mmooss

I have no idea what happened. I expect any experienced attacker knows about remote lock and remote wipe, and their first step would be extract everything they can ASAP.

Then they can load the extracted bits onto something else and go forward from there.

> it’s not really about stopping the breaches because it’s hard to say you’re ever going to be free from breaches, but creating a system of data storage that takes potential breaches in mind.

It's all of the above; generally it's called 'defense in depth': you don't just want a hard shell, you also want to secure the internal components - data and code.

Again, you want to start with a census of what is valuable and focus on protecting those things. You don't have resources to secure everything.

IMHO NIST advice is highly reliable but it's often too complicated to be useful, which seems to be the case here (that's up to you, of course).

Otherwise, you need to start with an idea of what valuables you have and what threats - hackers? lawsuits? competitors? how well-resourced? - you're protecting against. No security will be perfect. You need to make it more expensive to steal your data than it's worth to the attacker.

A few general tips off the top of my head:

* As much as possible, don't store anything on a computer that you don't want to read in the news or hear read to you in court. The safest data doesn't exist. For any communications, set a retention period (e.g., delete messages in 30 days), and just save separately anything you need to keep.

* Store confidential data (passwords, credit card numbers, anything that can cost money or reputation) only in a secure database; the only exception is when the data is actually requird. Password databases, if they have long-enough fields, can work here. Do not keep it in emails - don't email around passwords, credit card numbers, etc.; otherwise when the hacker accesses your email, all is lost. This especially applies to confidential client data - you don't want to have to explain to all your clients, 'you're confidential data might have been stolen - I don't really know if they hacker found it or will use it.' With a secure database, you have peace of mind.

* Use Apple products. They prioritize security and have the resources to deliver on it; they are the fastest route to security. Windows' value is to larger organizations managing large numbers of computers. Linux is too complicated to secure for non-technical users (and probably isn't as secure as Apple). It does require trusting Apple, but you need to trust someone.

* Use Signal for communication, as much as possible.

* Security is much too hard to do yourself. Depending on need, use products that a vendor remotely manages (but then you need to trust the vendor). Use your firewall to filter viruses, though that's imperfect and you need to be careful about it slowing down throughput.

> In 2020, NASA’s New Horizons spacecraft, having passed the orbit of Pluto, measured a proxy for the amount of hydrogen around it. In the area between stars in our galaxy — the “interstellar medium,” or ISM — New Horizons found around 130 hydrogen atoms per liter of space.

Not to nitpick, but I thought New Horizons hasn't entered the ISM, and only the Voyager craft have?

I agree. What I'm saying is, that's not a problem in this particular use case. To make a big generalization about search results:

For any search have always been a few or several valuable results, and more than enough bad websites to fill the first 10 or 100 or more pages of results - more than any user ever sees. Multiplying the number of bad sites by 1,000 due to people using LLMs doesn't change the search user's experience - there's still more than enough.

It's still the same problem for Google: Find the few valuable results and put them on the top. Does Google even need different tools to identify them? Link farms and spam pages are old technologies.

> ... I put the question into Google and clicked the first result: the Nighthawks Wiki.

The problem here is Google. Bad websites have always been around.

I see. Roku, for example, takes screenshots of the TV N times per second (and sends them home).

Remember that it doesn't take much to identify someone: Gender, birthdate, and (zip code?) uniquely identify ~80% of Americans. From viewing habits, it should be easy to fingerprint someone - Chicago Bears fan; strong technology interest; on your city block; likes AI porn with Lara Croft; home during day Sa, Su, Tu, Th; watches YouTube videos about ...

They have your location, and can detect your interests from what you watch, and fingerprint you. Things like this are pieces of a larger, comprehensive picture of your life.

Also, how do you pay for streaming channels, etc., if you don't give it any information?

Happened to elderly relatives. I had it set up so nicely and someone 'helped', and then it seems rude to disconnect what they did.

There are available IoT networks it could use, though I don't think all of them run over Wifi.

1) Would you consider publishing which apps you removed? (A wiki on making smart devices dumb - cars, TVs, refrigerators, tractors ... - would be useful, though I'm not suggesting you make and manage it yourself.)

2) Why bother removing the apps if it has no network connection? Defense in depth is sensible to me, but maybe there's something else I'm missing ...

3) Why not buy a large desktop computer monitor, or are those no longer 'dumb' either?

D. They seek disruption as way to market dominance and worldly power. It's not unfortunate, in their minds, but the means to their ends.

Disruption has been a SV buzzword for a long time now. It's not a byproduct but a strategy for your new technology product. SV has long perfected disruption and the people behind the AI products are masters at it.

How can so many who have seen it (and used it) for so long be so taken in by this well-worn tactic. Over and over, they choose what is most disruptive. They could have dealt with the mathematical output in many ways, including working with mathematicians to polish and publish; you see what OpenAI chose.

Similarly was the recent events where AI software 'broke containment' and hacked others. Obviously they could have controlled it if they valued it; they got the result they wanted. Notice how Anthropic (or were they first and OpenAI followed?) urgently publicized that their product, too, 'broke containment'. 'We're disruptive too!'

> there will be some thermal loss over time, but insulation is cheap

FWIW, one US govt source attributes ~20% of a typical household's domestic energy usage to water heating, though the source doesn't attribute it to thermal loss or initial heating.

You compared them to the 'very rich executives' in the parent comment.

Aha! What I meant by "politicized" is an issue like climate change, which is mostly an objective matter of evidence and rationality, turned into a political football that is a matter of my-side-vs-your-side.

It's a common technique used when the evidence and rationality are overwhelmingly against someone. Then they harp on (climate change) as (liberal) lies and oppression.

