I don’t know what to make of the accusations re: Chrome logins in the revised antitrust complaint against Google, but I’m now really looking forward to learning more.
A few years back, Google activated a feature that would automatically log you into the Chrome browser anytime you logged into a Google site. This made it basically impossible to be logged out of Chrome if you used Google accounts.
The Chrome engineers said that they had to do this because users with multiple accounts were getting confused — apparently the idea that some people might not want Chrome to be logged in was not contemplated.
Twitter is being sued over the Saudi spies they hired in customer service and SRE roles, the ones who used their access to collect information on Saudi dissidents. protocol.com/bulletins/saud…
A bunch of people have been telling me that it’s ok to relax end-to-end encryption to fight crime, as long as there are protections and data never leaves the company. Stuff like shows why it’s not.
“But this was an isolated incident!” Or alternatively, maybe being caught was the isolated incident. How many companies (startups, particularly) have internal controls sufficient to withstand even devops folks with admin credentials?
The NSA guidelines for configuring VPNs continue to require IPsec for VPNs rather than WireGuard. I understand why this is (too much DJB cryptography in WireGuard) but IPsec is really a terrible mess of a protocol, which makes this bad advice. media.defense.gov/2020/Jul/02/20…
The number of footguns in IPsec is really high, and they mostly express themselves in terms of implementation errors in VPN devices/software. It’s these implementation errors that risk private data, not some abstract concern about cipher cryptanalysis.
To be clear, there’s nothing wrong with DJB cryptography. The problem here is that the NSA only approves a very specific list of algorithms (see attached) and that list hasn’t been updated since 2016. It doesn’t even list SHA-3 yet! cnss.gov/CNSS/openDoc.c…
Everyone on HN is puzzling about how to ensure open access papers. The answer seems very simple: just have funding agencies (NSF/NIH/DARPA etc.) require a link to an Arxiv/ePrint version for each paper mentioned in an annual report.
For those who haven’t seen the current NSF system: for each paper you’ve published in a given year, you need to convert it into PDF/A (!!) and upload it to a private archival service run by the DoE, one that (I think) taxpayers can’t access.
(This PDF/A thing, as best I can tell, is just a subsidy for Adobe Creative Cloud. Every researcher I know converts their PDFs using a sketchy .ru website so that DoE server must be a haven of malware.)
Ok I just want to follow this up with a sanity check: “Find My” uses Bluetooth, right? So keeping it active is *not* the same as simply powering the NFC chip, which I know was available in previous phones/OSes. Or is it?
I’m asking because I know that AirTags support NFC, but also Bluetooth. And maybe the NFC chipset also supports some kind of longer-range communications? Basic question is: does the phone application processor remain “on” to support this feature?
I like that Apple has made this feature so ubiquitous that its actual technical operation can be ignored. But I actually want to know what’s happening in my phone when it purports to be “turned off!”
“iPhone Remains Findable After Power Off” what I can’t keep up anymore.
So I guess “power off” doesn’t mean “off” anymore, it means the device stays on and does some kind of low-power nearfield communication. I’m trying to decide how I feel about this.
The off switch is buried in the “Find My” settings dialog, weirdly in a tab called “Find My Network” which might make you think it’s intended to… find your network… but actually I think this is some kind of branding gone wrong.