sr2

> So they have publishers by the balls "forcing" them to use AMP to get higher in their rankings.

Except that I don't write blogposts to please the Google search engine. A site can be found via many other ways. News sites like Reddit are a great way to be discovered, aswell as HN. There's also link dumps like Pinboard which are another way to discover, aswell as others. Twitter, etc

Hypponen's law: Whenever an appliance is described as being "smart", it's vulnerable

https://twitter.com/mikko/status/808291670072717312

That's why all phones should have a decoy feature so that when asked to produce a password, you just give them the decoy pass, and it unlocks a clean profile with no way for them to find anything personal, and or incriminating.

There's a useful guide[0] if you're going to use a VPN and you should take it seriously. Personally I think a VPN is only ever useful for routing traffic over hostile networks (like at shady cafe wifi) and spoofing your geolocation to access geo blocked content.

[0] https://gist.github.com/joepie91/5a9909939e6ce7d09e29

What's to stop someone renting an offshore VPS, like say, in somewhere like Hong Kong[0], and that isn't part of the 'fourteen eyes' spying alliance?

[0] https://privacytoolsio.github.io/privacytools.io/#vpn

Also what's to stop someone stacking anonymously-bought VPNs on top of each other (proxy chaining) similar to how onion routing works, and creating their own homebrew Tor? If the VPN provider is peeking at the logs (which it shouldn't be doing), then all they see is another VPN IP. VPNception!

(Something like the SHALON[1] technique is useful for this, for example):

------------

> Abstract—In this paper, we introduce a novel lightweight anonymization technique called Shalon. It is based on onion routing, aims to reduce complexity, and delivers high bandwidth. We have, compared to the widely known approach Tor, slightly reduced the level of security in favor for greatly increased performance.

> The most significant advantage compared to other approaches is that Shalon is fully based on standardized protocols, which makes our approach highly efficient and easy to deploy. It also makes Shalon easier to understand for normal users, eases protocol reviews, and increases the chance of having several implementations of Shalon available. In this work, we provide a description of the design and implementation of Shalon, a performance and anonymity analysis, and a discussion on the scalability properties.

[1] https://pdfs.semanticscholar.org/6f30/f14ff4972ddd787bf7e859...

Too much emphasis on education and college in this article. Hacking requires 'thinking outside the box'; often called lateral thinking[0]. Formal education in the subject of hacking is nice, but doesn't allow for the creative mind to fully explore systems. There's a phrase:

   Don't Learn to Hack - Hack to Learn

In terms of earning money from hacking, there are tradeoffs made in both whitehat and blackhat hacking. One noticeable tradeoff in blackhat hacking is having no boss, and penetrating a system on your own terms. Whitehat hacking might pay more and be more respectful and a nice little haven where you can avoid jail, but it's often riddled with a rigid framework for getting into systems and doesn't encourage the lateral thinking I previously mentioned. Instead it's a corporate cubicle job where hacking is often automated and routine.

On the other hand, there is grey hat hacking which many fall into at some stage to strike a balance, and often balance criminality with a respectful whitehat job that pays well.

[0] https://en.wikipedia.org/wiki/Lateral_thinking

"Why Tipping Should Be Banned", by Adam Ruins Everything is worth watching if you are of the school of thought that tipping is bad: https://www.youtube.com/watch?v=q_vivC7c_1k

The gist of the video is that if you're tipping, then a waiter/waitress for example is not being paid enough, and tips are deliberately designed to bolster their unfair income.

+1 for tinc

For those who don't want to click, here's the abstract:

> Populism may seem like it has come out of nowhere, but it has been on the rise for a while. I argue that economic history and economic theory both provide ample grounds for anticipating that advanced stages of economic globalization would produce a political backlash. While the backlash may have been predictable, the specific form it took was less so. I distinguish between left-wing and right-wing variants of populism, which differ with respect to the societal cleavages that populist politicians highlight. The first has been predominant in Latin America, and the second in Europe. I argue that these different reactions are related to the relative salience of different types of globalization shocks.

Just make sure your catchall is renewed well into the next five years. Heck, you can do a 'rollover renewal' that lasts 10 years if you wanted.

This is to stop somebody eventually gaining control of the domain when it expires, setting up a catchall on it, and then being able to login to every single account you used with that address.

Some registrars protect a domain after expiration so nobody can hijack it and claim it as their own, but you often have to pay extra for this service.

There's also iPredator[0] run by Peter Sunde. PRQ is the work of Gottfrid Svartholm. Your traffic goes through Sweden, so you're safe!

[0] https://www.ipredator.se

> Have you MITMD your connection

Yes, with another Sysinternals tool called TCPView https://technet.microsoft.com/en-us/sysinternals/tcpview.asp...

You don't even need an AV product, you can spot malicious activity by eye alone.

This was before the client even connected for the first time. And the IPs were well known C&C servers used for collecting keystrokes and screenshots of your O.S

> the OpenVPN protocol is easy to be detected and banned in some highly censored network.

