345 karma · joined February 16, 2016
The current state of web development makes me sad, mostly because it's all fault of all the die-hard javascript developers, you know what f*ck all javascript/ecmascript/typescript/node developers.
IMHO memory leaks are important only on embedded software because you start there with a really low memory available for your software to run.
Also wonder if this "security feature" is NSA-approved, m pretty sure it is.
Sometimes i wonder if the people in the valley are so dumb or just so far ahead of the pack that foresaw a future were you can make a beautiful lie just to the take money from the big fish on the pond. // offtopic
Like in the old days, when scanning the entire IPv4 was seen unfeasible due to the high latency low speed internet but those numbers are going up each day on both network speeds and going down for latency by the time we have 100% IPv6 deployments it will be fast enough. Mirai 2.0 in the making thanks to net-engies pushing IPv6 hard.
There is no tool yet available but with IPv6 numbers going up it just matter of time before it become a necessity.
When you need an 3rd-party provider to "get in" the internet. FTFY.
Or just test it in a VM and stop wasting money on side-projects.
But speaking on your questions... Location On, Wifi Off offers better security IMHO, specially in the case your phone gets stolen/lost you may at least use that information find it or at least report to the authorities it's location the trade-off is that google/nsa et al will always know your location but unless you are Snowden or paranoid, you probably wont mind.
Also in the latest version (at least on the Beta afaik) you can activate Wifi Scanning, which uses the passive/aggresive mechanism mentioned on the article to find out if you are near the AP and turn on your wifi.
But in newer versions of Android (afaicr > 7.0) is no longer using an aggressive approach (visible to other devices), it just passively collect frames (https://plus.google.com/+mikekershaw/posts/DmpQ2no5bEk) so it's no longer an a privacy issue to have this option on those versions, still would recommend SWM to increase security.
HPKP and Let's encrypt has been a notable problem on the Let's encrypt community, if you see my reply to an earlier comment you can read the links on the problem it brings, it has even been proposed to use long-term certs (https://github.com/certbot/certbot/issues/2083) but the devs didn't like it therefore since it's not recommended and encouraged by one of the major free ssl certificate authorities it just means that it will less people will implement it and browser will eventually cut the support.
Let's Encrypt devs decided to put those short-lived certs (instead of the long-term certs everyone was using) making it almost irrelevant to use that "security header", almost every webdev knows the issues present on the current cache-invalidation problems on every major browser.