HNHacker News
TopNewBestAskShowJobs

wepple

3,237 karma · joined May 8, 2013

Security engineer. Strong opinions loosely held.
submissionscomments
wepple··on Apple says UK could 'veto' global privacy tools
I’d argue the latter would indeed be a challenge for Apple, but also a significant part of the threat toward a country
wepple··on Apple says UK could 'veto' global privacy tools
It’ll never happen, but how wonderful would it be for a major international company to simply withdraw from a country that manages to push through crazy rules?
wepple··on A hacked Microsoft test account was assigned admin privileges
This pattern is the rule rather than the exception across MS ecosystems, but to see Microsoft itself do it is particularly egg-on-face.

MS security has put significant effort into tooling and best practice documentation to try and prevent these types of major screw-ups

wepple··on Microsoft Teams went down around the world for over eight hours
My understanding is that they bundled it in so conveniently that it’s somewhat of a default. They probably don’t have to care because the average company isn’t about to do an entire slack deployment and integration into their purely MS ecosystem
wepple··on Apple announces changes to iOS, Safari, and the App Store in the European Union
They’re 100% correct though
wepple··on Ask HN: Would you fly on a Boeing 737 MAX?
This is a really great description of exactly what I’ve mused over in the past.

And to re-iterate: I don’t personally think we should intentionally increase harm in this area, I just find it intriguing where we do and don’t seemingly allow harm

wepple··on Ask HN: Would you fly on a Boeing 737 MAX?
I have semi-jokingly suggested that air travel is actually too safe.

That is, we accept far far higher risks in other areas of our life because it would be too inconvenient and/or too expensive to solve. How much positive impact would occur if we loosened air travel safety controls?

Caution that I suggest this and a thought exercise; not an actual suggestion.

Air travel just gets more newspaper headlines than “drunk driver kills family in accident”

wepple··on Ask HN: Would you fly on a Boeing 737 MAX?
+1 Boeing has a lot of work to do to regain trust, but taking a rational risk management approach probably results in me not being worried
wepple··on Ten Simple IT Security Rules for Early-Stage Startups
I’ve never ever run a phishing campaign against a medium+ sized organization and had zero hits. It’s great that you think you could never be conned, but I’d be interested if you think that scales to your entire security team.

A well-timed, creative phishing campaign can include things like a “regarding your employment status” right after the company announces layoffs, if you’re talking malicious actor and not watered-down security awareness exercise

wepple··on Meta now lets EU users unlink their Facebook, Messenger and Instagram accounts
IIRC I required a Samsung account to use my TV. Won’t buy anything from them again.
wepple··on Ten Simple IT Security Rules for Early-Stage Startups
Two issues with this:

1) no mention of U2F; vastly superior to OTP

2) “watch out for phishing” is near useless advice. A well-written phishing email will catch the most seasoned security professional. The only fix is: see #1 above

wepple··on Using Git Offline
How reliable is IPFS for things like this?

If I wanted to use git on ipfs, I could host a node and push all my git commits there, but I’d have to convince others to host it as well, correct? So perhaps it would be awesome for majorly popular projects, but still a end up having a SPOF for smaller projects right?

wepple··on Figure 01 has learned to make coffee
Did a quick search for anything at all with more detail than the twitter post, and couldn’t find anything. They sure do have a ton of hip marketing image. But they also seem to have some clued up engineers. So who really knows
wepple··on Figure 01 has learned to make coffee
Can anyone speak to the details & limitations here?

Can it truly learn via video visualization of humans performing an action and replicate?

During “training”, what feedback does it use, and what is the goal function to signify success?

wepple··on Fewer people are buying electric cars in the US
> And do you keep spare gas in cans ready, before the outage?

A lot of folks keep a 5 gallon for their lawn mower… although gas powered mowers are going the way of the dinosaur too

But yes, I tend to keep 2-4 5 gallon containers of 4 stroke gas. I’m almost certainly an outlier, but in more rural areas where you have to be self sufficient it’s not rare.

Heck, a lot of pickup trucks have diesel tanks with 12v pumps built into the bed.

wepple··on Fewer people are buying electric cars in the US
To say “definitely” don’t need one with near zero information on what a long trip constitutes is wild.

