problems

I seem to recall a video-based one that did something like this - it would tell you to make a specific facial posture to unlock the device, maybe Google's?

> ubiquity and userbase

I'm not so sure about that - I recall having much better experiences when these sites were much smaller. Something about eternal september.

This has sort of happened in some spaces - in certain right-wing communities Twitter has been largely replaced by Gab, Patreon by the aptly named Hatreon, etc.

The issue becomes more severe when it runs up against services that are hard or expensive to start or which rely on other uncooperative services - look at what's happened with Daily Stormer and Bulletproof.ai for example - Bulletproof wants to provide them service, but they're unable to find a TLD thus far which will allow their domain to stay online.

> By the way, regulating CloudFlare by limiting its ability to choose customers would be unconstitutional under the 1st amendment, would it not?

You're correct from a legal perspective, but Matthew Prince himself called it "dangerous" to do what they did. I think with good reason. While it's legally okay, it definitely raises valid questions, not about what's legal, but about what's right.

That's not how this works. With deniable encryption, it is entirely possible that there doesn't even exist a hidden volume to find. They will be unable to prove he has a hidden volume and surely a judge will not compel him for not producing something he may not be able to at all.

The same applies to facial recognition too.

This raises a major question though - what's the use case and threat model for facial recognition? If you're remotely concerned about security, clearly you're not going to use it. If you only care about preventing the casual attacker, either option seems good enough.

I just don't see a security model in which Apple has substantially improved it. The security of it is terrible in either case - all Apple did was make it more expensive.

I got the impression that VeraCrypt was not being run very well and that the developers didn't have much security experience based on the audit report that came out. I didn't consider it a trustworthy project. Has anything changed that?

Yeah, it works well enough - some pain, have to deactivate it to do the major updates and such on Win10, but it does work.

Fuck, that is absolutely nauseating.

What's worse is that trustworthy deniable encryption - which would solve this - is practically non-existent now that TrueCrypt is gone.

I'm not disagreeing that it's poorer for security, but in practice under most threat models you'll be able to patch in time for it to not even matter. And you'd still need to patch, even if it was nicely sandboxed - getting access to just the bluetooth stack could allow emulation of a keyboard or internet connection. Let's not forget that Apple has had trivially exploitable vulnerabilities in the past too - I'd argue that Linux's recent history has been significantly better in that department actually, despite the technical merits of the mitigations being worse.

There's no PoC code out for this even and it's been many times longer than it would take to patch something like this in most cases.

What I'm saying is that going from "Linux has worse security design" to "use an iPhone" is just a non-sequitur - people choose devices and operating systems for reasons other than the best security design and there's no reason that an attack like this should force you onto a single platform. It comes off as nothing more than fanboyism.

From blocks away? Bullshit. Maybe from the next room using a CRT monitor. I'd love to see the study saying they're able to reliably get keystrokes or screen images from any significant distance.

I'm not so convinced Linux is a "tire fire". Just about everything has vulnerabilities and needs to be occasionally patched, doesn't mean we need to get into some sort of holy war every time there's a new exploit for one device or the other.

That said, Android's lack of updates for older devices is its biggest weakness. Google is looking to fix this next version as they separate the HAL out. Something to look at is definitely if there would be a standard kernel with loaded modules or if it would still be left to manufacturers.

I've felt the same way. I went from crappy low-end Android devices when I had no money in school to a Nexus 4 and I haven't seen reason to upgrade since. The only reasons I've done so have been because I cracked a screen and because I wanted to hand down a device to someone else. Been sitting on my OnePlus One for a few years - looking at the market now and not seeing any reason to upgrade still.

Worse, I get worried about some newer devices which may make me less free - the Pixel has a very locked down boot process and the Magisk developer has been struggling to support it. I currently use Android Pay on my rooted device and I'm definitely not willing to pay to lose that freedom.

Do you have to mail them like when you're correcting an error or is this available online or via phone?

It's actually not too bad, even on phones without "easily" replaceable batteries.