> For scientifically bogus reasons, there is a lack of trust in the experts behind the COVID vaccine, and therefore an opportunity for political exploitation. Hence vaccines have become a political issue.

I think that's backward: Politicization of COVID vaccine, with the ground laid by prior health and scientific issues, causes the distrust. The same was done by the same people to attack every other institution: Science generally, journalism, academia (e.g., elite colleges), healthcare, international relations (the State Dept and Defense Dept), Federal Reserve, 'liberal' judges, etc.

It's intentional - by politicizing the issue, it shifts influence from the institutions to the political group. Reality becomes whatever they say it is - there is no external check on them remaining.

I'm sure you've considered satellite. As backup for the 999 service, maybe one of the emergency 2-way pagers carried by hikers?

> The company previously told The Register that customers without a fiber connection will likely be switched to SOTAP for Analog (Single Order Transitional Access Product), where equipment is installed in the local telephone exchange to allow them to continue to use their old phone line as before.

What does Single Order refer to? One purchase order at a time?

> I think you are asking for the voters to give the government a blank check to solve the issue.

Could you tell me what in my comment says or implies that?

> on a politicized issue

Climate change and natural gas's contribution to it are well-established facts. It's too easy for someone to politicize anything at all - climate change, vaccines, etc. - and then part of the population says, 'oh, we can't touch that'.

Natural gas is already more expensive. What people advocate is putting the actual price on the bills so people can make rational decisions.

What isn't on the bills but still affects people's pocketbooks is climate change, military funding (for countries without domestic natural gas), etc. People in Los Angeles don't see the fire damage on their gas bills, but they sure pay for it.

> a heat pump water heater ... use[s] substantially less electricity

Is that accurate?

They use a tankless water heater so electrical use is ~zero when nobody is using hot water, which is most of the time. If you use a tank - heating ~40 gallons of water 24/7/365 - that's hard to compete with by just being more efficient.

Is there such thing as a heat pump-powered tankless water heater? I expect the challenge is the surge of energy needed to instantly warm heating elements to functioning temperatures.

There are all-electric tankless water heaters but in my limited experience they need ~120A available, which is prohibitively expensive. (Why not just a capacitor that can surge the startup energy?)

I think you greatly overstate the results:

"... our study assesses if users are able to detect and deter man-in-the-middle attacks on the SIGNAL protocol. Our results show that the majority of users failed to correctly compare keys with their conversation partner for verification purposes due to usability problems and incomplete mental models. Hence users are very likely to fall for attacks on the essential infrastructure of today's secure messaging apps: the central services to exchange cryptographic keys."

Why not just describe the actual results? Most Signal users aren't subject to MITM attacks and establish secure end-to-end connections with zero effort or thought.

Federal requirements for Medicaid starting in January will result in large numbers of people losing coverage.

When they say "social graph for Signal", afaik they don't mean 'on Signal servers' but 'social graph on your phone'. It's a personal social graph that exists on the end-user device.

I don't remember how the hash issue is dealt with, however.

> Signal is not peer-to-peer. It is a centralized, client-server architecture.

It's not a P2P mesh, but Signal's servers are involved only for certain functions. I think communication tx is P2P - to send a message via server (used to hide sender IP address from onlookers and the recipient), you need to enable relaying. Possibly finding the recipient still relies on the server - if I want to send a P2P message to Abel, to what IP address do I send it?

> They got a 50 million seed donation in 2017 and reported almost 30 million in revenue in 2024. They are not exactly small. If they were VC founded and not a non profit they would be a unicorn.

The donation to Signal and VC investment are very different things: Donations to Signal are for operating costs. VCs invest for the purpose of enabling and owning a share of exponential growth to 'unicorn' status.

> unicorn

Unicorns are billion dollar companies that are rapidly growing. Signal isn't close to that.

> The server has access to your IP addresses and the server can at will build social graphs about the users.

How could it build a social graph? I think most messages are P2P unless the user activates relaying?

Thank you!

Last week, after spending 30 minutes placing one order in Uber Eats, I finally hit the last confirm and it told me the restaurant was no longer taking orders that night. I called the restaurant and they said they couldn't help: they only take orders over Uber Eats and they can't control UE's system.

Yes, they absolutely could help. They could take an order over the phone. They could choose a subcontractor who delivered good service to the restaurant's customers. The restaurant is 100% responsible.

If I used a subcontractor for a client, not in a million years would I tell the client, 'the subcontractor's failure isn't my problem; I can't control them'. I would look like a joke, entirely unreliable and clueless.

As in any job or interview - especially if you offer something different than all the carbon-copy candidates - you need to compel them to see your value.

If you believe in what you do - and 'decency' (depending on definition) isn't hard to believe in, having a long track record and obvious advantages - it's relatively easy to be compelling.

Finally, don't work for the corp. Work someplace else. Start your own!

> After running thousands of simulations, the team raised the rover’s tilt limit to 24 degrees and reduced the clearance required under the rover’s belly pan to 20 centimeters (about 7.9 inches). The team also updated the rover’s braking software to avoid rock hazards, nearly doubled steer motor current limits, updated flight software with “dynamic slip tables” to model expected slip, and used cross-slope driving to better anchor wheels on exposed bedrock.

I wonder why they didn't model and use these parameters in the original design (I'm not at all suggesting a mistake on their part; I wonder what their thinking has been):

Were Martian environmental parameters less well-known (e.g., how gravity, air resistance / wind, and scree dynamics interact)? Bot performance in Martian environment (e.g., motor power output) less well-known? Were they being understandably conservative with their irreplaceable bot?