Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NASA Has Been Hacked

forbes.com

Post reply on HN
Print view View original

51–60 of 114 posts

Re: NASA Has Been Hacked

#51

Post by the_other »

tjoff wrote: post #32
pdpi wrote: post #20

Earlier quoted context omitted.

I don't think that's actually true. Rather, it's an architectural thing — because all these ad systems were designed without consent in mind, accepting is a no-op, whereas refusing consent requires an outbound request to set some sort of "do not track" flag somewhere (presumably as a cookie).

If accepting is a no-op then you are being tracked even before you make your decision - as the page already have been loaded. A brutal violation of course but I absolutely expect that to be the case.

I leave the majority of pages that have these popups now. My (likely vain) hope is that the tracking data will show higher bounce rates, and eventually the publishers will explore better financing models.

I’m not holding my breath.

Re: NASA Has Been Hacked

#52

Post by riffic »

unethical_ban wrote: post #43
olliej wrote: post #22

IT security people need to stop thinking in terms of disallowing “unauthorized” devices on physical (wired and WiFi) and recognize start designing for human nature. Assume that the physical networks are compromised, and have all privileged resources only accept connections over VPN. Is it perfect? No, but it makes further compromise harder. The assumption of no trust also means acknowledging that you need gate incomi…

Making every device connect over VPN is infeasible. There are, however, varying models of governing port-level access exist. dot1x, ISE, and yes, on some networks forcing VPN is doable.

BeyondCorp would be an alternative to consider:

https://thenewstack.io/beyondcorp-google-ditched-virtual-pri...

Re: NASA Has Been Hacked

#53

Post by ryandrake »

neuralzen wrote: post #48
module0000 wrote: post #37

Hopefully, this doesn't cause fear mongering around raspberry pi devices. It's not a stretch to imagine a bureaucrat reading articles like this, seeing "a raspberry pi was plugged in" , and forming a negative opinion of the device and people that use them.

Unfortunately there already is. When I interviewed for a job in Antarctica we had discussed methods of saving on bandwidth usage and I suggested the use of a PiHole to strip out ads to save precious KB and was told that the Raspberry Pi was frowned upon due to previous issues, and it would likely never happen. :(

Good news then: you don’t need an actual Raspberry Pi or to run “pihole” software in order to filter ads via DNS. Just a beige Linux box running dnsmasq is enough!

Re: NASA Has Been Hacked

#54

Post by m_rn »

cronix wrote: post #5

At this point I really don't care anymore. It's like reading an article claiming the sky is blue...every damn day. Entire cities are offline and being held hostage. Gov't entities getting hacked, taken over. They don't care about our privacy, so I don't give a shit about their insecure systems. Let them all melt down. Then they might care about us, but only because it affected them in a hardcore way and forced them i…

cronix for president!

Re: NASA Has Been Hacked

#55

Post by Wowfunhappy »

tjoff wrote: post #32
pdpi wrote: post #20

Earlier quoted context omitted.

I don't think that's actually true. Rather, it's an architectural thing — because all these ad systems were designed without consent in mind, accepting is a no-op, whereas refusing consent requires an outbound request to set some sort of "do not track" flag somewhere (presumably as a cookie).

If accepting is a no-op then you are being tracked even before you make your decision - as the page already have been loaded. A brutal violation of course but I absolutely expect that to be the case.

Perhaps the purpose of the spinner is to delete the data they've already collected?

Are you still being "tracked" if all copies of the data are destroyed?

Re: NASA Has Been Hacked

#56

Post by Wowfunhappy »

iainmerrick wrote: post #17
enlyth wrote: post #15

Earlier quoted context omitted.

It gets stuck for a minute or two on 100%, then says that some trackers cannot use https and makes you click another link to finish the process. I wonder why these dark patterns are still acceptable on the web. I thought opting-out was supposed to be as easy as opting-in according to the GDPR? The vast majority of sites I see make opting-out a very difficult process, usually hidden behind a tiny grey span of text, wh…

I wonder why these dark patterns are still acceptable on the web. I thought opting-out was supposed to be as easy as opting-in according to the GDPR? Yes, that’s the idea, but who’s going to enforce it? The dark patterns trick most people into doing what they want. A small number of technically-savvy users may complain, but we have little leverage.

> Yes, that’s the idea, but who’s going to enforce it?

In theory, people are supposed to be suing the companies that do this, right?

Re: NASA Has Been Hacked

#58

Post by tetha »

txcwpalpha wrote: post #41
tetha wrote: post #18

Reading the audit, this kind of confirms my base question when building infrastructure: If people don't do the right thing the business needs, why is it too hard to do? Can't we reduce the pain to do the right thing so doing the lazy / wrong thing is harder? People not doing thing tends to be an indication of boundaries and responsibilities being drawn in bad ways. Something like the log reviews are a classical thing…

> but firewall all systems to access the central registry only, and widen the firewall after an authorized registration of the system. That way, the admins just have to rack systems with a usb stick with some credentials, and it goes or it doesn't. Someone first has to build this system, and after accounting for all of the red tape and approvals and training and new audits required and tallying up the total man-hours…

Yeah, size is one matter, technology focus is another one.

We've been acquired by a bigger shop with a lot less technology focus and exactly what you're describing is already happening. Things that should take 2 month waiting for customers already takes 1 month of planning and 2 month of scheduling the person that might be able to schedule the task of 2 month within the next 6 month or more probably never. It's a soft spot for me atm, because if that's the new norm, it'll be time to leave a lot of work behind.

Re: NASA Has Been Hacked

#59

Post by packet_nerd »

olliej wrote: post #22

IT security people need to stop thinking in terms of disallowing “unauthorized” devices on physical (wired and WiFi) and recognize start designing for human nature. Assume that the physical networks are compromised, and have all privileged resources only accept connections over VPN. Is it perfect? No, but it makes further compromise harder. The assumption of no trust also means acknowledging that you need gate incomi…

Meanwhile DNS, which is a precursor to almost every connection ever, is rarely encrypted or authenticated in practice. Standards like DNSSEC and DNS over TLS exist but seem to have lots of vocal opposition without any serious proposals for improvement.

A Microsoft certificate training I took recently literally put emphasis on randomizing source port numbers as a way to mitigate attacks.... let that sink in.

Re: NASA Has Been Hacked

#60

Post by _underfl0w_ »

Wowfunhappy wrote: post #55
tjoff wrote: post #32

Earlier quoted context omitted.

If accepting is a no-op then you are being tracked even before you make your decision - as the page already have been loaded. A brutal violation of course but I absolutely expect that to be the case.

Perhaps the purpose of the spinner is to delete the data they've already collected? Are you still being "tracked" if all copies of the data are destroyed?

That depends on who is doing the actual tracking/correlation and, assuming it's a third party, how quickly the site hands that data off.
Post reply on HN