skysight-inc/HackerNews huggingface dataset:
(I work for a company that provides guest WiFi services in public spaces.)

It's usually not that those specific services are whitelisted, but that a number of hostnames have to be whitelisted for the user experience. Sometimes, those hostnames include those types of services, depending on the phone, OS, carrier, etc.
Sounds like they are trying to achieve perfect forward secrecy per message. Typically you might do this with Diffie-Hellman using ephemeral derivation pairs per session. This is good practice as if any one session key is broken, that has no effect on the privacy of past or future messages encrypted under different session keys. They seem to be claiming to use their own crypto based on the parent comment (red flag) and no signature scheme over the top of it to prove a consistent identity, so I'm not sure what they would be doing. Establishing encrypted pipes over an observable medium is very doable, but providing a way to trust that the party on the other end of the pipe is who you think it is is the hard part as you pointed out.
Thanks for the info. I'm not particularly familiar with common JIT applications, but I suspect that this use-case is actually more niche than may think.

The problem is that the example presented requires a memory page with write + execute permissions (at the same time). I suspect many JITs don't do this for security reasons (and to deal with OSes which don't allow it), as it may make it easier for an attacker to gain arbitrary code execution.
It's likely that many JITs toggle between write and execute permissions, rather than have both enabled at the same time. Whilst this reduces attack surface, changing permissions on allocated memory requires syscalls, which are quite expensive in terms of performance.

The scenario presented in the article avoids the impact of syscalls, to maximize performance, leaving only the impact caused by the processor itself. If a JIT isn't overly concerned with this type of security, using write+execute memory could be a way to avoid syscall overhead. On the other hand, if a JIT does toggle permissions, the syscall overhead is likely much more significant than overheads caused by the processor (although the techniques shown might still help depending on how the JIT engine works).
> I would call them terrorists, mafia or fascists - the Indian word is Naxal/Urban Naxal.

Pray enlighten the rest of us as to how the current regime favouring one particular corporation isn't fascism?

Where is this definition of "urban naxal" defined? Just because one thought so? If speaking against the atrocities of authorities is being "urban naxalism", most of the current leaders also did so, during the emergency in India.
Is there a Retired/Erstwhile "Urban Naxal" title too, for them?

Please keep HN civil. Your ultra-right thoughts can find good currency on Twitter/Reddit.

HN being invaded by ultra-right, on a thread that talks about caste-based discrimination.

Guess it is enough Internet for one day!
Oh, and they sold data about torrent users. That's right. A Swedish ISP selling personally identifiable information. Not giving it out because of a court order.

I have steered many people away from them over the years. They would have to have at least a decade of good behaviour and a sun shining out of their ass before I would pick them.
I've never heard "reputability" used in crypto, but confusingly, it might be the opposite of "repudiability"?
It would be fine if they meant "forward-secure ratchet construction", like Signal does.

You can rotate message/session keys easily enough if you have a shared long(er) term key.
In the comments:

"MIT doesn't explicitly require any sort of attribution."

I haven't verified that, but if that is right, the forker isn't wrong.

In that situation it is both childish and annoying to insist on attribution.
Remote Code Execution in Apache Guacamole RDP Gateway (CVE-2020-9497/8)
If they had access to the servers then they could have intercepted the key transfer. They would then be able to decrypt any messages sent
That is weird and very foreign to me. Why not become an atheist? Or doesn't that count?
Location: Prague, Czechia

Remote: Preferred

Willing to relocate: Maybe

Technologies: Node, JS & TS, React, React Native, Python, Go, Postgres, GCP, AWS, Containers, Kubernetes, Terraform, Linux

Résumé/CV:
https://www.linkedin.com/in/mariandurco/
https://github.com/MajoDurco

Experienced software engineer specialised in full-stack development and dev-ops. Interested in helping to creating valuable early-stage products in a startup environment.
I tested this out of curiosity, and all iPhones I could find in my household rendered correctly in UTF-8 with only 12 octets [0]. This is replicated on iPhone 7, SE and XR, all running 13.5.1. So it may well be the issue was fixed in 6s or 7.

