mzajc

EDIT: Looks like they reverted this in 8.3? I haven't used it since 8.0, and probably won't, but can someone confirm whether using it without an account is now possible?

Insomnia 8.0 and above requires an account on their servers to use. The stated reason was that this makes it easier to advertise to you. No thanks.

Older versions are fine, though.

https://github.com/Kong/insomnia/discussions/6590

> From context, "vehicle" is clearly inferred to mean "automobile" rather than literally "vehicle".

From what context? At no point does the game say that, and from both the questions and the epilogue it's made clear that the game is about finding edge cases for what passes as "a vehicle" and "in the park".

Linked article: https://www.tomshardware.com/tech-industry/cyber-security/le...

I trust mine not to brick my smartphone on purpose, at least. Especially not using methods that leave traces of what was done.

The exploit gives you access to a machine, not necessarily the one terminating TLS and keeping logs.

I only forced myself to read through this slop prose because I found the topic interesting, but I'd much rather be reading something that doesn't repeat itself constantly and sounds human.

> 100% free and open source

... and the repository contains neither a license, nor the source itself.

> It downloads and runs droidguard with the privileges it has, giving that full access to the privileged access granted to microG.

Wow, no kidding! I checked the source code and sure enough, it downloads the DroidGuard APK from Google[0], and loads a class from it[1], (seemingly?) without any kind of sandboxing or separation. I believe I'm safe because I don't have the Play Integrity API enabled, but I really wish the UI was more explicit about this, because the info text only says

> microG GmsCore contains a free implementation of SafetyNet, but the official server requires SafetyNet requests to be signed using the proprietary DroidGuard system.

[0]: https://github.com/microg/GmsCore/blob/32bc8954ff872d0e1a05d...

[1]: https://github.com/microg/GmsCore/blob/32bc8954ff872d0e1a05d...

> MicroG downloads and runs google code in a privileged context

> many privacy and security issues

> leaking location to apps that dont have the location permission.

Could you share some details on these three points?

There's also https[//]microg.cc and https[//]microg.net, both masquerading as homepages for MicroG, and Duckduckgo finds several more. I actually reported the latter to Namecheap a year ago, but got no response back.

Is there a good authority to report these to? Clearly registrars aren't interested in taking them down, and they're probably not serving malware right now, but fake download sites for software running with elevated privileges is a security incident waiting to happen.

Note that MindTheGapps is distributed at https://github.com/MindTheGapps/. The dot-com domain looks like unaffiliated SEO squatting and could change download links to malware anytime.

Tor is great for this, as long as you're willing to put up with very long domain names, a mild amount of stigmatization, and an extra software requirement for visitors.

I'm so incredibly disappointed that my country, specifically the .si registry and everyone up the chain, is complicit in this :(

I'm sure there's several ways in which ICANN and RIPE could screw Russia over. I'm also sure (or at least hopeful) they understand this would achieve nothing outside of creating a splinternet.

From the guidelines:

> Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead.

Much like you could use any AOSP fork to run banking applications... until you couldn't. But hey, at least there's an explainer website[0] that completely glosses over this detail.

[0]: One great bit of environmental storytelling is the "Made with <3 by the passkey community" in the footer. "Passkey community" of course means timcappalli with minor contributions from two others. You might remember him from https://github.com/keepassxreboot/keepassxc/issues/10407#iss....

> there were some people on the standards committee(s) envisioning a glorious world where they can flip this on for everyone and instantly all the bad stuff stops.

Why the past tense? Here's a list of FIDO Alliance board members: https://en.wikipedia.org/wiki/FIDO_Alliance#FIDO_members. I would love a spreadsheet with their positions on remote attestation - let's start with the banks.

I was expecting the author to at least address the thinly veiled threat to blacklist KeePassXC at [0] (via the very same mechanism they claim is harmless), but of course it's not even mentioned.

I'm sorry, but if your system allows someone to make a credible threat like this, you should make sure to redesign your protocol so that kind of abuse is not possible BEFORE advocating for it. I'm so incredibly sick of people repeating history, only to disappear once we're all roped into yet another anti-user scheme.

And yes, passkeys absolutely ARE a trap.

[0]: https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

This is a paid application with additional features paywalled. Why not just use Firefox and uBlock Origin?

Wouldn't using transparent/translucent plastic for the casing make this attack much harder (assuming users verified the insides against official photos)? My bank's hardware tokens used to have that, but new ones are opaque like this wallet. I wonder why.

> Most of the FOSS community is hostile to even creating basic sandboxing.

> 90s-style package management

> 80s/90s security model

> parsers from the 90/00s

Perhaps the crux of the issue, and the reason these new systems get pushback, is because people, myself included, don't like being told that they have to stop using the tools that served them well for arbitrary reasons (usually age). Similarly, you can't expect everyone to trade user control, convenience, usability, and more for security, or sometimes perceived security.

This is brilliant news, I can't wait for a future without OpenAI, Anthropic, Google, and the like.

> I’m happy if this means Deno is able to get a second impulse.

From TFA: We will support the Deno runtime for another year with monthly releases containing bug fixes and security updates. After that year we will end our development of the Deno runtime.

> ICANN isn't the DNS police

ICANN and IANA very much are the DNS police. As a matter of fact, IANA maintains a list of special-use domains - though, despite its widespread use, .lan is not on the list - and these domains will get rejected from gTLD applications outright. The last thing I want is to require each recursive resolver to have their own idea of what should and shouldn't be resolved.

On a related note, Google owns a registry (CRR) and a recursive resolver (8.8.8.8) that's commonly used by default or as fallback. Letting them ban entire TLDs would be a massive conflict of interest.

Posting because OpenWRT, possibly others as well, assign .lan names to devices on the LAN by default. People who make use of this might want to follow the application, and, if it goes through, either change the name or make sure queries can't get incorrectly get sent to upstream resolvers.

Regarding that last point, I've had issues with dnsmasq in the past where it was remotely resolving domains even when they were configured to resolve locally. For .lan domains, this could be disastrous because I often send plaintext traffic to them. I did submit a fix/workaround[0], but it's still something to look out for. If anyone knows more about this issue or other ways queries could leak, please share!

[0]: https://github.com/openwrt/openwrt/pull/18610

It's slop, and there's no telling if it will still be maintained a year from now.

Searching for "Nura" returns dozens of existing results. They couldn't even get nura.org! Is there really not a more distinct name they could've picked? Even Nura OS would make them easier to find in the long term.

Non-exhaustive list of things already named "nura":

- NURA: Premium Ingredients for Food & Wellness

- Nura - Award-winning personalised sound

- NURA: India's First Ai Powered Health Screening Center

- Nura Clinics | Pain Management Specialists In Minnesota

- Nura (German rapper)

- NURA - Shop Now for Health Essentials

- Nura | Hummus, Falafel & Shawarma

- Nura: Rise of the Yokai Clan

- Nura, a defunct consumer electronics company based in Melbourne

- Nura Space: Workplace Management Platform

Competing for this name seems like an uphill battle.