News for hackers. Stuff that matters.

tempfs

Re:The Fed's $2.7T mortgage problem on Wednesday May 18, 2022 @06:30PM (#31428455)
You can't halt a bank collapse, but you can postpone it and attempt to reduce the impact with inflation which is exactly what has happened.

Additionally, if you don't address the lack of regulation that allowed the collapses in 2008, which we absolutely did not, it will keep happening and those future occurrences will grow in severity. Since now, in order to 'make money', the frauds have to be bigger, faster, and more aggressive.

Re:About iCloud Private Relay on Sunday May 15, 2022 @12:24PM (#31388590)
Have you read Apple's privacy policy?
This is entirely great and especially appreciate the Cave Johnson quote for bonus points.
Re:About iCloud Private Relay on Sunday May 15, 2022 @11:52AM (#31388321)
Just remember that now instead of your ISP knowing every site you visit, Apple now will.

So where as in the olden days, in order to figure out who you were, some actor had to buy logs from the destination sites and from the ISPs, then correlate.

Now they can just buy the information from Apple. How convenient for Apple.

I know Apple says they will only share your information with trusted partners and only with your consent which is implicit when you use private relay. No one ever asks who these partners are though. Probably the same people that used to buy your data from the destination sites and ISPs...

* We require you to have an account with us which we will use to track you everywhere.

** We will fingerprint your phone in order to abuse it as a pseudo hardware token.

*** Two of us also completely control your phone too, with the third one trying to worm our way into CPU-resident code.

This ought to be fun!

Re:Heroku Security Notification on Thursday May 05, 2022 @12:56AM (#31269641)
Threat actor is industry standard terminology for a malevolent or blackhat brand of hacker.

Not all hackers are threat actors.

https://en.wikipedia.org/wiki/Hacker

Everything in this country, in this life, is a competition. One big zero-sum game.

It starts in high school. Social status, academics, athletics, and now social media followers and likes.

I am very glad that when I was in high school, social media wasn't really a thing yet. I could leave it all at school. Just go home and read, play video games or go outside. Most of my mistakes were limited to the memories of those people who witnessed them first hand.

Kids today are under near constant competition with each other and it takes a toll.

At some point, I hope, without some massive existential crisis serving as the impetuous we can collectively come to the understanding that our technology has vastly outpaced our morality. I hope that the prevailing social norm becomes cooperation over competition and the desire to lift others up instead of stepping on them for your own personal gain.

Let's leave Microsoft's bad ideas on Windows mmmkay.
Re:Leaked Chats Show Lapsus$ Stole T-Mobile Source Code on Friday April 22, 2022 @10:24AM (#31121926)
If your devs/admins are keen on selling access to your network, ZeroTrust won't save you.
I really wish this situation was anything close to a real effort to protect free speech or even better to nuke Twitter from orbit.

I hope people realize that he is just trying to protect his favorite stock manipulation platform.

Re:Using Windows after 15 years on Linux on Thursday April 07, 2022 @03:50PM (#30949554)
Windows is for:

- People who know nothing about computers and don't want to.

- People who are being held hostage by some third party software that isn't built for ARM/Mac/Linux.

One can argue that Mac's satisfy the first condition as well.

Linux is for people who either don't mind learning how certain things work or outright require an understanding of how they work. Or who just want more choice in how they interact with a computer. Freedom from corporate data-mining and the privacy nightmare that is Windows...and coming soon to MacOS/iOS...is another big reason to seek alternatives.

The modern truth is that, for people with relatively simple needs, there are plenty of Linux flavors that just work as long as your hardware is not from Apple.[>=M1] These flavors have app stores that help even the freshest of newbies find media players, games, office apps, browsers, whatever. The fact that so many contemporary apps run either in a browser or use things like electron also further diminishes the requirement of Windows.

Even Microsoft realizes that Windows OS as a thing isn't something to explicitly sell to people anymore. They have been taking a page from Apple and trying to market how lovely it integrates with Xbox, Teams, the CloudPC versions, whatever. They've also hilariously made Windows 11 look like MacOS/various Linux DEs by transforming the taskbar into a dock and making the start menu look incredibly like Whisker/KDE's menu setup. They are also introducing stuff like virtual desktops, etc like they are some sort of revolution despite being on Linux DE's for eons.

Truth is that there's never been a better time to re-evaluate your computing needs and make some thoughtful choices about your workflows, your privacy, what you actually need vs what's actually on offer in these platforms.

