@0xtero@beehaw.org cover
@0xtero@beehaw.org avatar

0xtero

@[email protected]

Glorified network janitor. Perpetual blueteam botherer. Friendly neighborhood cyberman. Constantly regressing toward the mean. Slowly regarding silent things.

This profile is from a federated server and may be incomplete. View on remote instance

Is Privacy Worth It? ( blog.thenewoil.org )

When I announced I would be closing my communities earlier this year, a curious thing happened: a surprising number of regulars replied with some variation of ā€œI think this is my exit.ā€ While some were specifically talking about Matrix, claiming that mine was the only room they were really active in and therefore they saw no...

0xtero ,
@0xtero@beehaw.org avatar

Well, that was extremely long winded way to say "depends on your threat model".
Which it does.

So nothing new under the sun.

0xtero ,
@0xtero@beehaw.org avatar

In conclusion, Fuck EA.
End of message.

maegul , (edited ) to Fediverse
@maegul@hachyderm.io avatar

The fediverse wonā€™t succeed at putting up a substitute and thatā€™s a problem?

Just an impression: All the pieces seem to be there. But whatā€™s required is a team, with devs, PMs and coordinators, dedicated to making a particular place in the .

Thatā€™s resources and decently sized financial and organisational demands, especially to get a critical mass of users.

Is the fediverse up to that challenge? If not, is it an issue worth addressing?

@fediverse

0xtero ,
@0xtero@beehaw.org avatar

I think what we mainly lack is people asking questions, not a particular set up of tech.

0xtero ,
@0xtero@beehaw.org avatar

Why?

0xtero , (edited )
@0xtero@beehaw.org avatar

So your requirement with cellular calling (eSIM) is already fairly restrictive and depends on which market we're talking about. Where I live (.se) you get to choose between Apple and Samsung and since Apple was out of the question, you're stuck with Samsung.

Not entirely sure if your second requirement with long battery life can be fulfilled. You'll be charging the watch every day, probably more often if you take calls on it.

There's some rumors that Garmin Forerunner/epix will get eSIM support, but that will be also carrier dependent.

These wearables are pretty complicated high end devices, I wouldn't really give them to elderly parents who stuggle using a normal mobile.

I think it might be better to look into other tyoe of devices like pager systems from caregivers, if you're worried about health issues.

0xtero ,
@0xtero@beehaw.org avatar

Yeah, well just go ahead and see if it works for you now. I doubt much has changed, but some bits are probably more polished these days.
Most distros support some kind of LiveCD, so you can try it out without having to reinstall your machine, it's painless and quick to evaluate before you take the plunge.

zenbook duo pro

A quick search reveals this. Might be helpful.
https://davejansen.com/asus-zenbook-duo-and-fedora-linux/

0xtero ,
@0xtero@beehaw.org avatar

I thought it was funny as well. Sometimes FOSS communities are so very uptight, we should relax a bit.

Novel attack against virtually all VPN apps neuters their entire purpose ( arstechnica.com )

Pulling this off requires high privileges in the network, so if this is done by intruder you're probably having a Really Bad Day anyway, but might be good to know if you're connecting to untrusted networks (public wifi etc). For now, if you need to be sure, either tether to Android - since the Android stack doesn't implement...

0xtero OP , (edited )
@0xtero@beehaw.org avatar

I also donā€™t get much value out of the statement that ā€œeveryā€ OS except Android is vulnerable. Do they really mean all other OSes, or just what would come to mind for most people, i.e. Windows, macOS, Linux, iOS? What about the various BSDs for example?

It's a DHCP manipulation attack, so every RFC 3442 compliant DHCP implementation implementing option 121 would be "vulnerable" (it's not vulnerability though). Android apparently doesn't implement it, so it's technically impossible to pull off against Android device. There might be others, but I'd guess most serious server/desktop OS'es implement it.

The title isn't misleading at all, even though the "neutering their entire purpose" is a bit of a click-bait. This doesn't affect ingress VPN at all.

It's an attack that uses DHCP features (according to RFC).

It's a clever way to uncloak egress VPN users, therefore it does have privacy impact since most of us use VPN for purposes of hiding out traffic from the local network and provider and there's no "easy" fix since it's just a clever use of existing RFC.

