procombo

Hardly. Your privacy also depends on what devices your neighbors use. Bluetooth/Wifi/etc packet broadcast, etc. Apple does _some_ things to midigate privacy risks for their users, but not enough.

You used to be able to prevent sharing by blocking their "thumbnail generator" requests via firewall. Or block entire range such as "2a03:2880::/32".

I haven't looked into this method's feasibility in years though. I imagine there are much better ways they protect outbound clicks from their apps these days.

This person is still comparing themselves to their peers in high school. Doesn't check out.

I love ICF, but concrete alone doesn't block radio very well at all. Best to go with steel studs -- it's found in all modern commercial buildings where I live. Use steel joists between floors and a metal roof and you've got yourself a building full of tenants who have great wifi, but terrible 4g cellular.

https://www.scafco.com/wp-content/uploads/2017/09/iphone-bac...

Sometimes the reason they give you is just the one that pushed you over the edge. At Amazon being "insufficiently succinct" is a greater err than one might think.

It's what I have done for years. Only costs $1/mo for the number and a couple hours learning their API.

Your existing cell number can be ported over to Twilio if you are patient.

The only problem is trying to use the number for 2fa. A growing number of banks (like Capital One) block Twilio services from recieving their SMS.

Doesn't TrueNAS (was FreeNAS) connect to iXsystem servers from the NAS and from the NAS web interface?

I've recently conceded to the argument that it's impossible to solve the problem without first defining the role and function of the companies. I believe that should be at the center of Senate questioning, not because it's comfortable, but because it is necessary.

I cooked eggs this morning. There is a diversity of wonderful eggs and even some bad eggs. Is the Twitter service a) the eggs, b) the pan, c) the stove, or d) the hen-to-table service of providing a delicious breakfast?

If you don't mind me saying, Nick is just claiming your comment won't age well.

It appears one person's "extremism" is another person's "wisdom". If you've ever worked in state/federal government you'll get the sentiment. Sure it's speculative, but definitely not extremist.

Don't provide outlier data. What is your goal?

Any ad network not considering that traffic as fraudulent will shortly go out of business. That's why I say it declaratively.

As someone deeply integrated into the ad serving world, I'd like to remind you that adnauseam traffic is very easy to filter out as noise. Nobody is paying for that traffic.

> I haven't found anything in my searching

If this story wasn't about sensorship I wouldn't be laughing.

Awesome post Alessandro! Well written and in tutorial format. Much respect! I know what I'll be playing around with this weekend.

I will be looking forward to more blog posts of yours in the future.

I assume that service would only cost ~$10/month, because that's what Apple currently charges for Developer accounts.

The 30% per transaction only really makes sense for apps for which Apple has provided the advertising, distribution and processing -- the App Store.

I'd love to just provide a direct download for my customers who also happen to be Apple (device) customers.

You think Mozilla still has it in them?

As a long time Apple user, and open software advocate I'd literally cry tears of joy. I'd also have to throw Zuck a bone if FB joined.

I really just want Apple to separate their code signing (Developer) service with their advertising and distribution service (App Store).

The more reasonable thing for Apple to do is to separate the code-signing services (platform security and privacy) with the App Store services (advertising and distribution). From my vantage point that would solve all these problems.

"Typically" might be correct. Our nation's Covid-19 unemployment response is not typical.

All of my employees have been given the option to work, or be furloughed. Their decision. Two have chosen to stay home for their own personal reasons. They are on state unemployement and also collecting that weekly check from the fed. It's up to the fed when they stop doing that, but these people know we will work with them if/when that goes away.

Don't give Elon the benefit of the doubt for most things, but I think he's right on.

Amazon = net negative for people who do business with them. "Squeezes" relationships, as you put it.

Elon Musk ventures = solves real world problems while maximizing fun.

It's interesting how you paint Amazon and Walmart. Let me bring up just one example:

The short term price squeezing means manufactures are responding by providing lower quality items to Amazon, just like what they do at Walmart. (Try buying a box of name brand Pampers diapers on Amazon right now and compare them with the same SKU at, say, Target) And all the more power to them if that's their goal. But long-term it isn't a sustainable strategy, business or environmental.

Low-quality products equals more landfill and less money in consumer's pockets overall. It also means a very small market for product re-use, such as buying second hand. I grew up with 20 year old appliances from a local thrift shop. Every appliance I buy now seems to have a 24 month shelf-life, with the liability of having to dispose of unrecyclable materials. I'm telling you, net negative.

