• 3 Posts
  • 97 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle











  • I’m not sure why you’re so dismissive of this? It’s kind of asinine.

    Does everyone everywhere only ever use computers in an enclosed room? Is everyone with something value to exfiltrate easily accessible to kidnap and beat with a wrench?

    This is valuable for corporate espionage, political purposes, or for nation states. If miniaturized, even easier for targeted attacks where it might be difficult to inject malware, or for broad attacks on office workers.

    And the best part is that it doesn’t leave a trace which beating someone with a wrench and malware would do…


  • That doesn’t answer the question.

    Domains can expire, be sold, have their hosting (nameservers) changed…etc it’s very conceivable given the current climate that it could be a malicious site used for data exfiltration from prospective voters. The security posture, if any, of the owner are also unknown, meaning it may be unknowingly compromised.

    Especially when you have people willing to drop tens of millions of dollars on voter suppression.

    Plain and simple, don’t enter your personal information into a 3rd party site. Use your official government provided ones for this purpose.








  • I’m not claiming some grand level of knowledge here. I also cannot enumerate all risks. The difference is that I know that I don’t know, and the danger that poses towards cognitive biases when it comes to false confidence, and a lack of effective risk management. I’m a professional an adjacent field, mid way into pivoting into cybersecurity, I used to think the same way, that’s why I’m so passionate here. It’s painful to see arguments and thought processes counter to the fundamentals of security & safety that I’ve been learning the past few years. So, yeah, I’m gonna call it out and try and inform.

    All that crap said:

    And you are right, the problem gets moved. However, that’s the point, that’s how standardization works, and how it’s supposed to work. It’s a force multiplier, it smooths out the implementation. Moving the problem to the OS level means that EVERYONE benefits from advanced in Windows/Macos/Linux. Automatically.

    It’s not signal’s responsibility, it shouldn’t be unless that’s a problem they specifically aim to solve. They have the tools available to them already, electron has a standardized API for this, secureStorage. Which handles the OS interop for them.

    I’m not arguing that signal needs to roll their own here. The expectation is that they, at least, utilize the OS provided features made available to their software.


  • Another risk with Monitor, which may get better with time. Is that FOSS rust projects have a tendency to slow down or even stall due to the time cost of writing features, and the very small dev community available to pick up slack when original creators/maintainers drop off, burn out, or get too busy with life.

    To be clear: I have nothing against rust. It’s a fantastic language filling in a crucial gap that’s existed for decades. However, it’s I’ll suited for app development, that’s just not it’s strength.