TheDong

Wireguard allows effectively no configuration around auth, and so it's more likely that it is configured in a secure manner.

Openssh allows: password auth with weak passwords, PAM with potentially insecure PAM modules, gssappi, configurable ciphers, etc. Wireguard has none of those.

Each of those auth methods adds more possible vulnerable code paths and accidentally insecure configurations. It's very reasonable to believe that wireguard auth, since it has far fewer moving parts and configuration knobs, is likely to have fewer ways it can be insecure.

I do personally find myself most productive with a cycle of 20 hours awake / 12 hours asleep. Circadian rhythms vary by person.

Unfortunately, the world makes it hard to keep that cycle, and so instead I mostly do 17 hours awake / 7 asleep, which makes me feel constantly tired (though less tired than 16/8 at least).

That timing could also align with a device that is turned on and off at specific times, for example an insecure smart TV that is generally turned on to watch TV in the evening, and turned off around midnight.

Though the fact that it lines up with an 8 hour shift also makes it seem human-like, so I think I'd rank a human carrying an infected device as more likely than an infected periodically-active device.

> I know some people will say "Good riddance" to the outcome and to what I did.

I will instead say "skill issue".

Using Playwright results in some very obvious and easy to detect fingerprints. I'd expect better of someone on hacker news.

Mine hasn't been detected as far as I can tell, so I know it's possible to do better.

Buy a domain and server, rack up the server in a nearby datacenter, and host on that. Easy.

If you go with a cheap enough colo provider, you can get it down to like $200/mo (depending on electricity prices and such where you are) with an initial cost of like $800 for some used server hardware.

> if you have an attacker inside the network, it's already too late.

It shouldn't be though. Just because my smart lightbulb has an RCE and is isolated on its own VLAN with the router doesn't mean it should be able to attack the router and escalate to access my devices on other VLANs. It should only be able to do damage limited within its own vlan.

The quantitative data we have shows that NixOS is fresher than other distros in general by a significant margin.

See https://repology.org/repositories/graphs

If you pick a specific random package update, nixpkgs often has that update months to years before other distros.

If you pick a specific CVE, nixpkgs usually is better with the exception of embargoed ones, where Ubuntu, Fedora, etc get to prepare their patched packages ahead of time.

Yes, NixOS has already patched this.

NixOS also makes it much easier than ubuntu to install your own patches and version of the linux kernel.

For example, assuming NixOS had not yet released the fixed linux version, 6.18.56 (though it has), you could upgrade to it before NixOS did it upstream with this one line:

    boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux_6_18.override {argsOverride = {src = pkgs.fetchurl {url = "mirror://kernel/linux/kernel/v6.x/linux-6.18.56.tar.xz"; }; version = "6.18.56"; modDirVersion = "6.18.56";};});

You could add the patch yourself if you needed to with:

    boot.kernelPatches = [{ patch = ./cve-patch.patch; }];

And then you'd be updated.

The debian and redhat based distros all make it so configuring what packages are installed ('apt install' / 'yum install') is a different operation from configuring the packages themselves.

On NixOS, the specification of how to build a package, what package is installed, patches, etc are all in the same language, and so it's a lot more natural to patch things as needed.

And also, LLMs are pretty good at generating working nix, so you can have an agent apply patches to your kernel package with NixOS quite easily. Agents can also do this for ubuntu or redhat, but in my experience they're much worse at it, and it's harder to undo mistakes if they mess up.

That's a cool thought experiment, but it doesn't work in practice.

> When it sees a certain string in any write to the disk

dm-crypt or zfs encryption or any other commonly used encryption will encrypt the data before it's written to disk, so the disk controller will not be able to do anything with writes or reads since it will not have the encryption key.

It's almost impossible to verify the code on the hardware wallet really matches the code they released and that the hardware has not been tampered with.

Maybe the sim card is on a timer to broadcast your keys after a year, so you just can't detect cellular signal usage now.

To securely own bitcoin you have to first create a new chip fabrication plant to then make your own hardware wallet.

Asahi linux only supports older M series processors still, and there's a lot of caveats with it.

