nullpage

Reminds me a lot of William Landgren's work[1], another young blender animator. Definitely inspired by Ian Hubert's work. Either way amazing work!

1. https://www.youtube.com/@landgrenwilliam 2. https://www.youtube.com/@IanHubert2

University of Twente in the Netherlands has a great websdr[1] running some custom hardware that can tune into pretty much the entire shortwave spectrum. I've spent countless hours tuning in to various European radio stations and broadcasts (you can even pick up the odd number station if you are on the right frequency and get lucky with timing).

[1] http://etgd1.ewi.utwente.nl:8901/

My local makerspace[1] for sure.

1. https://protospace.ca/

I've enjoyed playing around with this product, but I wish there was a tier between free and pro that added infinite drawing without such a steep price. I'm not really interested in the sync stuff, but would happily pay a little to add infinite grid to the features otherwise included in the free tier.

From what sparse info I can find, it appears ground > sat > ground comms will be encrypted in some fashion so listening with an SDR and doing anything meaningful with the data might be hard, but I'm curious if there will be opportunities for it to be abused for anonymous downlink connections like the Turla spyware group used to do (https://arstechnica.com/information-technology/2015/09/how-h...)

Rapid7's project sonar forward lookup database is a good start. https://opendata.rapid7.com/

Mostly just a toy to learn some AWS/Serverless and security stuff, but a tool similar to burp collaborator for dns / http canaries tied into a slack bot. Essentially request a new canary url, you get back a unique endpoint such as 123456789abcd.detect.domain.com, and any time there is a DNS request or http request of any kind to that canary url it sends a message to a slack bot with relevant info, and includes some geoip data and a static map image of IP locations (via mapbox static image api). Considering doing my own plugin for mitmproxy (similar to burp collaborator everywhere) that can be useful in looking for ssrf vulnerabilities. A couple tools out there that do this, kind of just wanted to build one myself for the learning experience.

While 10./192. private addresses in IPv4 were in largely designed to help deal with address space exhaustion, they also are important because organizations can use them without having to own the addresses or register them in any way with IANA (or equivalent) since they are not publicly routable. IPv6 still maintains this feature with unique local addresses, and the entire fc00::/7 address range in IPv6 is allocated to private networks and is not routable on the public internet (not that AWS uses these, any IPv6 address they assign to you is a globally routable address). A lot of stuff just still doesn't support IPv6 yet (RDS for example https://aws.amazon.com/premiumsupport/knowledge-center/rds-i...) so you're options are to either give that endpoint a public address and manage your security groups well, or give it only a private address which gives you the added benefit of the endpoint not being publicly routable (which is a nice second layer of security beyond security groups), downside being the things that need to talk to it must now also live in your private subnet, hence Lambda launching in a VPC.

Sorry I didn't intend it to be a gatekeeping thing or trying to define who isn't or is a professional. I apologize it was poorly worded.

I think a diagram better explains what I'm trying to say.

What I feel like Apple's target audience was in the past with their 'Pro' lines:

https://imgur.com/a/ydLdE

What I feel like Apple's target audience is now with their 'Pro' lines:

https://imgur.com/a/dGI9R

It still meets the requirements of a lot of professionals, and a lot of professionals are still going to use them. I'm not trying to say 'whether or not you are a professional is directly related to whether or not you use a macbook pro'. It is just that apple seems to be slowly targeting their "pro" lines more towards the consumer who like pro stuff side to capture more of that market than they are trying to move toward the professional side to capture more of that market. Instead of getting more ports and longer battery life at the sacrifice of weight, we get things like the touchbar and ever thinner machines that have trouble living upto the battery expectations. For a bunch of professionals that doesn't matter, it isn't what makes a macbook pro fit their requirements. But there seems to be a very vocal segment of professionals who sit on that left most edge concerned that what apple calls 'pro' is moving further away from meeting their requirements than closer.

Edit: it might be more clear to say the green circle is people who find a macbook pro to meet their requirements.

I'm not in any way saying that a macbook pro (or any 'pro' thing) can't/shouldn't be used by professionals, or that people that use them are not professionals. It is just that I find more often than not when 'Pro' is used to market something, the primary audience appears to be consumers that want have a pro feeling, regardless of whether or not it was designed primarily for the requirements of a professional. If you are a professional and a Macbook Pro fits your requirements, great! It just feels lately that the 'Pro' moniker doesn't mean it is specifically designed with professionals in mind as the primary audience.

My rule of thumb lately has been that if something is marketed as 'Pro', it is usually intended for average joe who wants to feel pro, not to meet the requirements of people that are actually professionals.

