I generally think arstechnica.com does a decent job of being a non-garbage news site. I pay a couple bucks a month for the ad-free RSS feed. This story feels terrible to me. I don’t doubt a law suit has been filed, but I would expect some investigation by the reporter of the extra-ordinary claims of privilege escape the application is claimed to be capable of.
I’ve moved to WinPE for its immutability.
Surprisingly, I thought the article was a reasonable summary of the actual paper. I think some people might think this was a poke at privacy on Apple, but it really focused on how hard it is to create accessible settings despite the enormous number of options.
I have found that navigating the menus in Apple iOS is quite a bit easier than on my Android devices. Mac seems more difficult as the settings tend to be inside the individual apps and don’t surface as well through the search.
The paper hammered home the point that Siri configurations were particularly hard, but they also mention that Siri data is end-to-end encrypted. I thought all those points were fair.
I do believe settings need to be improved, but I have little faith they will ever be useful for 99% of users who will simply never change anything from the default. At this point I believe any meaningful improvements for the majority of users will come from useful defaults that include E2E encryption on basically all user data. I feel Apple is coming close with iCloud Advanced Data Protection that was introduced last year, but that needs to become a default. Maybe it cannot though—too many users will lose all their data and then the trade off of security to convenience will not be worthwhile.
I don’t think a big business should have an advantage over a small business that cannot afford that technology while using public airwaves. A better solution imo would be to prioritize all very low-bandwidth traffic.
I agree that decrypt/encrypt is bad—it is simply not E2EE. The solution would have to be a better method of public key distribution for ‘federated’ systems.
While I don’t know anything specific about facebook messenger, E2EE doesn’t necessarily preclude what you suggest. A messaging service could store the entire chat history encrypted without decryption keys. When you get a new client you could restore the entire history in encrypted form onto your device. You would then use a recovery key you would possess to decrypt the message history on your end. At no time would the messaging service have the keys to decrypt. I’m not saying that is what facebook does.
Why do you need to control both ends for E2EE? Both ends need a public and private key to encrypt and decrypt messages. You need a method of key exchange. I would prefer to have an offline method (phone call, in-person) of validating a key (like iMessage and Signal have). But I don’t see a reason to need to control both ends.
I read it….
arstechnica has a premium RSS for $3 a month that has no ads. I love it.
That sounds very slick. I never really used twitter so had no reason to use mastodon instead, but I am glad it exists!
If you migrate your own account to a new server, do other people follows of you automatically migrate too? Or do all your followers need to then update to follow you at the new location?
This is a very nice piece that had so much information I did not know. Toward the top of the article I was wishing for footnotes, references or something that would indicate it was not just your opinion, but as I got further into the piece you provided so many great references. I thought the calculator manuals were particularly accessible and convincing. Thanks for a great read!
The city I live in has two big box stores. One has a retired plumber in the plumbing section. I’ll drive further to go to that one and wait patiently for his advice.
Well if you put it like that I just want it more…
Oof. I would buy more efficient hardware with those rates too!
Get a power measuring device if you don’t have one and consider the real cost of buying something new if you already have something. For instance, I have an older gaming laptop I am considering repurposing for my home automation stuff. While idling it draws about 10w which is amazing to me and a number I never would have guessed. For me that works out to (24 hours * 10w * 365 days* 1000w/Kw ) 87kwh per year. I pay about 10 cents per kwh so say $10 a year. Buying something to save a little power will never work out.
My current home server is an intel NUC from 2013! It can’t do some of the things I would like to add on, but it is a great media server and downloader. Powerful hardware isn’t really a necessity.
Damn, giving me flashbacks of slowly moving through ACLs then hitting domain groups, domain local groups, global groups, then eventually universal groups as AD moved forward in complex situations.
Got to admit it worked well though.
Can I use Proxmox on generic hardware that will run Linux? I was unfamiliar with it but I am intrigued once I went to the website.
I agree with that “and”
Honestly my google auto-type keyboard suggests that any time I post.
I would feel that it would be a reasonable if it was my local paper running the story. Arstechnica IS a primarily technical news site—I believe they should have a higher bar—otherwise they are just parroting a report and not providing useful (to me) news.