News for hackers. Stuff that matters.

kiallmacinnes

Re:Barcodes are about to go extinct on Saturday October 03, 2026 @05:10AM (#49942585)
Absolutely - I 100% expect the links to lead to feel-good marketing fluff at best and end up being useless for consumers, but the stated goals are at least good.

It's just that, sadly, we can no longer have nice things.

Re:Barcodes are about to go extinct on Saturday October 03, 2026 @03:12AM (#49942022)
As I understand it, The key bits of data are in the QR code, they are just encoded as a URL - a highly structured URL that point of sale systems can decode without visiting the URL.

Doing it this way means the QR code is directly usable by consumers to get to a product info / marketing page, and directly usable by the POS systems.

Edit: I looked it up. An example URL:

https://example.com/01/09521207311511/21/1234ABDE1235

01 is a marker before the traditional barcode.

21 is a marker before the serial number.

There seems to be many other codes like 17 (expiry date) and 10 (batch number).

An annoying trend I've been seeing recently, which the GitHub repo behind this does, is having better documentation for the robots than there is for the users.

Compare the README.md to the skills/pay-for-http-request/SKILL.md

It's far more likely to be "not allowed to ignore a serious* call out" than a budget or training conspiracy...

*Serious as in, supposed shootings / murders / kidnappings etc - not serious as in "a legitimate call out"

The chances are, if you live somewhere like that, somewhere that actually has a low noise floor for RF, then you likely also have a lot of space to cover with your wifi - and that means sacrificing range (via additional access points) for the second network..

For me: Wifi is great! But, whenever it's practical, I avoid it... Everything with it is a tradeoff!

Your LAN can handle it :)

If the current setup can't, plugging the cameras and the NVR into a separate switch and none of that traffic will go near the rest of your LAN.

Wifi on the other hand, there's really no (practical) segregation to speak of - the spectrum has limited bandwidth, it doesn't matter if it's a different SSID / wifi network, it'll affect your Wifi!

Peer to peer? Self hosted stuff? (not sure how these work with starlink specifically, but - they should work, even if for whatever reason they don't)
While technically, yes, you are correct. It kinda misses the point - developers are more and more working with containers. Doing this on a Mac is an awful experience compared to doing it on Linux (or, Windows - I hear docker + WSL2 is pretty decent - but I've not tried it!)
> this device can handle a lot: firewalls, user management and access control for home media and file servers, and even some traffic control in data centers – without the need for a stand-alone router.

It's definitely got home networks as a target market. It's one of the suggested use cases.

Re:Briar has been removed from Google Play on Monday February 28, 2022 @07:58AM (#30499329)
I'm sure they are perfectly capable of signing up. But, I'd bet they are expressly forbidden from doing it.

Signups typically involve agreeing to some terms, and you absolutely don't want company employees working their official job duties agreeing to random T&C's.

> 1. Since 2020, it's illegal to send PII (personally identifiable) data to the US because of the removal of the Privacy Shield Framework [2]

Minor nit - "PII" really isn't the right term to use, because it suggests the info itself must be personally identifiable to an individual. The GDPR covers much more than this, and uses the term "Personal Data".

I stand corrected - not everyone can agree!

In reality, as a service provider, you have no ability to determine if the client IP belongs to an individual or not - so you have no choice but to assume it does identify an individual.

Honestly, it's not that big a leap to reach this interpretation.

1) Your IP address is considered personal data, as it can be used to identify you. In general, everyone can see and agree with this.

2) In the absence of additional protections and/or contract terms[1], the transfer of personal data out of the EU is an offense under the GDPR (well, technically it's not out of EU, but transfer to a country without GDPR equivalence).

So - embedding code / data from a 3rd party into your website results in a transfer of personal data.

[1] The idea of additional protections/contract terms is even questionable, but that's a whole other thing...

That's not strictly true - or at least - it's missing a piece.

When a company decides to use a product, it needs to ensure that product is legal to use in their jurisdiction(s).

If it gets to a court, it's likely that the consumer/client is the claimant and the Company who chose to use US Product X is the defendant. The company who makes US Product X is likely nowhere to be seen.

Re:Containerize Go and SQLite with Docker on Tuesday January 18, 2022 @03:52AM (#29976690)
They probably have 100 other apps and deploying this one without docker would make it a snowflake.
> but from my experience with Jenkins, I've seen using passwords in plaintext so many times, even in big companies

I reckon this has to do with how the CI tools are configured.

Everyone knows you shouldn't commit a secret to Git, so tools like GitLab CI which require all their config be in git naturally will see less of this specific issue.

Re:Some ways DNS can break on Monday January 17, 2022 @04:58AM (#29964979)
> This article ignores the most common problem I have with DNS these days which can roughly be construed as: What is actually handling resolution on my system?

