beckler

Getting some arduino.cc vs arduino.org vibes here.

That is one way. Generally there are several vectors when it comes to exploits.

Like, is the git repo secure? Can we add code that allows a backdoor or reaches out to a command-and-control server? Or how are their packages secured? Can we upload a malicious one to their package repo? Is the distribution server secure? Are the devices exposed directly to a WAN? Can we sell knock-off devices or modify legit devices before we resell them? Can we design them from the beginning to be exploitable? Were the engineers lazy and implement zero security controls? etc, etc...

This is why defensive security is rather difficult. You have to get everything right, but attackers only have to be right one time. Then when you get consumers involved, it becomes significantly more complicated and difficult. Some of these devices can stay active for years, and the owners realize no difference as long as it still works as expected.

high-level IoT botnet explanation: Imagine you discovered a massive flaw in a robot vacuum/video doorbell/smart fridge/wi-fi connected blender/router/etc, where it would accept and execute any command you sent it.

Next you come up with some way to discover and exploit as many of these devices as you can. It could be by finding all IP addresses of exposed devices via something like Shodan, or exploiting and taking over a centralized server that all these devices communicate with, or some other novel way.

Anyways, once your in control of all these devices, you pick a target URL and send a command to all your devices to start CURLing a specific address over and over and over.

Boom, you have a IoT botnet for DDoS attacks.

I think it's safe to consider routers IoT devices, but I would suggest that basically any independent embedded device is an IoT device. Literally any "smart home" device can get silently taken over and become part of a DDOS network.

I grew up with horses. It blows my mind people would willingly ingest that stuff. The horses don’t even like taking it. You gotta shove the whole syringe to the back of their throat to make sure they don’t spit it out.

I have two hypotheses.

The tow company and the local Avis branch have some weird kickback scheme going on.

Or the tow company has illegally put trackers on known rental cars and then fetch them for a bounty.

Someone is clearly able to track the car, and I wouldn’t put it past a tow truck company to pull something sleezy like this in either situation. Don’t know how likely either situation is, but those are my top two guesses.

I have heard nothing but horror stories from those who worked at RV.

My FIL runs an electrical co-op in upstate SC. He had the choice of creating a new HQ for their co-op, or run fiber to all their customers.

He ultimately chose the new HQ because the cost-per-mile was insane when you got in the more rural areas, and he had no guarantee that all serviceable addresses would subscribe, plus it would increase costs for all their subscribers even if they didn't join their network. He also afraid that something faster or more efficient than fiber would become more widely available over the next 10-15 years and then their network would be obsolete.

I believe it's fixed in macOS 11.4... looks like it was a bug that was affecting the data reporting tools.

https://twitter.com/marcan42/status/1396374313591140357?s=21

Then why do Venmo and CashApp get a pass? Is Fanhouse trying to leverage Apple’s Payment APIs without paying or something?

Well, it sounds like to me, that TE just did the hardware design, and PANIC is really the one making the decisions for the software/games side.

That being said, Teenage Engineering is one of those brands that has massively disappointed me over time. When the OP-1 came out it was a truly innovative, beautiful, and robust synthesizer... Despite that, everything they make now just seems over-hyped, over-priced, and homogeneous.

I mean their most recent "innovations" are, no-joke: a $600 portable AM/FM + BT radio, whose only real feature is a massive buffer so you can rewind or fast forward in real-time, and a robot that dances to music.

They're great at predictable, minimal design, there is no doubt there, but that's about it.

Copyright doesn’t really apply to UI designs.

Patents can apply, but it’s really only used in novel and unique situations. Even if Replit had a patient on its UI/UX design, if you were able to find evidence of prior art, you could petition to invalidate.

I actually experienced the opposite on my M1. Safari locks up all. the. time. but it happens more often when I open a new tab. I run into a ton of compatibility issues, and I hate that you can only install plugins via the App Store.

I really wanted to like safari since it’s the most power efficient, and when I got my M1 I went all-in on it, but I went back to Firefox after three months.

