wepple

Re-tool an entire factory overnight in response to a change in design of the car, or in fact to produce airplanes instead

You’d have to trust that the data being dumped was 100% identical to the actual pages users would eventually see, or you could end up with very weird (including dangerous) behavior

Of course, I know that some version of this can and does occur with classic web scraping too, but that is an arms race that a search engine can win

I went straight to your Arm instruction disassembly because I’ve been writing one too; did you consider using a data structure like a trie rather than deeply nested conditionals? Any particular reason for one vs the other?

Is there not a liability of people getting sick or trawling through nonsense and bad quality products?

This isn’t just an sim/T-Mobile issue

Most customer service representatives are on very low incomes (especially in other countries) and it’s not hard to find one who will take actions for a (western) small amount of money. CSRs often have powerful capabilities and access to sensitive information. With poor access controls.

Solve the SMS/MFA issue and they’ll attack the next thing in line

Why

Technically, yes?

But there has never ever been non-trivial software that has been completely free of such defects.

In other words (in my opinion), iOS is probably better than most other platforms against this type of attack.

I suspect anyone who works in tech is completely unsurprised.

Sure, the tech exists to make this thing possible, but it requires an Apple-sized company to execute on it, and even then it’s utility would be doubtful

There’s been a lot of pulling back on smart speakers because they’re not quite where they need to be - and this promised far far more than a smart speaker from a tiny new company.

The question is: did they believe they own hype or know it’s a sham?

Very well written

> No services for government, schools, health available only on proprietary and "smart" platforms

I wish this were a movement, I feel very strongly about this.

The social side of things is very difficult to work around.

Public institutions, however, should not be restricting information dispersal to third-party private companies who force even a casual viewer to agree to extensive legal contracts.

I’d aggressively support legislation against this.

Luckily with Elon doing crazy things to X, NYC has divorced a bunch of public services from it.

But not enough

If you’re using a fully-fledged OS for your secure comms (and using telegram off of a mobile device to start with), this probably isn’t your biggest threat.

Disabling of automatic media parsing as suggested is absolutely a wise choice.

This would be pretty bad indeed if it were wormable.

Yeah, there have been a bunch. The last one I remember was a fairly well used security camera. VPN was how they streamed video back to storage. A really “simple” solution to turning a LAN-based video camera into an internet-connected one.

I’ll see if I can drag up some references, a quick google doesn’t show what I’m looking for.

This advice massively reduces the largest risk, but “problems all go away” is wildly wrong

There are a ton of remote access and update functionality in these things that make them fully exploitable even with no internet exposure.

Theyll do crazy things like VPN back to home servers, where every single device is on a flat /8 with no additional security. So anyone who dumps the VPN keys from one is basically on your eth.

Or update unsigned firmware from domains that end up abandoned and left hanging

Etc etc

Amazon, Apple, Google tend to ship hardware that at least doesn’t having gaping 1997 style vulnerabilities everywhere.

Cisco have had some doozies but overall aren’t terrible.

Everything else is probably bad.

> You do what the payment card industry has been doing for decades

What? Mandate a bunch of paper-thin worthless rules that tie up security & engineering teams and don’t actually add measurable security improvements?

I’d be very interested in seeing the data that shows PCI-DSS has had any impact. I spent a previous life breaking into PCI compliant companies, and it didn’t offer the tiniest speed bump.

This is a horrible recommendation.

I stand very corrected. The Liberator mentioned in GPs post only has a single metal component, a nail used as firing pin.

Apparently the 380 cartridge doesn’t explode upon firing

I assumed even “3d printed” guns required a metal barrel. Can polymer withstand even a single round being fired? Are we talking 22LR only or something?

Breach only makes a lot of sense. That would indeed be hard to detect, and would likely solve the above.

What kept you on their platform this long if you don’t mind my asking?

I’ve read previously that folks who pay their card in full monthly are internally known as “deadbeats”, because there is no interest to be gained from them.

This seems to run counter to that - there is revenue, perhaps less?

11 years to get the technology to a place where it can reasonably replace gas.

I have my doubts that we’ll have the range and capability by then, perhaps if automakers are smart we’ll see more series hybrids and range extender models.

I’m not sure that attackers “win” this arms race; the cost has gone through the roof and their chance of detection constantly increases.

Indeed, defenders are often outgunned, but at a minimum we’ve pushed the level of effort way into nation-state territory, which is a good start.

Plus, detection is likely to be be very different.

I expect a lot of people will be doing a whole lot of thinking along these lines over the next months.

Code review? Some kind of behavioral analysis?

IMO the call to system() was kind of sloppy, and a binary capabilities scanner could have potentially identified a path to that.

TOTP has substantial security gaps to make it a non-starter.

Maybe a pubkey system where you choose your own client would be what you’re looking for?

> I thought this site was for intelligent comments?

Comments like this add nothing of value toHN discourse, somewhat ironically.

I strongly agree with the general gist of your post; I don’t use any social media and a piece of me dies anytime a twitter link is shared that I can’t read because I don’t have an account.

That said, I don’t think the technologies and solutions you’ve proposed will take flight unfortunately.

I’ve been very curious about IPFS for the longest time, but it seems to fit into the same category as blockchain: beautiful technology that could solve a lot of problems, yet the barrier to entry vs just doing it the status quo way is too high.

If the general public can’t be bothered having their own Wordpress blog, the jump to running a server or writing a single HTML tag is far too difficult.

I’d love to see a fully not-for-profit social media organization whose only goal is the wellbeing of users

Gas and electric charge for “delivery” as a flat fee, then actual usage on top of that.

If streaming services did similar, you likely wouldn’t be that much better off

Plus, but not unsubscribing, you’re reinforcing their current business model.

“It's a well known phenomenon at this point that social media exacerbates scepticism and pessimism. Which makes sense - busy people with a lot going on spend less time online than loners and depressed people.”

That does such a great job of expressing something I’ve intuitively “known” for a long time.

There are the people who do all the talking, and those who are doing - very few who are in both camps. If you’re busy making things happen, you’re less likely to be commenting.

He never uses “fun”

He says you have to be interested in it, it should excite you, and it should be your own project.

That’s absolutely not at odds with solving a problem. In fact, there’s a good chance that people are interested in solving a problem, likely one that is painful to you.