Father, Hacker (Information Security Professional), Open Source Software Developer, Inventor, and 3D printing enthusiast

  • 2 Posts
  • 69 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle
  • As expected, nobody cares about “reader mode”. Only once in my life has it ever come in handy… It was a website that was so badly designed I swore never to go back to it ever again.

    I forget what it was but apparently I wasn’t the only one and thus, it must’ve died a fast death as I haven’t seen it ever again (otherwise I’d remember).

    Basically, any website that gets users so frustrated that they resort to reader/simplified mode isn’t going to last very long. If I had my way I would change the messages:

    “This website appears to be total shit. Do you want Firefox to try to fix it so your eyes don’t bleed trying to get through it?”

    I want an extension that does this, actually! It doesn’t need to actually modify the page. Just give me a virtual assistant to comiserate with…

    “The people who made this website should have their browser’s back button removed entirely as punishment for erecting this horror!”




  • Rich people believe that no matter how rough the world gets they will be fine as long as they remain rich. History has shown repeatedly that this is a false assumption, demonstrating that the rich in America really are just as dumb as poor conservatives who get suckered into voting against their own interests every election.

    Also many of the absurdly wealthy are sociopaths and narcissists (because our economic system allows people like that to succeed by stepping on everyone else). To them, all that matters is how they look among their “in group.” So if they think they’ll look better by being a few billion richer they do whatever it takes to get there… No matter the long term consequences. Either to them or anyone else.









  • As someone who’s caught a leaker in the past (well, someone that was exfiltrating company secrets to a competitor) catching leakers is actually pretty easy if you have any modicum of control over the tools they use and the places they work. Barring that, no. Just no. It’s not going to happen.

    If a leaker is gullible and stupid some trickery is possible but I wouldn’t get my hopes up, Warner Music. Seems like a job that’s doomed to fail from the start. I wouldn’t even bother unless they know it’s just a job on paper and are actually just looking to give someone’s kid a legit-sounding job to pad their resume 🤷

    Not only that but if I were in charge of hiring I’d be extremely skeptical of any and all applicants. Anyone smart enough to do the job will know it’s impossible and will just become a master of stalling and picking low hanging fruit (aka useless) and everyone else is just a fraud.


  • It’s not just actually innovative patents that are missing from the patent system (which they are). It has also become so expensive to both file and litigate a patent that only big businesses and patent trolls can afford it.

    The median cost to litigate a patent is five fucking million dollars (in 2021). What this means is that if your patented solution isn’t worth at least 2x that amount it is quite simply not worth patenting.

    The whole system should be scrapped. It was fundamentally flawed from the start and has demonstrated over and over again that it does not scale. It’s not even worth it to keep pharmaceutical patents (there’s other, better, cheaper ways to come up with new drugs than $100 billion dollar commercial entities ripping us all off and spending half their budgets on marketing).




  • This is a, “it’s turtles all the way down!” problem. An application has to be able to store its encryption keys somewhere. You can encrypt your encryption keys but then where do you store that key? Ultimately any application will need access to the plaintext key in order to function.

    On servers the best practice is to store the encryption keys somewhere that isn’t on the server itself. Such as a networked Hardware Security Module (HSM) but literally any location that isn’t physically on/in the server itself is good enough. Some Raspberry Pi attached to the network in the corner of the data center would be nearly as good because the attack you’re protecting against with this kind of encryption is someone walking out of the data center with your server (and then decrypting the data).

    With a device like a phone you can’t use a networked HSM since your phone will be carried around with you everywhere. You could store your encryption keys out on the Internet somewhere but that actually increases the attack surface. As such, the encryption keys get stored on the phone itself.

    Phone OSes include tools like encrypted storage locations for things like encryption keys but realistically they’re no more secure than storing the keys as plaintext in the application’s app-specific store (which is encrypted on Android by default; not sure about iOS). Only that app and the OS itself have access to that storage location so it’s basically exactly the same as the special “secure” storage features… Except easier to use and less likely to be targeted, exploited, and ultimately compromised because again, it’s a smaller attack surface.

    If an attacker gets physical access to your device you must assume they’ll have access to everything on it unless the data is encrypted and the key for that isn’t on the phone itself (e.g. it uses a hash generated from your thumbprint or your PIN). In that case your effective encryption key is your thumb(s) and/or PIN. Because the Signal app’s encryption keys are already encrypted on the filesystem.

    Going full circle: You can always further encrypt something or add an extra step to accessing encrypted data but that just adds inconvenience and doesn’t really buy you any more security (realistically). It’s turtles all the way down.