News for hackers. Stuff that matters.

CapacitorSet

Re:Interview with an anonymous AWS cybersecurity engineer on Tuesday December 22, 2020 @06:09PM (#25512528)
This reads a lot like a PR piece for Amazon, with most "answers" promoting Amazon nearly like a press release and very little negative points.

A few sentences that stand out:

> If you have a ton of data in your data center and you want to move it to AWS but you don't want to send it over the internet, we’ll send an eighteen-wheeler to you filled with hard drives, plug it into your data center with a fiber optic cable, and then drive it across the country to us after loading it up with your data.

> Q: I know there have been a number of collective actions among Amazon warehouse workers around the issue of safety during the pandemic. > A: (a series of measures implemented at Amazon)

> Internally, people say, “Oh, we’re probably better than our competitions, or other warehousing and logistics companies.”

> Q: Has Ring brought Amazon into much closer relationships with law enforcement? > A: it would really surprise me if any of those relationships were the result of the Ring acquisition [...] I think Amazon also kind of backed into that situation. We only realized after the fact that we had all this data about who was coming to people’s front doors.

Re:Java Verbal Expressions on Wednesday November 25, 2020 @11:53AM (#25211266)
It seems that the cruft really boils down to using groups even where there is no ?/*/+ qualifier.
>a very convincing page on śtellar.org

If you rarely use IDNs, toggling `network.IDN_show_punycode` in about:config can help with that - you would have seen `xn--tellar-2ib.org`.

>I’ve met several founders who wanted to enable tele-medicine years ago but decided against it because “the lawyers cost more than the engineers”, and walking-on-eggshells destroys morale & iteration speed.

Thankfully so - I wouldn't want my telemedicine to rely on eg. some random unsecured Mongodb instance.

Re:Signs you're following a fake Twitter account on Thursday March 12, 2020 @11:57AM (#22558131)
I feel like the article went way too much over aspects like TPDNE and the non-existent lawyer, which - while being useful to know - are somewhat poor indicators of fake profiles especially in a tech circle. I personally know a few people who use TPDNE profile pictures and many who use fake names, although none do both (a wise thing in this day and age). The rest was quite lacking.
Re:Run your own high-end cloud gaming service on EC2 (2015) on Sunday February 09, 2020 @05:15PM (#22284702)
>$0.11/hr Spot instance of a g2.2xlarge

I'm not an AWS user, but don't spot instances risk being shut down/paused/etc at any moment? It seems like a bad solution for remote gaming.

The world is running at full speed towards a dystopia where private companies are more powerful than entire countries.
Re:Am I Unique? on Saturday January 25, 2020 @06:37PM (#22149355)
All the fingerprinting tools I've seen so far do not include JA3 signatures, which in my opinion make for an interesting bit of information - they introduce few bits of entropy since they depend on the TLS implementation, but for the same reason they can't be easily spoofed.

Plugging in an article and demo I wrote some time ago: https://jwlss.pw/ja3/

Re:First Node.js-Based Ransomware: Nodera on Wednesday January 22, 2020 @08:32PM (#22123990)
Interestingly enough the JS source is not obfuscated, merely minified with no name mangling.
Fractions of nanometers close? That's some insane precision.
Re:Debugging Network Stalls on Kubernetes on Friday November 22, 2019 @05:49PM (#21610946)
I feel like the title is somewhat appropriate: part of the post was about selectively removing parts of Kubernetes networking, and digging through the kernel networking stack, to troubleshoot the issue
If you share usernames, that is. I could very well make up a unique username like "Nikatoa" that I never even thought of before, and there's no way you could link that to any other account of mine - short of database leaks containing my email or linking/commenting from one account to another.
Re:NoSnoop – Find out if your HTTPS traffic is being monitored on Saturday November 02, 2019 @04:51PM (#21430003)
I find it somewhat ironic that the tool is served over HTTPS over some random domain. Certainly if an attacker has the resources to forge a certificate for eg. telegram.org doing the same for trustprobe.com won't be much harder.
Re:Private firefighters go to work for California's wealthy on Monday October 28, 2019 @09:20AM (#21376682)
>if firefighting is privatized, insurance companies would require more fire-resistant building materials and design (instead of the typical match-box American single-family home or low rise apartment)

This is what happens when firefighting and house maintenance are in the same interest. The libertarian argument argues for a private interest, but it could very well be turned on its head in favor of a public interest.

Re:Curryfinger – Find the Server Behind the CDN on Saturday September 14, 2019 @09:07AM (#20970553)
>I just find it odd how someone would go through the trouble of setting up HTTPS (instead of terminating it at the CDN)

At least wrt CloudFlare, it's actually recommended - for privacy reasons, at least so they claim - that you run SSL both between client and CDN, and between CDN and server: https://support.cloudflare.com/hc/en-us/articles/200170416-E...

Re:How the UK Security Services neutralised The Guardian on Wednesday September 11, 2019 @06:17AM (#20938323)
>An error occurred during a connection to www.dailymaverick.co.za. Peer using unsupported version of security protocol. Error code: SSL_ERROR_UNSUPPORTED_VERSION

How can you test so little on Firefox that it doesn't even connect? (FF Nightly, Linux)

Gates access to whom? Trade-offs in favour of what?

Introducing a fixed price gates the poor the most (eg. a wealthy individual can afford to spend a couple hundred pounds on a yearly subscription without much thought), and often incentivises trade-offs in favour of individual transportation (i.e. cars), which is less desirable in terms of pollution and traffic.

Re:A DMZ 'gardening job' that almost sparked a war on Thursday August 22, 2019 @03:40PM (#20771654)
Arguably, the US doesn't quite have the moral high ground in Asia...
Your setup will marginally benefit from the addition of [Decentraleyes](https://addons.mozilla.org/en-US/firefox/addon/decentraleyes...), an add-on which prevents requests to CDNs by serving some content locally.
Italian users might be interested in https://gambe.ro, a news aggregator to discuss the technical and social aspects of technology. Likewise, https://www.journalduhacker.net/ for French users.

Disclaimer: I'm a co-founder of gambe.ro.

Re:Pentagon testing mass surveillance balloons across the US on Saturday August 03, 2019 @07:13AM (#20599809)
It's a matter of cost and disincentives.

Want to pass a law that cuts on workers' rights in a country that typically doesn't protest? Sure, go ahead. Want to do that in France? You'll think twice about it after the clashes of 1st May and of the gilets jaunes.

Re:Almost half of Europe’s soil is dryer than normal on Saturday August 03, 2019 @06:29AM (#20599667)
This is not consistent with the data presented in the article, which shows that the "percent of Europe's area that is dryer than normal" is historically between 5% and 25%.
I fail to see how this would be of any help, especially the former. To me it looks like a feel-good action with virtually no political impact.
>It’s reasonable to charge fat people more.

It's only reasonable insofar as you view insurance as a profit-maker and deprive it of its social function of financial relief.

Older »