xylogx
@xylogx@lemmy.world
- Comment on Intel Demos Chip To Compute With Encrypted Data 5 days ago:
Homomorphic encryption is pretty wild, you can sort and search data without decrypting it.
- Comment on Do rich people get addicted to drugs? 1 week ago:
More realistic might be the addict does something stupid out of desperation like try to rob his dealer and is killed in the process.
- Comment on Is there a way out of an NDA after signing? It just seems people are so affraid of breaking it 1 week ago:
It is never a good idea to put yourself in a position where you have legal liability and could be sued. Damages and even just the cost of hiring a lawyer could bankrupt you.
- Comment on Can a reasonable person genuinely believe in ghosts? 2 weeks ago:
It is disturbing when people take this kind of mysticism seriously. I could say a lot about this but it may be best just to refer to the words of Carl Sagan:
“I have a foreboding of an America in my children’s or grandchildren’s time – when the United States is a service and information economy; when nearly all the manufacturing industries have slipped away to other countries; when awesome technological powers are in the hands of a very few, and no one representing the public interest can even grasp the issues; when the people have lost the ability to set their own agendas or knowledgeably question those in authority; when, clutching our crystals and nervously consulting our horoscopes, our critical faculties in decline, unable to distinguish between what feels good and what’s true, we slide, almost without noticing, back into superstition and darkness…
The dumbing down of American is most evident in the slow decay of substantive content in the enormously influential media, the 30 second sound bites (now down to 10 seconds or less), lowest common denominator programming, credulous presentations on pseudoscience and superstition, but especially a kind of celebration of ignorance”
― Carl Sagan, The Demon-Haunted World: Science as a Candle in the Dark - Comment on If there is a doctor that only saves killers, and a killer only kills other killers, I wonder who would save/kill more people? 3 weeks ago:
Depends on the killers the killer kills.
On an unrelated note, vaccinations save millions of lives every year.
Oh yeah, then there is this -> www.cgdev.org/blog/update-lives-lost-usaid-cuts
- Comment on A sneaky demonstration of the dangers of curl bash 3 weeks ago:
Take a look at Shai Hulud. All the attacker had was the key.
- Comment on A sneaky demonstration of the dangers of curl bash 3 weeks ago:
I would feel more comfortable running curl bash from a trusted provider than doing apt get from an unknown software repo. What you are trying to do is establish trust in your supply chain, the delivery vehicle is less important.
- Comment on A sneaky demonstration of the dangers of curl bash 3 weeks ago:
What you said is the key infra needs to get compromise. I do not need to own the PKI that issued the certs, I just need the private key of the signer. And again, this is something that happens. A lot. A software publisher gets owned, then their account is used to distribute malware.
- Comment on A sneaky demonstration of the dangers of curl bash 3 weeks ago:
Not sure how else to explain this. Look at the CISA bulletin on Shai-Hulud the attacker published valid and signed binaries that were installed by hundreds of users.
"CISA is releasing this Alert to provide guidance in response to a widespread software supply chain compromise involving the world’s largest JavaScript registry, npmjs.com. A self-replicating worm—publicly known as “Shai-Hulud”—has compromised over 500 packages.[i]
After gaining initial access, the malicious cyber actor deployed malware that scanned the environment for sensitive credentials. The cyber actor then targeted GitHub Personal Access Tokens (PATs) and application programming interface (API) keys for cloud services, including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.[ii]
The malware then:
- Exfiltrated the harvested credentials to an endpoint controlled by the actor.
- Uploaded the credentials to a public repository named
Shai-Huludvia theGitHub/user/reposAPI. - Leveraged an automated process to rapidly spread by authenticating to the npm registry as the compromised developer, injecting code into other packages, and publishing compromised versions to the registry.[iii]"
- Comment on A sneaky demonstration of the dangers of curl bash 3 weeks ago:
If I can control your infra I can alter what is a valid signature. It has happened. It will happen again. Digital signatures are not sufficient by themselves to prevent supply chain risks. Depending on your threat model, you need to assume advanced adversaries will seek to gain a foothold in your environment by attacking your software supplier. in these types of attacks threat actors can and will take control over the distribution mechanisms deploying trojaned backdoors as part of legitimately signed updates. It is a complex problem and I highly encourage you to read the NIST guidance to understand just how deep the rabbit hole goes.
Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
- Comment on A sneaky demonstration of the dangers of curl bash 3 weeks ago:
Signatures do not help if your distribution infra gets compromised. See Solarwinds and the more recent node.js incidents.
- Comment on A sneaky demonstration of the dangers of curl bash 3 weeks ago:
Yes this has risks. At the same time anytime you run any piece of software you are facing the same risks, especially if that software is updated from the internet. Take a look at the NIST docs in software supply chain risks.
- Comment on The U.S. spent $30 billion to ditch textbooks for laptops and tablets: The result is the first generation less cognitively capable than their parents 3 weeks ago:
We should be investing in teachers not technology.
- Comment on Whats the best way to clean up 15 years of stuff around the house? 4 weeks ago:
Get some boxes. Mark them as trash. Start putting stuff in those boxes. After a sufficient amount of time has passed where everyone has had time to know what is in the boxes, dispose of them.
- Comment on Is Dungeon Meshi worth it if I'm not into anime? 4 weeks ago:
My daughters got super excited to hear I was watching anime. I was like what, the D&D cooking show? I had not even realized it was anime. It is intensely odd, and I find that delightful.
- Comment on I don't actually read the news. I surmise the news based on memes that begin popping up for which I have no context. 5 weeks ago:
If everyone is doing the same then you have a better grasp on the popular zeitgeist than any news pundit.
- Comment on Ad blocking is alive and well, despite Chrome's attempts to make it harder 5 weeks ago:
Was the slider turned up all the way?
- Comment on The new Microsoft copilot key is impossible to properly remap. 5 weeks ago:
I was able to remap it with Autohotkey on Windows.
- Comment on 5 weeks ago:
As long as they have no logs the only thing you could get from memory is encryption keys, which can be rotated.
- Comment on Microsoft Just Killed the "Cover for Me" Excuse: Microsoft 365 Now Tracks You in Real-Time 1 month ago:
Your IP address can be correlated with your location without needing this Microsoft cruft. Combine this with MDM and badge reader logs and your employer already has all the information they need to track you.
- Comment on Supreme Court To Decide How 1988 Videotape Privacy Law Applies To Online Video 1 month ago:
I feel like they are targeting big tech here.
- Comment on Neocities deindexed from Bing 1 month ago:
Dick Duck Go gets its search results from Bing.
- Comment on In order to be allowed to drive, you don't just have to promise to pay if you hit someone, you have to pay in advance in case you hit someone 2 months ago:
So like self-insurance?
- Comment on Hacker Congress CCC talk by Cory Doctorow: 'A post-American, enshittification-resistant internet' 2 months ago:
TLDR: US forced everyone to pass anti-circumvention laws by threatening tariffs. Now that the US has unilaterally imposed tariffs on everyone, why ot repeal those laws?
- Comment on Salesforce regrets firing 4000 experienced staff and replacing them with AI 2 months ago:
Looks like the Times of India broke the original story based on Benioff’s podcast comments:
“According to CNBC, CEO Marc Benioff revealed in a podcast that Salesforce had trimmed its support workforce from 9,000 to about 5,000 people through AI deployment. The company later clarified that it had “successfully redeployed hundreds of [those] employees into other areas like professional services, sales, and customer success.”
- Comment on Where does the revenue gathered from taxes go and what is national debt? 2 months ago:
Have a look at this site, there are some good visualizations: usafacts.org/government-spending/
- Comment on Say, the country/countries you have citizenship in, decided to not want you anymore and threw you to some random "3rd world country", how do you survive? 2 months ago:
Learn to speak Canadian.
- Comment on Salt is very salty. Sugar is not that sweet. 2 months ago:
Put a teaspoon of salt in a glass of water and it is so salty you can barely sip it without gagging. Put a teaspoon of sugar in a glass of water and it is mildly sweet.
- Comment on [deleted] 2 months ago:
How could this possibly be better than Netflix’s recommendation engine or even just asking chatgpt?
- Comment on Passkeys Explained: The End of Passwords 4 months ago:
Ok I see a lot if discussion on this topic but no one seems to have mentioned the main feature of the spec that makes them phishing resistant: presence detection. This is what makes FIDO resistant to credential replay. The spec is not perfect but it prevents most common phishing attacks.