Do you tow anything on your long trips? Go into extremely cold environments? Go into areas with no or minimal charging infrastructure? Does the endpoint of your journey lack power outlets?

wepple··on TKey is a RISC-V computer in a USB-C case, that can run security applications
I guess as a follow-up, you possibly can’t actually “update” firmware for this, without it creating entirely new keys that would have to be registered with every application
wepple··on TKey is a RISC-V computer in a USB-C case, that can run security applications
Can anyone comment on the design decision to not store device firmware? Is this common?

I would’ve assumed it would generally be safer to have permanent but updatable firmware, to reduce the attack surface of malicious firmware loadings

wepple··on Show HN: Weeks of Your Life
But if you get to decide what is “meaningful”, it’s just a reminder of the finiteness of life.

I’ve spent a bunch of this holiday sitting on the couch, relaxing or letting my mind wander or just enjoying being near a warm fire. I don’t think I’ll regret that at the end of my life (provided my life isn’t all sitting on a couch)

I’d argue if you feel pressured to do “meaningful” things that apparently don’t bring you joy, you’re just miscalibrated about meaning of your life?

wepple··on Google agrees to pay $700M in antitrust settlement reached with states
The system is currently very broken. Less laws wouldn’t make this situation better. Either update/adapt, or require specific amendments?
wepple··on Google agrees to pay $700M in antitrust settlement reached with states
How would this type of attack work on an android that is locked to play store?

I guess you could use a web phishing page, but you couldn’t remote access their device. Maybe you could get a malicious data capture app into the play store that simply collects data, but it would eventually get banned

wepple··on My cat water fountain comes with a spicy USB power adapter
The tools exist, but maybe not in a single nice package. I use:

- A pass-thru USB power meter. Measures volts, amps, wattage (simple arithmetic), and watt-hours

- a USB load device. You can configure the voltage and amps to draw. Used in conjunction with the above, you can see just how much a USB supply can supply

- a watch cell powered cable tester. Not essential for your use-case, but great for working out whether a cable is at fault or not.

None of this directly measures quality, but usually you can infer that from amps, and from negotiation.

wepple··on Booking.com users angry at firm's response to hacks
I imagine everyone is finger-pointing.

Booking.com says the hotel is at fault for having their credentials leaked; the hotel says booking.com failed to protect their account, the bank says the user was phished so it’s not their fault.

IMO if booking.com offers a messaging service which lends far more authority than “just a random person SMSing you” then they’re on the hook for this.

wepple··on Tesla Cybertruck Pricing and Specs
Oh, maybe I missed the point then?

People buy the hyper inflated metric that sounds good, even if it’s not actually what they want?

A huge one of this is (or was?) megapixels in cameras. When actually, sensor size & quality, and glass quality matters a ton.

wepple··on Tesla Cybertruck Pricing and Specs
I think you missed the point? Tesla brag about fast quarter mile speeds which don’t really amount to much, whereas a really nice driving experience via good suspension and weight distribution is truly wonderful.

Let’s see Tesla brag about Nurburgring times!

wepple··on Tesla Cybertruck Pricing and Specs
Price after rebate seems reasonable: you pay money, get the item, a rebate gives you money back on your purchase.

Savings over time is a whole other dimension, you have to wait for it. And it makes huge assumptions about usage and input (gas) prices.

It also assumes you’re not already driving an EV so your current gas cost is $0. That seems near illegal.

wepple··on Tesla Cybertruck Pricing and Specs
+1 who in their right mind would use a maverick for actual work? Ford don’t even pretend to market to those folks.

https://www.ford.com/trucks/maverick/

It’s a Subaru with a truck bed

wepple··on Canadian government reaches deal with Google on Online News Act
> Does one counter-example disprove the rule?

No, NZ is an outlier. Regularly rated the least corrupt country on earth. “Basically everywhere” still holds.

Also, whilst NZ may not have explicit corruption such as bribing police directly, the grandparent post suggesting that special interests affect govt is still true. Jacinda was supposed to be the one shining hope that many believed would bring in CGT and she admitted it would never happen. The wealthy property owners (including most MPs) wouldn’t let that happen.

wepple··on From airlines to ticket sellers, companies fight U.S. to keep junk fees
Sure, of course it does. How often do you look at it, and think through what portion is actually going to the business? Tax-not-included prices do that automatically.
wepple··on From airlines to ticket sellers, companies fight U.S. to keep junk fees
Yeah, what the above says

I also don’t hate the side effect that it somewhat points out to you that it’s the govt taking a cut

It sure is nice in most of the rest of the developed world to buy a product or service and immediately know how many dollars have to go from me to them because it’s the one price, though.

← PreviousPage 11 of 34Next →