ZoFreX

7 ms·

1.
Bundler Is Still Vulnerable to Dependency Confusion Attacks(zofrex.com)
3 points by ZoFreX 5y ago|0 comments
2.
by ZoFreX 7y ago
This seems to be an internet meme, because it's repeated in every discussion on this topic but I never see any citation for it. It also doesn't seem to hold up to scrutiny - even if the initial packing of the vehicle holds everyth
3.
by ZoFreX 7y ago
Largely yes. Or at least a lot less of a problem. The biggest risk from space garbage is that the small stuff is not trackable, so at any point it could slam into satellites or, god forbid, people or space stations. It's going fast eno
4.
by ZoFreX 7y ago
Also, to prove a rocket you need to have a dummy payload of some kind. Whatever you think about the stunt of using a Tesla as that dummy payload, there was going to be a payload of some kind however that decision went. The fact it was a car
5.
by ZoFreX 8y ago
Windows doesn't have fine-grained permissions for adding to or changing certificate stores, though. When you run "mkcert -install" you'll get a generic prompt for mkcert requiring admin permissions, not a prompt for it c
6.
by ZoFreX 8y ago
Counter-point, I haven't had a single Apple keyboard fail on me yet (although I do not own the new Macbook, so I don't have the dreadful one) and my Matias broke after just 1 year.
7.
by ZoFreX 8y ago
It's not, necessarily. It's a tradeoff between usability and security, and each site should make their own decision about what is right for them. It obviously makes attacks like the one in the article easier, but there are other w
8.
by ZoFreX 8y ago
If people are using it, not paying attention, with the expectation that it will beep to tell you to take over that's a big problem. In situations like this divider issue it won't beep, it thinks everything is fine right up until i
9.
by ZoFreX 9y ago
> This should help you to have a backup next time you get locked out! The official authenticator also displays a backup code which it tells you to keep a copy of somewhere safe...
10.
by ZoFreX 9y ago
The difference is (according to the article) that there is an abundance of objects at 0mph - signs, litter, barriers - so the system filters all of these out to avoid constantly braking. There is no such abundance of ignorable items going a
11.
by ZoFreX 9y ago
> it pauses with an incorrect password for a few seconds, then visually shakes indicating it's a wrong password This is also the behaviour of the App Store preferences in version 10.13.1
12.
by ZoFreX 9y ago
> Hopefully their mobile apps use HTTPS for everything too? Well, HSBC's didn't: https://threatpost.com/banking-apps-found-vulnerable-to-mitm...
13.
by ZoFreX 9y ago
NatWest are particularly terrible. Last time I checked, in-branch they were still using Internet Explorer to visit an http (not https) site on their intranet to launch via Java Web Start a thin client to log in to their (I assume) mainframe
14.
by ZoFreX 9y ago
Being a jerk and disagreeing are orthogonal. You can be a jerk while agreeing with someone, and be a not-jerk while disagreeing. I'm curious, in reference to the post, how you would have no problem working with a "Bob"? Is th
15.
by ZoFreX 9y ago
Hence tilting - high speed vehicles tilt, low speed vehicles don't, and everything works out ok.
16.
by ZoFreX 9y ago
Lateral acceleration is much more annoying to deal with than longitudinal or vertical, even if it's constant. Perhaps they could tilt in bends to convert some of that lateral to vertical?
17.
by ZoFreX 9y ago
> with a reputation as huge and important as Google's Not trolling: What reputation? Among non-techies, their reputation is one of creepy and spying. Among techies, it's that company that keeps killing loved products. Among dev
18.
by ZoFreX 9y ago
Anyone who hasn't seen this yet should take a look, it explains in detail: - Why they are doing this - What the potential passenger benefits are - And bonus, it includes lots of cool infographics on passenger journeys
19.
by ZoFreX 9y ago
They go into a lot of potential benefits in their paper here: http://content.tfl.gov.uk/review-tfl-wifi-pilot.pdf
20.
by ZoFreX 9y ago
How would tracking the Oyster card ID that's registered to my name, address, and credit card # in their system be an improvement compared to tracking the hashed MAC address of my phone?
21.
by ZoFreX 9y ago
> Why do they need to do this? This is explained in detail here: http://content.tfl.gov.uk/review-tfl-wifi-pilot.pdf If you would rather buy a paper ticket with cash you can still do that, and you won't be tracked i
22.
by ZoFreX 9y ago
Yup, I'm happy with it. Can't see how else you would get this amazing data which is obviously going to be extremely helpful for managing an increasingly overcrowded train system. Even the article says they're using this to as
23.
by ZoFreX 9y ago
In that one scenario yes, that communication could save the day. I think the article is more about what happens if you multiply that by 100, and one person is disproportionately making that communication happen.
24.
by ZoFreX 9y ago
In the circles I hang in (as in, both people I talk to, and articles I read) the term "emotional labour" is used like it is in this article. Sometimes terms mean different things in different circles or groups or contexts, it does
25.
by ZoFreX 9y ago
And how many of your passwords need to leak for that scheme to be completely transparent?
26.
by ZoFreX 9y ago
I highly recommend the essay "The Programming Systems Product" from the collection "The Mythical Man-Month" which provides an answer to this exact question.
27.
by ZoFreX 9y ago
A use-case where it makes a big difference: bad internet. My internet is not fast, and not super-reliable, which is why I download TV and movies overnight so I can watch them without being at the mercy of the ADSL gods.
28.
by ZoFreX 9y ago
The "power" to ban people isn't up for debate, though. Reddit have that power, whether they exercise it or not. If they did not exercise it today, it could still be inherited and abused by a future actor tomorrow. There may b
29.
by ZoFreX 9y ago
> If HL would have been a EA game It was! I know EA are the go-to bad guy in these comparisons, but EA is the distributing publisher for physical copies of Valve games, and Valve are on record as loving working with EA.
30.
by ZoFreX 9y ago
> it's amazing that Valve continues to ignore it Valve isn't a monolithic entity nor a top-down controlled company though. This argument doesn't reflect how they make decisions. They have spoken on a few related points in

More ›