Speaking for the OnePlus One and Nexus 5 the procedure is pretty straight forward: pop it open using plastic trim tools (which are often sold with batteries) disconnect the ribbon cable and pry the battery off any adhesive. Drop the new one in, reconnect it and snap it back together and you're done.

Depends on the phone I guess, but the whole thing takes maybe 15 minutes.

Yeah, they're majorly helpful for transit commuters - you can avoid extended wait times, know when you can take a walk to the convenience store or even know when there's another or a bigger bus coming so you can decide whether it's worth getting on the packed bus or waiting for the next one. It really does change the transit game a lot.

In Canada we've had contactless card readers for a few years now - the mobile payments are compatible with the exact same protocol, so instead of tapping your card you just tap your phone.

I haven't even gotten any funny looks tapping my phone with Android Pay at places not advertising it - even just after it came out in Canada.

Not only that, but they're doing things like Certificate Transparency - publishing every certificate they sign into public logs and they're funded and supported by some of the biggest names in online security and privacy.

They're probably the most trustworthy CA on the planet.

I'm not suggesting that - look at big professional projects like Lineage, Paranoid and others.

I'd say it is a quite genuine option - you just need to know one person who can set you up once, updating is simple and streamlined.

I find it ironic that you're in the security industry, yet have no interest in getting security updates as quickly as possible.

We're not talking about major updates here, we're talking about updates that take about 30 seconds to apply plus a reboot, once a week and you know you're always running the latest and greatest from a security standpoint. Most change nothing from a user perspective.

Of course, you're free to treat these updates as you like, I typically only patch about once a month or when there's a major remote vulnerability.

If you run custom ROMs on Android that situation is currently better than anything - you can still get updates for a Galaxy Nexus from 2011. Xiaomi is also currently providing official updates for 4+ years on some devices.

The official situation should change too - with the release of Android 8 there is now a more defined layer separating the HAL from the rest of the OS, allowing updates to be pushed out universally.

Not necessarily true - if you have the know how or know someone who does, you can run a custom rom on your Android device, Lineage is updated weekly for many devices and will easily provide many more years of life. Once it's set up it's pretty hands off too, so just knowing one person who can do it for you once is pretty much enough.

The official situation is slated to improve now with Android 8 separating the HAL and the rest of the OS more clearly it likely means that in a generation or two this won't even be a concern.

New battery is about $10, not exactly a blocker, but they do increase the price.

RSS does give us this.

http://rss.cnn.com/rss/cnn_topstories.rss

TinyTinyRSS and Fever make it a pretty good experience too.

Yeah, and even with that extreme measure taken, Bulletproof found them a new domain on the .at TLD, check the whois for dailystomer.at

I think this has been answered many times over, even the most extreme free speech absolutists tend to agree that direct, specific threats are unacceptable. General, non-specific threats and expressing joy about violent acts however... opinions vary.

They've been using onion domains to provide service while their clearnet site is unavailable - so the technical solutions do indeed exist. They're just harder to use.

Of course, the other option is to find someone who does want to host you or start your own. They've done decently, bulletproof.al has been willing to provide them domains, bitmitigate is providing their DDoS protection, etc.

As others in this thread have mentioned, there's a tendency for many entrepreneurial types to gravitate towards services that are very much hands-off, BitMitigate and Bulletproof made a name for themselves here and I'll certainly give them a shot if I'm hosting anything where users can post comments or I'm posting things that are remotely controversial. There's value in knowing your site won't go down even if the worst kind of controversy is stirred.

Did modules/import not make the final revision? I was quite looking forward to that feature.

It's not "better-safe-than-sorry", but a simple cost-benefit analysis of the risks and stakes presented.

Depends on your lifestyle and how valuable you think these things are, but I find these things almost entirely valueless. I think virtual assistants are basically total trash - I can type my query on my damn phone faster and more accurately than the Echo or Google can get it - and I just see no value in DNA sequencing unless you're looking for a specific medical condition, the fluffy interest in stuff like racial makeup just seems like a shitty trade-off to me.