noobquestion81

Fair points, ty for the rebuttal

I think it would be completely crazy if apple did this without entering into a special contract with google. Theres no way some sales engineer just signed up for a google ads account one day

I agree, and I am usually the first to cast privacy stones at facebook. While I wouldnt wear these in most cases I wear sunglasses today, I could imagine plenty of social scenarios where I would not be the least bit creeped out to wear or see people wearing these. Generally these are situations where people would already be comfortable taking pictures with their phone.

They are the best looking camera glasses I have seen - they look like standard wayfarers. But then again, I thought the same of the first gen Spectacles (the newer ones are hilariously dumb looking), so we’ll see. $300 is only like twice the price of normal wayfarers, so not bad there either.

Disadvantages AFAICT: - standard Facebook trust issues - no private audio, AR, or motion sensing - not waterproof (wtf, but at least they’re not horribly expensive and I guess just become normal wayfarers when they get wet) - no “click to save the last 30 seconds mode” (maybe with a Orange LED color) like my PS5 has :)

Wow. Almost unbelievable. Any security engineer or literally any (authenticated or agent-based) enterprise scanner should have caught this. Wonder how this one slipped through - the 2019 runc bug was a HUGE deal if you work in container security and its presence should have set off Critical alerts automatically.

Knowing nothing else, my guess is this was certainly exploited, as you can grab off-the-shelf exploits for the runc exploit.

I suspect because almost no one wants to be a “gardener” of microblog/message/talk/email, and most do not know how. They just want to follow and talk to people. FB solves all of these with one signup, as did myspace. I also expect gaining traction for decentralized networks is by definition harder as the brand has fragmented.

I’ll believe Mark when it happens. In 2017 he also said he’d ship a billion oculuses; I think they sell maybe 3M a year.

My 2c; I did see their remote work demo and thought it was kind of cool, although (anecdotally) coding in a virtual screen tends to give me headaches. But until the headsets arent heavy, expensive, and silly-looking or require goofy paddles I do not think the VR metaverse will be gaining any mass traction.

Personally I have found current VR is fun for some games and tedious for everything else. The wow factor of a large expensive facial protrusion with a screen and gyro was gone by the time Oculus was acquired. What followed was a lowering of price, allowing for 4-5x more users per year to be disappointed. And Facebook has more or less failed at all their hw offerings thus far despite much PR, right? I dont see that changing. They should stick to monetizing your information IMO, they’ve been able to make that highly efficient and it doesn’t cost $800 for the end user or leave large imprints on their faces.

Unfortunately no - the curl commands will by default go out over http, which does not use TLS at all or provide any guarantee of remote server integrity, just like plain TCP.So an attacker with the right network posture (say, they pwned your router or a hop between you and these servers, can just reply with plain HTTP and give you code that you will run.

Like op said, just tack on -f and https://, and remember to do this in the future.

Funny, the point of TLS is to prevent MITM attackers from reading traffic. The two install commands provided would give a LAN or MITM attacker root on your host.

To clarifymy stance, now that I have a bit more time this evening… unprivileged userns is the only way forward for linux sandboxing on a bare-metal host past the boundaries of POSIX isolation. so from a security perspective I do hope most distros get this turned on at some point, and that these bugs stop being so commonplace.

actual bugs, qualys’s recent cve-2021-33909 is one example.

I had the same experience a couple months back trying to set up a gaming PC. This was after the initial screen set my speakers to max and then blasted Cortana screaming at me in different languages. This was at about 3am in the morning, and I have pretty good speakers. After recovering from my heart attack, I then proceeded to fight for ~20 minutes on how to install without a Windows account - since I had already set up Wifi, the easiest way was to unplug my router for a bit. After a while Windows booted up, but would constantly BSOD on reboots. I gave up and bought a console.

Absolute trash OS, sorry.

Agreed that if you did a shitty job benchmarking you could get shitty results.

It's not entirely fair, because in the 60s basically all modern crypto primitives were missing. If I had those:

1. Encrypted onion routing on layers that betray source/dest IP. 2. eSNI on all TLS connections. 3. Privacy-focused DNS.

Yes this is the way. What reddit has done to its own mobile experience is incredibly disrespectful, I couldn’t agree with this article more. Just... let me see your fucking ads?

