felixhammerl

I was like "wow, I haven't seen a considered harmful article in a while, the quiet must be ancient", the I saw the author and it made sense.

When he says something, it's usually worth a listen.

Reminds me of Doggerland: https://youtube.com/shorts/Afwxk4peYys

Thanks for the info!

The first problem was to get the original file from somewhere in a usable format, then strip DRM in a later stage. Seems like step 1 was already made significantly harder now.

If your app has to display stuff, you have no code kits available that can help you out. No vibe coding needed.

If your app has to do something useful, your app just exploded in complexity and corner cases that you will have to account for and debug. Also, if it does anything interesting that the LLM has not yet seen a hundred thousand times, you will hit the manual button quite quickly.

Claude especially (with all its deserved praise) fantasizes so much crap together while claiming absolute authority in corner cases, it can become annoying.

For those with an old Kindle, couldn't you download it onto the Kindle and then pull it off of there via USB?

In the news we seem to have reached Schrödinger's AI: Too dumb to do anything properly, but coming for everyone's jobs due to being too powerful.

Did anyone figure out how to handle two fundamental problems of MSRs yet?

1) Molten salt is corrosive as hell and will chew through your pipes.

2) It can't be serviced. If it ever shuts down and solidifies, it cannot restart.

Even the most massive hacks or breaches or cyber attacks barely put a dent into any reasonable business. One or two news cycles and a management rotation, that's it. Okta? Target? Equifax? Capital One? Uber? Even Solarwinds for crying out loud.

Everyone does enough to not be accused of gross negligence, but really I have not seen anyone pay more than lip service. And I don't blame them. No matter how much this hurts to say as a security professional.

"thousands of dollars every day" does not a negative reinforcement make. That us not even a rounding error for even mid sized companies.

There are so many half baked takes, but this is my favorite:

> There will always be a market for stable-over-latest software, especially for businesses.

That market is called the nvd.nist.gov at best and 0 day brokers at worst. Why do people stil not accept the fix forward supremacy and patch their mess?

Apple Silicon truly is phenomenal for dev stuff. But gaming ... oh well. And you obviously can't heat your room with them, so your feet may feel cold. ;)

Wife uses a mid-2013 Macbook Air as a daily driver still after >10 years, works in academia. What happened is simply that CPU stopped being the thing that made stuff slow, so a mid-2010s upper midrange can still hold its own today, ssd was already good then, and memory plateaued around 8gb for entry level machines some 5 years ago. So as long as your thermals don't suck, your ssd doesn't smoke out, and your keyboard holds up, you can still use these machines today. If you maxed out memory then, that is.

let me blow your mind with "the lazarus heist" podcast: https://www.bbc.co.uk/programmes/w13xtvg9/episodes/downloads

Spiekermann said it best: Don't work for assholes. Don't work with assholes.

https://www.creativeboom.com/uploads/articles/a3/a3e652c7fa0...

BuT YoU ArE UsInG cat AnD dd wRoNg!

So?

This comment was brought to you by someone who never produced/maintained software that had to withstand a 24/7 onslaught of automated exploit kits and port scanners over an extended period of time.

VCs offer bad advice, because most of them are successful not because of the ruthless elimination process that is a startup, but despite. Meaning that they have no idea why they are successful. Take this example: Let's take 10 identical startups with identical traits doing the same thing in 10 places of the US. Some die because they burn money quicker, b/c SF salary is expensive. Others die because they are in rural US and don't get exposure to the right people. Or they succeed because lower cost of income allows for longer runways so they are still alive at the right time, as opposed to the SF startup. Or they might have a neighbor who knows someone who knows someone.

All of those that make it in the end will think they made it because they were smart and hard working and what not. Truth is that hard work and smarts are the lower entry barrier of success, not what takes you all the way to the top.

But then again VCs are mostly self-congratulating morons who will attribute their success to anything but luck.

Case in point: Anything from Sam Altman or Paul Graham.

Especially with the UK out of the picture.

That is a good example of a misdirection play, a polarizing discussion point that political opponents get hung up on, which you never ever intended to actually pass, and you'll happily drop it later, but it helped relieve political pressure from other potential hot topics. We see typical conservative tactics being employed against the conservative base :)

Google knew that what they might be able to claim had a very shaky legal foundation, not even taking the public backlash into account. But there is a big difference between taking a picture and taking billions of pictures, analyzing them, and putting them into a publicly accessible database. German courts are not at all dogmatic in the way they interpret the law, because a law written long back might need to be reinterpreted today in the light of new technologies or societal developments.

I find it strange that folks in the US and UK, given that these are championing modern dragnet surveillance, would recoil at the idea of government issued ID, thus forcing everyone to come up with error-prone workarounds enabling identity fraud. As a German, the idea of a bill proving anything at all is just wild.

Please stop using GPG for SSH with your yubikey. Everything you need is baked into openssh 8.2. Check the "Using resident keys" section: https://www.yubico.com/blog/github-now-supports-ssh-security...

Unrelated to the Linux kernel, there is a good example of how Mario Heiderich (probably the most knowledgeable person for XSS on the globe) purposefully introduced an XSS vuln into AngularJS through a patch after (!!!) checking it with the relevant authorities and even then it was a close-ish call: https://m.youtube.com/watch?v=wzrojHHyQwc

this kind of stuff belongs into #iam14andthisisdeep

exactly. the passphrase for the private key isn't touched. the >24 chars passphrase is used for the symmetrically encrypted pgp message.

wtf tls? it's not about transport. it's about us not being able to read shit b/c you encrypted your key. i don't want your plaintext keys, so to prevent the nsl thing from happening.

also, nsl? we're german. meh. ;)

"trust us" sucks. period. we can agree on that. https://blog.whiteout.io/2014/06/12/how-we-operate/

we're trying to move away from storing stuff on our servers. more on that soon.

why pbkdf2? here's why: http://www.w3.org/TR/WebCryptoAPI/#pbkdf2

the chrome app will run both on linux and mac os. and windows. and the chromebook. same does the web app. one of the marvels of the modern web :)

you are mixing two problems:

1) libraries are often too complex for the avg dev: well, crypto is complex and there is rarely a one-size-fits-all solution. however, there are high level APIs that address your issues in openpgp.js (https://github.com/openpgpjs/openpgpjs). problem is that a lot of people try to roll their own crypto if the library does not offer those high level #box() and #unbox() functions. and THAT is a real problem down the road.

2) lack of empathy is really a big problem, which I've articulated here: https://blog.whiteout.io/2015/01/29/why-alice-has-a-problem-...

we're using and contributing to openpgp.js and so far this has worked pretty good for us, because it provides a sane API, properly documented, coherent code style, CI tested. here's a snippet for decryption and signature checking in Whiteout Mail: https://github.com/whiteout-io/mail-html5/blob/master/src/js...