yifanlu

Because AT&T is DSL, Comcast is cable, and Verizon is Fiber. If you want the fastest internet, you really don’t have a choice. And telling people “you have a choice, just switch to something slower” is not the same as “you have a choice, download the podcast elsewhere” because in the second case you get the same quality (lol I said quality when referring to infowars but I digress) podcast.

No, because ISPs are natural monopolies (https://en.wikipedia.org/wiki/Natural_monopoly). The government allows them to have a regional monopoly in exchange for investing in the infrastructure. As such, there’s no easy way for competition to happen. (You would have to invest in a new infrastructure. Notice how you never have two cable companies or two DSL companies unless it’s one company selling under two names). The reason net neutrality is a big deal is because ISPs want their cake and eat it too. They like the protections of a natural monopoly but they don’t like the regulations that comes with it.

So ISPs dictating what content is acceptable would be like your garbage collection company refusing to collect political flyers for an opposing party or something. Even though it’s not technically the government, I would see it as a government sponsored entity.

Now if you want something compariable, consider the bakery refusing to serve a gay couple. Even though I support gay rights, I agree there with the Supreme Court that a private entity should not be forced to endorse speech they do not agree with. And that would be what Apple is doing here.

Let’s stop pretending that we, as a society, care about fairness here. Rich people always get away with more shit. Let’s just enjoy one rich asshole getting part of what he deserved instead of lamenting about how a second rich asshole didn’t. And yes, I said to enjoy it because don’t pretend these stories means anything more to you than the entertainment value. Either you ignore them or you acknowledge it is tabloid drama that you enjoy (I am in the latter group). Dude was a rich asshole who took internet trolling from a middle school hobby to a lifestyle. The deck was stacked in his favor and he still blew it. That’s what we care about and why we like this story.

The post was from 16 days ago right? Did Apple fix it?

Just a half minute skim shows the author claims it passes the natural proof barrier but makes no claim about it being non-relativizing or non-algebraizing.

> Broadpwn is a fully remote attack against Broadcom’s BCM43xx family of WiFi chipsets, which allows for code execution on the main application processor in both Android and iOS.

This implies they have code execution on the application processor just from broadpwn (and not additional safari/ios exploits). Hijacking internet traffic is indeed serious but tech blog sites are already picking up on this and blowing it up. Example: https://9to5mac.com/2017/07/20/broadpwn-wifi-vulnerability-i...

> PSA: Update to iOS 10.3.3 to fix serious wifi vulnerability allowing attacker complete control

Right, I'm guessing they just patched the actual wifi chip vulnerability. That's why I would like someone (preferably the author) to disclose if there is indeed a privilege escalation or not and to provide more details if there is.

> Most modern systems have a MMU to prevent the peripheral from DMAing to memory areas not specifically reserved for it, but given (certainly Android) systems run oldschool kernels hacked together by the last kind of crowd you want working on them it's probably not enabled or setup correctly.

I'm not sure it's fair to assume iOS IOMMU isn't set up properly just because that's the case on many (most?) android phones. According to the author, most android phones don't even have KASLR which iOS had since iOS6. I would assume IOMMU exists and is working properly unless someone has evidence otherwise (quick google shows very little information on iOS + IOMMU). If a DMA attack is indeed successful on iOS devices, I think that would be substantial enough to write about.

> The other more obvious privilege escalation is that there is still a kernel driver on the application processor talking to the chipset.

I would consider that a separate exploit--but even then you still need a KASLR bypass (another exploit?) at the very least to gain control.

> so these often aren't written as defensive as they should be

On the contrary, the market rate for a iOS jailbreak chain is upwards $1 million USD so I'd be surprised if a single exploit gives you full system control.

The article mentions

> Broadpwn is a fully remote attack against Broadcom’s BCM43xx family of WiFi chipsets, which allows for code execution on the main application processor in both Android and iOS.

But it doesn't go into any details on this privilege escalation actually works for iOS and more specifically that it doesn't require additional exploits. Can anyone explain this in more detail? If this actually allows code execution on iOS application processor, that means we have a jailbreak right?

> Hickey created a malicious, macro-based Word document on his own computer that when opened would allow him to carry out a reflective DLL injection attack, allowing him to bypass the app store restrictions by injecting code into an existing, authorized process.

That's enough to show that you could have run ransomware. Unsigned code execution under Word privileges (which presumably has write permissions to user documents) is enough to encrypt user documents.

