Hacker Newsnew | past | comments | ask | show | jobs | submit | lm411's commentslogin

When the AI scrapers were just getting started, that is basically what I thought - their plan was to scrape / suck up everything they possibly could before people realized what was happening and blocked them.

The rate at which they were spidering and scraping was so far beyond what any other supposedly legit spider was doing, it seemed like the logical explanation.


The quality difference between various fans is absolutely huge.

I can put in a few Noctua fans and be confident they are going to last 5+ years of running 24x7. Or I can put in 25% cheaper fans and be pretty much guaranteed one or more is going to fail within the first couple years.

In my opinion, fans are never a place to cheap out when building a PC - server or desktop, whatever.


I've experienced similar with some Southeast Asian cultures as well.

I'm a patient person, but it can be frustrating to have to endure 10 minutes of verbal diarrhea that eventually results in a "no" or "I don't know".


I'm genuinely curious if this is a thing with roots in Spanish culture? Because there is strong Spanish influence in Philippines and South America.

I don't know any Spaniards but I do know Filipinos and the confidence projection is a real thing. The Filipino IT guy confidently declared that my OnePlus Android phone wasn't certified for the software he was trying to install and was getting errors. It is a bog standard application that can be installed on any modern Android phone but the level of confidence he projected, just because he didn't know OnePlus as a brand, made me doubt myself until I turned on the critical hat and pushed back a little with alternative approaches, which solved the problem.


Over the last couple of years, I've spent a lot of time in Indonesia. By the time I got used to their way of communicating, I questioned my own reality, perception and sanity. I even put a thought it's some very passive way of gaslighting foreigners. It seems it's just how they like to do it here.


> the idea of attending public protests/riots, particularly any directed against the governments that issued me my student visas, sounds like possibly the stupidest move

You'd get a real kick out some of the protests in Canada then.


How does one feel bad for a corporation, especially of this size? Double so for one that quite literally removed "Don't be Evil" as its motto and from its code of conduct.

The corporation has no feelings and I don't imagine the board members or shareholders are feeling bad about this.


> removed "Don't be Evil" as its motto and from its code of conduct

It's still in the code of conduct

https://abc.xyz/investor/board-and-governance/google-code-of...

And it still doesn't mean a damn thing.


Personal anecdote, having lived in a few very poor countries and a few relatively very wealthy ones:

1) In the poor countries, I find people are generally quite happy living their day to day lives but rate their happiness low - because they think people in wealthy countries have it so much better. I.e. they underrate their happiness because they think wealthy people must be so much happier.

2) Vice versa in the wealthier countries - so many miserable people, but, they feel that they can't complain because they see how bad things are in the poor countries.

I think these "happiness ratings" are a bunch of bullshit. Some of the happiest families and communities I've seen are in the poor countries while so many people are miserable and lonely in the wealthy countries.

I believe it is very very hard for a person to subjectively rate their own happiness. (Edit to add, especially when they are comparing their own happiness against cultures and people they have mostly only seen on TV).


So basically, you dont believe people when they talk about how they feel and what they think, because you think you know them better.

That is not how it works. If you ever had someone else project feelings they think you have on you while ignoring what you say, you would know how absurdly missing the mark they are.


Please don't twist my words.

I've lived in these families and communities on both sides. I clearly said it was anecdotal.

I think you missed the whole point of my comment.


Dude had to rewrite traceroute to discover what the first line of the man page description says.

> traceroute tracks the route packets taken from an IP network on their way to a given host. It utilizes the IP protocol's time to live (TTL) field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to the host.


I disagree, obscurity wastes attacker resources and easily fools a lot of simple vulnerability scanners.

Obscurity is totally underrated. Attacker resources are limited.


It’s kind of having a line of cardboard tanks. Can be helpful in some circumstances, but it can’t always replace actual tanks


Actually decoys are very useful in Ukraine Russian war. It is usually decoys of air defense or long range precision fires like Himars and target is to waste resources of opponents long range fires which are limited and/or expensive.

Further more you can also reveal position of the attacker and counterfire.


If you have 500 tanks and 500 cardboard tanks, someone with only as many real tanks as you have may not bother attacking. Thus, having the cardboard tanks saved you a battle.

If someone with 1000 tanks attacks, it's a battle you would not have won anyway.


And yet, cardboard tanks have been useful only a handful of times during wartime. Tanks on the other hand have proven their usefulness many times.


thank you, I had this debate at work so many times.

Sure it's not a security measure as such, but it's still a worthwile component to the overall defense system.


