Trump doesn’t appear to care much about the law.

I understand that this is frustrating but it is arguably the right option. If the correct owner can recover the account without TOTP then the TOTP isn’t really protecting the account.

Of course there are various ways to authenticate and it can make sense to have authentication to be (username + password + OTP) OR (email verification) but for a lot of people that email verification is a weaker link. It is more secure to only allow the former.

What I wish is that more sites would document their account recovery procedure. Often times they ask for a phone number for verification or notifications and that silently becomes a backdoor into the account. Even better would be if users can select what authentication combos are supported on a per-account basis (there are a few companies with “lockdown” settings that are a simplified version of this).

Of course it then becomes important to make it clear to the user “if you ever loose you X your account is forever lost”. It shouldn’t be surprise.

This advice feels like “Have you moved to the surface of the sun? Make sure to drink lots of water.” It’s not wrong, but also not particularly helpful. The only solution is to stop buying these things. Ideally take them back and get a refund if it isn’t too late.

Generally speaking it will be fine. SSH will also refuse keys with open permissions so you would notice if it was wide-open to other users of the device.

But you know if you are running random code or AI harnesses as that user it can be at risk. Or if you copy around the key all over the place it is more likely to leak. But generally speaking you are secure by default, just don’t do something dumb with the key and you’ll have no problems.

It sounds pretty reasonable. As long as you keep SSH patched and keep the key safe it should be quite locked down. Do double-check that password login isn’t allowed (or that all users have a very strong password).

One non-security note is be careful with rsync backup. Generally rsync isn’t considered a backup as any mistakes made in the source will be propagated to the “backup” on next sync. Although there are ways to use rsync to take good backups (like copying to a new directory for each backup).

Why only streaming services? Why not target the volume of any ads within content that contains audio? While we are at it why not say that the add can’t be significantly more bright?

CSS != HTML

I don’t think there is any way to play audio from CSS.

But I mean it is open source, you could patch it to do whatever you want.

I built Chibichange to have a way to conveniently deliver changelogs to Dawarich users

Have you considered just posting a changelog to your blog? That would be much more convenient than every app I run pinging me in its own way by phoning home to its server.

https://xkcd.com/1200/ comes to mind.

Games have no sandboxing anyways. They can access most of the data on the systems on which they run. Whether the game, crack or a HV crack makes little difference.

Sure, running a hypervisor or kernel level does allow them a bit more access, mostly around persistence. But I don’t think it is a huge difference to most people.

So IMHO you are already putting a lot of trust in any pirated software or crack, hypervisor bypasses are really just a small matter of degree. If you don’t trust the crack don’t run it. Easy as that. Or if you want robust protection run games on dedicated hardware with no personal information or in a dedicated untrusted gaming VM.

The problem is that only your heaviest users are going to pay to remove the ads, so it doesn’t make sense to price the subscription at any sort of average user. You need to slide the price point way up the distribution just to break even.

Oof, that is really not a good look. This should have been clearly disclosed and probably with a per-notification for the patch release.

There are a few main benefits.

1. For hardware-backed keys they can’t be stolen aside from physically stealing the hardware. So unless your machine has malware there is no way for an attacker to authenticate using them.
2. Even for software keys the site you authenticate to doesn’t learn enough to impersonate you. For example if for some reason your bank leaked some logs with PW + MFA someone could use that to log in as you (although admittedly short timeouts on MFA validity makes that window very small).
3. The browser ensures that you only authenticate to the correct domain. So it prevents phishing. (Although a password manager that only fills into the correct domain also accomplishes this.)

So I think if you are using unique passwords with an automated password manager the effective benefit is quite small. However for the “average computer user” who likely has less than 5 passwords that they use for everything it forces a pretty high base level of security.

It also supports iOS.

Please be civil and polite. This type of aggressive comment insulting people because of the tools that they use isn’t welcome here.

No, but you can still choose to choose software that doesn’t steal and sell your data. You can also support laws that make doing this illegal.

The idea that putting this on your phone is bonkers is bonkers to me. Why would you want to carry around a journal or paper when you have everything on your phone? It can also be more easily backed up and synced.

It shouldn’t be normal that this data is stolen and sold. That is 100% the problem, not the fact that people track things on computers.

This is also likely interesting because console SDKs are usually highly restricted. So not only is the Minecraft code leaked (which is probably moderately interesting) it is likely that the console APIs are quite interesting to emulator developers and reverse engineering for other PS3 games.

Please be polite. If you don’t like a post you can downvote it. If you would like to comment please be more civil.

While Amazon is awful it isn’t just them. It is a systematic issue with our economic system. Our society constantly makes efforts to keep the poor poor so that they are forced to work for low pay resulting in a cycle of abuse. Basically every public company will end up in the same situation and we see that with every large company. If a large public company isn’t shit the CEO will be fired by the shareholders and replaced with one who makes the company shit.

So yes, avoid Amazon, but also talk to your government representatives. The cycle will always continue until the incentives are changed. To properly exit this shit system we need to change our society and government.

I hear what you are saying. But our society is pretty fucked up if you “deserve” something bad because you bought a product without imaging how the manufacturer can make it worse in the future.

The owners should be able to return the product if something like this happens, no matter how long ago they bought it.