karma20

Firefox for iOS and macOS. I have strict tracking protection [1] enabled on the former, and NoScript + uBlock Origin set up on the latter. I also use Little Snitch on the Mac.

[1] https://support.mozilla.org/en-US/kb/tracking-protection-ios

I like the concept but share some of the blockchain concerns here. In particular, I'm interested in how the Gaia "driver model" [1] is actually architected, and how this compares to local storage:

> Gaia enables applications to access [it] via a uniform API.

[1] https://gekri.com/privacy

HN's policy on paywalls is outlined in the FAQ [1]. Private Browsing mode is generally a good workaround:

> It's ok to post stories from sites with paywalls that have workarounds.

> In comments, it's ok to ask how to read an article and to help other users do so. But please don't post complaints about paywalls. Those are off topic.

The rationale explained by dang in a 2015 post [2] makes sense:

> Publications like NYT, WSJ, the Economist, and the New Yorker have paywalls that leave ways for readers to work around them. Such stories are OK to post to Hacker News. Yes, this sucks, but the loss of many substantive articles would suck worse.

[1] https://news.ycombinator.com/newsfaq.html

[2] https://news.ycombinator.com/item?id=13434938

HackerOne is a platform on which Valve runs a public program [1] that awards monetary bounties. I'm confused as to why Valve is allowed to forbid disclosure of "out-of-scope" reports and will only "generally" disclose reports in any case:

> Please note that we will not consent to disclose reports if they have been marked out-of-scope or inapplicable, or where Valve has not taken a specific corrective action / mitigation.

> Valve embraces transparency in our security. We will generally disclose the details of vulnerabilities found, upon request.

[1] https://hackerone.com/valve

Also of interest is the follow-on discussion [1] taking place on the electron/asar repo.

[1] https://github.com/electron/asar/issues/123

Qihoo has also employed dark patterns to push deceptive security practices around its own browser [1]:

> When you attempt to install other browsers, the 360 Safe Guards will allow the browser to be installed but will then popup saying not to let it become the default browser.

> When users of 360 Safe Guards run a check of their system, if they don't have the 360 browser installed it will give them a failing grade. If the user chooses another security software to protect their failing grade browser, the Safe Guards say no.

Also interesting is a statement by Opera on the 2016 acquisition [2]:

> The transaction would give Opera access to the extensive internet user base of Kunlun and Qihoo in China as well as the financing and other support of the Consortium that would allow for the full potential of the Company to be realized. At the same time, Kunlun and Qihoo would be able to cross-sell their products and services to the Opera user base, and benefit from Opera’s leading mobile advertising platform.

[1] https://web.archive.org/web/20150723081728/http://www.digita...

[2] https://arstechnica.com/information-technology/2016/02/chine... (can't find a direct link)

TL;DR: Microsoft bumps Azure max bug bounty to $40k, introduces Azure segregated hosts for researchers to test against, and formalizes their Safe Harbor terms [1].

[1] https://www.microsoft.com/en-us/msrc/bounty-safe-harbor

Interesting concept. From the FAQ [1]:

> Login into Hero Trainer when you go for a run (gym check-ins will come in the future)

How would you calculate points earned for each run or gym visit? For the former, does the app rely on step count during the "tracked" period or does it incorporate outdoor GPS?

[1] https://hero-trainer.com/faq/

TIL. I should check out Rectangle:

> Spectacle used it's own keyboard shortcut recorder, while Rectangle uses MASShortcut [1], a well maintained open source library for shortcut recording in macOS apps. This cuts down dramatically on the number of bugs that were only in Spectacle because of the custom shortcut recorder.

[1] https://github.com/shpakovski/MASShortcut

Interesting. From the source article [1]:

> [...] they would essentially be "dev devices." Think of them as iPhones that allow the user to do a lot more than they could on a traditionally locked-down iPhone.

It sounds like Apple might provide vetted researchers with development-fused devices [2]. In an official capacity, these have only been mentioned once - during a Black Hat talk by Ivan Krstić [3].

[1] https://www.forbes.com/sites/thomasbrewster/2019/08/05/apple...

[2] https://www.theverge.com/2019/3/7/18255509/apple-iphone-dev-...

[3] https://www.blackhat.com/docs/us-16/materials/us-16-Krstic.p...

At least in part, the author seems to conflate 'collecting images of pax' with 'their usage of the IFE':

> Cathay confirmed it is collecting images of passengers while they're on board, monitoring their usage of the in-flight entertainment system (IFE) and how they spend time during the flight.

However, it sounds like Cathay are just using fixed cameras and not ones built into individual IFE screens:

> The airline said these images are captured via CCTV cameras fixed around the airplane and not from embedded seat-back cameras.

> Cathay's spokesperson said similar devices were not installed in its IFEs. "Our inflight entertainment systems do not have any cameras, microphones or sensors to monitor passengers, nor have they in the past."

For sure. It definitely echoes the thrill of bug-hunting when you know you’ve found something interesting but need to dig a bit deeper.

> It is fascinating how we are moving from traditional ads, as everyone has grown an automatic negative response, into these more subtle experiences.

Absolutely, and overlay AR sounds like their next step:

> Snap recently released zanily animated beacons called Landmarkers — the Eiffel Tower can pop like a champagne bottle for tourists.

Interesting that they've already tested this with an ad campaign [1] but don't want partners to dilute theirs IRL [2].

[1] https://variety.com/2019/digital/news/game-of-thrones-snapch...

[2] https://lensstudio.snapchat.com/templates/landmarker/

Todos: I use Trello with a handful of boards, most containing Getting Things Done style lists (Today, Tomorrow, This Week, Sometime).

Note-taking: I settled on Bear after trying Apple Notes, Evernote, and OneNote. While I can't search inside scanned docs, the UX is polished and syncing is flawless if you're in the Apple ecosystem.

Agree. This kind of DLP-like scanning is totally infeasible at GitHub scale.

In particular, one excerpt from the complaint reads like output from a noisy scanner that has detected “exposed SSNs” in client-side code:

> [...] Social Security numbers are readily identifiable: they are nine digits in the XXX-XX-XXXX sequence.

Das Pro, brown switches. Picked one up to replace my aging daily driver at work (Magic Keyboard). No complaints here.