News for hackers. Stuff that matters.

flixic

Re:Find images from movies based on what you draw on Wednesday October 13, 2021 @12:16PM (#28854106)
It somewhat decently identifies the object drawn, but fails badly to actually find the identified object.
Re:The Facebook Status Page is up again on Monday October 04, 2021 @05:55PM (#28752576)
Facebook app, Instagram and Messenger are working for me.
I'd like to hear Microsoft's explanation for this "feature".
Re:Cryptocurrency and the unbanked on Sunday October 03, 2021 @07:57AM (#28736480)
Despite benefiting tremendously from crpyto, I don’t believe this narrative.

The article mentions the core problem: being your own bank is a HUGE risk. I can accept that risk and deal with complex security mechanisms I have to maintain to both protect my own bank and keep it accessible. But a good security guide for crypto is 20-30 pages and requires serious cryptographic understanding. Currently, I can’t expect that from average users.

Everything can be solved over time. Social recovery wallets and user-friendly hardware might become mainstream. But I don’t see that happening in the next 5-6 years, and I fully expect CBDCs to be far along in that time. Then, countries will be a lot less motivated to promote crypto for the unbanked.

Re:The Rise of One-Time Password Interception Bots on Friday October 01, 2021 @12:22PM (#28720418)
For transfers, Smart ID displays both recipient and amount. So that part can’t be easily MITM’d.
Re:The Rise of One-Time Password Interception Bots on Friday October 01, 2021 @11:15AM (#28719556)
I never thought about this, but yes, I think it can be MITM'ed exactly as you described. Same attack can probably be performed on the web, where Smart ID is also a sign in method.
Re:The Rise of One-Time Password Interception Bots on Friday October 01, 2021 @10:52AM (#28719193)
Banking systems in Baltic countries use a unified 2FA system called SmartID[0]. When authenticating to bank via phone, they ask for two things: your user ID (which is not secret), and to authenticate using Smart ID, which means entering a PIN on your phone.

However, each PIN entry is accompanied by "code check": bank's support person says their 4 digit code, and you can verify that it matches on request for PIN screen. This neatly prevents someone pretending to be a bank during a call, because each PIN request uses a different "code check".

[0]: https://www.smart-id.com

It's also very simplistic. In subject matter, in character archetypes, sometimes in acting, and most annoyingly, in editing (how it never trusts the viewer to remember what happened 25 minutes ago, so they show flashbacks to remind you).
Re:Telling the Bees on Tuesday September 28, 2021 @01:27PM (#28685250)
The name wasn’t based on bees just because bees are respected. “Bičiulystė” (meaning friendship, using the same word Bičiulis) was usually a neighbor friendship with a particular purpose: to take care of bees communally.
In many cases, "animations on the web" has become Lottie animations. Or, at least, Lottie raises the bar for animation expectations.

I'd love to see two things:

- A decent free or one-time payment editor for Lottie (don't make me use AfterEffects)

- Perhaps a Lottie implementation using Web Animations API, if that is even possible.

So, China is the worst because of censorship (strictly controlled information), and US is in a bad spot because of too much misinformation (too little control on information).

I'm struggling to understand this "measurement".

Re:iOS 15 on Monday September 20, 2021 @04:38PM (#28598692)
Initial Safari design was quite different from what shipped today (beta process worked!). The main differences were: all the buttons where crammed into the address field, dropping the toolbar (shipping design returned the toolbar), and the address bar was floating over content, detached from the bottom. This caused many sites to break.
Re:Renting a car will be a pain until at least 2022 on Friday September 17, 2021 @05:39PM (#28571213)
It's been a long, long time since I read an LATimes article. It looks like they finally allowed people from Europe to view their website, after years of blocking it completely due to not willing to deal with GDPR. Well done, and "finally".
Current comments seem to be responding to the wrong topic. This article is not at all about energy use, but about mining hardware lifetime and resulting eWaste. Which seems like a legit argument, and harder to dismiss with "but it uses renewable energy".
Re:Monotype acquires Hoefler&Co on Friday September 17, 2021 @02:43AM (#28562034)
Can’t agree more with this tweet. It was amazing fonts directed by Frere-Jones that created almost all the value for H&F-J.
Re:Kape Technologies buys ExpressVPN for $936M on Thursday September 16, 2021 @01:42PM (#28554735)
Looks like we have a VPN duopoly forming:

- Kape with Cyberghost, PIA and ExpressVPN

- Tesonet with NordVPN, and allegedly a couple more most known, but there is no strong proof, so I'd rather not list them here.

