You forget that big companies will gladly offer shit to their customers, but then will offer something better to those who are willing to pay more (id est, governments. Why make things more secure for everyone if not doing that can make more money?
5,702 karma · joined June 9, 2017
If Apple were seen to be subverting privacy at all, they'd lose literally tens of billions of dollars of revenue because they would no longer be a "premium" brand with offerings that truly differentiate themselves from every Android provider.
I trust that no company of that size would risk the most important thing that differentiates themselves from the whole rest of the world for the purpose of spying, making profit from tracking and advertisements, et cetera.
Your argument isn't far off from saying that Apple will collude with lots of security researchers, and because you're not invited to the party, nobody can prove that you're wrong. Oversimplification, yes, but basically true.
For instance, they appear to care about security issues that publicly embarrass them or that affect huge customers of theirs, issues that'd've been trivial to fix, instead of fixing issues for the sake of fixing them. This kind of "sales" based security and their responses have forced me to encourage multiple companies to use other vendors.
If that alone weren't reason enough to dismiss this, the article has marketing BS throughout. For instance, "SSH access to a server often comes with elevated privileges". Ummm... Every authentication system ever has whatever privileges that come with that authentication system. This is the kind of bull you say / write when you want to snow someone who doesn't know any better. To those of us who do understand this, this is almost AI level bullshit.
The same is true of their supposed selling points:
> Author fine-grained policy to govern who can SSH to your servers and through which SSH user(s) they can log in as.
That's exactly what ssh does. You set up precisely which authentication methods you accept, you set up keys for exactly that purpose, and you set up individual accounts. Do Cloudflare really think we're setting up a single user account and giving access to lots of different people, and we need them to save us? (now that I think about it, I bet some people do this, but this is still a ridiculous selling point)
> Monitor infrastructure access with Access and SSH command logs
So they're MITM all of our connections? We're supposed to trust them, even though they have a long history of not only working with scammers and malicious actors, but protecting them?
I suppose there's a sucker born every minute, so Cloudflare will undoubtedly sell some people on this silliness, but to me it just looks like yet another way that Cloudflare wants to recentralize the Internet around them. If they had their way, then in a few years, were they to go down, a majority of the Internet would literally stop working. That should scare everyone.
There are many, many applications for which performance isn't as important as cost and/or power draw. For instance, these days it can be cheaper to run an additional microcontroller close to where it's needed than it is to fabricate a wiring harness to bring sensor data all the way to a centralized location. RISC-V excels here.
It's a mature enough ecosystem that people can compile whatever software they want and run it without fuss on RISC-V. Nobody is going to buy a RISC-V laptop with a full GUI and be disappointed when it doesn't perform like a MacBook.
So if I can buy a small SBC with two ethernets and a few RISC-V cores that takes few enough watts they can be counted on a single hand for a handful of dollars so that I can make a hardware VPN device, and I can download and compile most software on it, that interests me. Processors like Intel's N200 have their uses and definitely more performant than RISC-V, but take way too much power and therefore generate way too much heat. So why would I even bother comparing? They're in different leagues.
TLS on a 33 MHz m68030 is passable. Since the i80486 should be closer in performance to the m68040, negotiation could take place inside of the timeout that many servers would have. In some ways it would be a good rate limiter since you'd likely only want to allow a single connection at a time.
I've often wondered about how to re-solve certain problems now that we have decades of hindsight. For instance, your BIOS doesn't boot from CDs or from large disks. So what do we do? We make a disk image (vnd on BSD and whatever the equivalent on Linux make this so easy) and install an old fashioned BIOS boot block. We have a small 40 megabyte or so FAT-16 filesystem (FAT-32 wasn't a thing until 1996), on which we have a kernel, such as NetBSD because NetBSD can still run on 486 systems without fuss.
The kernel, once loaded, knows how to access large disks, CDs, or even mount a filesystem over NFS. We then use that system to disklabel / fdisk the rest of the disk, format an FFS filesystem and swap, and install our OS. Simple, right?
But how do we get this image on to an 80486 system? We really shouldn't lose to history the kinds of tools that let us boot from floppy. NetBSD still can, even though it takes something like six of them.
Since the i80486 has no management engine, running an open source BIOS would make it fully, 100% open. Interesting... Will my next email server be an i80486 system? It's worth considering.
Port forwarding over ssh is still... port forwarding.
