191–200 of 209 posts
Earlier quoted context omitted.
In fairness, FTX had a profitable bankruptcy [1]. So it's still better to be scammed by Jane Street alumni than to be scammed by the usual alumni of Goldman Sachs, JP Morgan etc [1] https://www.bloomberg.com/news/articles/2024-05-15/ftx-bankr...
How is that fair? It was luck from the AI investment. Pure luck.
TeleMessage CEO LinkedIn bio - reads like a terrible AI hatchet job: "At the helm of TeleMessage, my leadership is defined by strategic innovation and a steadfast commitment to advancing telecommunications solutions. With a focus on SaaS products, our team has successfully navigated the industry's evolution, ensuring that we remain at the forefront of technological advancements. My role encompasses not only the overs…
Earlier quoted context omitted.
How is that fair? It was luck from the AI investment. Pure luck.
Regardless of how you feel about SBF and FTX, claiming an early investment into Anthropic is "luck" rather than being ahead of the curve feels off the mark.
Earlier quoted context omitted.
This is why Signal is so opposed to third-party apps (or forks) that connect to their service. If you want to keep the branding of Signal being the secure app, you need to make sure that all Signal users are actually using a secure version of Signal. If an insecure fork (like this one) becomes too popular, most groups will have at least one member using it, and then the security is gone.
That was Apple's same reasoning for shutting down that iMessage client app. These leaks seem to justify their concerns.
Earlier quoted context omitted.
You need to account for the risk of blackmail, persecution, and embarrassment (e.g., evidence of infidelity, refugee status, medical condition). Most of the time, citizens have the right to keep secrets or lie.
Citizens - yes. Politicians outside of the job, using whatever comms they wish - also yes. Politicians on the job - no. All their job communications can be public, and humanity and citizens of the country would be actually much safer than now. Outside of the military/intel ones, of course.
I'm not saying these chats shouldn't be released. But I'd hope the names and other identifying info of people who weren't uninvolved would be redacted, just keeping the context to show what kind of information was being carelessly shared. Of course, given the admin's shamelessness, they'd claim anything with redacted info was faked. It might be better to leave it verifiable.
So one of their servers had a /heapdump endpoint that publicly served a heap dump of the server? This whole saga is out of control. This group didn’t really “publish” anything, though. They’re offering access to journalists through a request form. They’re also not saying how much actual message content they have because the 410GB of heap dumps makes for a bigger headline number.
Aren’t those Israeli software companies all supposed to be top notch, ex Mossad, yadda yadda? Doesn’t sound like it. I hope the message dump is juicy.
TeleMessage CEO LinkedIn bio - reads like a terrible AI hatchet job: "At the helm of TeleMessage, my leadership is defined by strategic innovation and a steadfast commitment to advancing telecommunications solutions. With a focus on SaaS products, our team has successfully navigated the industry's evolution, ensuring that we remain at the forefront of technological advancements. My role encompasses not only the overs…
"I'm a CEO. We're SaaS. I'm a CEO."
Earlier quoted context omitted.
That was Apple's same reasoning for shutting down that iMessage client app. These leaks seem to justify their concerns.
Nah, that was to keep their users hostage and force them to buy a iPhone.
Sure, this is HN, we know one of the effects of locking the ecosystem and coloring in-system messages differently is to encourage people to be in the ecosystem.
At the same time, you ALSO need to consider that obviously there will be leaks.
Malicious/advertising apps will target the new messaging interface to gain more data on their victims, etc.
Earlier quoted context omitted.
Nah, that was to keep their users hostage and force them to buy a iPhone.
This is a shallow dismissal of an argument that should be given more consideration. Sure, this is HN, we know one of the effects of locking the ecosystem and coloring in-system messages differently is to encourage people to be in the ecosystem. At the same time, you ALSO need to consider that obviously there will be leaks. Malicious/advertising apps will target the new messaging interface to gain more data on their v…
Locking down a platform is not an acceptable solution to the above conundrum - it doesn't matter if the user is using an official device/app whatever if they are untrusted. They can always turn around and leak everything you say without any technical measures.
Should we have no security? No, if you want to color messages differently based on perceived platform, fine. This is just an illustration that no technical measures can replace the fundamental trust necessary in these types of situations.
Earlier quoted context omitted.
I'm the original author of the Spring Boot feature for heapdumps: https://github.com/spring-projects/spring-boot/pull/5670 . It seems that users commonly misconfigure Spring Boot security or ignore it completely. To improve the situation, I made this PR: https://github.com/spring-projects/spring-boot/pull/45624 . When the PR was created in 2016, endpoints were marked as "sensitive" and, for example, the heapdump endp…
In my opinion, the original sin of Spring Boot Actuator is allowing server.port and management.server.port to be the same. It makes it too convenient for developers to skip the security review that would be done for opening a non-standard port. I think it would be wise to either disallow the ports being the same, or if they are the same, only enable the health endpoint.
Sure, punching buttons for money is a widespread issue in the industry, but devs also like convenience.
Security has the hard problem that it's infuriatingly difficult to troubleshoot (ever tried to write security policies for an app or figure out how to let an app through a firewall, or set of firewalls?), and there's a bit of a culture of "security by obscurity".
So it's kind of expected that this is the behavior...
Sure some people will really just not care, mistakes will be made, but secure defaults, easy to configure and simple to understand are features not often seen from security products generally. This is driven by poor motivations from security folk who want to protect their industry...