Researcher says China's "onslaught of cyberattacks" poses significant risks to Taiwanā€™s national security and democratic processes, warns that "these tactics can be replicated elsewhere" ( theconversation.com )

Taiwan is experiencing millions of cyberattacks every day, writes Lennon Y.C. Chang, Associate Professor of Cyber Risk and Policy in the Centre for Cyber Resilience and Trust at Deakin University, adding that "other countries worried about the impact of cyberattacks and disinformation campaigns on their elections and democratic...

0xtero ,
@0xtero@beehaw.org avatar

These attacks range from phishing attempts to sophisticated malware intrusions. Website defacement attacks and Distributed Denial of Service (DDoS) attacks are often seen during significant events

...

And these tactics can also be replicated elsewhere. Other countries worried about the impact of cyberattacks and disinformation campaigns on their elections and democratic institutions should be paying attention.

These tactics are already being replicated elsewhere. This has been the normal Internet background noise for years. This is not news.
However, just as in 2014 when Russia was preparing for Crimea annexation, the amount of targeted (cyber and kinetic) escalated. Same again before Ukraine invasion. That's what we should be paying attention to - not everyday "millions of cyberattacks" or hybrid misinformation war - those are already happening. and should be handled as basic boring Internet hygiene.

We should be building resilience against targeted pre-invasion cyber. We should be building ways to take down drones, we should be building robust satellite communication networks so we don't have to rely on kindness of tech billionaires. We should find more robust ways of navigating because GPS is too easy target.

In short, we should be learning from the Ukraine conflict, which is the first (and currently only) real live theater for cyberwarfare.

0xtero ,
@0xtero@beehaw.org avatar

Lemmy instance with "radical" moderation. Sort of like old SA/goon forums, 4chan etc.

0xtero ,
@0xtero@beehaw.org avatar

Those were not unmoderated. Just radically differently moderated.

Where do the rural homeless near you live?

This seems to be something people don't always give second thought to. When people talk about the homeless, the first things thought about are images of people on busy city streets in rusty clothes waiting around near allies. In there, the answer is quite static, because it can be I guess. But if that's the case, change the...

0xtero ,
@0xtero@beehaw.org avatar

I was about to type this exact thing. We have some homeless of course, people always fall through the cracks - but for the most part, the local government provides for basic needs, shelter, food, money and (in due time) housing. Winter is harsh, you don't really survive living "in the nature" in rural areas.

Summer months often see homeless in the form of "Roma traveling beggars" or the "Irish asphalt/garden workers" who live out of caravans, tents or just back of their cars, but they migrate to southern Europe when winter comes.

But yeah, we pay a fuckton of taxes to have a social security network that catches people who are down on their luck. It's not perfect, but it's something. People don't have to live without food or roof over their heads.

0xtero ,
@0xtero@beehaw.org avatar

I guess it's time to update uBlock Origin lists.

0xtero , (edited )
@0xtero@beehaw.org avatar

I mean.. why would people downvote you for that?
I have a todo.txt which I update. If I need to "be mobile" I just stuff some notes into Signal note to myself.
During meetings, I still take notes with paper and pen, because that's much faster than digital notes.

maegul , (edited ) to Fediverse
@maegul@hachyderm.io avatar

Reflecting on the firefish/calckey "moment"

which was about a year ago now, I can't help but suspect it was a small event with wider implications on the dominance of in the

I think it was the last chance to direct the twitter migration energy into discovering new/different fedi platforms.

And it was blown, with alt-social in a weird steady/waiting state that's smaller I suspect, than what many hoped for.

@fediverse

cntd: https://hachyderm.io/@maegul/112358202238795371

1/

0xtero ,
@0xtero@beehaw.org avatar

Congrats and/or condolences for this "moment".

I guess I'd have to check mastodon to find the rest of this thread and the context of what it actually references.
Posting into Lemmy/Kbin groups from long mastodon threads is quite janky experience, I find.

1/

0xtero ,
@0xtero@beehaw.org avatar

Thanks for the context.

And yeah - a lot of fedi is built on spur of the moment inspiration without much planning on the long term. Sometimes it works out (like pixelfeed and the other related projects) and sometimes the passion of one (or small group) of devs just isn't enough.

Lemmy is pretty good example (from the other side of the scale) as well - we're at version 0.18.4 - and the devs are pretty hostile.