Yes, and trolling LinkedIn for people that they could just socially engineer or otherwise bribe into gaining access from.
It is almost like these 'another winning step towards fusion' announcements arrive on a schedule meant to make sure that the funding isn't pulled.
Everyone is assuming this is the Russians and that could very well be true. If I were a bad actor from some place other than Russia, now would be a great time to pursue my own objectives and make as much noise as I wanted assuming that Russia would be blamed for it. Maybe even drop some misleading artifacts while I inside someone's network to re-enforce the paranoia. Just saying...
My favorite fuckup is when the MS Authenticator itself tells me that it needs me to use MS Authenticator to verify who I am, so it sends a code to itself.

You can't make this shit up.

Re:New York is using cameras with microphones to ticket loud cars on Wednesday February 16, 2022 @04:02PM (#30365638)
Death to the burble-tunes and the idiots that acquire them, then use them to assault the neighborhood.
Even if you ignore the fact that they'll find a way to shit on Linux[to push WSL] I simply do not trust Microsoft to get anything right in terms of security.[1]

[1] Being alive and security aware for the last few decades.

Re:Twitter suspends account tracking Maxwell trial on Wednesday December 08, 2021 @12:18PM (#29487492)
If you rely on social media for your news you're gonna have a bad time.
Re:FTC sues to block Nvidia-Arm merger on Thursday December 02, 2021 @08:08PM (#29425383)
Finally, someone gets it. There is a lot of other well intended, intellectually driven arguments and opinions in this thread, but I am afraid that the people actually making the calls here are mostly likely being guided by their own self interests.
My favorite new features of Windows 11 are the fact that my wireless adapter suddenly sucks and that it now takes me two clicks to get the full right click menu.
It is a for profit company, the reason is always profit.
This is exactly how you get around those pesky laws that prevent you from doing it yourself as a governing body. You just let/encourage/look-the-other-way as private companies do it for you then you just buy access from them. All perfectly legal since those private companies are busy selling your private data to anyone and everyone else.

The advent of smartphones, social media, search engines, pervasive online shopping are all absolute boons for surveillance entities.

And the best part is that the users/public just gives all of this info up willingly and for free.

Re:macOS Monterey on Monday October 25, 2021 @09:23PM (#28995318)
Well... you could create a new user profile, install the apps to that user's profile, give their group access to the folders you want the browser to be able to get to (Downloads folder, whatever), then lock them out of anything else....then run the browser as that user only. aka (sudo -u Bob /Applications/Firefox.app/Contents/MacOS/Firefox )

OS perms should do the rest. I don't know if OSX has a firejail equivalent but that would be nice too.

Re:Nine Raspberry Pis powering an office (2016) on Monday October 25, 2021 @09:17PM (#28995283)
Add something like this to your /etc/fstab. Will save a few touches to the SD card and enhance system security a little. My last SD went for 3+ years on a decently busy little Pi.

  ##
  ## Decrease touches to root partition a little with noatime flag
  ##
  /dev/mmcblk<NUM>p<NUM>  /               ext4    defaults,noatime  0       1


  ##
  ## decrease writes because tmp activity by mounting as tmpfs
  ##
  tmpfs /tmp tmpfs ddefaults,nodev,nosuid,noexec,noatime,mode=1777 0 0


  ##
  ## /dev/shm security measure
  ##
  tmpfs /dev/shm tmpfs defaults,noexec,nodev,nosuid 0 0
Another vote for Brother's Laser printers. Love mine, cheap, reliable and works on Linux without a hitch.
Believe me when I say that all major tech companies have spooks in their ranks. They don't really need to insert backdoors or ignore bugs. They have human assets in the teams.

Ask anyone who works in one of these organisations and they will attest to how many former IC people fill the ranks in certain areas.

Re:Windows Package Manager 1.1 on Monday October 11, 2021 @12:53PM (#28830340)
I use Debian and have three non-Debian repos in my sources.list. No problems thus far.

Been using Linux for over a decade and haven't run into any problems from apt/repo's. So I am using what I believe to be a qualified opinion when I say edge case here.

Re:Windows Package Manager 1.1 on Monday October 11, 2021 @12:42PM (#28830237)
Repos and package management are one of the best features of Linux.

Sorry that you've worked your way into problematic edge cases but for everyone else this solves way more problems that it creates.

A world where you no longer have to update dozens of applications one at a time or worse never at all is a very good thing.

This is also a terrific non-SCCM/Windows Store way to provide access to and limit what all can be installed on a Windows box.

Why use MSFT-overlayed Chrome(aka Edge) at all instead of just using Chrome?

Edge will always lag Chrome for security matters and MSFT will just be yet another surveillance layer within it.

Just use Firefox folks. It's fast, secure-ish and leaves you only one threat actor to keep track of instead of two.

Don't really need DPI to detect services and protocol patterns, just a decent perimeter device which almost everyone has.

Ex. Tons of UDP streaming from an endpoint to a cloud box sticks out like a sore thumb using little to no special detection magic.

Older »