Fun, clever, and witty comments are increasingly rare here on YC. Thank you for this.

Whitelists works fine. Pin "extensions" work fine. The next step is probably just a simple question/answer regarding personal information about the recipient.

Just like account security questions. Provide drop down selector/s for users to select their question.

I'm not going to provide my public number here, but if a caller of mine isn't whitelisted I just prompt them for my billing zip code. Now, that's not going to work for every one, but considering who I want to get phone calls from, it's pretty foolproof.

Keep the energy up @davidajackson. I'd love to see you hugely successful with your efforts!

The original 13 colonies literally predated the fed. States weren't created for the convenience of the fed, it was the other way around.

Apparently we are all supposed to become lawyers. ;)

Creating a whitelist service for yourself literally only takes a couple hours studying Twilio docs. Hardly a huge waste of time, and when you get 2 spam calls every morning before 8 am for weeks it's completely worth it.

I've always wondered a similar thing... why is reputation-based TLD network security limited to a single verification entity (CA w/ revocation policy)? Seems obvious to me certs should be signed (and thus revokable) from multiple entities by default. I've implemented this before in clients ad-hoc, but why isn't it default?

Don't get me started on authoritative DNS security.

I installed newest version OpenWRT on a popular brand, recently manufactured wireless router last week.

The OpenWRT firmware couldn't access https sites without installing multiple packages first. Then they had me install all the root certs over an unencrypted connection. The opkg repos and install files are all downloaded over http.

With full seriousness, I really hope nobody expects operational security using these routers.

Until several years ago cookies couldn't be used for CSRF tokens, because they were sent with every request to your site, regardless of where the request originated. SameSite changes that because you can now control when a given cookie is sent with a given request, based on how a link was followed. It puts the work on the browser.

SameSite is just a property you use when setting a cookie, like the expiration, or url path. There are three settable values: None, Lax, and Strict.

'None' sends the cookie with every request, like how browsers "historically" acted.

'Lax' is the new default [1]. If someone follows a link to your page, these cookie are sent with the request. If a third-party site POSTs to one of your pages, these cookies won't be sent.

'Strict' cookies will never be sent to your server if the request originated from a third party, even if it's as innocent as following a link from a search engine.

So use these types to your liking. Your needs vary. If you want the user to appear logged in when they follow a link to your site you're going to use None or (most likely) Lax.

As far as CSRF, you can generate a single CSRF token at login and set it in a cookie as with SameSite=Strict. Regenerate it every so often, or at "big" events, and voila. One CSRF token per device session. No worries about multiple tabs open, and you have reasonable expectation to only have to keep track of a single token at a time. The kicker is, you technically don't even have to have a CSRF token if you don't want. If you're serious about nobody linking to an "internal" authenticated page, just set the primary session id cookie as strict. (I would personally do more than this, but hey.)

I do secure portals. So we set several cookies across the board. Varying expiration times. They all have their purposes.

[1] While you can consider Lax as the new default, if you omit the SameSite property on a cookie it is actually attributed as something referred to as 'NotSet', which is unsettable, and acts a hybrid between Lax and None. Browsers vary a little here, but it's only to maintain reasonable backwards compatibility at the moment, and both Mozilla and Chrome developers plan to remove this hybrid functionality in the future. Basically.. a cookie will act like None for 2 minutes, then act like Lax after that, etc.

Awesome writeup.

You mentioned you're still "finding an elegant way to generate, use and clean up CSRF tokens".... Consider implementing an "httponly", "samesite=strict" cookie for security check. Apple recently got on board so all major browsers are supporting this. One goal of samesite is to make CSRF tokens redundant.

We roll out at least three different cookies with varying expiration times. Including each of "strict", "lax", and "none". They are there for various reasons.

Of course additional checks occur, especially for big operations, but we no longer keep track of multiple CSRF tokens for each user/device/browser combo.

Keeping track of CSRF tokens via JavaScript, considering multiple tabs, is kind of a nightmare... and it's never as secure as you initially think.

Made me chuckle. Your "just let them talk for 5 minutes", is another person's "wait until they're receptive to feedback." :)

I've never met a frustrated or angry person who is receptive to actual feedback. I'm the same way. Validate my emotional concern first, then move on to the next step.

Most of the time all I need to do is vocalize my problem... and that works best when I "have the floor."

If you don't mind me suggesting, that is really what was happening.