problems

Not exactly just against cheap gadgets - remember the Connexant keylogger from earlier this year? It seems to be a common thing for driver developers to log keypresses for development purposes yet fail to disable that functionality in release... easiest fix? Don't install closed source drivers for 3rd party hardware.

https://www.modzero.ch/advisories/MZ-17-01-Conexant-Keylogge...

So what's your suggestion? Just disable SELinux for that application if it's failing?

Stutters like mad for me, so bad that I closed it even though it seemed really sweet. Chrome and Firefox on Windows, recent i7 and higher end nvidia GPU.

It's not about what any individual person may say, but about what gets produced in the end. Pure HTML and JS tools like Bootstrap make it easy to crank out basic web templates for developers, while tools like Flash made it easier for designers to make beautiful toys.

Yeah, at this point in the game if it's not Android or iOS it's dead in the water. Spinning up another platform is likely difficulty to impossible - we've seen so many try and fail, Blackberry, Windows Phone, Tizen, Jolla, Ubuntu. It's a chicken and egg problem, to get more users you need existing users making apps and bragging about their device.

​

You're talking about both what burglars say they do and what affects the risk of being caught. Both of which have no impact on how burglars actually behave in the field. They may report the most ego-boosting thing they want to, but behave very differently. A better way is to simply compare crime rates in areas with CCTV to those without.

Studies like this one: https://journalistsresource.org/studies/government/criminal-...

That shows when CCTV is used, large, measurable drops in crime rate occurred in all circumstances tested.

See my comment here: https://news.ycombinator.com/item?id=15296354

I'd be interested if you know any shortcomings of these, so far my experiences have been quite positive, though I have only been running a Hikvision and a cheap rebranded one for about a month.

Biggest catch is probably software - you basically need a Windows box or VM for one-time configuration as ActiveX or proprietary tooling is common, once that's done you're all set and don't need to touch that tooling again, just monitor your camera via the standardized ONVIF and RTSP stream.

There's potential security catch too - I managed to dump the firmware off one and crack a telnet password, but I had to manually enable telnet and so long as you do not expose it to the internet, there's not much harm there. I've read about older cameras that had hardcoded default telnet passwords with telnet on by default and unable to be turned off, fortunately I haven't seen anything that egregious yet.

Overall, the shortcomings, while present are very manageable as far as I've seen. Definitely not a perfect "out of the box" experience like a Nest device will be, but cheaper, more flexible and more interesting to me as a tinkerer.

See my comment here:

https://news.ycombinator.com/item?id=15296354

Only catch with the Pi might be decode/encode performance if you plan to do anything with the video on that side of things, you'd have to have video software that can take advantage of hardware acceleration on the Pi.

Any cheap Hikvision or Dahua camera will usually support ONVIF. ONVIF is the key search term, if it has that it supports the standard open protocols and it'll work with most software around. Try searching it on ebay or aliexpress. Some of these do offer their own cloud too, but it's disabled by default on all I've tried so far.

A few samples:

https://www.aliexpress.com/item/2015-New-model-DS-2CD2135F-I...

https://www.aliexpress.com/item/4MP-Dahua-H-265-IPC-HDBW4431...

Heck, even my local computer store has their own branding of a cheap camera for a quite good price:

http://www.canadacomputers.com/product_info.php?cPath=37_498...

I bought one of these recently and it seems to be a Dahua based firmware, full ONVIF support and available locally is pretty nice.

Wow... that's quite a price tag. For ~$60 USD you can pick up a 1080p camera with quite good quality, nice Sony sensor and hardware H.264 with no mandated cloud connectivity - then hook it to Xeoma, Zone Minder, Blue Iris or similar software and automatically ship the latest motion detection results up to your favorite cloud storage platform or your own server.

I guess I'm probably not the target market for this though, but if you're a tinkerer there are some interesting options. And fun to be had in the firmware reverse engineering department too.

Makes sense, I guess I shouldn't really assume otherwise, that's how ARM is used these days. I hope we'll see some competition on the actual microcontrollers and stuff to push that price down further.

Nice. That's a big improvement in price over the previous ones.

I'm still a little unclear on RISC-V's goals - are they looking at the microcontroller market or are they looking more to offer an alternative for ARM and x86 CPUs?

In the microcontroller market there's a lot of competition right now, especially with devices like the ESP32 going for $8 with wifi and bluetooth.

Just ditch it - clearly the author has no regard for privacy.

I cringe just thinking about implementing something like that.

I know many high productivity Vim, Emacs and IDE users - but in terms of low productivity people, IDEs definitely dominate.

Really, not a jab at anyone, just that Vim and Emacs are more advanced tools and it takes more advanced users to use them with any gain. More advanced users also use IDEs for some of their nicer tooling - personally I'd kill without Resharper at work.

F-Droid has done a lot of work towards reproducible builds.

https://f-droid.org/wiki/page/Deterministic,_Reproducible_Bu...

Actually, in Signal more recently now you don't even get to confirm the new key, it just says "hey, the key changed" in the conversation text and keeps going.

I'm not exactly comfortable with this now - it seems like someone may be able to spam messages to hide the key change.

Yeah, just go ahead and use some random closed-source IM tool for your secure messaging - seems like a great idea.

Unfortunately, Apple being Apple - doesn't expose those new sensors in any APIs.

For now, yes, but it opens up the possibility of changing that down the line or for users to manually perform those updates.

Approximately zero - I mean, about the only things they've done is updating of play service stuff and some interesting malware detection techniques. They've (sadly) done almost nothing towards the goal of truly improving the update situation until now.

Hopefully somewhat more?

It's likely a logical first step in a larger push to resolve the update issue on Android devices.

I highly doubt anyone torrenting on their phone doesn't know what they're doing. It's not exactly a common malware C&C method, most likely users pirating stuff and playing dumb. Keep in mind, Android also has apps like Popcorn Time available fairly readily.

Have you not heard about Project Treble and the HAL separation efforts going on? Google is indeed trying to innovate here. With Android 8 at least, the situation should improve - it might take some additional enforcement through Play agreements and such to really get it locked down though.

What they're doing with Android 8 is making it so that the HAL is separate from the OS and the OS is then upgradable outside of the HAL. This should mostly resolve the issue, assuming they enforce it with the Play agreements.

On many Android phones you can legitimately unlock your bootloader and load whatever software you please.

F-Droid does support this fully automatic app installs and updates, see:

https://f-droid.org/wiki/page/Installing_F-Droid_as_a_system...

https://f-droid.org/wiki/page/org.fdroid.fdroid.privileged

If you say "most people won't bother" - that's true, but most people will gladly tick the unknown sources box too for pre-release or pirated apps already.

Funny part about this is that Daily Stormer has hosting, DDoS protection and DNS service even a registrar now (Bulletproof.ai), but they can't find a TLD that won't censor them.

On Android you don't even need to hack anything to install the Gab app, just tick a box in the UI and download the APK. Many gambling sites already do the same.

It strikes me that their argument on iOS might be even stronger given the relative unpopularity of jailbreaking devices these days and the complete lack of sideloading functionality for non-developers.

So question then is, what's the scam?

Stealing card info? Selling the VINs to people trying to sell stolen vehicles? Or just producing fake CarProof-style reports for cheap.

It's not people who have previously pirated it - it's people who have intentionally leaked their copy to crackers.