The problem with this is, you spend a lot of effort for low benefit. You should spend it on actual security instead.


Changing a port and enabling aslr are not "a lot of effort".


Changing the port is not the kind of security measure that will consume a lot of the attacker resources


Sure, it'll do nothing to stop a determined attacker, but it does wonders to stop the noise from passive scanners.

Are you familiar with the Swiss cheese model of risk management[0]? Obscurity is just another slice of Swiss cheese. It's not your only security measure. You still use all the other measures.

[0] https://en.wikipedia.org/wiki/Swiss_cheese_model


It will conserve a lot of defender resources, it will completely bypass all mass scans, and it will make "determined attackers" much more visible as they will have to find the port first which will show up in logs and potentially land them in a tarpit.


What would be "actual security" in this context?

This isn't about security of the same kind as authentication/encryption etc where security by obscurity is a bad idea. This is an effort where obscurity is almost the only idea there is, and where even a marginal increase in difficulty for tampering/inspecting/exploiting is well worth it.


The one not described as "security through obscurity".


My point is: the "security through obscurity is bad" and "security through obscurity isn't real security" are both incorrect.

They apply to different threats and different contexts. When you have code running in the attackers' system, in normal privilege so they can pick it apart, then obscurity is basically all you have. So the only question to answer is: do you want a quick form of security through obscurity, or do you not? If it delivers tangible benefits that outweigh the costs, then why would you not?

What one is aiming for here is just slowing an annoying down an attacker. Because it's the best you can do.


Somehow your approach was not chosen by Intel ME or AMD PSP, and they remain unbreakable.


That's orthogonal to this. That requires special hardware and using those doesn't really rule this out as an additional measure.


I'm going to assume whatever efficacy obscurity brings will take increasing hits as AI tooling becomes more commonplace.


Yep. I just bought a Pi CM5 for my son, for his ClockworkPi uConsole. CAD $200 for the 8GB module. I bought a whole Pi5 16GB not long ago for under CAD $200.

I will not be buying any more SBC's at this price point. I wonder if Raspberry PI will survive.


The whole Google Play experience is awful.

Recent things I've had to do:

1) Re-submit an app after it was rejected and labelled a gambling app (it wasn't even close - a 15 second look by a real human would have seen that. This one was even appealed and the support was utterly useless. I ended up changing one word and re-submitting the app, approved no problem.

2) An existing app, in the Play store for years but a nice app - only about 500 installs. I had to submit a new version for no reason whatsoever... Except to keep the customers developer account active.

Those are just issues I've dealt with in the last month or two.

Every single time, Google Support is completely useless - including the appeals process, which is an absolute joke.


Not to mention if you made one app in college and then didn't keep up with the SDK updates, Google perma-closes the entire Play account such that the only way to publish a new app is by creating a brand new gmail account


Forcing people to keep up with SDK updates is a bad thing in itself. Let people target the earliest possible feature set and make the app run on as many phones as possible rather than showing scary messages to people due to targeting an older API.


I think the problem is that older SDK versions allowed you to do things like scan local WiFi names to get location data, without requiring the location permission.

So bad actors would just target lower SDK versions and ignore the privacy improvements


The newer Android version could simply give empty data (for example, location is 0,0 latitude longitude, there are no visible WiFi networks), when the permission is missing and an app on the old SDK version requests it.

Of course, they don't like this because then apps can't easily refuse to work if not allowed to spy.


That can have some very extreme legal ramifications.

Consider - it's a voip dialing client which has a requirement to provide location for E911 support.

If the OS vendor starts providing invalid data, it's the OS vendor which ends up being liable for the person's death.

e.g. https://www.cnet.com/home/internet/texas-sues-vonage-over-91...

which is from 2005, but gives you an idea of the liability involved.


Phone companies are required to make sure 911 works on their phones. Random people on the internet aren't required to make sure 911 works on random apps, even if they look like phones.


The comment you're replying to literally has an example of an internet calling service being fined $20,000 for not properly directing 911 calls.

I guess Vonage should try to appeal the case and say pocksuppet said they're not required to do that.


Vonage sells phone services that happen to use the internet. This is not the same as being WhatsApp.


It can't have "extreme ramifications", Google's own phone couldn't call 911 for a while.

And you can manually force only the voip dialing apps instead of everyone


Yeah the SDK updates... For sure. Another pain in the ass.


Maybe it's better now, though I doubt it, but my experience publishing on the Apple app store years ago wasn't any better.


So what was the word you changed?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: