sterwill

Over a decade ago, I created an AWS ELB to serve a production API. It was HTTPS-only, using an Amazon-signed certificate served from ACM for my employer's domain. Right after deployment, logs showed a regular pattern of 404s trying to POST/PUT to my API at paths I didn't support. Thousands of requests per hour, and they continued for days. It didn't look like a DoS--the paths looked like someone else's API.

I got curious what all the traffic was, so I added a route to the API that saved some of the uploaded data. It was live home surveillance video and photos! Indoors, outdoors, baby monitors, living rooms, etc. It was pretty easy to find which vendor's hardware was doing this (from headers, paths, watermarks) and I reached out to their security contact to let them know what I found. They responded generically but didn't seem to care that much.

In short, because HTTPS was required, and an ELB gets assigned IPv4 addresses arbitrarily, I can only conclude that a whole fleet of home security cameras were sold across the US that hard-coded the IP address of their cloud server and had certificate validation disabled.

Does this result in programs more frequently erroring/crashing because they can't allocate? I don't know how well many of the programs I frequently use on my desktop (Firefox, GNOME desktop, JVM + IntelliJ, Slack, etc.) handle allocation failures. I'm not sure they would do much better than crash, but I know the default OOM killer settings work well for me. About once a year a real runaway process (usually a throwaway program I'm working on) gets OOM-killed, and that's fine with me.

Same here. I enjoyed Q3A, but I spent so many hours playing TF/MegaTF.

How does grandma install all of that on macOS?

I flew to Belfast in the mid-2000s. I don't remember the security screening as being that unusual (for an American), but the terminal architecture was interesting.

I have 2 Reolink PoE cameras, and they just hopped on the network with DHCP and I used a web browser to configure them. No app needed. I did install the app later, once the cameras were safely on their own VLAN, and I could connect to them by internal host name or IP address.

I've never looked at what the Android app is doing on the network, but maybe I should. I usually just keep it open for a few minutes when I'm waiting for a delivery or I hear someone ring the doorbell, so I'm not too worried about it piping lots of video to Reolink HQ. I haven't noticed much of a battery drain having used it earlier in the day.

I bought Reolink PoE cameras because they support standard RTSP and I could put them on their own VLAN where they can't get to the Internet. I can still use the Reolink app to view them when I'm on the LAN, or through Wireguard when I'm not. I use ffmpeg to save streams to a big disk. Works great.

Not bragging, but I bought the Blender Book!

Same here. I used Debian back in the 90s, switched to Ubuntu for more regular releases, but the ads from apt were the final annoyance. Debian 12 has been excellent.

I hope they stay in it because I love my 1 Gbps Google Fiber service. Install was great, it's super reliable (compared to Spectrum cable Internet), and the price is nice. I don't even own a computer or switch with network ports that can do > 1 Gbps, but 20 to the home is impressive.

Google Fiber gets this right. They say my Internet package will cost $70 and every month the total I get charged is $70.

On my old 2014 Mazda 3, you could SSH in over USB Ethernet as root, and just edit the timeout delay in the console JavaScript files. That was great.

I like having the ABV in big print so I can avoid the super high ones. It's a bonus for me!

My Reddit user experience is similar to yours. I paid for rif years ago because it's simple and fast, and I don't want to see ads. I'll gladly pay Reddit for an ad-free experience if I can use an app that's better than their own, but if they don't want to take my money, they'll lose me as a user.

I use "rif is fun golden platinum" because it's simple and fast and I don't have to look at ads. I'll gladly pay Reddit _and_ rif to keep using that combination without ads. I'm certain whatever I pay Reddit to use their API through another app will be worth more to them than any ad revenue they could get from me, because that will be $0.

I share my desktop (single windows and/or whole desktop) at least once every day. Usually with Google Meet in Firefox, but also with Slack, Microsoft Teams, and Zoom. I don't need remote access to my desktop or laptop (windowing system) though. SSH is just fine for me.

I'm not disagreeing with any of the technical points in the article. I'm just saying that my experience with Wayland is pretty good. Someone (GNOME? Ubuntu? thousands of generous developers?) is doing all the work to make it work pretty well for me.

So much is written about Wayland not "being ready." I've used it exclusively on my desktop and laptops for... as long as it's been available in Ubuntu. It works fine. I don't have any issues with input methods. It puts pixels on my monitors. The screen doesn't tear when I move windows around like X did. It's fine for me.

