71–80 of 126 posts
Earlier quoted context omitted.
> Really, my issue is stuff on my own network. I want to see what my TV sends home. Same with an amazon-echo, or really any IoT thing. Yet, if they all use SSL and don't allow me to add a root CA, I can't look at what they run. Which is part of why the more paranoid of us steadfastly refuse to own such devices.
And sadly it's near-impossible to find a non-Smart TV these days :(
It's not dead. Encryption has (unjustifiably) pushed the enterprise to install fake catchall certificates on proxies so they can snoop plain-text traffic. (Why anyone would ever think this is a good idea is beyond me.)
Assumption 1: Machines on your network are already compromised and fully owned by a sophisticated and extremely difficult to detect rootkit. This is true of every large business. There is always that guy who will click on any link or open the document from what appears to be their co-worker.
Assumption 2: APT tries to disguise their traffic as ordinary web traffic, because anything else is suspicious.
Assumption 3: You have massive legal liabilities if your data is exfiltrated.
Being able to do DPI and pattern matching on all TLS traffic (and firewall off anything you can't DPI) is pretty much mandatory.
I'm worried about this development. One the one hand, ubiquitous encryption is simply required for security on the internet. Things like lets encrypt and warning on http are great improvements. On the other hand, the owner of a network has some right to look into the packets on that network. Especially if the owner of the network also owns the end-points of that traffic. My main use-case here isn't corporate networks…
> Really, my issue is stuff on my own network. I want to see what my TV sends home. Same with an amazon-echo, or really any IoT thing. Yet, if they all use SSL and don't allow me to add a root CA, I can't look at what they run. Which is part of why the more paranoid of us steadfastly refuse to own such devices.
Earlier quoted context omitted.
I'm hoping for something like 'Right to Repair' or 'Right to Tinker' that'll let us verify more devices are trustworthy. My smart TV (I am ashamed to admit I have one) is really useful. Very little about the idea of a TV with build-in Plex support requires it be totally locked down. Hence it is a buisness decision that could be competed or regulated away. (I was going to make the same argument about a TV with build-i…
Some of us (for whom Charisma is not their dump stat) need to get elected to national legislative assemblies and form technology and engineering caucuses. Possible items for its agenda: - Right to Repair - Right to Tinker - Right to "Pwn Ur Own" - Hardware sellers required to deliver firmware source to buyers --- including build scripts --- including device-specific signing keys --- even for cars and tractors - Publi…
For awhile I've been wondering if people would like me to be their spokes person for such issues. I have a lot of experience and I think I have a mind for politics as well. I think its really critical we get it right at this point in history. I would love to work with others for such a cause.
If you have any advice to get started I would humbly accept. I think its really critical we get it right at this point in history.
Author is dead wrong. Products exist today that perform DPI on SSL streams: https://www.a10networks.com/resources/articles/ssl-inspectio...
Earlier quoted context omitted.
Your definition of a usable TV is outdated.
Agreed. It's not even the TV that needs access to Internet. What if you have one of the Roku, Apple TV, Chromecast, etc devices that stream content from the Internet? Without those we might as well go back to storing content locally which let's face it - is mostly retrieved quasi-legally through BitTorrent.
But at least it's always available and will not disappear between the moment you first watch it and the moment you want to show it to your spouse.
I really expect (and hope) to see a resurgence of torrenting in the wake of ongoing balkanization of streaming platforms.
Earlier quoted context omitted.
Agreed. It's not even the TV that needs access to Internet. What if you have one of the Roku, Apple TV, Chromecast, etc devices that stream content from the Internet? Without those we might as well go back to storing content locally which let's face it - is mostly retrieved quasi-legally through BitTorrent.
yeah, while that's true, a manufacture like amazon or apple is much more likely to update your device since they are still hoping to sell you content. You think your offbrand Smart TV is going to update past a couple bugs? They already made all the money they are going to make off that TV and they are done. Still have to trust the manufacture for that to work, but at lease you're not just left wide open there. (I mea…
Honestly, who cares? I mean, it's a TV. It should not need Internet to work, and it definitely shouldn't need software updates. Displaying video on a screen is a solved problem.
The very fact you can use "software update" and "TV" in the same sentence signals a pretty big problem - a problem of companies selling you TV as a service, and customers accepting half-done pseudo-products.
Earlier quoted context omitted.
yeah, while that's true, a manufacture like amazon or apple is much more likely to update your device since they are still hoping to sell you content. You think your offbrand Smart TV is going to update past a couple bugs? They already made all the money they are going to make off that TV and they are done. Still have to trust the manufacture for that to work, but at lease you're not just left wide open there. (I mea…
> You think your offbrand Smart TV is going to update past a couple bugs? They already made all the money they are going to make off that TV and they are done. Honestly, who cares? I mean, it's a TV. It should not need Internet to work, and it definitely shouldn't need software updates . Displaying video on a screen is a solved problem. The very fact you can use "software update" and "TV" in the same sentence signals…