"The critical firmware flaws came to light last year in an advisory that was sponsored by an investment that was betting against the stock of St. Jude, which was formally acquired by Abbott Laboratories in January. In the two days following the disclosure by investment firm Muddy Waters, St. Jude's stock price fell 12 percent. At the time, St. Jude issued a statement saying the Muddy Waters report was "false and misleading.""

This reminds me of the plot of Casino Royal where the villains short the stock of an airline / airplane manufacturer, then attempt to blow up the plane they are showing off to force the stock to sink. That is some questionable ethics, then again the investment firm is called "Muddy Waters" haha.

Curious about your home setup, what ISP are you using at home that lets you have essentially a /25 block of public IPs, let alone 40GbE of bandwidth? Especially if this is costing you $500/month.

This reminds me of the Halo series lore:

http://halo.wikia.com/wiki/Offensive_Bias

http://halo.wikia.com/wiki/032_Mendicant_Bias

Perhaps this has some clues as to how the SMS code was intercepted:

https://www.theverge.com/2017/6/13/15794292/ss7-hack-dark-we...

It is some tech out of GE Digital that, from what I understand, uses sensor data + machine learning against a digital representation of the system to predict failures and tune performance. A friend of mine just recently took a job at a start-up using this technology (https://veerum.com/about/), however I haven't had a chance to catch up with him and really understand how this stuff works.

There is some more information here: https://www.ge.com/digital/power-digital-twin

https://www.ge.com/digital/blog/rise-digital-twins

Totally, but they could just spin it to the consumer like TV cable packages. "Get our Internet 'Social Media Plus' plan for $100 / month, featuring blazing fast speed to our premium partners Facebook, Twitter, and Reddit! Use a corporate VPN from home? For an extra $10/month add on our VPN Pro PLUS package to get ultra fast connection back to your office!

terms and conditions apply, all other internet traffic is at speeds of up to 1mb/s"

It is far fetched sure, but I honestly wouldn't put it past some ISPs to attempt something super lame like this.

> home ISP, who only gets to see an encrypted pipe

Until your home ISP that doesn't care about net neutrality just decides to throttle your OpenVPN encrypted pipe and make it useless, they don't need to see what is inside of the encrypted pipe to fingerprint it as a VPN tunnel.

I believe this is part of it https://arxiv.org/pdf/1608.06344v4.pdf

Thanks for the archive link, can also confirm that actual link doesn't work on my Shaw Canada connection either.

A poorly implemented design decision then (which they turned off on AWS back in 2012 due to exactly this happening to many people). https://forums.aws.amazon.com/thread.jspa?threadID=101218

There was no way at the time for me to a) see that I had a second account associated with my email address or b) reset the password for the second account without going through support c) merging the two accounts into one even with supports help.

There was this awesome bug with AWS a while back too where you could accidentally sign up an account twice with the same email address, but no way of knowing you had two accounts without paying really close attention to your account ID. So if you went to log in and used your email and one password, you would sign into one account, but if you used the same email and a different password, you would sign into the second account (who knows what would happen if both accounts had the same password). Anyways a couple years ago I signed up for an AWS account to mess around with the free tier (doing a pluralsight course I think), and after a bunch of messing around didn't touch it again for a while. A year after I was going to use AWS for something and forgot I had already setup an account earlier (or thought it was on a different email or whatever), and managed to sign up for a second account with the same email address (which now became the primary account). Continue down a few months and I start getting billing emails for a few dollars a month but could not figure out why (and the invoice wouldn't show up in my AWS console for that email address). After digging I realized somehow I had two AWS accounts one the same email and the bill was on the other one, but I couldn't log into it as I didn't remember the password, and doing the password reset would just sent me a reset for the second account. It took a tonne of back and forth emails with amazon support to get it fixed and gain access to both accounts, the charges ended up being for having a few VMs created (but stopped) and my free tier ran out so it was billing me a few dollars for storage a month. I haven't really touched AWS since after that because the billing can be so obtuse if you aren't paying very very close attention.

Having just watched Spaceballs this is the first thing that came to mind haha.

It is a little more complicated than that. If you start doing MITM on https connections where pinning is involved, typically those sites / apps will just stop working as they don't trust the CA for the cert that is injected during the MITM. So yes it 'protects' you, but it does so by not letting you access that page / app. Chrome (and I'm sure most other browsers / apps) can have their pins overriden by user installed root CA's (which is what they are pressuring people to do in this scenario).

You can read more about how Google does certificate pinning here: https://www.imperialviolet.org/2011/05/04/pinning.html