neerdowell

6 ms·

1.
by neerdowell 10y ago
This is a textbook example of FUD.
2.
by neerdowell 10y ago
> There's no way to know GCHQ/NSA aren't running 90%+ of bridges and exit relays Yes there is. There are currently 857 exit nodes. The Tor Project only has to personally know who runs 86 of them to ensure that 90% of the
3.
by neerdowell 10y ago
> The Tor Browser does not send misinformation; it just blocks. No, it doesn't. TB sends all kinds of misinformation, from the user agent string (always reports itself as being its base version of Firefox running on 32-bit Windows
4.
by neerdowell 10y ago
> The Wire guys made very specific claims (where did they get the >$2M figure from ... and why would they simply invent such a figure). Their court filing[0] says the license fee was "unspecified" and the $2 million figure
5.
by neerdowell 10y ago
You think more than 50% of the people using Chrome deliberately sought it out and installed it after making an informed decision? Not because it was pushed via bundlware or a Google-owned property?
6.
by neerdowell 10y ago
Most users haven't made a conscious choice to use Chrome. They install it accidentally by not unticking a checkbox[0] or because they are told it will make the Google work better[1]. [0] https://i.imgur.com/LNFjqzd.png
7.
by neerdowell 10y ago
CCleaner: https://i.imgur.com/LNFjqzd.png The checkbox is pre-selected.
8.
by neerdowell 10y ago
Except they are. The F-Droid devs kept claiming they weren't. Moxie asked them to describe the system and surprise, surprise the keys are stored on a machine that is connected to a network that is connected to the internet. It turned o
9.
by neerdowell 10y ago
What? APKs are signed by the developer before they uploaded to the store and the signatures are verified by PackageManagerService which is a part of AOSP.
10.
by neerdowell 10y ago
> By giving NSA the only thing what they want: metadata from Google What metadata does Google get from Signal messages? The time/date you received a message, the size of the message... Is there anything else?
11.
by neerdowell 10y ago
What does Play Services have to do with anything? APKs downloaded from the Play Store are signed by a key the developer holds and validated by Android's PackageManagerService which is open source.
12.
by neerdowell 10y ago
> But ignoring much of the developing countries (see whatsapp), China Moxie says Signal works fine in China: https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
13.
by neerdowell 10y ago
> He decided not to. That's completely his right. He doesn't go into a lot of detail about why he has decided this, but it's completely up to him. He doesn't like how F-Droid uses centralized signing keys which are
14.
by neerdowell 10y ago
Each device has its own key. Before a message is sent, the client grabs all the keys for each device associated with the account of the recipient, it then encrypts the message separately for each device and sends a separate encrypted copy f
15.
by neerdowell 10y ago
I'm not seeing your point. A vulnerability was found in OpenSMTPD. That vulnerability could not be exploited on OpenBSD because there was no way to overflow the buffer without smashing the stack canary. If you had the same version of O
16.
by neerdowell 10y ago
People are testing the mitigations. For example Qualsys' audit of OpenSMTPD[0] noted that a buffer overflow they found was not exploitable on OpenBSD as even a single byte overflow would smash the stack canary. [0] https://w
17.
by neerdowell 10y ago
> Yet, the mere fact that I see OpenBSD desktops in Google images running shoddy applications shows many OpenBSD users make similar tradeoffs to what you described of Linux camp. Are these "shoddy applications" not more secur
18.
by neerdowell 10y ago
You mean libel. Slander is spoken, libel is written. The easy way to remember this distinction is to know that one of the most famous libel cases in history, nicknamed the "McLibel" case, concerned printed pamphlets.
19.
by neerdowell 10y ago
It's not that much of a stretch to imagine that the reason the FBI are threatening to abduct her off the street and deny her the right to legal counsel is somehow related to her being a major Tor contributor.
20.
by neerdowell 10y ago
> I'm curious about the technical reasons. uBlock hasn't been updated in almost a year. uBlock Origin is actively developed. uBlock has effectively had no significant changes or improvements since the uBlock Origin fork happe
21.
Our 2016 Open Source Donations(duck.co)
3 points by neerdowell 10y ago|0 comments
22.
by neerdowell 10y ago
And Google would never break the law or breach a contract. Especially a contract they signed with the UK Government. I mean, other than that time just a few years ago[0] where Google broke the law and then breached the contract they signed
23.
by neerdowell 10y ago
End-to-end encryption for Android to Android conversations has been in place since November 2014: https://whispersystems.org/blog/whatsapp/
24.
by neerdowell 10y ago
>oh please. i trust google far more than my own government for data protection; we're talking about an orginisation who leaves sensitive literally just lying around We're talking about a corporation that had employees access
25.
by neerdowell 10y ago
> It also bothers me that they didn't just use the GPLv2 Maybe they want people to be able to easily distribute binaries of the software via BitTorrent. Apache allows this, the Vim License allows this, GPLv2 does not[0]. [0] http
26.
by neerdowell 10y ago
We only spent 15 years trying to fix the mistakes. The last 5 have been spent repeating them.
27.
by neerdowell 10y ago
Not all ASLR implementations are equal, eg. PaX's ASLR vs standard Linux KASLR.
28.
by neerdowell 10y ago
If a zero-day is found in standard Android (ala Stagefright) it's possible it won't be exploitable on Copperhead because of the hardened malloc, overflow protections, bounds sanitizing etc.
29.
by neerdowell 10y ago
BBM's security paper: https://help.blackberry.com/en/bbm-security/latest/bbm-secur... [PDF] Check out the bottom of page 7, and the diagrams on page 8.
30.
by neerdowell 10y ago
It's required in POSIX 1003.1-2013 that rm refuse to remove the root directory[0]. [0] http://pubs.opengroup.org/onlinepubs/9699919799/utilities/rm...

More ›