I think the point is that it's dishonest/irresponsible for Microsoft to advertise 10 S in this way. Even though technically they're not saying you can't get hacked by ransomware--anyone without technical knowledge can reasonably assume that's the case. The article showed that MS didn't really put too much work into adding extra security/mitigation. Just shutting down side loading isn't work proportional to what they advertise.

Contracts have many terms that haven't been legally tested. The idea is that you put in words that will protect you in court if it ever comes to it. It gives them more options to pursue a legal argument--chances are though if their best argument involves this clause, the case is their's to lose.

Occam's razor. Is it a giant conspiracy coordinated by some Other Entity with Power and Influence able to manipulate NYT as well as Google to maximize the impact of their destructive forces?

Or... because of all the bad publicity and Uber being in the limelight, those who were already feel uncomfortable about what they saw finally got the initiative to speak out... and the news media finds the story hot enough to publish because of the #DeleteUber campaign... and throw in some consequential timing at Google.

No. The Vita also has FreeBSD listed in its OSS page because it used a lot of the network stack. That listing doesn't mean anything.

BuzzFeed News has actually become a pretty reputable organization in the past couple of years. They have quality journalists working there (according to journalist friends). I was also surprised when I heard about this since I associate them with listicles, but appearently that's how they fund things...

The key insight from Adleman is that DNA complement binding allows for massively parallel "brute force" for the HPP. This exploits the fact that chemically, complement pairs will "find" each other given enough time, so if we encode all pairs into complements, then we know that every matching corresponds to a path.

An unanswered (although touched upon; unanswered I suspect because it is in the source paper) question in the paper is: why does this not mean P=NP if we only require O(m) test tubes and "mixing" operations on a formula of size m? The answer I suspect (I haven't read Adleman's paper) has to do with the amount of time it takes for the "mixing" operation to work. I would imagine that as the number of clauses increase, the number of DNA strands in the test tube increases, and the time it takes chemically finding your complement would increase exponentially. I'd be interested in the real answer though.

Lipton is legit. In page 1 though

> However, it does _not_ mean that all instances of NP problems can be solved in a _feasible_ sense.

Basically, this says nothing about the P vs. NP problem (as I'm sure many are thinking of when NP is mentioned). This is more about a non-trivial utilization of the massively parallel properties of DNA computers in order to speed up brute force computation.

Can someone point me to the actual ruling? The only one I can find was from last year (2015). Has it even been ruled this year yet?

I have lived in America for a long time and can speak English fluently. However if I say "Americans are stupid, and most people don't know how to speak their own languages properly." even though it may be based on my observation living here for over a decade, it is ignorant at best and racist at average. I'm showing my feeling or superiority when in fact I'm the stupid one because I don't understand regionism and slang.

But that's besides the point. Just because you lived there and learned the culture (who's to say how well) doesn't mean you can't be racist against them. Otherwise, there's a lot of colonists who we own an apology to.

I've read the author's bio on their site and even there it downplays Japan and Japanese culture and up plays the author themselves.

So, umm, is nobody else going to call this racist?

> Every bookstore, magazine stand, and school, has a significant portion of its bookshelves packed with comic books. Why? It’s generous, and a bit dismissive, to say that Japanese folks simply love “cute” things. It’s probably truer to note that a significant segment of the population isn’t accustomed to reading, or thinking, at an adult level.

> Kids in Spain are reading Kiss of the Spiderwoman , kids in America Harry Potter, and kids in Japan . . . Naruto, the adolescent ninja. What’s Japan famous for? Literature? Movies? Music? Web design? Please. Comic books. Anime. Illustrations everywhere.

Right, I'm guessing they haven't read Tales of Genji or Saikaku or watched many of the films out of Japan in the Criterion collection. But let's dismiss an entire culture and history because of the popularity of anime (which, by the way, is not just for kids, but that's a different topic).

> Japanese people themselves are aware of this; if not individually, then at least as a group. In recent years a flood of new words has entered the language, and guess what, they’re all written with the Japanese phonetic alphabet, katakana.

And that's because they can't read it? WTF. Katakana is pretty. It's marketing. Sometimes Japanese poetry (yes it exists) uses katakana for style and emphasis. I don't claim to know how Japanese marketing works but you, author, don't either.

> Nobody bothers to make kanji for stuff anymore, because half the time, no one can read it.

What? Even if you're being hyperbolic, that's still too much. Yes, there's a lot of difficult kanji even for native speakers. For foreigners like me, it's the biggest barrier to learning it. But to claim that native born speakers can't recognize half the words in common use...