This is neat and can be quite useful, but it's still port forwarding. There's nothing wrong with that - it's not like people will easily guess the hostname and port number and will start brute forcing ssh using this.
But neither VNC nor RDP should ever, for any reason, be connected directly to the Internet, even if using a random port number. Use ssh with -L to connect to VNC or RDP over ssh.
Interestingly, the first more challenging program I wrote as a child was a prime counting program. Although I wanted a Jupiter Ace because I wanted to learn Forth, instead I had a Sinclair ZX80 with 8K ROM (and later a T/S 1000). With the speed of Sinclair BASIC, it'd've taken multiple years to count the first million primes, something that I use as a benchmark these days and which takes less than a second on an Apple ARM CPU.
I remember collecting counts to compare ln(x) with pi(x) and imagining how wonderful it'd be to have powerful computers that could give me the answers I wanted in seconds and minutes instead of days, weeks, months or years. I like to imagine Turing had imagined the same thing now and then :)
It's not that at all. If you report phishing / malicious content to them, you have a right to expect them to take action in a reasonable amount of time - not weeks, and certainly not never. This isn't a "right", this is a reasonable way to work on the Internet that's worked since the '80s.
Do they have a "right" to just ignore abuse complaints and host whatever they want, even if it's illegal, malicious or that violates someone's copyright, and to ignore all requests to take appropriate action?
As it is, I have to explain to people regularly that clicking on "sponsored" links, or whatever Google calls them, doesn't work because we have to block "googleadservices.com" due to their hosting of malicious Javascript payloads. Certain very large companies that are very, very privacy and security focused insist on blocking known malicious Javascript hosting services, and Google is no exception.
> where "64-bit" is immediately understood to mean x86-64 — because who wants a computer that can't natively run most applications made for a PC?
Huh? Sure, when people hear "64 bit", they don't think about Alpha, UltraSPARC or Power, but I don't think "64 bit" universally makes people think about x86-64, considering the ubiquity of 64 bit ARM CPUs in practically everyone's pockets. And "most applications made for a PC" has very little to do with whether something is 64 bits or not.
> the pure 64-bit architecture of Intel Itanium did not allow 32-bit (x86) applications to run natively
They were totally different instruction sets, so this had almost nothing to do with 32 versus 64 bit. The Itanic even had support meant to accelerate emulation of 32 bit x86, so if anything, Itanic would've performed dismally running 64 bit x86 code compared with 32 bit x86 or native Itanic code.
> Itanium landed with a thud in the market despite being among the first to the 64-bit punch
Itanic was late in the 64 bit world. Alpha, UltraSPARC, MIPS and even Power had 64 bit long before the 2001 introduction of the Itanic. AMD had already announced their spec and had development environments and toolchain support for x86-64 before Intel's Itanic release.
> However, the story of Intel Itanium doesn't quite end at the launch of AMD64/x86-64 in 2003 despite the obvious chilling effect. Itanium still kept support and was iterated on until February 2017, and shipments didn't completely halt until July 2021. For some fringe scenarios, Itanium was very performant and even ideal.
No. No, it wasn't. This tries to make Itanic seem like it was good enough to hold on until 2017, which is definitely not the case - Intel threw literally billions of dollars at the Itanic, but it really sucked. It never had any real edge over any of its contemporaries - not in raw performance, not in price per FLOPS or MIPS, not in aggregate performance. It was Intel proving that they're a one trick pony, which they still haven't figured out.
Aside from ethernet chips and x86, Intel has failed at everything - at embedded processors (Atoms have typically been woefully underpowered and have had reliability issues, like bricked Cisco routers), at broadband chips (see the Puma chipset debacle), at CPUs for embedded devices (even their modern "e" core devices like the N200 can't compete in performance per watt compared with ARM, and are too power hungry for anything you'd want to actually put in your pocket), at cellular chipsets, and so on.
Don't take my word for it. The Register does an excellent job of calling Intel out for their lackluster products and inability to compete outside of x86 (and problems competing inside of x86).
I should update my transparent proxy how-to to be used with MacProxy Plus...
Sure. However, Cloudflare hide and protect the "them". The information in WHOIS, in the DNS SOA record, in the network hosting the content, in the servers hosting the DNS, in the registrar's abuse contact, all say "Cloudflare". Cloudflare'll "pass along" a message for you and will happily refuse to tell you who actually owns the site.
