markovbot

Well obviously it's redacted, but presumably this is the full redacted report, which is what was supposed to be released today

Not in the least.

What software do you use to do that?

How do you prevent a user who is not aware of the consequences but following directions from something they trust from doing it?

I get these once or twice a year, meet the minimum spend, use the points and cancel the card. Repeat after 6 or more months as a "new customer".

Except they don't see cameras. I've started pointing out surveillance cameras to my more normie friends, who are frequently surprised.

their users

Or by not having a facebook, obviously. If you have one, you're part of the problem :)

>The owner of this website (www.lowtechmagazine.com) has banned your IP address (x.x.x.x).

Anyone else getting this? I'm just going to read it on archive.org but it seems weird. I'm coming from a Digital Ocean NYC IP

I can edit the comment to be less snarky if that helps...

So the marketing emphasizes the privacy aspects of this device, yet in the comments (not noted on the website), you state that it has "no security whatsoever". This seems like an important disclaimer that should be given on the website.

So it says all over the site that it says it's open source, but I can't find a link to the source code.

Why are there embedded Facebook and Google tracking scripts in your site about a supposedly privacy-focused phone?

The website doesn't the website have https.

I see a lot of claims of privacy focused and openness on this page, but not a lot to back those claims up.

EDIT: So I guess the source code isn't available, so I'll have to ask here: how are phone calls on this oh-so-privacy-focsed phone secured? It says VoIP, does that mean it's SIP? Does the SIP use TLS? Is the TLS verified? is the media encrypted? Is it end-to-end encrypted? What encryption is used?

could you be more specific? Why is this junk? Why doesn't it belong on HN?

>Using the open source tool IPlocation.net, "I learned that the IP address resides in the Slovak Republic," Madrone writes. "Using other open source tools, I confirmed that the geo-location was the Slovak Republic. Also, I confirmed that this IP address is reserved for that provider based in the Slovak Republic. Based upon this investigation, as well as my training and experience, the complaint sent to Cloudflare regarding CodeIsFreeSpeech.com did not originate from the New Jersey Office of Attorney General or its Division of Criminal Justice."

Does "open source" mean something completely different in this context? iplocation.net doesn't seem to be remotely open source...

Who do you use instead? I'm really disappointed by their IPv6 support and undocumented egress firewall rules, but found other providers to have their own set of problems. Would love suggestions.

Nope, didn't mean to imply there was! GitLab certainly seems to have replicated a lot of the good ideas from GitHub, I just wanted to point out that it now seems to be going the other direction as well.

Oh my bad. Point still stands.

>Install the plugin for your editor, see metrics on your personal dashboard

So it seems like the "personal dashboard" is part of a SaaS product, meaning all of the metrics about how I work and operate are uploaded to a 3rd party server?

No thank you

I'm assuming this is a response to GitLab's concept of a WIP merge request.

Last i checked, they still issue a single IPv6 address to each droplet (eg a /128, not a /64) and silently block certain ports on IPv6, so no.

From what I can tell, the telcos are implementing it, or at least say they are:

* "Caller Verified is T-Mobile’s implementation of the STIR and SHAKEN standards" [0]

* "Verizon reiterates both our commitment to deploying the STIR/SHAKEN call authentication technology" [1]

* "Sprint supports efforts to build the SHAKEN/STIR call authentication system" [2]

* AT&T doesn't seem to mention STIR or SHAKEN by name on their robocall page [3] but the FCC sent them a letter thanking them for their "commitment to implement a robust call authentication framework in 2019" [4]

* "Comcast is proud to be at the forefront of efforts to address the scourge of illegal spoofed robocalls in this country, including the development of the end-to-end call authentication protocol known as SHAKEN and STIR" [5]

etc

[0]: https://www.t-mobile.com/news/caller-verified-note9

[1]: https://ecfsapi.fcc.gov/file/1119062987519/2018%2011%2019%20...

[2]: https://ecfsapi.fcc.gov/file/1091391175368/Sprint%20Call%20A...

[3]: https://about.att.com/sites/cyberaware/ae/robocall

[4]: https://docs.fcc.gov/public/attachments/DOC-354933A2.pdf

[5]: https://ecfsapi.fcc.gov/file/111974588343/Comcast%20Resp%20t...

that sounds like a feature, not a bug. Cold calls, even without spoofed caller IDs, should be a fine-able offense.

Cool, thanks for the info. Any idea what the timeline on creating that CA is?

Right, I didn't mean to imply that this action by the FCC was in any way wrong. The fact that caller ID is completely unauthenticated in 2019 is horrifying, and regulation is long over due.

So the article doesn't seem to mention any of the ongoing efforts to stop or reduce caller ID spoofing, such as SHAKEN/STIR. I'm not clear if that will do anything, and it's certainly far too little too late, but the industry is doing something.

On that note, does anyone know how SHAKEN/STIR is supposed to work? I understand that it basically sets up a PKI with JWTs in SIP headers, but from what I can tell there needs to be some sort of trusted CA which creates and signs these things, but I can't tell who that CA is or if there even is an agreed upon central CA.

I'd also be interested in any corrections/expansion on any of the things I said above, I really don't know much about it and would like to.

edit: after making this comment I did a bit more research, and it looks like[0] there will be per-country CAs that can issue certificates to owners of phone numbers within that country. I'm specifically curious about which CAs will be trusted in the United States.

[0]: https://tools.ietf.org/id/draft-burger-stir-iana-cert-00.htm...

A better comparison would be homicide vs vehicular homicide: it's got a different name when done with a different medium

It doesn't have to be. Could start by allowing website authors to opt in via a tag in the <head> or something, then opt out on a per-link basis with an attribute (eg preload=false)

...unless it's been widely rolled out already. They just need to make sure that it doesn't fuck up during initial testing.

I've voted in every election I since I turned 18 and nothing seems to have been done about this and many other things. But issues that megacorps care about happen right away.

Voting isn't a real solution to unchecked corporate lobbying.

I think the point is that autoresponders will autorespond to legitimate business emails as well as phishing/scam/whatever other emails.