I recently searched "best chair posture" and was saddened to see almost the entire first page as affiliate blog top-10 garbage.
I could have worded the query more clearly, absolutely, but it's a shame that our world's greatest knowledge search tech is currently plagued by these kinds of results.
So, clearly not enough time or experience to make scientifically false statements about an entire country of nearly 90 million people, many of which are much smarter than you or I.
I don't doubt that problems exist. And I'm sorry your family has to deal with that. But going on rants about genetic inferiority is not the solution.
I appreciate you telling some of your experiences, but don't let them poison your tongue. Put that energy into something constructive. Just my thoughts. I wish you and your relatives the best.
So no account for the "genetic" intelligence required to navigate such a society intelligently? You have some extremely disgusting conclusions that aren't based in facts but merely extremely prejudice and racist conjecture amplified by propoganda. I really hope you rethink them. You claim you have depression in your post history. May I make a suggestion. Stick to things you know, ideas to create, and find new constructive habits that don't feed whatever the hell this kind of output of yours is. It will cause you problems.
I think the US is much more inclined to use parallel construction and the full extent of the legal system to bring down someone, which while can be similar, is not quite the same as someone simply never being seen again.
Pretty cool to set WASM support added now. I may have to revisit the game to grind out golang & rust syntax skills, depending on how difficult it is to use in practice
A lot of people who have dealt with much worse volatility in their national currency thought it was a good idea. Many national currencies have performed so much worse than this.
There's tons of land unused in the US. But I also agree with you. I haven't played with this one yet, but it looks very nice for automated hydroponic setups.
Lmao. Microsoft has a few great open source projects out I'd say. This seems promising to me. But yeah the Azure setup docs look a little easier here, and they mention promoting Azure usage for the backend in this post . Thank God they've included standard Linux setup instructions and made it possible for that, though (I'm not entirely sure about all the services entirely). Hopefully disabling telemetry is easy. I suspect this project isn't for small scale users, unfortunately, but I need to dig into this more.
For what it's worth, the whitepaper for their VPN makes some pretty strong claims to user privacy, with the VPN client being open source. Normally Google's privacy policies are fairly vague, but this seems to be very clear about the claims and what is/isn't logged. Maybe all the Cohort/Privacy Sandbox things makes IP somewhat irrelevant anyway, and they're just banking on folks who will continue to provide data through other Google services? I really can't speak for the true privacy implications of using the VPN, but I found this interesting.
Chromebooks offer some of the best consumer grade security around for PC hardware. Coreboot, firmware tamper detections, Disk encryption, tightened RBAC, kvm virtualization, lxc containerization, seamless a/b partition updating, optionally enable mandatory hardware 2fa keys... All on a simple touchscreen interface even Grandma can use and buy for as low as $100. Meanwhile, a huge number of Linux distributions still promote the use of x11 in their default experience. I'm not saying Google is without recourse, but they work harder than most with their security and it shows pretty clearly to me. Who are you trying to compare them to? Do they not send the formidable Project Zero on their internal projects regularly?
At least from a design perspective, I would highly encourage users to check out Secure Scuttlebutt. It solves many problems highlighted here. Dominic Tarr really did some excellent work building it.
Anyone could have easily just downloaded the nonfree iso. However, I think it's so very important that we can simply say "Just go install Debian" to anyone just looking for a rock solid OS.
I like their pricing structure for bulk accounts. What I'd absolutely love to see is more email services that are Protonmail compatible, utilizing WKD or whatever it they need. Here's something to look at anyway https://github.com/Excision-Mail/Excision-Mail
I have worked for a few school districts and the security has always been very poor. Nobody really hardened Windows too much, leaving the attack surface wide open. In grade 8 I discovered blank admin creds. In grade 12 trivially pwned our grade system with url enumeration. I disclosed these responsibly. The local community college had numerical birthdays for student AND FACULTY passwords and published the full class rosters on Moodle for any student with basic OSINT skills to have some fun, although I think this policy was changed after they got owned last year. I tried to tell them. Schools either need to go full Chromebook, or get a SOC, or we need to start really investing in Linux-based school infra. Or Windows needs to make group policy easier maybe. I found something called Univention Corporate Server, a German debian-based offering which seems fair, but I can't speak for it in practice.. One of the problems is School vendor software is typically beyond bad. Very, very expensive with ANCIENT libraries. Payroll uses super old programs because they comply with obscure and complicated state tax requirements for schools, that they probably paid 40k for. I'm just ranting at this point... Sigh I just got hired to work at a college again and would love some thoughts this, news like this always triggers me. I'm not sure what I'll be walking into just yet. Lately I see districts moving responsibility onto cloud vendors.
I agree wholeheartedly and this is why I use Matrix. The fact that a vulnerabilitiy of this magnitude can largely be defeated with precautions, albeit non ideal, are a real testament to the power of e2e. Hopefully we will see the fixes these non-default settings recommendations very soon.
You mean, allowed to decrypt unless following the discussed mitigations? I suspect you don't regularly use the client, which is fine, but these warnings and notifications are very annoying and essentially impossible to ignore. You are highly incentivised to resolve them. Obviously, I agree the exploit is bad. I just think the millions of users would appreciate practical discussion of the very practical mitigations instead of all the unnecessary doomsaying happening surrounding this.
Yes. I have used Matrix professionally for years and it's pretty simple for me to understand and follow what is unnecessarily editorialized here to keep my conversations safe. I don't understand why this language is not being simplified to keep Matrix users safe, as that should be the highest goal of this entire situation.
"if you follow these instructions without fail, Matrix can provide you with confidentiality and authentication." I was hoping the researchers could clarify these simple mitigation instructions to protect users, assuming they already know how to use Element.
Your suggesting to use Slack, where a similar compromise would reveal your entire account message history.. ? Just enforce proper key verification for now and you're fine..
Looks like it would only be "likely to go unnoticed" for users that regularly disregard the massive annoying warnings about unverified devices and don't enforce verification
It still looks like users that enable the previously mentioned option and/or verify sessions accordingly are fine. I'm just trying to clarify a simple guideline for users looking to continue using Matrix securely with confidence.
Yes, FydeOS is a ChromiumOS fork with their own login server and Android support. They recently open-sourced their base build (including Pi image overlay) on OpenFyde.io
Thanks for your work! So a user can mitigate this by keeping encryption enabled and also enabling the option to never send encrypted messages to unverified sessions?
No, there are not vulnerabilities in Matrix's encryption. Homeservers are not decrypting all your messages, which is what the subheading seems to suggest.
A specific client js library implementation used in Element could have been exploited to impersonate users, join rooms, recieve future messages in these rooms.
Of course, everyone sees notifications and warning icons of these new sessions.
Responsible disclosure occurred, flaws being patched appropriately, not found used in the wild, carry on...
I applaud Matrix and Element teams for tackling the hard problems of e2e for the masses and doing a phenomenal job.