HNHacker News
TopNewBestAskShowJobs

karma20

63 karma · joined August 4, 2019

Views expressed in comments belong to the author, and not necessarily to the author’s employer, organization, etc.
submissionscomments
karma20··on What does your ad/tracker blocking setup look like?
Firefox for iOS and macOS. I have strict tracking protection [1] enabled on the former, and NoScript + uBlock Origin set up on the latter. I also use Little Snitch on the Mac.

[1] https://support.mozilla.org/en-US/kb/tracking-protection-ios

karma20··on Show HN: I made a privacy-focused online journal
I like the concept but share some of the blockchain concerns here. In particular, I'm interested in how the Gaia "driver model" [1] is actually architected, and how this compares to local storage:

> Gaia enables applications to access [it] via a uniform API.

[1] https://gekri.com/privacy

karma20··on Ask HN: Why are pay-walled articles allowed on Hacker News
HN's policy on paywalls is outlined in the FAQ [1]. Private Browsing mode is generally a good workaround:

> It's ok to post stories from sites with paywalls that have workarounds.

> In comments, it's ok to ask how to read an article and to help other users do so. But please don't post complaints about paywalls. Those are off topic.

The rationale explained by dang in a 2015 post [2] makes sense:

> Publications like NYT, WSJ, the Economist, and the New Yorker have paywalls that leave ways for readers to work around them. Such stories are OK to post to Hacker News. Yes, this sucks, but the loss of many substantive articles would suck worse.

[1] https://news.ycombinator.com/newsfaq.html

[2] https://news.ycombinator.com/item?id=13434938

karma20··on Steam Windows Client Local Privilege Escalation 0day
HackerOne is a platform on which Valve runs a public program [1] that awards monetary bounties. I'm confused as to why Valve is allowed to forbid disclosure of "out-of-scope" reports and will only "generally" disclose reports in any case:

> Please note that we will not consent to disclose reports if they have been marked out-of-scope or inapplicable, or where Valve has not taken a specific corrective action / mitigation.

> Valve embraces transparency in our security. We will generally disclose the details of vulnerabilities found, upon request.

[1] https://hackerone.com/valve

karma20··on Basic Electron Framework Exploitation
Also of interest is the follow-on discussion [1] taking place on the electron/asar repo.

[1] https://github.com/electron/asar/issues/123

karma20··on Chrome 69 Is a Full-Fledged Assault on User Privacy
Qihoo has also employed dark patterns to push deceptive security practices around its own browser [1]:

> When you attempt to install other browsers, the 360 Safe Guards will allow the browser to be installed but will then popup saying not to let it become the default browser.

> When users of 360 Safe Guards run a check of their system, if they don't have the 360 browser installed it will give them a failing grade. If the user chooses another security software to protect their failing grade browser, the Safe Guards say no.

Also interesting is a statement by Opera on the 2016 acquisition [2]:

> The transaction would give Opera access to the extensive internet user base of Kunlun and Qihoo in China as well as the financing and other support of the Consortium that would allow for the full potential of the Company to be realized. At the same time, Kunlun and Qihoo would be able to cross-sell their products and services to the Opera user base, and benefit from Opera’s leading mobile advertising platform.

[1] https://web.archive.org/web/20150723081728/http://www.digita...

[2] https://arstechnica.com/information-technology/2016/02/chine... (can't find a direct link)

karma20··on Azure Security Lab: a new space for Azure research and collaboration
TL;DR: Microsoft bumps Azure max bug bounty to $40k, introduces Azure segregated hosts for researchers to test against, and formalizes their Safe Harbor terms [1].

[1] https://www.microsoft.com/en-us/msrc/bounty-safe-harbor

karma20··on Earn Premium Items in Popular Games for Exercising
Interesting concept. From the FAQ [1]:

> Login into Hero Trainer when you go for a run (gym check-ins will come in the future)

How would you calculate points earned for each run or gym visit? For the former, does the app rely on step count during the "tracked" period or does it incorporate outdoor GPS?

[1] https://hero-trainer.com/faq/

karma20··on Ask HN: The most useful Mac keyboard shortcuts?
TIL. I should check out Rectangle:

> Spectacle used it's own keyboard shortcut recorder, while Rectangle uses MASShortcut [1], a well maintained open source library for shortcut recording in macOS apps. This cuts down dramatically on the number of bugs that were only in Spectacle because of the custom shortcut recorder.

[1] https://github.com/shpakovski/MASShortcut

karma20··on Apple is Reportedly going to launch macOS and iOS bug bounty and
Interesting. From the source article [1]:

> [...] they would essentially be "dev devices." Think of them as iPhones that allow the user to do a lot more than they could on a traditionally locked-down iPhone.

It sounds like Apple might provide vetted researchers with development-fused devices [2]. In an official capacity, these have only been mentioned once - during a Black Hat talk by Ivan Krstić [3].

[1] https://www.forbes.com/sites/thomasbrewster/2019/08/05/apple...

[2] https://www.theverge.com/2019/3/7/18255509/apple-iphone-dev-...

[3] https://www.blackhat.com/docs/us-16/materials/us-16-Krstic.p...

karma20··on Cathay Pacific says it's monitoring passengers via onboard cameras
At least in part, the author seems to conflate 'collecting images of pax' with 'their usage of the IFE':

> Cathay confirmed it is collecting images of passengers while they're on board, monitoring their usage of the in-flight entertainment system (IFE) and how they spend time during the flight.

However, it sounds like Cathay are just using fixed cameras and not ones built into individual IFE screens:

> The airline said these images are captured via CCTV cameras fixed around the airplane and not from embedded seat-back cameras.

> Cathay's spokesperson said similar devices were not installed in its IFEs. "Our inflight entertainment systems do not have any cameras, microphones or sensors to monitor passengers, nor have they in the past."

karma20··on Self-XSS to Site-Wide CSRF on Twitter
For sure. It definitely echoes the thrill of bug-hunting when you know you’ve found something interesting but need to dig a bit deeper.
karma20··on Snap’s Secret Weapon Speaks
> It is fascinating how we are moving from traditional ads, as everyone has grown an automatic negative response, into these more subtle experiences.

Absolutely, and overlay AR sounds like their next step:

> Snap recently released zanily animated beacons called Landmarkers — the Eiffel Tower can pop like a champagne bottle for tourists.

Interesting that they've already tested this with an ad campaign [1] but don't want partners to dilute theirs IRL [2].

[1] https://variety.com/2019/digital/news/game-of-thrones-snapch...

[2] https://lensstudio.snapchat.com/templates/landmarker/

karma20··on What is the best tool for tracking todos, projects, meeting notes?
Todos: I use Trello with a handful of boards, most containing Getting Things Done style lists (Today, Tomorrow, This Week, Sometime).

Note-taking: I settled on Bear after trying Apple Notes, Evernote, and OneNote. While I can't search inside scanned docs, the UX is polished and syncing is flawless if you're in the Apple ecosystem.

karma20··on GitHub sued for aiding hacking in Capital One breach
Agree. This kind of DLP-like scanning is totally infeasible at GitHub scale.

In particular, one excerpt from the complaint reads like output from a noisy scanner that has detected “exposed SSNs” in client-side code:

> [...] Social Security numbers are readily identifiable: they are nine digits in the XXX-XX-XXXX sequence.

karma20··on Ask HN: What keyboard do you use?
Das Pro, brown switches. Picked one up to replace my aging daily driver at work (Magic Keyboard). No complaints here.
karma20··on Ask HN: How can we destroy AMP?
> Firefox Quantum: Developer Edition for browsing and web dev (bonus points for allowing extensions, e.g. uBlock Origin, in their mobile Android app)

Similar setup here, but recently switched back to iOS. It's a shame that extension support is impractical because of WebKit.