I did it for 3.5 years and then I jumped ship back to just regular development. When I started, we were actually really great at discovering and solving actual issues. Our VP got replaced with someone who wanted us to only work on compliance checklists, and the joy I found in that job went from 100 to 0 in an instant.

If you have $99,990 in BTC, and $10 in cash, only the $10 is covered.

Coinbase could shut down converting crypto to cash at any time. There is no promise or guarantee that they have to allow cash exchanges or deposits, since they're basically buying and selling crypto on your behalf.

Coinbase and FDIC insurance seems tricky at best... I think it only covers deposits made via cash from federally recognized institutions, and will only be covered if you leave it as cash.

If you are transferring tokens in and/or converting tokens to cash, I don't believe those transactions would meet the criteria to be covered by FDIC at that point. I might be wrong on that assumption, but FDIC is only deposit insurance, not withdraw insurance, and its under very specific terms.

I have to use mongo at work. They used it because they thought it would be easier for the developers, but I find the query pipelines confusing at best. It can be extremely nuanced depending on how complex your aggregations are. I usually have to rewrite complex queries often because there are so many subtle details that can make your queries return incorrect data.

Even the docs in mongo tell you what kind of SQL query certain operators perform… I would rather just do SQL.

It's currently at 7.7% + $0.25. But it's a bit more complicated than that.

If you want something to sell, you usually have to use their "bump" feature to get it to show up at the beginning of any relevant search results. You give an additional percentage of the sale to get it higher in the listings. If you have a more common item, you usually have to give up a higher percentage to get it noticed.

Once you factor in shipping and everything else, I usually sell most of my items at a loss of 10-25% depending on the item. I've never really made a profit from anything I've sold on Reverb.

I like reverb, and I think it’s a pretty great resource, but they raised their rates back in August and it’s left a bit of a bad taste in my mouth. I end up paying almost 10% to just sell something, and that’s before shipping.

It could always turn a TV on or off. I had to change my television settings to allow it to accept commands over hdmi.

I think by far the most interesting part of this article is New Horizons observing parallax of Proxima Centauri... it's a bit mind-blowing to think about the vast distances involved, but to actually observe it is just wild to me.

http://pluto.jhuapl.edu/News-Center/News-Article.php?page=20...

The way I read that isn’t that your forbidden from doing any of those things. Your forbidden from doing those things with a dedicated machine (i.e server). Like you are forbidden to make your personal server a node for a speed test for others.

I wish there was a convention on the order of classes on an element. Like height/width first, padding/margin next, idk what next, and then pseudoclass variants at the end, but in the same order?

I don't know honestly, I just wish there was a convention.

Content is free, doesn't mean API access and requests have to be free.

They’re a web/hosting service provider, like AWS or GCP, but with less services. They’re much more popular in European countries.

Not OP, but I'll post what I've found:

  > vm_stat
  Mach Virtual Memory Statistics: (page size of 16384 bytes) 
  Pages free:                               28209.
  Pages active:                            114788.
  Pages inactive:                          111624.
  Pages speculative:                         1301.
  Pages throttled:                              0.
  Pages wired down:                         99067.
  Pages purgeable:                          11340.
  "Translation faults":                 340573628.
  Pages copy-on-write:                    8586888.
  Pages zero filled:                    184635739.
  Pages reactivated:                     62859723.
  Pages purged:                          12373577.
  File-backed pages:                        88759.
  Anonymous pages:                         138954.
  Pages stored in compressor:              645107.
  Pages occupied by compressor:            127459.
  Decompressions:                        62433647.
  Compressions:                          82841473.
  Pageins:                               10295559.
  Pageouts:                                177162.
  Swapins:                               16692043.
  Swapouts:                              17670838.