0xtero ,
@0xtero@beehaw.org avatar

Yeah, exactly the beehaw vs. lemmy situation.

0xtero , (edited )
@0xtero@beehaw.org avatar

Yeah, as a beehaw user, I'm pretty familiar with the situation. I'm not going to re-hash the whole thing here (and I don't represent the instance), but let's just say PR's for features were offered, but not accepted. Discussion was attempted but it resulted in Lemmy devs asking beehaw to fuck off - so that's the end of that.

There's an alternative being tested. I believe we're going to Sublinks, but there's still active development going and sizeable migration. So we're still here. For the time being.

0xtero ,
@0xtero@beehaw.org avatar

There's a good write-up from the Beehaw admins here: https://docs.beehaw.org/docs/important-questions-decisions-and-reflections/beehaw-lemmy-and-a-vision-of-the-fediverse/

0xtero ,
@0xtero@beehaw.org avatar

Average Bethesda experience I guess

0xtero ,
@0xtero@beehaw.org avatar

It's missing quite a few features and it's buggy.
Still ten times better than Cities Skylines 2.

0xtero , (edited )
@0xtero@beehaw.org avatar

Ente Photos - Google Photos replacement with encryption and privacy
Ente Auth - Good multiplatform authenticator.
^^ These are paid for service (you get both with same sub), but extremely good.

AntennaPod - Podcatcher
K-9 email

0xtero ,
@0xtero@beehaw.org avatar

Someone being enraged about snap on behalf of Windows users was certainly a take I didn't know I needed.

0xtero ,
@0xtero@beehaw.org avatar

I donā€™t and the energy consumption of public AI services is a stopper for ā€œtesting and playing aroundā€. I think Iā€™ll just wait until it takes over the world as advertised.

0xtero ,
@0xtero@beehaw.org avatar

This sounds like average Bethesda experience. I always get hyped by their pre-releases, but I find the actual games to be tedious and boring slogs.

I know itā€™s down to personal taste, but I think I enjoy a bit more rail-roading and bit less sandbox. Witcher 3 and Cyberpunk 2077 are ā€œjust rightā€ for me, the story is tight. Bethesda games a bit loosey-goosey (ha!) with their storytelling.

How to make it so frequently used sites don't constantly require 2FA? [SOLVED]

EDIT: After reading all the responses, Iā€™ve decided to allow cookies to persist after they close the browser, which I expect will make it so that 2FA doesnā€™t kick in as often, at least not on their most frequently used web sites. I may also look into privacy oriented browser extensions that might offer some protection, such...

0xtero ,
@0xtero@beehaw.org avatar

Iā€™ve configured Firefox on their Linux laptop not to keep any cookies after the browser is closed. I know this isnā€™t a Linux/Firefox issue

Itā€™s you issue.

Block third-party cookies, but allow cookies from the site itself. Iā€™m not sure why youā€™d filter those out in the first place?

Ask: How do you handle your rƩsumƩs?

Usually I rely on my network & havenā€™t needed this kind of document in ages, but Iā€™ve been tasked with creating a rĆ©sumĆ© for myself. Iā€™ve grown more privacy-conscious every year & I think itā€™s weird that we are expected to give out so much information about ourselves to companies that lie about their culture & donā€™t...

0xtero ,
@0xtero@beehaw.org avatar

Iā€™m a consultant so whenever Iā€™m applying for a new gig I need to provide a consultant profile, which is very similar to resume.

Over the years Iā€™ve learned that most customers are not very interested in the ā€œpersonal stuffā€ sections - they just want to know you have the skills required, so try to minimize the amount of personal data and concentrate on skills and past gigs (anonymizing customers/companies) etc.

But - unfortunately you have to tell something about yourself and your ability to work together with others, thereā€™s really no way around it. Itā€™s also more and more customary that (for some reason) they want your photo. Stuff like education, certifications need to be there, but keep it very short. Think about ā€œsocial media profile pageā€.

Provide stuff like contact info, address, phone, date of birth (if required) and references separately - donā€™t put them into your resume. You can add something like ā€œPersonal information and references provided separately by requestā€ in there, that way, even if the document is shared, all they get is something resembling a LinkedIn profile.