Re:NSO Group iMessage Zero-Click Exploit Captured in the Wild on Monday September 13, 2021 @05:07PM (#28516894)
Apple specifically introduced BlastDoor framework to combat this, so NSO shifted their attacks around decoding, avoiding BlastDoor.
What if 3 US citizens said "fuck no", and it was someone on much shakier ground who felt the pressure to say yes? Not a given at all, just makes it more likely.
Re:A cross-platform GUI for YouTube-dl on Friday September 10, 2021 @10:05AM (#28481748)
The way I look at this, the UI would be only to speed things up / simplify things a little bit. It wouldn't try to do full error validation before execution. It's the job of a command-line app to fail with an error if wrong combination of flags or inputs was provided, and the UI might display that error in a pretty generic way.
Re:A cross-platform GUI for YouTube-dl on Friday September 10, 2021 @08:52AM (#28480799)
Can be XML as well, but I think HTML is too complex. The goal, for me, is simplicity.

    <section name="Options"><checkbox flag="c" label="Compile" /></section>
It shouldn't be a hassle at all to convert a man page to a UI that speeds up actions and avoids common errors.

Anyway, this idea is free, so feel free to take it and do whatever, even full HTML (:

Re:A cross-platform GUI for YouTube-dl on Friday September 10, 2021 @08:49AM (#28480768)
It seems to me that a lot of these projects aim to deliver really "good" apps: native UI, table output, etc… Results are great, but the UI building complexity also becomes quite high.

I think that's the wrong goal. The goal should be really simple definitions and ok quality apps. Simple JSON (or XML, don't care).

    { control: checkbox, flag: c, label: "Compile" }
Re:A cross-platform GUI for YouTube-dl on Friday September 10, 2021 @08:23AM (#28480512)
This is cool! Syntax might scare off many developers, I think one of the goals should be approachability, it should be super easy to transform your favorite command-line app into a GUI.
Re:A cross-platform GUI for YouTube-dl on Friday September 10, 2021 @08:20AM (#28480489)
Gooey is a great northern star to follow, but this hypothetical app should work with any command-line app.

Idea would be to define UI structure that outputs (and executes) essentially a string (command) to run.

Re:A cross-platform GUI for YouTube-dl on Friday September 10, 2021 @08:04AM (#28480353)
An idea that anyone is free to take: JSON-definable UI for command-line apps. Define checkboxes for flags, inputs for arguments, buttons for commands and file pickers / droppable wells for file input. Allow some customization of layout of these elements. Have in-app "store" to download these JSON definitions, maybe even suggest them based on `which` output. Electron app, obviously.
Re:Why don’t the French celebrate Lafayette? on Friday September 10, 2021 @06:39AM (#28479724)
Tiny tip: loose is opposite of tight, to lose is opposite of to win.
The app literally says "Welcome to FractalCrypt!" when you open it. Not only revealing the encryption format name, but clearly hinting to how it works.

I'd much prefer an encryption format that hides itself in a well-known one layer encryption (like encrypted zip).

Re:Chekhov's Gun on Sunday September 05, 2021 @06:53AM (#28423232)
One my favorite subversions of this technique is in Mr. Robot, with a gun hidden in a popcorn machine. Using of the gun is never shown on screen: the show assumes that the person watching remembers that a gun was shown and hidden, and allows the connection to be made "between the lines". Excellent use of Chekhov's Gun, but it only works because of a certain amount of TV tropes literacy.
Re:O.mg Cable on Thursday September 02, 2021 @01:08PM (#28394598)
Took me a moment to realise, but this is for keyboards, not iPhones. I don't think (?) anybody can access anything from an iPhone using an evil cable (using publicly-known attacks).
Re:Helm is a personal server that lives where you do on Sunday August 29, 2021 @05:33PM (#28350653)
It seems they are targeting "normal" people (to whom word "dockerized" sounds like a misspelling of something happening in a port).

Mixing "normal" people and self-hosted email is a recipe for very bad experience.

Older »