seethishat

They appreciate technical correctness and they do not exaggerate. Most 'security researchers' are not technically correct and they exaggerate a lot (seeking fame and all).

Dismissing their claims is not being selective, it's just the right thing to do.

I'm not sure there are any regulations around opting to do that in the US. Do you have a phlebotomist friend? If so, they might do it for you, but it can be risky and they might not want to take the risk, get sued, etc.

It is an interesting question. Are there companies that draw and discard?

Yes... travel, tattoos, drug use and sexual behavior can and should disqualify a person from donating blood.

Doing whole blood donations seems to significantly reduce PFAS in the blood. Here's one paper:

https://jamanetwork.com/journals/jamanetworkopen/fullarticle...

Edit: This also helps others who are in accidents, car wrecks, have Cancer, etc. Yes, we pass on the PFAS to others, but the immediate need for blood is more urgent than the potential long term impacts of PFAS.

No backdoor is secure. Read the "Keys under Doormats" paper from 2015:

https://www.schneier.com/wp-content/uploads/2016/09/paper-ke...

Wildcard certs were somewhat useful for hiding this. Not sure that's still true.

Any LSM can stop that POST. SELinux, AppArmor, Tomoyo, etc. They are built-in to the kernel. You just need to know what you are doing to use them.

Some spiders seem to think, recognize people and take immediate evasive action. Contrast that with a beetle, or ant. They just keep walking along like I'm not even there.

I turned the kitchen light on once and saw a spider in the middle of the floor. It ran straight under the fridge. It would peek out occasionally to see if I was still there.

That's why spiders scare me.

Obviously no one knows every detail all the way down the stack. It's not possible, but having some level of understanding of how a system operates is useful especially if you ever have to fix it yourself or explain why/how it is broken.

c't published articles about a few programs that I wrote (many years ago). They always sent me copies of the magazine with a CD when they did that. The CD had all the free/open source programs that were discussed in the magazine. Very good publisher.

It's a joke. By using RAID, more bits will be corrupted, thus more efficient.

To make the corruption more efficient, store the file on a RAID.

I pay for and use Mullvad VPN. I believe they value everyone's privacy and I believe they are competent technologists.

I don't care about politics. I will continue to buy and use Mullvad VPN.

I wonder, why not use an LSM like Tomoyo, App Armor or SELinux to not allow the AI to read the secrets file? That way you could be certain that it could not be tricked into doing so.

My main concern is transparency. How do we know that the ruling/governing class is not abusing these monitoring systems and exempting themselves from monitoring?

If we are all subject to the same monitoring and there are no exceptions, that would be fair. However, if some people are exempt from monitoring because of their connections, relations, etc. then that would be unfair.

And if some people are allowed to harass and stalk others based on some attribute (race, religion, nationality, etc.) because they are in a monitoring position (while others are not) then that would be unfair as well.

We need full transparency.

I agree. Hiding from a grizzly bear is a good strategy. But if that fails, you will need pepper spray and maybe a shotgun.

Bear Defense Plan: Hide, Non-lethal, Lethal.

It is OK to talk to them. Just don't lie and don't answer questions. Doing either could land you in jail.

It's really about personal privacy. Your computer is likely to be stolen and sold. If you don't want others reading your email, viewing your pictures, seeing your tax returns, etc. then you should encrypt the drive.

I call this "The Pawn Shop Threat Model" ;)

And, IME it is likely to happen.

That conclusion is similar to the concept of 'unconditional security' especially WRT one-time pads. The key must be at least as long as the message itself.

Other forms of encryption are based on assumptions and conditions being true (e.g. factoring is a hard problem, etc.) that may or may not be true. We don't know.

This is true. Everything is in a constant state of decline (including our health). Enjoy it while you can.

My problem is it is an experiment (synthetic nicotine that is socially acceptable) and kids are addicted to it. It's like candy. No one knows or complains because the users are not generating smoke, vapor or spit. They just swallow the synthetic nicotine.

Yes, people have used tobacco products for a long time. However, they have not sucked on them like candy and swallowed the contents 16 hours a day. They spit, exhaled, etc. Chewing tobacco and snuff are not acceptable and they ruin your teeth/gums. Smoking is not acceptable and it ruins your lungs/breathing ability. This stuff is socially OK, because no one can tell you are using it (no spit or smoke).

Check out all the reports of GI issues on reddit (QuittingZyn). This stuff causes all sorts of GI issues from the top of the stomach to the bottom of the bowel.

The newer synthetic nicotine pouches (Zyn, On, Velo) are everywhere in the USA and are being used by kids as young as 13. They are ruining the gut health of an entire generation of kids.

Edit: Both boys and girls are dependent on these things now and they seem socially acceptable (no smoke, no spit, just swallow the chemical nicotine). Get ready for a huge wave of GI problems due to this.

Until one of them communicates a threat, then it is a criminal matter.

They did for awhile, but removed it due to complexity and security issues.

I run it. Home firewall, office desktops and laptops. It's pretty stable and I'm fairly familiar with it. Really simple if you know Unix. I hope it never goes away, not sure what I would replace it with. Linux is so complicated now, it's just too much for me to deal with

I'm a long-time Mullvad user. I will continue to buy and use Mullvad VPN services (with my credit card that has my name on it) so long as it is legal to do so in my country.

VPNs are not 100% anonymous. They are not meant to be. Instead, they are meant to provide some level of privacy to law-abiding adults.

Most people would be embarrassed if their co-workers and neighbors knew the intimate personal details of their lives. Things they like, things they buy, things they do, etc. So, most people should use a VPN to protect their privacy.

By definition, 'most people' don't want or expect 100% anonymity online. They just want a bit of privacy in their personal life and their relationships. That's it.

VPNs don't protect (and are not intended to protect) criminals who want 100% anonymity from governments while committing online crimes. This is an important distinction. 'Most people' are not criminals and do not have this unrealistic expectation from Mullvad and other VPN providers.

This reminds me of a James Micken's quote from "This World of Ours" in response to security people admonishing users for clicking links in email:

    "It’s not clear what else there is to do with computers besides click on things..."

How many cameras do you drive past and walk by to get to the coffee shop ;)

I saw something very similar a few months ago. It was a web app vibe coded by a surgeon. It worked, but they did not have an index .html file in the root web directory and they would routinely zip up all of the source code which contained all the database connection strings, API credentials, AWS credentials, etc.) and place the backup in the root web directory. They would also dump the database to that folder (for backup). So web browsers that went to https://example.com/ could see and download all the backups.

The quick fix was a simple, empty index.html file (or setting the -Indexes option in the apache config). The surgeon had no idea what this meant or why it was important. And the AI bots didn't either.

The odd part of this to me was that the AI had made good choices (strong password hashes, reasonable DB schema, etc.) and the app itself worked well. Honestly, it was impressive. But at the same time, they made some very basic deployment/security mistakes that were trivial. They just needed a bit of guidance from an experienced devops security guy to make it Internet worthy, but no one bothered to do that.

Edit: I do not recommend backing up web apps on the web server itself. That's another basic mistake. But they (or the AI) decided to do that and no one with experience was consulted.

A lot of dumb criminals seem to carry smart phones. The irony.