• 0 Posts
  • 32 Comments
Joined 3 years ago
cake
Cake day: June 22nd, 2023

help-circle


  • The US federal minimum wage is $7.25/hour but that’s ridiculously low and impossible to live on almost everywhere. States and cities can also have their own minimums. California is $16.90/hour and San Francisco (an expensive city in California) is $19.61/hour. Multiply the hourly amount by around 168 hours/month to get the monthly amount. But, if your BF has some kind of professional job in an expensive city, he will be making a lot more, at least $50/hour (100k/year), depending. To put this in context you basically can’t get any decent rental housing in San Francisco for $2000/month for 1 person.

    Is this like a real boyfriend or an online boyfriend? I wonder what he is thinking.





  • From the linked post:

    It is tempting to file “print management software” under boring infrastructure, and that is precisely what makes this class of product so attractive to attackers. PaperCut NG and PaperCut MF are among the most widely deployed print-management platforms in the world, dominating large enterprises, healthcare networks, and higher education — sectors where on-premise print infrastructure remains the norm and where the Application Server is routinely joined to Active Directory, holds privileged service accounts, and sits on network segments rich with lateral-movement opportunities. On Windows, the Application Server binary pc-app.exe runs as a service with SYSTEM privileges by default, so any code execution inside the Java process is, for practical purposes, full host compromise.




  • Source for this?

    This is a start: https://grapheneos.social/@GrapheneOS/117140352254892456

    The obsession with security chips is what allows Pixels and iPhones to be the most secure devices on the planet.

    I remember the govt trying to muscle Apple into unlocking someone’s iphone, til they suddenly stopped because they found Cellebrite could unlock it instead. There have been several new iphone generations since then but I haven’t heard about govt muscling anytime recently. So I have to infer they can still unlock iphones. As for Pixels, this is in Dutch but very recent: https://www.omroepbrabant.nl/nieuws/6023856/drievoudige-moord-in-oosterhout-telefoon-van-verdachte-gekraakt

    Machine translation of main paragraphs:

    The Netherlands Forensic Institute (NFI) has unlocked the Google Pixel phone belonging to 29-year-old Veronica K., according to the prosecutor. “A large number of images of weapons and stacks of cash were found on her phone. There are also a large number of chat messages that can now be read.” K. is alleged to have facilitated the murder by supporting the perpetrators.

    The prosecutor expects to receive the first results from the NFI on Thursday. During the hearing, the prosecutor also said there is good reason to hope that the NFI will be able to unlock the Google Pixel phones belonging to the other two suspects as well.

    So I think you’re putting too much faith in this stuff. I will ask my crypto homies if they have any recent info about phone attacks though.

    More relevantly, most secure devices AGAINST WHAT? You’re talking about a locked phone attack which is the absolute least of most users’ worries. The phone is so insecure in everyday use that the border patrol is near irrelevant. Plus users including paranoids like me don’t have any opsec to speak of. When was the last time you crossed a border with an Android phone anyway? I don’t think I’ve ever done that. Like most people I don’t leave the country that often. Last time I did was before I switched to Android, IIRC. I might have had an analog or 2G flip phone or something. If I travel somewhere again it’s not that big a deal to leave my Android phone at home, as I mentioned before.

    Even in the border patrol picture, Graphene and TPM won’t protect you from what used to be called rubber-hose cryptanalysis (xkcd.com/538). They’re defending from the wrong threat.

    Look, I understand the advantages of crypto hardware. I’ve programmed it and written simulators for it. But, the way to really keep cryptography in people’s hands is to make it not require special hardware. Thus I’m skeptical that the government hates Graphene, but it really did hate PGP back in the day.

    If I get to add new hardware to phones, TPM would be on my list but not at the top. First might be something like POCSAG (plus build out the pager network again) so you can receive text messages without transmitting anything or revealing your location. Second, third, etc. would be in a similar vein.


  • That’s all very nice but not many of us are willing to buy a $1000 phone (or an obsolete Pixel) to get Graphene. They soon won’t be able to run it on new Pixels, and also the stuff about AOSP updates stops mattering since AOSP itself is nearly dead. The obsession with security chips (fighting the seized phone attack while comparatively ignoring much more relevant threats) is another misplaced priority. It’s the old notion of “fence post security”, putting a 100 foot fence post in the middle of the desert expecting the attacker to try to climb over it instead of going around it.1 And again, I’m amused at the idea of the US and Chinese governments allowing a Motorola (Lenovo) Graphene to be sold if it’s really that secure.

    We need a de-googled Android fork (maybe Lineage is that) on mass market phones using the hardware that those phones have. Otherwise we’re acquiescing to the notion that Elon Musk deserves more privacy than Joe Schmoe when it should be the other way around.

    1 hpmor.com chapter 115.




  • I think that isn’t really a thing. Usually you would have a tape drive in a backup server for a network, and the backup server would have its own HDD, so you’d back up over the network to the HDD and then dump HDD to tape locally at close to the transfer speed of the disk. Higher capacity tapes have fast transfer and if your data source can’t kee up, the tape has to start and stop all the time, which slows everything down and wears everything out.

    “Some TB’s” = single digits? Probably just back up to remote storage if you have enough network speed.





  • So when I say it requires no resources, I’m comparing it to alternatives like going on a retreat or participating in some sort of group. My point is it has lower barriers than alternatives which makes it more available.

    Therapists are professionals who have to get paid, just like doctors, electricians, piano teachers, bicycle repairpeople, or whatever. I left out car repair because that’s largely about access to expensive garage facilities and special tools. Yes those costs are significant financial obstacles for lots of people, especially if they’re recurring. Participating in a group (like joining the local chess club) is usually free? Or if you mean a therapy group, I think that’s a a therapist leading a group session, so the participants split up the cost and it’s cheaper than individual therapy.

    Anyway, this is money that has to come from somewhere.