I purchase the hardware, I should be able to do what I want with it. I want apple hardware for the good processor specs and battery life and general hardware quality.

Apple should be forced to release the necessary hardware specs to develop drivers so that I can use my hardware I purchased as I want. They should be required to let me own my own signing keys to boot my own software.

Anyway, I'd personally want bootcamp because it's a step closer to being able to install Linux, an operating system that lets me have a good tiling window manager that works.

Why the heck would anyone want to use macOS willingly, where the window manager and file browser are both complete unconfigurable trash.

F-Droid on android was a far better app store than Google's.

An Open Source / Free Software Only app store on iOS which only allowed reproducible builds would be so much better than the iOS app store for security.

I would trust that so much more, and I feel like anyone even marginally technically competent would too.

If Mozilla made its own app distribution platform for Firefox and Thunderbird, I'd also naturally trust that.

At this point, I do not trust apple at all. The iOS app store sells ads. If I search for my bank's name, a different bank comes up as the first result.

If you search 'Ledger Bitcoin Wallet' on the app store, someone who pays more for the ad slot can present you with a crypto stealer (which has happened in the past! the app store review didn't catch that obvious bullshit).

The app store's "due diligence" and "vetting" all went out the window as soon as they started selling the top search spot to the highest bidder.

That dancing anime girl is from this video, "loli god requiem" https://www.youtube.com/watch?v=Ci_zad39Uhw

It's a video of an underage-looking ("loli") anime girl insulting the viewer for being a pedophile.

At this point it's mostly used by pedophiles in a sorta tongue-in-cheek way.

Of course, all the best security professionals are either pedos, israelis, furries, or all of the above, so it's not really surprising.

Oh, wow, that makes it even sillier. If I want to delete certs from my system certificate store, I can do that, the stdlib should not be making that choice if it's not even packaging the things.

I mean, they're the TLS certs are baked into the stdlib 'tls' package, not the compiler itself.

It's just an unfortunate unforced error that the go TLS package is bundled along with the compiler, in the same way Safari being bundled with iOS updates is an unforced error meaning a safari security bug requires a full OS update.

gTLDs at least have some minimal level of accountability and security standards.

ccTLDs are at the whim of the country. If you went with the '.su' ccTLD from the soviet union some years back, well, that would have been quite unfortunate.

Legally I feel like they're also worse. Like, say you're an abortion clinic operating in the regressive country of the US, and you get a '.us' ccTLD, surely it's more likely the government outlaws abortions and censors your domain via the registrar than if you used a '.com'?

Reverse engineering doesn't help for iOS very much since even if you build your own version of their app with that feature unlocked, iOS doesn't allow you to sideload.

You'd have to pay $100/year for an apple developer account and then refresh the app every 14 days (since publishing your own hacked version on the appstore would plainly be a copyright and trademark violation, and if you use a developer account to load a developer version of an app on your device, you have to constantly refresh it).

Switch to one of the linux phones if you actually want to install software on your device.

I mean, Tesla demoed, promised, and took reservation money for a roadster reboot that _also_ didn't contain any technology China didn't have in 2017, and at this point they still haven't delivered on that and it feels safe to call it a scam.

Just because the technology is technically feasible doesn't mean that a specific company is not scamming you when they promise it.

And Tesla already has enough of a history of fake promises (your tesla will be a self-driving robotaxi earning money while you sleep within a few years, FSD will take you across the country while you sleep by next year, humanoid robots, the new roadster is taking reservations now and will deliver soon, regulation is the only thing holding up FSD, etc etc).

You can install various linux distros (not android distros) such as postmarketOS and Ubuntu Touch on a Pixel 3a

https://devices.ubuntu-touch.io/device/sargo/

And "discord" means "disagreement", "lack of harmony", "arguments" in English. Even weirder name for a chat application in an even more commonly used language.

"Slack" associates pretty strongly with "slack off" (get no work done) too, so that one's also strange.

I think "Zulip" has the best naming of all these.

I wouldn't be surprised if Samsung or Xiaomi eventually forked to make their own "developed in the open" Android.

Though given how little those companies have respected their users so far, I feel like this is a bit of a monkey's paw.