> Ever wonder why Japanese people have such trouble learning English? Just look at how well they speak their own language.

Again, even if you move past the reductive reasoning and general racist stereotyping, it's just plainly wrong. Even in a logical level. Do you really think a nation of people who speak a language can't do it well? Why do they choose that language then?

Seriously, I get "skepticism", but wtf HN. If it looks racist and smells racist, let's not just skid past it and just inquiry about "supporting data".

I have to admit I never done one myself (always been meaning to, never had the time) but a lot of friends have and I trust their words. I believe it helps in the real world because these "war games" simulate real world systems and trains people in attacking them (therefore learning how to defend against such attacks).

Yup, when I hacked the Kindle, it was a weekend's work. It was fun and challenging work, but not educating as this was.

In theory everything you need is in those binaries. We had to start from nothing. There's already a lot you can learn from the device just by running your own code on it.

For the IRC bot, is there protection against an attacker with superior connection seeing the message first and replaying the hash before the bot sees the original message? Also maybe you can use a Merkle tree to tradeoff storage and verification time?

> The number of people who gave an opinion on quantum computing is 16.

> 1 said quantum computing is a hoax.

Wow.

So, your concern with password managers right now is that losing your master password means you lose everything?

You wish to design a new system where the threat model includes losing the master password? I think your implementation only adds 3 bits "more" security than a "basic" implementation that is: hash web site name || root password.

Say, in your implementation, the attacker gets the root password and "salt based on another random password" (it's likely that they get both at the same time because they would be stored in the same place. If they're not stored in the same place, you just discovered a weak form of 2-factor auth). All the attacker has to do at this point is guess 10 values (30-40) and try each one to get the account password. That's your 3 extra bits of security from the 'basic' implementation.

But if you just look at the two "features" you presented of your scheme, I don't know any popular password manager (LastPass, 1Password, etc) that doesn't have them. Can you explain?

In terms of security, this doesn't improve anything (all security hinges on the master password). In terms of flexibility, this is a lot worse than a secure password manager.

No. Let's see what happens if this same story is told without the racism. Bob is on the phone with his mother and said he will have a "salad" tonight. Sally across the aisle heard it as "suicide" and reports him. The attendant promptly calls security, has him evicted, and the FBI is called. Does that sound reasonable to you?

So no. Many people did lots of things wrong that day. The passenger who obviously doesn't know arabic mishears a word and reports him out of prejudice. The staff who took the complaint seriously because of his race. The security and FBI who harassed him for a long time as a result.

Do you really think a white man uttering Allah (where that's the only word heard by another passenger) would be subjected to the same treatment? And also, even if the man WAS a terrorist, do you really think he would go on the phone and talk about his terrorist plots in the open? Even if this guy said "martyr", that still does not warrant the treatment he received. Just like if Bob actually said "suicide," literally it's just a word that's sometimes used in a bad context. He wasn't misheard as saying "I will blow up this plane." So it took many layers of prejudice for this to happen.

> i wonder why anyone thinks open problems in number theory are a sound means of crypto

The short answer is that the numbers are so large that with current state of the art means (which I'm sure you know a lot about), factoring a 2048 bit number takes around 1000 years and 4096 bit keys takes about 2^32 times more years. Even if computers get faster every 10 years, you can see that it won't improve much. That's why we use number factoring for crypto; because it takes so long to break.

However, as you've pointed out, since the problems are open, the calculations are meaningless. And of course all this analysis goes out the window with quantum computers. But the unfortunate truth (the "biggest embarrassment of computer science" as Dan Boneh calls it) is that we don't actually have any proof that security exists. All crypto is built on open problems. So better choose open problems that's been open for a long time.

Of course, in a perfect world we would all be doing that. However, there is a tradeoff of boot-time/power consumption/hardware complexity (the hw AES engine only does CCM/CTR/CBC). Given their track record though, I wouldn't be surprised if things still broke if they used GCM. I think the main takeaway isn't that there's a couple of things they could have done differently to prevent this (which is always true in hindsight), but that certain major design decisions made such bugs inevitable.

You may not mean it this way, but for any reader who might be mistaken:

P == NP => integer factorization can be done in polynomial time with a classic computer but not vice versa. In fact, many people believe P != NP && integer factorization can be done in polynomial time since FACTOR lies in this awkward space in the intersection of NP and co-NP. (Most other problem in this space are also in P, but we think P != NP, so...)

Now of course, if you put in quantum computers into the mix, Shor's algorithm can break both RSA and ECDSA in polynomial time.