bill_mcgonigle

I actually didn't consider this advantage when I switched from Digicert to LetsEncrypt.

Wow.

That was highly entertaining, thanks for sharing.

New take on tokenmaxxing as a hobby.

Glad to hear it.

Many folks believe Google has been pressured to move towards allowing no packets on the Internet without an attached government ID. Real open source communities are in the way of the AI Surveillance Police State.

That's pretty crazy with today's expectations though I remember touring a physics lab c. 1990 and they had just gotten a Mac IIfx maxxed out with options for $14K. Which was more than a typical new car price at the time. It was monitoring and data-logging a tokamak so I think they had a DoE grant. I hoped I'd own a 64MB machine one day to do some real serious computing! Now my email reader needs 4.2GB resident. :/

Make a commitment to forbid lethal use of this service and I'll subscribe for backup/disaster preparedness.

It would be a huge selling point over the competition which is allegedly being used in terroristic attacks.

Algorithm: one (or a group of) terminals reaches altitude headed from one warring region to another. Disable its transit data, keep watching telemetry. A single modest modern CPU could process the data stream from millions of devices, though it probably makes sense to have a coprocessor at each downlink location, with minimum handoff data near hextile boundaries.

Hopefully nobody in the criminal underworld has figured it out on their own.

Do you believe the mitigation would be difficult to engineer? If, say somebody else, publicly disclosed the unmasking technique how long would you guess it would take Apple to implement a verifiable fix?

For those wondering this gives full system compromise to an authenticated user with permissions to edit the firewall, AIUI.

Nasty but I was expecting a remote unauthenticated attack at 9.9. Hopefully you don't allow admin on WAN!

Thanks for finding the bugs and writing about the design pattern problem, HackerAsk.

I was always fascinated by the visual effects you didn't know were there. The obligatorily twenty minute CG battle at the climax of a Marvel movie bores me but when Ellie hears the signal from Vega and is racing her truck back to the office past the giant radio telescopes the mountains in the background aren't real. Why? Because Art, that's why.

I think this is why AI Slop is so pervasive. If the tool were used properly you wouldn't even know it was there. It's possible some curl bug report was discovered with responsible use of ML but now such reports are disallowed, and for good reason. Though if used responsibly who would know?

There was always that kid whose book report was obviously from reading the back cover; today he's in a corporation trying to get someone else to do his work with an LLM. Not a new strategy, unfortunately.

I haven't heard of this package personally and it's not on my desktops so it must not be pulled in by any of the task- desktop environment metapackages I use. So you probably have to go looking for it.

I really don't care about this package or protest but what might be more interesting to consider is what if this were in a default package and what if the affected locales were different?

If I make a list of all the countries who have recently been at war or are currently engaged in hostilities or have ethnic animus towards each other and just choose to taunt them all, that would really be a dick move and it's probably OK for Debian to drop the package. FWIW I'd rather see them adopt a kindhearted fork than override an author/ maintainer when possible.

If there's no special pleading for the ru/ua conflict then it's not too concerning.

This is a neat idea! We are way too ossified in some of our interface paradigms while also having thrown out science-based best practices hard-won in the '90's.

The scenario you describe is already a disaster, though! Who let that slip through? Replying to a message should create an idempotent context that can't run away from you. "What a mess!" as the kids say.

I'm not a user of smart earphones but lots of things like that should be on the table. Decades ago we were waiting for small cheap cameras and CV to do focus-follows-gaze and just kinda forgot about it when the stack arrived.

There are more "pinch to zoom" type revolutions available to those with a studious HCI methodology. Even Academia seems to be chasing "latest craze" development now, not fundamentals.

I hope your experiment succeeds!

We welcome the Nordics with peace and brotherly love.

Left/right doesn't matter much for a no-logs VPN.

Up/Down (authoritarian/libertarian) is what matters there.

If he has high allegiance to the extant power structure then promises should be questioned.

If he is for radical decentralization and antiwar then I'm more likely to trust promises made about privacy and autonomy.

Then there's international confusion about left/right. Scandinavia is known as a good place to run a business because businesses regulation is much lighter than places like the US which are heavily regulated. In the US business regulation is "left wing" in Scandinavia it's "right wing".

We'd use a 14-dimensional vector for political positioning if we wanted to be studious but most folks are just looking for a friend/enemy distinction. Even many of the comments here looking to dump a well-regarded service if either "tastes great" or "less filling" is confirmed. The false dialectic as means of control and all that jazz.

It's in its awkward teenage years stage now.

Pretty soon the AI will tell your father things that are more difficult to disprove and it will be done the same way "news" and Wikipedia do it - telling you how to feel before telling you what happened, reporting only part of the story, and not covering most happenings at all.

Now is the time to teach your circle psyop avoidance skills. Or build an honest competitor (if it were allowed to exist - Marc says only three will be permitted to exist).

Pay attention to these warning signs. The Prussian System puts tremendous social pressure on many girls. Outcomes can be tragic. Those girls often do well in different schools. Boys mostly fail to learn and get punished under the Prussian System but they tend to suffer less social pressure. If a book about prison makes you think of your school something is very wrong.

