kernelPan1c

I've taken my stack of old laptops and created a microk8s cluster out of them for the purpose of self-hosting random stuff.

Agreed, this is a problem that we will solve through scientific innovation in power generation (nuclear) and carbon sequestration. The solutions that fall in the emotional domain often involve legislation and a reduction in quality of life.

Industrial control systems are experiencing the growing pains of letting go of older technology that was designed prior to security being much of a concern.

ICS networks are often designed to be 'air gapped'. All too often the air gap is broken via a vpn into the network so that someone can RDP to a windows scada machine (that doesn't receive updates because it can't reach the internet itself).

Full-disk encryption. https://www.howtogeek.com/234826/how-to-enable-full-disk-enc...

Nothing more than speculation but...I suspect if you aren't using an open source OS, it's possible the NSA has a backdoor into the machine. The lack of open source is partly why the EternalBlue exploit existed across decades of windows releases.

How does this work?

Confidential...as in only you, the recipients, Google, the NSA, and other intelligence agencies the NSA shares information with can read these emails.

Is this the right #? 1517486 points to something about a tug crew error.

https://titan-server.arc.nasa.gov/ASRSPublicQueryWizard/Quer...

I understand the sentiment. I certainly have my own bouts of intense paranoia related to security and the privacy of my personal stuff. It can become unhealthy. However, I think as long as the majority are complicit with email providers that don't offer end-to-end encryption, we may fall deeper into the clutches of government surveillance, targeted advertising, and other practices that IMO are an overall toxic influence on humanity. I don't practice what I preach at the moment but hopefully the loss of convenience is not too significant as I make the switch.

Ah, I guess the point I'm missing is that with a 'serverless' setup, the cloud provider must have access to your private key? Unless you use some sort of key server setup (what they call Keyless SSL)

"has never turned over their SSL keys or customers’ SSL keys to anyone;"

How would they be able to give up customers' SSL keys?

I have an XPS 15 9550 as well and primarily use ubuntu. I feel your pain on the failure to hibernate/heating up in a bag. Dell seems to have had plenty of issues with buggy BIOS and motherboards on this laptop. Last week mine became afflicted with the notorious XPS issue of powering itself on automatically immediately after shutdown (from windows or ubuntu) and will only respond to the power button being pushed if the charger is plugged in. I've replaced the battery and the CMOS battery in an unsuccessful attempt to solve the problem. Dell support said I could pay $70 to send in my laptop to get it diagnosed and then quote me an exorbitant price to replace the MOBO; all while being without a laptop for god knows how long... no thanks!

I resurrected a MacBook Air from 2013 and have been running Ubuntu for a week now. It's very refreshing to be on stable hardware even if it's not a powerhouse.

Rockstar to push an update and make this cheat irrelevant?

I wonder how Rice got this data.

The more interesting story is that if you can get this data (MITM or some other means), you could front run a fund by figuring out who they’re researching.

Everyone knows that orders are executed fairly on SEC regulated exchanges, right? Ehhh, not really.

It's important to look back on Flash Boys and recognize the reality of regulated exchanges. Ultimately consumer demands will drive the ethical operation of any exchange.

How could Facebook detect an infected machine?

A Facebook spokesperson said Charity may have been asked to download the wrong software because some malware can spoof what kind of computer a person is running

Just changed the user agent?

Yes! PoS poses a much greater risk of centralization

You're criticizing Tor for something that's impossible to solve. If you think that's possible then please open a ticket

Not criticizing tor. Just pointing out a couple of ways in which a tor user could give themselves up by doing stupid things while using tor.

Interesting stuff on timing based attacks. Thanks

Yes, anonymity and security are separate but related issues.

If you access an http site, a government controlled exit node could inject js and eventually gather enough info through profiling mouse movements and browsing habits to ID you.

Even with https, if the feds are in cahoots with the certificate authorities, you would be just as vulnerable to this sort of injection right?

However, tor hidden services is another story. I think this is where a bad actor would hit a wall.

Agreed. Bitcoin solves some problems with current forms of payment that shouldn't be unique to blockchain. Credit cards and checks are the equivalent of giving vendors your wallet's private key.

So we will inevitably end up with some variation of Proof of Stake protocol – where we will simply have to trust some users more than others

Doesn't this defeat the point? I can't imagine a scenario in which a proof of stake system does not become centralized. The average person will want to stake the extra money they have but won't want to maintain a dedicated machine with adequate storage and zero downtime. They will entrust a third party to earn money by staking on their behalf. Thus, you have created a centralized system with a whole bunch of extra complication.

Isn't this just key pinning? I'd like to see a P2P system. This way governments can't force CA's to allow MITM.

I agree, VPS providers don't inherently provide any added security or privacy.There's not much that would stop these providers from jumping at an offer to hand over your data for a pile of cash. If you want privacy, use Tor. If you want to beef up security, check SSL and URL before entering creds. If you need to evade corporate firewall rules, a VPN can do the trick.

Regulation doesn't affect the ability of a currency to be influenced. It just puts that ability in the hands of a select few. The US govt prints money to pay off maturing debt. After some time, this scheme will come to a disastrous end. As long as there's trust in the central auth, both Tether and USD can survive.

Yes, since you can't trust the JS, doing this would be an attempt at security through obfuscation. I mostly just think it's strange that these keys aren't accessible. If there were ever a mismatch detected, the server could at least know with certainty that there's a bad actor on the connection.

Thanks for Zooko's Traingle wiki. Hadn't seen that one before.

Public key pinning helps but it operates on the assumption that the initial key is the correct one. I find it curious that these public keys are not readable by the client.

Yes, greater for security but still depends upon reliability of certificate authorities and ISPs. ISPs have the ability to issue the client a bogus certificate while they hold the real one in order to decrypt traffic. Why won't browsers allow the certificate's public key to be readable by javascript so that the remote server can verify the client has the correct certificate? This wouldn't be foolproof but it would significantly beef up security.

Similar to how tor hidden services get resolved, distributed hash tables seem like the way to go. Take the ISPs and Cert Authorities out of the equation.