Does anyone know a way on ios to forcibly redirect all reddit links to old.reddit.com?

Its pretty stupid with sports drinks, but I could see this being perhaps practical in a frozen food aisle. I often open the freezer, take out a product to read its nutritional facts, then put it back. I guess now I could just tap?

Good lord dude. Any site you browse to on the internet can trivially steal all the data in your phone...

This is a genius fix because in order to enforce your own privacy you must betray the privacy of n+ friends. Awesome.

Putting aside “real” art for a moment: for many mediums, I do. It’s the same difference that explains why an original acrylic painting costs a fortune while a print is $30 in the gift shop. In many mediums a digital copy cannot capture the texture, light effects, and other features originally intended by the artist. In these mediums I think only the originals can capture the human intentions of the artist themselves, and a great deal of value stems from the fact that you hold in your physical hands a piece of a person. Only the owner can see these things. This certainly does not apply to all artistic mediums, but it does seem to apply more to the art I see in the price ranges common to NFTs.

Glad someone is pursuing this model. I am doing well enough that its absolutely worth it to me to pay my way out of the “proliferation of personal data” game.

Thinking on it I had an amusing thought: I wonder if there will ever be a google premium :) All tracking, no ads.

Good point. Let’s throw out all our inherent biases.

Would you expect your OS to have application-specific shortcuts for systemwide, cross-application functions like copy and paste?

Of course not, that’s insane.

I use a Linux desktop as my daily driver FWIW, I’ve “gotten used to it” too. But this doesn’t mean its the best way.

This isn’t true either. If market share is your goal, just write 3 native apps. No, devs choose electron to speed up development of apps that need to be cross-platform. They only write one app instead of three. Faster dev cycle. In doing so, they aim for the middleground UX between all the platforms and end up with something that kinda sucks on each one. Its a tradeoff that is usually overlooked, and indeed is often sold later as “a unified look”, which doesn’t do anything for typical users that work within a single platform.

I dont think the OP’s original point was primarily that the defaults are terrible, in any case. Its that the management of keybindings is godawful. The configuration fix you linked makes this point precisely. In order to have consistency in a basic systemwide function like “copy” you have to dig through forums or bust out your terminal emulator’s man page.

Who actually wants two separate (app-specific!) key bindings for “copy”, which is meant to be a system-wide action? Thats terribly silly and immediately leads to you accidentally killing programs in your terminal. A very silly design choice IMO.

A very useful thing that I automated recently is changing my router’s MAC address and subsequently rebooting the modem. For my ISP (xfinity) this has the amazing benefit of getting me a new IP. For a home connection, your IP is the easiest way to track you. Yes VPNs exist and are better (depends on provider, latency, blahblah), but if you don’t mind your ISP seeing your traffic and instead just want to avoid an IP representing your identity, it’s a very easy way to accomplish this.

I’ve thought hard about the summary for this, I think this is a good one:

Facebook: we don’t provide anything of tangible physical value. Other people do, and they make money off of it. Where’s our money?!?!

The stakes are “we lost all the user passwords”. This is a problem that can occur if e.g. the POP is logging too many things. Preventing passive collection at POPs also prevents all sorts of footguns like these that can lead to a breach, it is smart security sense IMO.

Disagree. Theres a big difference between passive and active collection attacks. If the stakes are a site-wide password breach, it can make sense to eliminate passive attacks specifically.

Remember, sometimes breaches are caused because someone at the POP left HTTP parameter logging enabled.

I doubt it. This is way more work for your typical eng than setting up SSL.

Edit: oh I see, you think the timeframe of this code goes back to when logging in via http:// was acceptable. Maybe.

If you are wondering why they do this, the answer is not because they don’t trust TLS.

It is (likely) because they use geographically distributed terminating load balancers, perhaps owned by someone else or run in someone else’s POP, and are trying to prevent passive collection of passwords.

apple uses this technique on non-HDR displays tho.