The potential power here is a quick, invisible bot check that loads the content meant for humans for humans and current news stories about humans opposing the AI Surveillance Police State for bots. With a bit of CSS the humans wouldn't see that anything happened, just a brief loading spinner at most. If anybody prototypes something like this please post about it.

I sure hope nobody is doing this with pacemakers or flight control software.

And why does this essay's type style change dozens of times? Who is that helping? It's like a cut and pasted ransom note.

Not sure if he'll succeed but it seems really positive that he feels the business environment there is strong enough to give it a try. Kudos for the implicit thought leadership here. Distributed success is where we're going.

I had a brief conversation with a family member's provider about this recently. She hadn't considered that fly-by-night SAAS providers often have atrocious infosec and she had thought of it all as upside; her company had asked her to do it (with consent). The opt out was easy but no other patients had declined before. On the other hand, another provider's after-visit notes are always full of mistakes and need correction, which is fairly important in tracking longitudinal progression of degenerative conditions. We didn't even get into data backup SOP's, obviously, but on my systems I would need to take special care to ensure that production data wasn't restorable to a snapshot for at least two years, and it's hard to imagine folks who don't secure their S3 buckets are doing this right. "It's complicated." Third-party certification is likely needed.

Well if you wanted to compromise F-Droid you could target their build server's ME or a cloud vm's hypervisor.

To do a supply-chain attack on Google's SDK would be much more expensive and less likely to succeed. Google isn't going to be the attacker.

The recent attack on AMI/Gigabyte's ME shows how a zero-day can bootkit a UEFI server quite easily.

There are newer Coreboot boards than Opteron, though. Some embedded-oriented BIOS'es let you fuse out the ME. You are warned this is permanent and irreversible.

F-Droid likely has upgrade options even in the all-open scenario.

People today take the WIMP interface for granted and forget about the pioneers who invented it.

It's really sad to see desktop apps adopt hamburger menus and things that make sense on mobile but make life harder on a desktop built for WIMP.

Thank you, Bill! Some days I'd rather be using your interface.

What a nice writeup! Just curious - what kind of wire do you use to solder on the pins - enameled?

I wonder if they offer their customers source to keep the Busybox folks happy?

I was a kid in the 80's and would regularly see $5 interest credits on my meager savings, free ATM, free phone banking (don't laugh) and they even set it up for me that if I went below $20 in my checking the system would pull $50 from my savings. 1986 or so - overdraft fees hadn't been invented. After the dot-boom/bust The Fed "aggressively pursued ZIRP (zero interest rate) policies". Mortgages got much cheaper but fees replaced the interest income. Somebody is paying either way. It used to be the loan holders. I even remember my local bank having a stack of a hundred toaster ovens to give to anybody who opened an account. They wanted your business so you would do your loans with them. I quite preferred that America though it might be possible to argue that getting nickel-and-dimed everywhere is overall cheaper. But that was at the height of Americans' real purchasing power from wages and I'm disappointed that my kids had to grow up in the opposite environment. Maybe this will change before they will be shopping for a home. I read recently that real wages (purchasing power) were actually higher during the Great Depression. Soaring highs on the Dow don't matter much to people when all the productivity gains during that period have been transfered to financialized everything to make that NGU. The system needs to be stable for us to all benefit. "The Gini Coefficient is too damn high" as they say.

Check out your DNS stats too. Mine are up 500% YoY for no human reason.

Others, note that the new archive name is 'stable-security'. You might need to update your pins if you upgraded from Buster and you're not seeing the update now. I put in a pull request to add it to the release notes.

Thank you for not selling this to the "industry"!

Who says closed source doesn't have benefits?

WaPo called out NYT for fake news twice yesterday. This supports your argument - they both can't be right! They both can be wrong, of course.

You don't have to be faster than the bear, just faster than the other camper. Assuming the bear is just hungry, that is; if you messed with her cubs, she's coming for you specifically.

These are, of course, opportunistic targets and specific targets. Moving the ssh port helps with the former, but not the latter.

There is some economic cost with portscanning everything, but the bigger impact is that if you moved your ssh port you're more likely to also have turned off password auth and more likely to be running fail2ban and more likely to be running an IDS. Spammers don't want to deal with you making their livelihood more difficult. Poor spammers.

People who see brute force attacks chasing their port moves are probably specific targets. Ears up.

> Stripe would still keep $40

So you have to charge $1000 + ($40 * % of users who return + cushion) for the product. That means non-Stripe businesses can start to out-compete you on cost.

What makes it so that Stripe has such a unique position and can impact your costs and competitiveness to such a large degree?

> A small flat fee to cover network expenses would be more appropriate

That sure seems like the solution a free market in processing would settle on. Something is up.

> I'll ask our legal team if we can somehow contractually preclude ourselves from sharing this data in the case of liquidation or otherwise bind ourselves in a useful fashion...

Attack real problems on all flanks, but I don't think you can get an affirmative from Legal.

Do you have cryptographers on staff? The "technology as a contract" approach is to implement a homomorphic encryption technique to do your cross-site correlation without being able to unmask the individual who is using multiple sites.

That way you don't have to trust your users, customers, sysadmins, big-data people, LEO, OR creditors. Keep it as secret sauce, or even better, drop an open-source library on github to advance the state of privacy. I would like to be able to ask vendors, "why AREN'T you protecting users' privacy this way?".