Many years ago, I managed a server room with dedicated cooling on the 4th floor of a 4-story building with a flat roof. One night the temp alarms went off, and when I showed up water was dripping off my overhead Liebert unit and onto the racks.

And it wasn't even raining outside! So I grab some plastic to cover the racks and phone in emergency portable cooling as the room's AC started failing.

It turns out earlier that day, a technician performing seasonal maintenance on a boiler tank on the roof had drained the tank and refilled it. But instead of directing the water out into a proper drain, he sent it down a convenient pipe that was actually a vent from our ceiling into the boiler house. The boiler was dozens of meters from my server room, but the water followed the old steel and plaster ceiling remnants over to my computers.

And this boiler water was more exciting than rain: it came with all the dissolved minerals, metals, and preservatives computers crave! I didn't lose any computers in the racks, but it killed the Liebert's control board.

2006 NC owner here with a reasonably new battery. I keep it parked in an attached garage, so no extreme cold or heat. Mine will always start after leaving it for 1 month. I probably left it for 2 months at some point in the last two years, and it started, but that feels like pushing it.

The next time a mechanic tells you cars can't sit for a few days without a battery drain problem, ask how people who park at the airport get home after a two-week trip.

I'm "letting" semantics shape my reality? The war metaphor for drug policing was chosen 9 years before I was born. It's been used my entire life to normalize the violence and societal costs associated with criminalizing drug usage.

I'm not talking about policing or crime in general here, or "giving up on policing" or whatever you're implying. This seems like a non-sequitur.

I want us to reshape our conversations about drugs to focus on health impacts, and throw away the dumb war metaphor that has twisted a public health problem (drug abuse can hurt you) into a multi-generational, multi-billion (-trillion?) dollar "police action" that has shown no path to a solution.

How did they decide that this data doesn't need to be protected? If it's PHI (at the covered entity) and accessed through their BAA, it's still PHI and deserves protections. Were they willfully ignoring their obligations?

You can't win a war against something that can't die or surrender, so you can't win a war against drugs. You can win a war against people. Is that how the US should solve its health problems? With war against its own people?

Which MITM attack has a government used to read your Signal messages? I've heard people allude to government breaks of Signal for years, but always without evidence. Surely some Signal messages have been recovered from devices in the government's possession, but that's not a protocol problem. Are you saying a government has successfully spoofed safety number change messages from your contacts?

I did a quick search for my username, and to my surprise I found that I submitted both a trivial patch and a new splashscreen image for The Gimp 1.1 back in 1999! I would have never remembered that on my own. Lots of fun!

I bought a pricy 1999 PowerBook G3 to run Linux, and it was an excellent little computer. At the time there wasn't much out there with the same build quality. 1024x768 display, built-in Ethernet, and a SCSI port! I mapped a couple of Mac-special keys near the touch pad to mouse2 and mouse3 and it was perfectly usable with X11.

Used it for 5 or more years before switching to a ThinkPad.

Years ago, I ran a tor relay (not exit node!) on my stable home internet connection. I forgot all about it for months and months, and then when I was trying to update a home insurance claim, I kept getting weird site errors. Pages would half-load, I'd get 500 errors submitting forms, etc. I wasn't _using_ tor at all, just normal Firefox like always.

I peeked at the failed AJAX calls and I saw that the site was denying my traffic because I was classified as a high risk endpoint. The name of their WAF/filtering vendor was in the error responses or headers, so I found a free way to query that company's threat database for my home IP. There it was, my IP was marked high risk because it was associated with a tor relay. It's a silly threat correlation, in my opinion, but it was enough of an annoyance that I stopped running the relay so I didn't have to worry about flaky firewalls.

The ironic thing was, I could have probably fired up Tor Browser and tried new exit nodes until I found a fresh one their system didn't know about, just to finish updating my claim! I actually just tethered my laptop to my phone, I think.

PS I forgot to ask: does anyone know if Snowflake is as detectable as a normal bridge or relay node? If so, there's the risk that your home connection gets a risk/reputation strike against like mine did.

The Brie I buy is made in France, so I'll leave it up to you guys to convince them that it's not "real."

I buy French Brie at US grocery stores many times a year. Did you mean to say it's one of the types that isn't illegal?