You can also try to add ā€œconfidentialā€ to the document header, but Iā€™ve noticed itā€™s not respected very often.

Would you teach your kids how to pirate?

My gf and I have had discussions about teaching morals to kids. In that vein, I asked myself, would I teach piracy to my kids? Yes, itā€™s technically illegal and carries inherent risks. But so does teenage sex carry the risks of teenage pregnancy, and so we have an obligation to children to teach them how to practice safe sex....

0xtero ,
@0xtero@beehaw.org avatar

Teaching kids good, healthy anticapitalist values is important. Itā€™s also good to teach them some basic computing and privacy skills, because theyā€™re not going to get that anywhere else. Theyā€™re going to be under lot of social peer pressure to have the latest phones and being connected on social media, consuming information from algorithms.They need to understand how to minimize the harm from Meta and the big tech.

Same applies to the copyright industry and their practices (along with corps who are heavily anti-repair like Apple) - they need to understand the exploitation model of capitalism and lobbying - from there, let them make their own choices.

Can you live without YouTube ?

Today in a Privacy community a post about YouTube. No word about privacy but all about which software or settings are needed to watch videos and the money needed to host videos. It made me wonder whether some of you can lead a meaningful life without YouTube. Or will a cold turkey bring the worst out of you ?

0xtero , (edited )
@0xtero@beehaw.org avatar

Iā€™ve been paying for Nebula account for a while now. Itā€™s got high quality stuff and itā€™s owned by creators making the content.

Thereā€™s also peertube and other fedi variants.

Works great for me, I donā€™t feel like I need YouTube or Iā€™m missing out on important stuff.

NewPipe/Piped to watch occasional video linked from an article.

0xtero ,
@0xtero@beehaw.org avatar

Gamers are so fucking weird. Really enjoyed the show. Hope they make 2nd season.

0xtero ,
@0xtero@beehaw.org avatar

But if it was reality

ā€œIn a future, post-apocalyptic Los Angeles brought about by nuclear decimation, citizens must live in underground bunkers to protect themselves from radiation, mutants and bandits.ā€

And you picked a girl punching a guy the exact moment to suspend your belief at? Damn dude.

0xtero ,
@0xtero@beehaw.org avatar

A symlink is a file that contains a shortcut (text string that is automatically interpreted and followed by the operating system) reference to another file or directory in the system. Itā€™s more or less like Windows shortcut.

If a symlink is deleted, its target remains unaffected. If the target is deleted, symlink still continues to point to non-existing file/directory. Symlinks can point to files or directories regardless of volume/partition (hardlinks canā€™t).

Different programs treat symlinks differently. Majority of software just treats them transparently and acts like theyā€™re operating on a ā€œrealā€ file or directory. Sometimes this has unexpected results when they try to determine what the previous or current directory is.

Thereā€™s also software that needs to be ā€œsymlink awareā€ (like shells) and identify and manipulate them directly.

You can upload a symlink to Dropbox/Gdrive etc and itā€™ll appear as a normal file (probably just very small filesize), but it loses the ability to act like a shortcut, this is sometimes annoying if you use a cloud service for backups as it can create filename conflicts and you need to make sure itā€™s preserved as ā€œsymlinkā€ when restored. Most backup software is ā€œsymlink awareā€.

How the xz backdoor highlights a major flaw in Nix ( shadeyg56.vercel.app )

The main issue is the handling of security updates within the Nixpkgs ecosystem, which relies on Nixā€™s CI system, Hydra, to test and build packages. Due to the extensive number of packages in the Nixpkgs repository, the process can be slow, causing delays in the release of updates. As an example, the updated xz 5.4.6 package...

0xtero ,
@0xtero@beehaw.org avatar

Kinda tired of the constant flow of endless ā€œanalysisā€ of xz at this point.
Thereā€™s no real good solution to ā€œupstream gets owned by evil nation state maintainerā€ - especially when they run it in multi-year op.

It simply doesnā€™t matter what downstream does if the upstream build systems get owned without anyone noticing. Weā€™re fucked.

Debianā€™s build chroots were running Sid - so they stopped it all. They analyzed and there was some work done with reproducible builds (which is a good idea for distro maintainers). Pushing out security updates when you donā€™t trust your build system is silly. Yeah, fast security updates are nice, but it took multiple days to reverse the exploit, this wasnā€™t easy.

