News for hackers. Stuff that matters.

weeks

Re:We have a year to fix security everywhere on Tuesday September 08, 2026 @03:47AM (#49606935)
https://jamstack.org

You're describing the Jamstack or headless CMS concept verbatim.

They're referring to the EU not being able to compete.
“Buy, receive, or sell the personal information of 50,000 or more California residents”

If a business engages this type of activity, they need to have a scalable process for providing California residents with their data.

Describing a California law passed by a majority of voters as “idiotic hoops” is a miss.

Do I have a choice not to work with you?
Re:AWS announces forks of Elasticsearch and Kibana on Thursday January 21, 2021 @06:20PM (#25866020)
Apache Spark and Apache Kafka? It doesn't seem likely that the Apache Software Foundation would consider implementing the SSPL instead of the Apache License.
The technical claims don't seem very far fetched. They're basically describing every banking "anti-fraud SDK" I've ever reversed.
https://googleprojectzero.blogspot.com/2017/10/over-air-vol-...

Even Apple's IOMMU has had vulnerabilities allowing for full memory access from the WiFi modem.

Apple's policy is one certificate per company. So it being a single point of failure is unavoidable.
Re:Did Uber steal Google’s intellectual property? on Wednesday October 17, 2018 @09:20PM (#18245204)
Code review, trusted build environments and code signing could entirely prevent a single engineer from modifying the code running on the car.
Re:Hardening macOS on Saturday September 29, 2018 @03:40PM (#18102358)
"I recommend rolling your own email server"

This is actively harmful advice. Do not roll your own email. Use a well-known provider with a solid security track record.

You think the CEO of 23andMe and ex-wife of Sergey Brin can't afford the best nursing home for her grandmother?
Re:Meltdown and Spectre on Thursday January 04, 2018 @11:55AM (#16071841)
Thanks for pointing that out. I've escalated internally to have the video restored.

Edit: the video has been restored.

Re:There are over a billion outdated Android devices in use on Monday November 13, 2017 @07:44PM (#15691641)
https://developer.android.com/guide/topics/ui/layout/recycle...

https://developer.android.com/guide/topics/media/exoplayer.h...

RecyclerViews are only implemented in the support libraries, even for newer versions of Android. I haven't used Exoplayer personally but by reputation it does all of the hard media stuff for you.

Re:Se­cu­rity Keys on Thursday August 17, 2017 @11:43PM (#15043383)
While I absolutely agree with you, it seems far more likely that native implementations by Apple, Google and Microsoft will dominate the market. Windows Hello is a great early example of this.
Android supports U2F via NFC and Bluetooth now, which is used for user authentication on Android devices. We've also released an (experimental?) iOS app to support U2F over Bluetooth.

https://itunes.apple.com/us/app/google-smart-lock/id11520663...

https://www.ubnt.com/edgemax/edgerouter/

Ubiquiti's EdgeRouter gets my vote if you're willing to muck around on the CLI to get to advanced features.

Re:The Holder Report on Uber on Tuesday June 13, 2017 @07:59PM (#14549736)
My former employer reimbursed our lunch as taxable income for this reason.
Re:ARKit on Tuesday June 06, 2017 @11:18PM (#14503478)
From what I've gathered this totally depends on your market. Creating a paid app or an app targeting US University students? iOS first. Creating an ad supported app or targeting an international market? Android first or use a framework that supports compiling to both platforms.
Android 1.0 had this via ACCESS_COARSE_LOCATION, unfortunately Android only recently got runtime permissions.
If the user isn't informed the app they installed is clicking on ads, it absolutely is malware.
Playing whack-a-mole with memory corruption vulnerabilities isn't how you create a secure operating systems.
Re:Wikimedia Foundation spending on Sunday May 07, 2017 @04:43PM (#14287550)
Where I feel a lot of the animosity from the Wikipedia community stems from is that the people who have "cultivated expertise in governing" are actually Wikipedia volunteers, not WMF employees.
Re:Wikimedia Foundation spending on Sunday May 07, 2017 @04:36PM (#14287512)
As a Wikipedia administrator (mostly inactive), this sentiment makes complete sense to me. The WMF seemingly spends the majority of its money on non-critical functions such as community outreach, local chapters, yearly conferences and other non-critical costs. Including a parade of highly paid, not very effective executives. One thing to keep in mind is the WMF != the Wikipedia community, it is very possible to truly support the Wikipedia mission without also supporting how the WMF is ran.
Re:Uber CEO Plays with Fire on Sunday April 23, 2017 @01:33PM (#14179212)
While you're right that a lot of FinTech applications do use fingerprinting, it is absolutely against the rules. It's rather annoying from a mobile security perspective but given the rampant abuse of persistent device identifiers on Android, I understand and appreciate Apple's stance here.
Re:Google Identity-Aware Proxy on Thursday March 09, 2017 @07:51PM (#13835379)
The purpose of ascertaining device identity is to prevent someone who can't obtain legitimate Google issued hardware from using stolen user credentials. If you're already a Google employee you can just ask for more trusted hardware, so there would be little point in breaking that part of the security model.
Re:Basic Security Precautions for Non-Profits and Journalists on Sunday February 12, 2017 @04:02AM (#13627510)
For one, without Google Play Services you have no Play Store. Unless you're going to prevent users from installing apps entirely, there isn't really another safe way to obtain apps. Additionally Verify Apps, SafetyNet, Safe Browsing, etc. are all part of Google Play Services. You _really_ want Verify Apps.

Older »