[0] https://i.imgur.com/KDau4PP.jpg
That is a reasonable approach if you know that what you are decoding is supposed to be UTF-8.

If you don't know the text encoding because there is no information to indicate it (or you don't trust that information to be correct) then you will have to guess and "decode as UTF-8 for valid UTF-8, use some legacy encoding otherwise" is a common approach (used e.g. by many text editors).
Is anyone tracking this form of damage? This articles says "hundreds of thousands":

Here’s What Recovery From Covid-19 Looks Like for Many Survivors

https://www.nytimes.com/2020/07/01/health/coronavirus-recove...

Number of new cases and deaths does not tell the whole story. If lots of people take months to recover or never recover completely, that could have big long term economic impacts. As far as I can tell nobody currently knows how prevalent this is. Here is one data point for lung damage:

Up to 30% of COVID-19 survivors may suffer ‘irreversible’ lung damage, warns leaked NHS guidance

https://www.thehealthsite.com/news/up-to-30-of-covid-19-surv...

Nothing about damage to other organs, chronic fatigue, muscle recovery time, etc. Even if we find drugs that prevent anyone from dying, large numbers of people may still be disabled temporarily or permanently. It seems important to track and understand this.
Our "industry" is in a perpetual state of juvenile teenage behavior and right now the frontend-dev sector takes the cake.
Tesla (TSLA) crushes Wall Street’s Q2 estimates with over 90k deliveries
Highstreet Mobile | Backend Engineer | Utrecht (near Amsterdam), The Netherlands | Onsite/Remote (EU) | Full Time

Highstreet Mobile's mission is to connect people to the brands they love. We are a team of makers and we've built a SaaS product for fashion brands. We enable brands to give an amazing shopping experience to their customers. Our customers get a native mobile shopping app for Android and iOS and that app constantly gets better.

You would be designing and developing API's in our middleware, the beating heart of our product. It connects to different e-commerce and payment providers like Magento, Commerce Cloud, Adyen and many more. You will focus on scale and performance, will deploy to production every week and will work closely with our mobile engineers.

Stack: Ruby / Sinatra / Rails / Minitest / Redis / OpenAPI Spec / PostgreSQL / Go / Docker / k8s / GCP / Gitlab CI

https://jobs.highstreetmobile.com/backend-engineer
Especially for someone who titles themselves as a "Chief Marketing Officer".
I read it as saying you could deny writing any specific message as it could have been forged after the session ended. Non-reputability.
I'm not sure what you mean. They were using a tool that encrypted their communications, it just wasn't good. What's the difference between using Signal and using what they were using, or using GPG and what they were using?
So this issue affects Telia Lithuania clients.
But I wouldn't be surprised if the same (or similar) issue affects clients in Sweden.

The article mentions a leaked password hash from 2014, but as far as I know, there were at least 3 password (not hash!) leaks over the last 10 years.

Generally, I recommend people buy their own routers and never use the "Self Service" for managing passwords.

As for hostility of service providers - the situation isn't that good.

Some years ago, a white hat reported some data leak vulnerabilities in a medical "self service" portal.

Vulnerability: change your personal code/id (SSN for folks in US) to another person's number in the POST, and voila - you get the medical history of another person.

What happened is that the white hat got blamed for "hacking" that system.

Result: Vulnerabilities aren't getting reported.
Bad guys are exploiting them left and right.
White hats don't bother disclosing them.

I personally know at least 5 exploitable vulnerabilities in some government websites, but I won't be disclosing them, since that will land me in a lot of trouble.

EDIT: grammar
You would join an existing organisation, as you'd have no chance setting yourself up as a "startup" - existing gangs would not take kindly to someone trying to disrupt their business.
If this were a an RV/towing forum I'd immediately question and possibly ridicule your setup but this is HN so have a nice day!
Telia's consumer business survives (in Sweden) because older people have a very hard to disrupt instinctive brand trust for them. I've been trying to get my mom off them for five years now...

