• 0 Posts
  • 34 Comments
Joined 1 year ago
cake
Cake day: June 7th, 2023

help-circle
  • While it was kinda lame for Mozilla to add it with it already opted-in the way they did

    That’s really the rub here. Reading the technical explainer on the project, it’s a pretty good idea. The problem is that they came down on the side of “more data” versus respecting their users:

    Having this enabled for more people ensures that there are more people contributing to aggregates, which in turn improves utility. Having this on by default both demands stronger privacy protections — primarily smaller epsilon values and more noise — but it also enables those stronger protections, because there are more people participating. In effect, people are hiding in a larger crowd.

    In short, they pulled a “trust us, bro” and turned an experimental tracking system on by default. They fully deserve to be taken to task over this.


  • Switched to full time Arch because I didn’t want to run Windows Privacy Invasion Goes to 11. And it’s been pretty good. Valve gets a big “thank you” for their contributions to WINE and making gaming on Linux nearly as seamless as Windows.

    It’s probably still true that “Next year” will be the year of Linux on the desktop, and it will be for several more years to come. But, it’s starting to feel like cracks are forming in the Microsoft wall.



  • Holy Misleading Headline, Batman…
    The actual first sentence of the article:

    Since 2019, the U.S. Department of Defense has been asking for a waiver from legislation barring it from doing business with companies reliant on telecommunications equipment manufactured by Huawei.

    Emphasis added. This isn’t the DoD saying “we need to use Huawei hardware”, it’s the DoD saying “a fuck-ton of companies we do business with use Huawei hardware.” And that’s because Huawei hardware is cheap and businesses like cheap. While I do think the DoD has some leverage in contracts to say, “welcome to the Defense Industrial Base (DIB), you cannot use anything manufactured by Huawei in infrastructure which is within scope”. If the text of the law says that the DoD can’t do business with companies who use Huawei hardware at all, then that’s going to be very limiting.





  • And once you have found your specific collection of plugins that happen not to put the exact features you need behind a paywall but others, you ain’t touching those either.

    And this is why, when I’m investigating phishing links, I’ve gotten used to mumbling, “fucking WordPress”. WordPress itself is pretty secure. Many WordPress plugins, if kept up to date, are reasonably secure. But, for some god forsaken reason, people seem to be allergic to updating their WordPress plugins and end up getting pwned and turned into malware serving zombies. Please folks, if it’s going to be on the open internet, install your fucking updates!



  • I think AI is good with giving answers to well defined problems. The issue is that companies keep trying to throw it at poorly defined problems and the results are less useful. I work in the cybersecurity space and you can’t swing a dead cat without hitting a vendor talking about AI in their products. It’s the new, big marketing buzzword. The problem is that finding the bad stuff on a network is not a well defined problem. So instead, you get the unsupervised models faffing about, generating tons and tons of false positives. The only useful implementations of AI I’ve seen in these tools actually mirrors you own: they can be scary good at generating data queries from natural language prompts. Which is, once again, a well defined problem.

    Overall, AI is a tool and used in the right way, it’s useful. It gets a bad rap because companies keep using it in bad ways and the end result can be worse than not having it at all.







  • Windows 10 released in 2015. Windows 11 released in 2021. It’s pretty much in line with other release cycles for Windows Desktop OS releases.

    • XP -> Vista - was about 6 years
    • Vista -> 7 - Was about 2 (But everyone sane basically skipped Vista)
    • 7-> 8 - Was 3 years, with a fourth year to get to 8.1.
    • 8 -> 10 - Was about 3 years.

    If you only look at the releases which mattered, XP -> 7 was 8 years and 7 -> 10 was 6. So, it seems like Microsoft kinda accepted reality this time around and we didn’t get some sort of asinine Windows Mojave shenanigans trying to polish a turd. That said, I’m still running 10 on my main system and my experiences with 11 are making me consider an upgrade path to Linux when Win10 goes EoL.



  • It’s always a “chicken or the egg” situation. Right now, there isn’t much need for a home router with anything faster than a 1Gbps port. In the prosumer space 10Gbps is available, but it’s not super cheap (about $300 with SFP module). But, if something like 50Gbps becomes common, manufacturers will be incentivized to make products for it. The economies of scale and the effects of competition will kick in and prices will come down.

    I’m old. I was at one of the events where Intel announced 1Gbps over copper. This was supposed to be impossible, there was no way to push 1Gbps over Cat-5 cables. But, with Cat-5e and Cat-6, they had cracked it. At the time, there was no way this was ever going to be a cheap technology and it was intended for large enterprises for major switch interconnect runs. Now it’s everywhere.

    Maybe 50Gbps to the home won’t happen. And this is just some exec blowing smoke. But, maybe they’ll do it and kick off the market for cheaper equipment in that class. While I do agree that we’re lacking the “killer app” to make that much bandwidth to the home necessary. Things like music and video streaming came about after the advent of faster speeds. It wasn’t until we had DSL that people realized that streaming music, in real time, would be a thing. We needed the bandwidth to be there for the use cases to be discovered.


  • From the unsaflok.com site:

    Dormakaba uses a Key Derivation Function (KDF) to derive the keys for some of the Saflok MIFARE Classic sectors. This proprietary KDF only uses the card’s Unique IDentifier (UID) as an input.
    Knowledge of the KDF allows an attacker to easily read and clone a Saflok MIFARE Classic card. However, the KDF by itself is not sufficient for an attacker to create arbitrary Saflok keycards.

    Security is hard. Cryptography is even harder. Don’t roll your own algorithms, it’s just asking for a problem. And given that “oversight”, I’d bet that the rest of the kill chain involves equally bad encryption or hashing being used on the cards.


  • Piracy and torrenting was always a service issue. Sure, there is some core of people who will never pay for content or a service. But, a lot of people will be happy to pay something for content, so long as they can get what they want without too much hassle. And that has largely been the landscape for the past decade or so. Apple Music popped up and gave people the same sort of access to music Napster did, at a cost which wasn’t ridiculous. It also didn’t host a million viruses and didn’t carry with it any sort of moral questions or legal risks. Netflix did the same for movies and TV, shrinking the space for video piracy. And many movie and TV producers are finally accepting the new paradigm and trying to carve out their own space which mimics the speed and convenience of piracy, while still earning them some money. We probably have a long way to go and a lot of growing pains. But, the fact that torrent traffic is falling and official streaming services’ bandwidth usage is growing shows that they are doing something right. That said, I suspect that we will see them fluctuate for a while as customers punish the more outlandish attempt to monetize streaming services. When the official services start getting too bad again, we’ll see more black flags flying. And that’s a good thing.