  > top -o faults
  PID    COMMAND      %CPU TIME     #TH    #WQ  #PORT MEM    PURG   CMPRS  PGRP  PPID  STATE    BOOSTS           %CPU_ME %CPU_OTHRS UID  FAULTS    COW     MSGSENT    MSGRECV    SYSBSD     SYSMACH
  533    WindowServer 10.5 06:21:59 21     5    2792- 876M-  209M+  298M   533   1     sleeping *0[1]            0.17876 1.03550    88   24771383+ 131690  354813610+ 136121938+ 237020876+ 554000668+
  2862   Safari       0.0  62:48.95 10     3    7051  480M   6400K  316M   2862  1     sleeping *0[37332]        0.00000 0.00000    501  13919243  76306   67003396   20901240   54405367+  167230473
  2883   com.apple.We 0.0  16:36.04 92     3    926   393M   384K   301M   2883  1     sleeping *19137[3734]     0.00000 0.00000    501  4032470   132     7204377    3215767    45641766+  32182159
  491    mds          0.0  11:00.86 5      2    422   66M    0B     52M    491   1     sleeping *0[1]            0.00000 0.00000    0    3296694   154     6396987    1450677    27494382   5594171
  792    mds_stores   0.0  14:00.57 4      2    93-   72M-   16K    61M    792   1     sleeping *0[1]            0.00000 0.00000    0    2786911   1956    4619344+   1304164+   15524959+  4296749+
  2694   Terminal     7.6  03:17.73 8      2    311   303M-  37M+   104M-  2694  1     sleeping *0[6352]         0.85412 0.15218    501  2034254+  338     1151091+   265791+    1517195+   269400

I'm at 1.32TB on my almost 1 month old MBA (8GB RAM/512GB DISK).

I just upgraded to the M1 Air. I was on a 2011 MBP, but I started having so many issues with it being deprecated and out-of-support that I finally caved. I also thought about waiting for the M2, but honestly who knows when that will launch, and what those laptops will look like. The M1 outperforms far beyond my expectations, and has some serious benchmarks that made me realize that I didn’t make a bad decision in pulling the trigger on it.

I think I wanted to wait for the M2 because I had FOMO for the next generation, while also thinking that the M1 was gonna have a bunch of weird bugs. If anything there are known limitations (like with external displays and booting from external drives), but I don’t really fall in those categories so I was okay with it.

If I were you, as long as you’re not in a rush to upgrade, just wait and see what the M2 is like. If you can’t wait, know that you’ll be in excellent shape with the M1.

I’ve been slowly transitioning away for almost a year now. And I was all in on google products and services.

I got rid of my android, switched to iPhone, was gonna go with protonmail, but went with Hey instead and I have zero regrets, Hey is awesome! Cancelled my YouTube premium/music subscription and switched to Apple Music.

Recently I’ve been going through my password manager and updating accounts and services to use my new email address. I’ve almost completely transitioned away. I’ll still keep my google account for stuff like my Stadia games (and tbh Stadia is actually pretty good), chromecasts, and my nest thermostats, but when we move I’ll probably leave them with the house.

Unfortunately there isn’t really any good neutral replacements for email + calendar + contacts, etc.

They do exist, but I just found switching phone ecosystems easier than anything else.

> "One exception to this that I've found is when someone already has plans for getting rid of someone and just needs the "ammo". At that point, they will quickly become your "friend" in order to get all of the dirt on that person, and then once the deed is done, it'll be like you never existed to them."

This one hits hard. I was just a developer at the time, but I had a co-founder get really chummy with me, and I eventually discovered it was for exactly this reason: to get "ammo" against the CTO to force him out. I got fired shortly after the whole situation played out.

I have a early 2011 MBP on High Sierra.

I recently reported a bug to Mozilla that I was experiencing in Firefox. They couldn't reproduce it, but it was essentially the integrated graphics are so old in this machine that their new render engine was causing major glitching issues. The solution was to hard code the use of the previous engine for older laptops.

This, among a number of other issues made me decide to recently upgrade... but hearing about these old-but-new features makes me want to cancel my order and wait it out a bit longer.