What's more, even when you can clearly show infringement, Cloudflare doesn't take action to stop it, even though they both can and should. Not taking action when you're informed that something is illegal is facilitation. Entities that host are not liable for the content of their clients, but entities that ignore illegal activities aren't (and shouldn't be) protected.
So there's literally no other option besides suing them, even if you want to go after the party that's using Cloudflare to do the illegal thing. You literally can't unless you sue Cloudflare and get a court (that Cloudflare actually listens to) to force Cloudflare to reveal the party they're hosting and protecting.
I'm not sure how you think "you sue them, not their hosting provider" is relevant in a discussion about Cloudflare unless you really didn't know all of this.
Yes, putting rate limiting that's much slower than humans and CAPTCHAs that discriminate on to their abuse reporting pages just shows how much distain they have for people who want to report abuse.
I started having a huge problem with them ages ago when I reported that they were hosting a Bank of America phishing site. They took no action, and when pressed, they said that they couldn't take action because they needed to protect the site owners' free speech. Imagine that! Fraud, even when it's 100% obvious and blatant, is protected by free speech!
Right now, for example, a phishing site is hosted via Cloudflare at "schwabs-wild dot com". Cloudflare replied to a complaint about it in less than a minute and a half to say:
"We were unable to confirm phishing at the URL(s) provided."
Visiting the phishing site shows a site that's clearly trying to pretend to be Charles Schwab and that asks for a person's social security number as part of the login!
So are Cloudflare employees so dumb that they can't tell that this clearly is NOT legitimate, and are they so quick that they respond to complaints in literally a minute and a half, or has Cloudflare automated their responses for complaints like these because they've already gotten so many of them?
HN has a lot of Cloudflare users who like Cloudflare, so sometimes comments like these get downvoted, but I genuinely wonder how even CF fans could justify CF not only hosting blatant phishing sites like this, but also how anyone could justify ignoring complaints about this illegal activity. They clearly will continue to do it until there's more pressure, whether Charles Schwab has to contact them directly or there's a court order from a court they care about (certainly not a Moldovan one).
Cloudflare wants to pretend they're doing good for the world by offering things like DNS-over-https, wanting everyone to use it and telling us to just trust them when they say they won't do anything nefarious with the data that's made available to them, but so long as they pick and choose their judicial jurisdictions, why would the rest of the world want to trust them?
The author links to a piece about how "it's harder to be a man than a woman", which basically asserts (I'm generalizing liberally) that people are too weak to question social norms and are simply unwitting victims of what society teaches them. Perhaps what's discussed there can be applied to college enrollment.
If the issue, which the author appears to suggest, is that men can't help but try to be and want to be what they're taught and told they should be, then that leads to wondering what can be done about it. But so long as these masculine insecure men lean right, perhaps at least in part due to their inability to see beyond us-versus-them, and so long as it's socially acceptable to be right leaning, with all the implied racism, sexism, xenophobia and so on that go with it, things won't change much.
Growing up, I was staunchly anti-religion. Religions have done more to harm humankind than any other thing, yet we're taught to "respect" religion and religious beliefs, even when those religions support misogyny, war, slavery, pedophilia, et cetera. I saw through that and marveled at how hard it was for most other people to see through it. But now, in 2024, we (most of us) at least try to squelch our desire to punish the victims when they speak out, which is a start.
Perhaps it's time to do the same for toxic masculinity and right-leaning tendencies. Perhaps it should be socially acceptable to call men out when they're being assholes, to lean in to what they derisively refer to as cancel culture. Perhaps right-leaning beliefs should wholesale be called out for encouragement of unacceptance, particularly and especially when using religions as justification, while at the same time wanting those same religious beliefs to be "respected" because they include some good. Frankly, I'm tired as hell at the same people who want to punish immigrants and poor people saying that they believe in following Jesus, as though Jesus would say, "sure, send those needy fuckers packing".
It's not like men are nice and accepting when people toe the line. Let's lean in to being the assholes that "masculine" men already tell us we are.
People, usually businesspeople, consider adding some craptastic thing such as intrusive ads, to make more money. Who doesn't like more money? They add the thing, and revenue goes up!
What they don't see is the effect that comes when fewer people visit the site because they're too annoyed to come back over time. They see and take credit for the small increase, but of course they don't take credit for the gradual decline afterwards, a decline that often enough leaves the site making the same or less money than it did before the craptastic ads.
If people and companies took the bigger picture in to account, they likely wouldn't do these things.