This isn't a rare occurrence and it does not take a practised eye to see. The pickpockets are always well dressed (usually very similar to the tourists). I like visiting BCN and I think it's a wonderful city, but it is completely infested with thieves targeting tourists to a degree that I have not seen in other European cities.

I'm surprised this is not common knowledge among people from there, maybe try 15-20 minutes people watching anywhere along Las Ramblas and see for yourself. Busy, sunny days with lots of people and police around are the best times to spot the thieves. You'll also frequently see tourist couples speaking to police reporting the robberies. You can watch the body language and gestures from a distance and it is very obvious.

Any idea if they support email 'distribution lists' or similar? I want something like test@example.com > delivered to list of users with a mix of email addresses at other domains. Gandi.net does this now (they call it a forwarding only address) but their included mailbox size is 1GB. I've got a non-profit domain that needs more email storage.

I tried Zoho last year after hearing multiple recommendations and it was nothing but problems with spam coming in and my outbound emails being incorrectly marked as spam. I even had SPF + DKIM tested and working from the start! Not sure I would try them again after that experience.

For always up to date guides try the CryptoParty Handbook: https://www.cryptoparty.in/learn/handbook

Just checked the Pushbullet site intending to see if they support Linux and to review their privacy policies. "Sign in with Google" or "Sign in with Facebook" are the only options on their sign in page. It does look like a cool service but not at all aligned with my privacy and open-source concerns. Thanks anyway.

It's a bit of a crude workaround but that might work. My use-case is that I frequently browse to a site on my mobile and want to view it later on my desktop machine. I could do that with a couple clicks easily before. Now I will have to keep a bunch of tabs open on my mobile and remember to manually go and check for them when I'm back on the desktop.

Just one example, I would browse through my Twitter feed before going to sleep. Any interesting links from Twitter were sent to the desktop machine from the mobile. In the morning, I would start Firefox on the desktop and a bunch of new tabs would automatically pop open, which was great.

Slightly off-topic but does anyone know the status of the "Send Tab to Device" function? It is my favorite feature on Firefox for Android and it has disappeared. Not the first time this happened, either. Are they randomly adding and then removing support for this? I'm definitely not the only one affected: https://support.mozilla.org/en-US/questions/1087138.

I can visit the desktop version of Mozilla's add-ons site and see an extension which supposedly does this, but the 'add to Firefox' button is disabled if I visit the same link on my mobile. Bizarre.

Exif data is particularly useful for preserving copyright metadata and (optionally) contact info for the photographer. Stripping too much metadata perpetuates the 'orphan works' problem and creates lots of photos floating around the internet that can never be used commercially, because the photographer cannot be identified.

More info here from the US Copyright office - choice quote: "For good faith users, orphan works are a frustration, a liability risk, and a major cause of gridlock in the digital marketplace." http://www.copyright.gov/orphan/

Also, the UK has effectively given everyone the green light to steal photos lacking metadata because it's basically too difficult to find the photographer. http://www.bbc.co.uk/news/technology-22337406

And from my perspective, I release many images CCO Public Domain with my email or name in the metadata, and I'm annoyed that this metadata is not preserved because it means people may be reluctant to re-use my images due to (non-existent) copyright concerns.

I have these and they work exactly as advertised: https://www.amazon.com/PortaPow-Specialised-20AWG-Charge-Sho...

$6/each (when you buy a pair) and they do rapid charging with absolutely no data connection. There are many other branded ones that are over-priced so avoid those and try these. If you don't want the Micro USB tips you can buy the standard USB adaptor to place inline between the outlet and your existing data cable.

No, this is not practical and you risk damaging the tires. It is possible to deflate the air ride suspension for the tractor drive axles to drop a few inches (useful for backing under a new trailer when the nose is low) but I did not do this because the rear of the trailer would still be too high.

Not one of my finest but it is a view leaning out the driver's window and looking up and back at the top front left corner of the trailer, with the (very dark) bridge girders looking like they are resting on the trailer. There's about an inch of clearance and I am just coming out from under the bridge, nearly to the edge, with most of the trailer yet to pass under. Very difficult to see though, I really needed more flash but I was concentrating on other things and holding up traffic.