Tunnelbear are one of the few VPN providers that use a thing called obfsproxy to circumvent this kind of censorship. They call it 'Ghostbear'[0] but really it's just an obfsproxy bundling which uses the domain fronting technique.

[0] https://help.tunnelbear.com/customer/en/portal/articles/2435...

[1] https://en.wikipedia.org/wiki/Domain_fronting

Yeah and use a decent client like Viscosity, or if your O.S supports OpenVPN config files natively, just use them.

I spotted loads of malicious network traffic, and using the Sysinternals Autoruns[0] utility I was able to spot attempts at persistence. I also checked the outbound connections and they were C&C servers. I can't remember if the installer was digitally signed or not, but there was definitely malware in it. I always make sure to opt-out of any AD ware that might be bundled with an installer, but this seems to have been injected surreptitiously, and installed with very little interaction.

Just be careful with the bespoke VPN clients as they are very juicy targets for MITM attacks. I know I would be going after VPN software if I wanted to do ex-filtration for a small subset of users trying to hide their tracks from governments and ISPs.

[0] https://technet.microsoft.com/en-us/sysinternals/bb963902.as...

Even if this site was not a joke, I wouldn't trust an online password generator, especially if the pass is generated on the backend instead of the client. A quick Google for 'password generator' yields hundreds of these sites which are more than likely run by the same outfit and are possibly logging the passes into a database to make cracking various accounts easier.

There's a few PW generators which run on the client only and don't send any requests to third parties, and I use them sometimes. They are typically very JS heavy and use different seeds to generate sufficient entropy, like client fingerprint, mouse co-ordinates, timezone, etc

Another two I heard TheGrugq mention in one of his talks are Mullvad and PRQ

https://www.mullvad.net

https://prq.se/?intl=1

I'm not sure about Liberland, but I know in the Isle of Man that Bitcoin is thriving: https://www.middletonkatz.com/wp-content/uploads/2015/06/Isl...

I found malware in the PIA installer. Not sure if it was planted by PIA themselves or I was subjected to a MITM attack, and so I would never use any bespoke VPN software again. Best just downloading the OpenVPN config files and plug them into something like Viscosity[0] (which I trust over the more bespoke VPN clients made by the VPN providers themselves).

[0]: https://www.sparklabs.com/viscosity/

Some kind of crypto-haven like The Isle of Man or Liberland

> Having up to date Android and iOS zero days plus the rootkit / RAT software is not something you can get open source or find easily commercially.

You might be right about not being able to find 0days that target the latest versions of iOS or Android so easily, but there are dark web markets stuffed with 0days that target specific versions, or a range of versions. Not sure about pricing, but they're typically cheaper than the exploits that target the latest and greatest.

It's by pure chance that the owner of a device is using an out-dated O.S on their phone. Others may argue it's not by chance, but by design, and that some phones can't upgrade properly and remain locked to a specific version..You know, because governments sometimes demand that phones are deliberately left unpatched so they can do interception or do ex-filtration on them?

> It's entirely possible that one day many years from now, a prospective employer/insurer/whatever finds such a comment and flags me for it

This is why you should use pseudonyms and strive for anonymity. It's trivial to signup to Hackernews under an assumed name, or handle, and start venting on contentious issues. Hackernews might shadow-ban your throwaway account, so you might have to lurk moar and share some interesting links before you can comment without being censored. I know from experience. Last time I checked, HN has no strict policy on multiple accounts and you can do this very easily.

In terms of OPSEC, you obviously shouldn't contaminate your real iden with your anon iden, or contaminate your anon idens with other anon idens. You should also deliberately alter the stylometry of your writing so nobody can link two pieces of text to each other. Anonymouth[0] is my favorite tool for doing just that.

[0]: https://github.com/psal/anonymouth

So does your device automatically choose the correct network depending on what sim it has?

What if you're on some obscure lesser known mobile network and the EU country you're traveling to doesn't support that network? Vodafone (a non obscure network) however seems to be ubiquitous in the EU.

Or better phrasing:

Halcyon Days: https://en.wiktionary.org/wiki/halcyon_days

Days of Yore: https://en.wiktionary.org/wiki/days_of_yore

HN does allow reposts if there is a substantial time period between each listing. Not sure the exact time period, but I usually give it a few weeks before I can post it again.

https://hn.algolia.com/?query=%23Cherry%2520Blossom&sort=byD...

Is it expensive?

Glad you mentioned Bulletproof. Asprey said once in one of his many videos that Coconut Oil doesn't work when combined with coffee because it contains bad saturated fats which you want to avoid. It does however contain MCT, but not in the ratio you want, hence his Octane oil products which only provide the good fats that you need.

You mean like a Sybil Attack? You might be right about a certain culture of sockpuppetry on places like Reddit where it's actually trivial to setup multiple accounts under different IPs and then upvote all your stuff. It's no secret you can pay for services where people do this for you and 'astroturf' your chosen topic and make it seem more popular than it actually is.

https://en.wikipedia.org/wiki/Sybil_attack

https://np.reddit.com/r/shills/comments/4kdq7n/astroturfing_...

https://www.youtube.com/watch?v=jdaPJLJCK1M