The carrier business is a lot more sane.
And not to speak about their involvement with dictatorships and bribes.

https://www.svt.se/nyheter/granskning/ug/teliasonera-i-milja...
>>And those operations need members. Where do they come from?

Friends and friends of friends. If you hang out with "dodgy" people you will eventually see those opportunities pop up.
Anyone wondering if this is a new issue; it's not, it's a more detailed writing of some previous issues, one of which being the Gemalto affair[0].

The new cards issued in 2018 are not known to have any vulnerabilities.

[0]: https://www.linkedin.com/pulse/timeline-estonian-id-card-vul...
The amazing thing here is this was a perfect piece of viral marketing - one criminal presumably recommending / refusing to do business without another one buying a new phone.

But it also has huge knock on effects - I mean there are 60,000 people identified on here - and they won't be the bottom level of crime organisations. I don't have a clear number but this must be a large chunk of all established criminal networks in huge numbers of countries.

Seems to me the level of competition has dropped in the criminal industry - VC opportunity perhaps :-)
You may be interested in the book “Wiseguy”, a very interesting, informative, and often hilarious book about Henry Hill, a member of the mafia in New York.

https://www.amazon.com/Wiseguy-Nicholas-Pileggi/dp/143918421...

It explains in great detail how he got into the mob and how the mob works. I would assume many organized crime groups follow similar paths. Essentially young kids with problems with authority meet hoodlums who can vouch for them, they get into the lifestyle, and start learning how to hustle. No one rats because doing so means death.

This book is also what the superb movie Goodfellas is based on, which is a fairly close portrayal of the book.
Session keys are fine, and they're usually not the top level identity or key. So long as this is what they're doing, i.e. using an asymmetric KEx (e.g. Diffie-Hellman) to exchange public keys, from which a shared secret would be derived, and then from that a KDF would be used to generate a key using a salt, you can keep generating new keys for each session from that shared secret (shared in the sense that it's symmetric, not that you send it over the wire).

You can still be more secure, but that's a decent start.
I don't think the author has any answers. Rather she's calling out the jarring dilemma parents face.

If you ask me, I don't think there's any good answers, because we want and need both--education of the children and the efforts of the adults.
Could also simply mean that they are chaining different encryption algos from libraries (à la TrueCrypt) which would indeed add to the security level or even at worst not harm it. (This assumes that each step is not broken...)
Really impressive, and de-motivating for me! :) I was working on something similar as a side project. The only information that was not easy to get, because it was not delivered with every DNS request, is the "expiration date". How did you manage to get it? Or even more interestingly: Are you willing to give some insights, how you realised it?
Yes, but I'm not sure we should be giving up real rights to imagined threats. In practice, what encryption systems do is make it sufficiently inconvenient to steam open our letters that the authorities only do it with motivation. The only real case for some of these proposed laws is "we don't want to employ specialists in this field" not "these systems are uncrackable".
I had the impression we went from 1024 to full HD without any steps in between
Good to know. If the PK-3 ever fails me I'll give the Kryonaut a shot.
> That said, I want to be clear that we did not and have not collected any personal information here.

So, you do collect information just not the kind you would classify as 'personal information'. I wonder if my personal domain with my full name qualifies?

There is no way this feature would be created in a company built on privacy considerations.

Like, wow!
£13m is only what the Met (London police) seized. It was over £50m in the whole UK
No rationality here, he knows he "got caught" and from there his clearly out-sized ego took the wheel.
Curated by an algorithm

Does anyone know how that worked?
That's nice. But in this particular case the engineer says things that I know for a fact are not in line with DDG's mission statement so even if he speaks off-message he's actually destroying that trust. There is nothing about @yegg's response that strikes me as weasel speak, it is the content that is different and exactly where it matters: privacy first.
Saying "many times stronger than RSA/AES" but not providing details on the algorithms is a huge red flag.