Bottom line, donā€™t run bleeding edge distros in prod.

We got very lucky with xz. We might not be as lucky with the next one (or the ones in the past).

0xtero ,
@0xtero@beehaw.org avatar

Iā€™m not sure why you think I didnā€™t? Sorry if it was unclear.

From the blog:

This incident has really made me wonder if running the unstable branch is a great idea or not.

My comment:

Bottom line, donā€™t run bleeding edge distros in prod.

Hope this clarified my opinion! Have a good day!

0xtero ,
@0xtero@beehaw.org avatar

Yeah, I can get that. The xv situation probably wasnā€™t the best of examples though?

0xtero ,
@0xtero@beehaw.org avatar

Luckily Iā€™ve changed my default OS to Linux

0xtero ,
@0xtero@beehaw.org avatar

Microsoft hates this one simple trick

0xtero ,
@0xtero@beehaw.org avatar

And thus begins the enshittification of Discord

0xtero ,
@0xtero@beehaw.org avatar

I think theyā€™re only worried about U.S class action. Donā€™t think American companies really care about the legality anywhere else

0xtero ,
@0xtero@beehaw.org avatar

Only reason Discord has ā€œa shopā€ in EU is for tax evasion. Itā€™s a P.O Box at Schipol airport. I really donā€™t think they care very much.

0xtero ,
@0xtero@beehaw.org avatar

I meant NL is one of the top 10 tax havens in the world due to their exemptions that allow corporate tax evasion.

0xtero ,
@0xtero@beehaw.org avatar

I donā€™t think this one counts as a big win to be honest It was just freakish luck

0xtero ,
@0xtero@beehaw.org avatar

Or found out in corporate code review / pentest. We just donā€™t know. I get that we want to say FOSS is great due to the ā€œmany eyes/shallow bugsā€ thing, but that didnā€™t work for OpenSSL or log4j. The fact that it did now is great, but letā€™s not get carried away. It was just pure luck.

0xtero ,
@0xtero@beehaw.org avatar

SELinux has been GPL for 24 years.

Itā€™s part of what was called Rainbow Books, but is known more widely these days as the Common Criteria.
en.wikipedia.org/wiki/Common_Criteria

Itā€™s the ā€œGovernment setting standardsā€ sort of scenario.

Backdoor found in widely used Linux utility breaks encrypted SSH connections | Ars Technica ( arstechnica.com )

TL;DR there was a backdoor found in the XZ program. All major distros have been updated but it is recommended that you do a fresh install on systems that are exposed to the internet and that had the bad version of the program. Only upstream distros were affected.

0xtero ,
@0xtero@beehaw.org avatar

Catching this now is pretty huge, because it mainly targets distro build systems. Had this gone undetected, weā€™d be in shiznit creek couple of years down the line.

Meta gave Netflix and Spotify access to users private messages ( arstechnica.com )

in 2018, Facebook told Vox that it doesnā€™t use private messages for ad targeting. But a few months later, The New York Times, citing ā€œhundreds of pages of Facebook documents,ā€ reported that Facebook ā€œgave Netflix and Spotify the ability to read Facebook usersā€™ private messages.ā€...

0xtero ,
@0xtero@beehaw.org avatar

Oh boy. Some of you people watch too many movies.

Letā€™s get some basic stuff established:

  • This thread is about commercial platforms selling your direct message data. Thatā€™s the threat model.
  • I donā€™t live in a country where the police SWAT teams throw flashbangs without court orders
  • If the authorities want to get to me (which, again, is not the threat model of this thread). They can. Easily. They know where I live. They just have to knock on the door. Itā€™s not even locked.
  • I did, to my best knowledge, not reply to you in anywhere this thread. Iā€™m not sure why you are replying to me.

But sure. Iā€™ll give you this: If your threat model is dodging SWAT team flashbangs, I doubt using Signal is much use to you at that point. That just wasnā€™t what this thread was talking about.

0xtero ,
@0xtero@beehaw.org avatar

Which was a response to this

  • All
  • Subscribed
  • Moderated
  • Favorites
  • ā€¢
  • random
  • tech
  • kbinEarth
  • testing
  • interstellar
  • wanderlust
  • All magazines
    •