Father, Hacker (Information Security Professional), Open Source Software Developer, Inventor, and 3D printing enthusiast

  • 7 Posts
  • 307 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle
  • This is a, “it’s turtles all the way down!” problem. An application has to be able to store its encryption keys somewhere. You can encrypt your encryption keys but then where do you store that key? Ultimately any application will need access to the plaintext key in order to function.

    On servers the best practice is to store the encryption keys somewhere that isn’t on the server itself. Such as a networked Hardware Security Module (HSM) but literally any location that isn’t physically on/in the server itself is good enough. Some Raspberry Pi attached to the network in the corner of the data center would be nearly as good because the attack you’re protecting against with this kind of encryption is someone walking out of the data center with your server (and then decrypting the data).

    With a device like a phone you can’t use a networked HSM since your phone will be carried around with you everywhere. You could store your encryption keys out on the Internet somewhere but that actually increases the attack surface. As such, the encryption keys get stored on the phone itself.

    Phone OSes include tools like encrypted storage locations for things like encryption keys but realistically they’re no more secure than storing the keys as plaintext in the application’s app-specific store (which is encrypted on Android by default; not sure about iOS). Only that app and the OS itself have access to that storage location so it’s basically exactly the same as the special “secure” storage features… Except easier to use and less likely to be targeted, exploited, and ultimately compromised because again, it’s a smaller attack surface.

    If an attacker gets physical access to your device you must assume they’ll have access to everything on it unless the data is encrypted and the key for that isn’t on the phone itself (e.g. it uses a hash generated from your thumbprint or your PIN). In that case your effective encryption key is your thumb(s) and/or PIN. Because the Signal app’s encryption keys are already encrypted on the filesystem.

    Going full circle: You can always further encrypt something or add an extra step to accessing encrypted data but that just adds inconvenience and doesn’t really buy you any more security (realistically). It’s turtles all the way down.



  • Riskable@programming.devtoLemmy Shitpost@lemmy.worldEat it
    link
    fedilink
    English
    arrow-up
    7
    arrow-down
    1
    ·
    11 hours ago

    To be fair, a 250g RC aircraft can cause a lot of destruction to a plane that’s in the process of taking off/landing or to a car on a highway.

    Having said that, they really have gone overboard with the regulation. Restrict airspace near airports and over highways, not something as ambiguous as “over people”. They also (still) require a spotter for FPV which is just silly. The point of the spotter is so you can figure out where it went if you lose control (presumably, to take responsibility if it crashes into something important and does some damage). Anyone flying FPV is going to know exactly where the RC aircraft was when they lost control (and modern ones will return themselves home if contact is lost like that).

    They need to focus more on regulating features instead of “what and where”. If every RC aircraft has to have a return to home feature that would make more sense than something super ambiguous like, “don’t fly above people.”


  • This is crap. TikTok is just a video hosting platform with a powerful, China-controlled algorithm that keeps people addicted. If TikTok were to disappear today a new platform would rise to take it’s place within milliseconds. Seriously: Do you honestly think that everyone would just put down their phones and do something else because TikTok doesn’t work anymore‽

    It’s not even being banned! Which is another reason why this article is total bullshit. ByteDance just needs to comply with the law that is meant to prevent the Chinese government from interfering in US politics (yes, that’s the real reason why that law was passed). That means they need to break ties with China or just outright sell the platform to some other company. If they let it die in the US they’d be throwing away billions of dollars which just isn’t going to happen.

    Furthermore, China has absolutely no ground to stand on by complaining about TikTok bans. They ban all sorts of foreign-owned apps in China for more dubious reasons.




  • It’s like everything else conservatives think they want: “We want illegal immigrants out of the country! But we’re not willing to fund more immigration courts/judges. Let those court cases back up forever so they can stay here indefinitely! Oh wait…”

    Conservative: “Tesla chose Texas for their new whatever, yeeeee fuckin’ haw yo! That’s a lot of money that will come into the state!”

    Bystander: “But don’t they have to settle that case with the EPA before they can proceed? I mean, they totally fucked that river and will have to pay for cleanup.” (note: this is hypothetical river fucking)

    Conservative (and Libertarians, oddly): “Yeah yeah whatever. That’s why we have the courts!”

    Bystander: “Except that court case won’t be heard for years because the courts are backed up. Apparently there’s not enough money in the Federal budget this year to pay for more judges, courthouses, and lawyers to handle cases like that”

    Conservative: “Then they need to increase taxes! Oh wait…”


  • Congratulations conservatives! With this ruling, you just drastically increased the size of the Federal government.

    Simple administrative rulings are gone so now we’re going to end up with five zillion more expensive lawyers, a lot more judges, and a gazillion more cases before the courts.

    It’ll also increase the cost of doing business! Because now instead of just having to occasionally deal with an administrative body full of technical people who know what matters and what doesn’t every company is now going to have to hire teams of lawyers to defend themselves in court and explain every little thing to a jury of total laymen.

    The companies that violate the law regularly with the intent to “just pay the fines” will now have to defend themselves in court over and over and over again. You think immigration courts are overloaded? Now every federal court will be!

    Perhaps they thought this would just result in businesses no longer having to comply with regulations? Hell no. Next year’s Federal budget is going to balloon in order to pay for all these new inefficiencies.

    They are insane.

    Of course, this is conservatives modus operandi: Don’t bother looking at real outcomes and real consequences of their actions! Instead, look towards tradition and religion and only that which is right in front of their face.




  • Riskable@programming.devtoLemmy Shitpost@lemmy.worldAutomation
    link
    fedilink
    English
    arrow-up
    9
    ·
    edit-2
    12 days ago

    To be fair, that’s a very open ended question. I mean, what kind of bolt are we talking about? A standard lag bolt? If so you don’t tighten it! That’d be a trick question! You tighten the nut. Same thing applies with car wheel bolts. Tricky tricky!

    Is it a hex bolt that also has a cross head? How tight are we talking?

    I’m just going to assume bolts of lightning and Usain Bolt are off the table.




  • The base assumption is that you can tell anything reliable at all about a person from their body language, speech patterns, or appearance. So many people think they have an intuition for such things but pretty much every study of such things comes to the same conclusion: You can’t.

    The reason why it doesn’t work is because the world is full of a diverse set of cultures, genetics, and subtle medical conditions. You may be able to attain something like 60% accuracy for certain personality traits from an interview if the person being interviewed was born and raised in the same type of environment/culture (and is the same sex) as you. Anything else is pretty much a guarantee that you’re going to get it wrong.

    That’s why you should only ask interviewees empirical questions that can identify whether or not they have the requisite knowledge to do the job. For example, if you’re hiring an electrical engineer ask them how they would lay out a circuit board. Or if hiring a sales person ask them questions about how they would try to sell your specific product. Or if you’re hiring a union-busting expert person ask them how they sleep at night.