If they have built some home-grown algorithm, then it's possible the NCA actually cracked the encryption (with a bit of help from GCHQ) rather than using the baseband processor to snoop on the keys or something like that.
Magnum Engine 2020.06 released with redesigned asset pipeline and new examples
TsParticles – Pride Flag made with particles
I seem to fall into that style of writing too often. I'll claim mea culpa on the overloaded terseness as well. The recent posts on here about editing and writing have been interesting and nudged me to start working harder on that skill.
algorithms don't matter for shit to the person that controls the (mandatory) updates.

its the same issue with all modern e2e apps like whatsapp or signal, if there is a single client implementation its not secure at all to these kind of attacks.
> What this does on top of that is then to cover the corner case where an object would be safe for SRA, except something requires the object to have the same layout as on the heap.

I'm a little surprised that see such noticeable performance improvements. Obviously benchmarks etc etc, but I didn't expect these cases to be quite so common.
Array | Senior Frontend Developer, SRE | Full or Part Time | REMOTE | https://www.array.io

Array is a FinTech in the personal credit, financial, and identity space. We help our partners build compelling personal integrations into their applications and marketing flows.

We are seeking senior frontend developers with NextJS/React experience and the web components standard. Bonus points for experience with PWA's or litElement.

We are also seeking a Site Reliability Engineer to help us scale and maintain uptime. We run a fully containerized micro-service stack both on-premise and in the cloud.

We have an innovative executive team with deep experience in our space. We work hard and get to use the latest tools to stay cutting edge. We were fully remote 15 years before the pandemic.

If interested, send me your LinkedIn, resume, and a short introduction. If we seem like a match I'll get you fast tracked with our recruiter. phillip at array dot io
Regarding your last point, I have a hard time seeing what you mean. The system is audited both internally and externally fairly regularly, the latest report being released just December last year [0]. There is also frequent news coverage, both supporting and criticizing the system [1][2]. One of the current government parties [3] is an active critic of the system. So it seems like a fair stretch to say that discussing or criticizing the system isn't common or somehow not welcome.

None of this is to say that the system doesn't have flaws, as every other IT system, it does. It is however publicly discussed as you would expect in a democracy.

[0] https://www.mkm.ee/sites/default/files/e-valimiste_tooruhma_...

[1] https://www.err.ee/keyword/15389

[2] https://www.postimees.ee/term/15008/id-kaart

[3] https://www.valitsus.ee/et/peaminister-ministrid/valitsuse-k...
It's unclear, but that statement alone makes me shudder.

Anyone doing secure comms at this level, and is talking about families of mathematics always gives me the impression they don't really know what they're doing.
The author makes caffeine sound like a super power. I wish I could experience that even for a little bit.

I drink a lot of coffee (I think I average 4 or 5 quadruple espresso shots a day right now) but it does nothing for me physiologically. I don't feel like it wakes me up, it doesn't make me procrastinate less or focus more, it doesn't keep me from sleeping (I'll regularly drink a quad shot after a full day before going to bed).
I see you commented below that you used OpenVPN for implementing this. I tried using a self-hosted Squid proxy with the Spectrum website, but was unsuccessful at getting it to work. I also tried routing the traffic over SOCKS5 (using ssh -D) and it still didn't work. This was a while ago, but I recall that the website was using Flash. I'm just assuming that the website was using Flash to do some local network checking outside of the tunneled traffic and that's why it didn't work, but I'm uncertain if that makes sense. Sounds like I should have tried a full traffic solution like a VPN...
Not just during the world wars. British intelligence apparently faced the same dilemma when infiltrating the IRA, and some of the results were quite ugly (look up Stakeknife if you're interested).
Might encrochat and its shareholders have a case against various european governments here?

Are they supposed to simply accept that the government will hack into their servers and users devices with no compensation?
Create and monetise your newsletter without writing
> Are there real uses for this kind of thing, on modern architectures?

For me, I came up with an algorithm for doing error correction coding, however, good performance can only be achieved by JIT'ing code. Trying to implement the algorithm without JIT results in many if/switch statements and memory lookups, which makes it much slower.
Unfortunately, the JIT'd code can only be used once because a new function needs to be written every time the routine is called, which leads to a scenario like that in the article.