Google is doing better here than Apple. Most google devices have an unlockable bootloader.

I have old Chromebooks and Nexus Tablets that are EoL, but I can install linux on them and give them a second life.

The source code for my old EoL pixel phones is out there, it's just a matter of effort to port Ubuntu or PureOS or one of the other Linux phone distros to them.

It's Apple that is being as evil as possible when it comes to stomping down alternatives, they don't release iOS source code, they bricked most of my old devices when they EoL'd them by not letting me unlock the bootloader and install my own OS, they don't release drivers.

I'm deeply unhappy with Google's current direction, but they're still lightyears from the level of evil Apple inflicts upon us.

First let us install other browser engines on iOS, and then we can talk.

Safari has the most obscene monopoly of any browser ever. IE 6 came pre-installed on windows machines, but you could always install Mosaic or such.

Google Chromebooks come with Chrome as the only default browser, but you can still run Firefox on Chromebooks just fine (even in two different ways, the supported android app version, and the semi-supported linux terminal + launching firefox that way).

Heck, iOS's monopolistic behavior is so bad that multiple regions (the EU + Japan) have already ruled against their behavior, though in reality Apple has complied in a way that makes it impossible to actually make a second browser engine for iOS still (going against the spirit of the law, but the courts haven't caught up to them yet).

Safari is also an awful browser in that it requires someone to buy an expensive machine to see if their site works on it.

I can run a windows trial copy in a VM to see if my site works in IE, I can run Chrome or Firefox on linux to verify if my site works in them. I can install a free android emulator on any common OS to see that my site renders right in those.

But Apple doesn't give me a legal way to freely run an iOS simulator nor even a macOS VM on my linux machine, I have to pay money, to buy their hardware to see if my site will work on Safari.

And even worse, Safari is the browser with the largest number of rendering bugs and quirks currently, while also having a huge number of users (since iOS users can't install another browser), so any web developers are basically forced to shell out for apple hardware.

Security isn't just an absolute, it's also a multi-faceted series of defense-in-depth measures.

Can you get arbitrary code execution on the RTOS from another app? No? Then adding layers to protect apps from each other is meaningful.

What you're saying isn't too far from "Well, if the attacker has physical access they can just freeze and decap the memory to read all secrets, so like there's no point in even hashing passwords or fixing XSS"

It should be legally required that apple release the drivers and spec sheets and signing keys for their hardware such that i can build my own drivers and run linux on my iPhone and airtag and macbook.

I'm paying for the hardware, I should be able to use it.

Same for my closed-source fridge, air conditioner, and nintendo switch, all of those should be legally compelled to allow running any software.

Bundled hardware+software should be illegal.

I mean, at this point it's pretty well known that all tech services will be hacked by fable, anthropic themselves promised it, so writing your journal in google docs or claude or a txt document on your laptop or such is the same as releasing it publicly yeah?

If it were written on paper, and only in a room with no phones or cameras so fable couldn't hack it, then I think you wouldn't be sharing it.

I agree with this fully, this is how a lot of civilized countries work.

For 90% of the population, taxes are automatic, and the few people who do side-jobs or have lemonade stands or deal drugs have to file their own taxes separately.

I'm not opposed to that, I just want the 90% case of "single or normal family + W2 employer(s)" to be covered automatically.

In more civilized countries, you file your current address and all change of address forms with the government, you register any separation agreements with the government, etc.

The government absolutely should know enough to apply this reasonably accurately, and things that they can't correctly derive (like 'paid more than half the costs of keeping up the home') should simply not be part of tax law, or should be a checkbox when registering your address of "I am head of household" so the government knows.

The US government can't derive all this, but they should update it so they can.

Heck, with the NSA's hooks into banks and cell phone companies, there's a non-zero chance they actually could derive this all now if they wanted.

I think the more comparable thing would be youtube premium (paying to not have as many ads there), and I certainly pay for that.

I have no clue how popular it is though overall, presumably not super popular.

I also don't think the $300-$2000/mo "ad-free iOS subscription" would be super popular if it existed, but idk, I know at least a few people that would go for it.