This does my nut in too - even just narrowing the Q down to modern Linux Desktops with e.g. chrome/firefox, and I have absolutely no idea what the query path is. So many components have been added to the path over the last few years :(

Re:Some ways DNS can break on Monday January 17, 2022 @04:55AM (#29964960)
That's not always possible & wise, e.g. the example given is the Kubernetes search/ndots values. Changing this would break the expected "API" between the applications in Kube and the Kube cluster, which is bound to cause some pain and suffering down the line :)

Using a FQDN (as in, a DNS name with the trailing dot) is the only reliable way to avoid this without breaking other things!

Re:Some ways DNS can break on Monday January 17, 2022 @03:44AM (#29964599)
On the `ndots` problem, it's best to get in the habit of using fully qualified names when you know them. A fully qualified DNS name ends in a period.

Continuing the example in the article, use `google.com.` and there will be just one query.

Re:The utilization of 44/8: the reason I mapped IPv4 and IPv6 on Monday December 06, 2021 @09:09AM (#29459878)
Need? They most likely don't need it.

They got it back in the day (prob mid-90's) because they asked for it - IP space used to handed out like candy on Halloween.. Now that it's a valuable asset - they are very unlikely to just hand it back.

Re:Winamp source code leak on Monday November 29, 2021 @09:47AM (#29380459)
I'm not 100% sure of all the details, but archive.org has some exceptions[1] to the DMCA & thanks to California, it's officially considered a library - which again, I believe gives it some more leeway on the DMCA.

[1]: https://archive.org/about/dmca.php

> that's an unintended consequence

No, it's entirely unrelated to NAT. That's a consequence of the firewall on the router.

IPv6 doesn't get rid of the firewall.

Re:Universal Android Debloater on Saturday October 30, 2021 @02:17PM (#29051034)
I don't see anything in there that requires `adb uninstall com.sony.foo` to work, for example?

The command should generally work, sure, but that doesn't appear to require the command should work for all stock package names.

Re:Email Authenticity 101: DKIM, Dmarc, and SPF on Monday August 16, 2021 @05:29AM (#28196346)
> SPF will verify, but for the wrong domain

I can see that argument, but - it's kinda a philosophical question about "who the sender is". Is the the person who typed out the text? or is it the server which transcribed that text into N new emails?

The ML server will verify the original authors SPF. The N recipients will verify the ML servers SPF - the chain (which matches the series of MTA's involved) is still verified end to end.

> It'll break when used together with DMARC's alignment checks.

Yea, DMARC is a much bigger issue for mailing lists, but that's no reason to say "A mailing list will _always_ break SPF" - a well configured* ML has no issues with SPF at all.

* And, yes - the definition of "well configured" had to change when SPF was introduced, that's of course annoying, but there has been many many years for ML operators to make these changes.

Re:Email Authenticity 101: DKIM, Dmarc, and SPF on Monday August 16, 2021 @05:01AM (#28196188)
One of SPF's shortcomings is that is doesn't act upon the `From` header at all, which is the name/address the recipient most often is shown. Instead, it acts upon the `Return-Path` header, which a well configured mailing list will set to a domain it controls.
Re:What's Inside the EU Green Pass QR Code? on Tuesday June 22, 2021 @11:00AM (#27592521)
It's about as thin as it can be, given the requirements for offline validation, and the environment it's designed for (airports / other national borders etc).

Nobody wants every verification resulting in a ping back to some central server doing who knows what.

Re:What's Inside the EU Green Pass QR Code? on Tuesday June 22, 2021 @08:12AM (#27590667)
Theres a whole extra layer of legal complexity here :)

e.g. some countries will consider you fully vaccinated X weeks after your 2nd jab of a specific vaccine. Others will say it's X+1 weeks.

The system has been built so that these decisions aren't in the cert itself, rather each country can layer on "business rules" on top. So - even if the cert expiry date is likely to be set far into the future, that has zero bearing on if it will be accepted or considered expired.

Re:New browser signal could make cookie banners obsolete on Wednesday June 16, 2021 @12:56PM (#27530729)
Ignoring the many obvious privacy issues with this proposal, have you considered how this would result in a legally mandated single point of failure for (nearly..) all web sites?
Re:Security keys are now supported for SSH Git operations on Wednesday May 19, 2021 @08:28AM (#27207627)
By "place to dock", you mean like a USB port or something else?

Lots of keyboards obviously have that already - including at least some of the Das Keyboards (mine does...)

Re:Security keys are now supported for SSH Git operations on Wednesday May 19, 2021 @02:20AM (#27205211)
Yes, you can use gpg-agent to handle this - I've been doing it for years... Every machine does need to be setup to use gpg-agent in place of ssh-agent, which frankly is a little annoying - but once it's setup your key is entirely on the YubiKey or similar.

Here's[1] the first blog I could find that at a glance appears to provide the right instructions.

[1]: https://evilmartians.com/chronicles/stick-with-security-yubi...

Older »