Otherwise, I do think this is somewhat niche, but there may be some interesting applications if the security of write+execute memory is not a concern.
The problem is with the monopol on violence the government is supossed to have. Today, anyone rich enough can have violence or the threat of violence, at a industrial scale like government used to have them. Bezos or Musk could have a rod of god in orbit, and you wouldnt even know.

And to prevent this from escalating, as artefacts are getting ever denser, in information, energy and potential - you get a panopticon. Those liberal ideas, where forged in a world, where the peak of energy density and danger was a musket.

This world is gone. To prevent it from coming back, we get the panopticon.
Does teenage anxiety have its roots in infancy?
I guess the lesson here is clear: don't overrely on technology.

There are tried and tested methods for running a covert organisation and they all rely on organisational resilience rather than ultra clever tech. Also, don't reuse channels - actual intelligence operations failed because of breaking this rule.
This is intended to convey meaning to anyone engaged in military planning activities and it is assumed that the reader has the relevant education in military planning so they can quickly understand what is being said. It’s no different than reading a scientific paper where a single sentence may be unpacked on multiple levels because the reader/audience for the paper is someone who has a deep background in the subject.
Yeah, I wonder too. I had Cyanogenmod on a very old Android phone, and after a while messaging started to act up in strange ways.

The paranoid side of me started to weigh different explanations against each other, and one would be a compromised base band processor which tried to do something to the Android side, but failing, since it was no longer the vendor image it (hypothetically) was expecting to manipulate.

Security is tricky and must be designed in depth and a mistrust of all layers. If the hardware is designed such that the baseband the main CPU are not separated by a communications channel, all can be lost if one does not control the baseband firmware too.

(For instance if the baseband processor has shared memory access, that's a problem. If it's just a data interface, treat the baseband processor as a hostile network.)

In my case, the likelier cause was probably something buggy in the Cyanogenmod image, or, while still unlikely but less so than baseband exploit, that the Android side itself had gotten some kind of virus because of some kind of security flaw in that particular Cyanogenmod version.
If this story interests you, here is an engrossing article that ties together modern sumo, Mishima's attempted coup, and a surprising bit of investigative journalism: https://grantland.com/features/sumo-wrestling-tokyo-japan-ha...
There is a JEP to support Java on windows on AARCH64.

http://openjdk.java.net/jeps/8248496
Or: we want the full firehose of data, and then we want to employ Machine Learning specialists. ML is apparently magic.
Machine Learning Monthly – June 2020
>>If you wanted to get into the criminal drug trade, how would you start? Is there a guide somewhere I can follow?

You would start from the bottom. Going around saying you want to part of the business, is a sure way to end up dead as a snitch.

Yeah there's a LOT of money: cocaine costs as little as $2k a kilo in Columbia and can be sold in EU for close to $100K when accounting for cutting. I guess a lot of it is segmented. For example: one group brings 800kg from Ecuador and sells it to local gangs and so on. If they get caught, other groups fill the void.
> These aren't street dealers. It's an organized, carefully designed, well-oiled machine. How does this machine work? How does it survive the loss of so many members?

Narconomics[1] has a pretty good discussion of the economics (including recruiting) of cartels.

[1]: https://www.amazon.com/Narconomics-How-Run-Drug-Cartel/dp/16...
Pah, these guys are petty thieves compared to Wirecard...
The criminal world offers a fascinating glimpse into what pure, unrestrained capitalism would look like.

If we look at what trading corporations do in times and places where they can get away with it, we see:

-Aggressive acquisition of natural resources to protect the supply chain

-Use of armed force to gather and protect said natural resources and the geographic territory wherein they're contained.

-Use of armed force to protect and expand market capitalization (markets, trade routes etc)

This is pretty much identical to what a drug cartel does on a day-to-day basis.
Web Developer Monthly – June 2020
I was studied by med students (during a doctor visit) as a child, nobody even asked. What's so different?
Sounds like poor OpSec to me