Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Guide to Not Getting Hacked

motherboard.vice.com

Post reply on HN
Print view View original

51–60 of 84 posts

Re: A Guide to Not Getting Hacked

#51

Post by the_common_man »

ryanlol wrote: post #47
Redoubts wrote: post #44

Earlier quoted context omitted.

I’m out of the loop, what’s wrong with pidgin?

libpurple suffers from very poor code quality, leading to tons of exploitable vulnerabilities. Just as you would expect when writing C parsers for lots of complicated protocols.

> libpurple suffers from very poor code quality, leading to tons of exploitable vulnerabilities. Just as you would expect when writing C parsers for lots of complicated protocols.

Is this your personal feeling or do you have something to back this up? A quick look at the source code suggests it's basically like any other glib based program.

Re: A Guide to Not Getting Hacked

#52

Post by ikeboy »

tptacek wrote: post #41

Everything that's in this piece that's true is on the Tech Solidarity guide. What isn't, is false. https://techsolidarity.org/resources/basic_security.htm In particular: * Do NOT install antivirus on your computers. Antivirus software is absurdly dangerous. The closest you'll come to benign AV is Microsoft's, but that's an asymptotic kind of safety. * Do NOT go out of your way to funnel your traffic through a commerc…

Is tor browser inside whonix good? Would you recommend a different browser inside of whonix instead?

Re: A Guide to Not Getting Hacked

#53

Post by tptacek »

ikeboy wrote: post #52
tptacek wrote: post #41

Everything that's in this piece that's true is on the Tech Solidarity guide. What isn't, is false. https://techsolidarity.org/resources/basic_security.htm In particular: * Do NOT install antivirus on your computers. Antivirus software is absurdly dangerous. The closest you'll come to benign AV is Microsoft's, but that's an asymptotic kind of safety. * Do NOT go out of your way to funnel your traffic through a commerc…

Is tor browser inside whonix good? Would you recommend a different browser inside of whonix instead?

If you use your browser for more than one site per execution, having your browser process owned up is devastating. Don't use Tor Browser.

Re: A Guide to Not Getting Hacked

#54

Post by ryanlol »

the_common_man wrote: post #51
ryanlol wrote: post #47

Earlier quoted context omitted.

libpurple suffers from very poor code quality, leading to tons of exploitable vulnerabilities. Just as you would expect when writing C parsers for lots of complicated protocols.

> libpurple suffers from very poor code quality, leading to tons of exploitable vulnerabilities. Just as you would expect when writing C parsers for lots of complicated protocols. Is this your personal feeling or do you have something to back this up? A quick look at the source code suggests it's basically like any other glib based program.

This is a commonly known fact, not just my personal feeling.

Re: A Guide to Not Getting Hacked

#55

Post by ryanlol »

ikeboy wrote: post #52
tptacek wrote: post #41

Everything that's in this piece that's true is on the Tech Solidarity guide. What isn't, is false. https://techsolidarity.org/resources/basic_security.htm In particular: * Do NOT install antivirus on your computers. Antivirus software is absurdly dangerous. The closest you'll come to benign AV is Microsoft's, but that's an asymptotic kind of safety. * Do NOT go out of your way to funnel your traffic through a commerc…

Is tor browser inside whonix good? Would you recommend a different browser inside of whonix instead?

https://medium.com/@thegrugq/tor-and-its-discontents-ef51648...

You really just want to use Chrome/Chromium.

Re: A Guide to Not Getting Hacked

#56

Post by jlgaddis »

ryanlol wrote: post #17
paulryanrogers wrote: post #16

Earlier quoted context omitted.

Why else is it terrible?

It also recommends running an antivirus on desktop, using a VPN, using tor browser, pidgin and goes as far as discussing android as a viable option. The “lock up your SIM” part is simply ridiculous too, this has never ever stopped anyone. This article is terrible because it has clearly been written by non-experts who should not be writing any security guides.

Your comments (this one, and others downthread) get downvoted to hell yet tptacek's comment [0] -- which says basically the same thing -- is at the top. WTF?

[0]: https://news.ycombinator.com/item?id=15735789

Re: A Guide to Not Getting Hacked

#57

Post by proee »

jdietrich wrote: post #46
proee wrote: post #43

Regarding web extensions like Adblock or others, this seems to be quite risky I'm using because the developers of the plug-in could get hacked and silenly release a version that captures your password fields. Are we really ok giving full read/write access to our webpages from companies we know nothing about? I'm considering removal of all web extensions that have read/write access. Thoughts?

uBlock Origin is GPL licensed. It collects no analytics. The code base is concise and highly legible. The primary maintainer (Raymond Hill) appears to be a principled man. I don't think that it has been independently audited, but I trust it more than most of the software on my computer. https://github.com/gorhill/uBlock

Right, but do you trust that his entire system is locked down. Wouldn't this be the ultimate target by a hacker at the highest level. They might even go so far as to physically breach his location if they knew they could gain access to his machine. Installing keyloggers, etc.

This might allow them to change the plugin at the last minute if he made an update and pushed it out.

Re: A Guide to Not Getting Hacked

#58

Post by [deleted] »

tptacek wrote: post #41

Everything that's in this piece that's true is on the Tech Solidarity guide. What isn't, is false. https://techsolidarity.org/resources/basic_security.htm In particular: * Do NOT install antivirus on your computers. Antivirus software is absurdly dangerous. The closest you'll come to benign AV is Microsoft's, but that's an asymptotic kind of safety. * Do NOT go out of your way to funnel your traffic through a commerc…

[deleted]

Re: A Guide to Not Getting Hacked

#59

Post by Santosh83 »

jdietrich wrote: post #46
proee wrote: post #43

Regarding web extensions like Adblock or others, this seems to be quite risky I'm using because the developers of the plug-in could get hacked and silenly release a version that captures your password fields. Are we really ok giving full read/write access to our webpages from companies we know nothing about? I'm considering removal of all web extensions that have read/write access. Thoughts?

uBlock Origin is GPL licensed. It collects no analytics. The code base is concise and highly legible. The primary maintainer (Raymond Hill) appears to be a principled man. I don't think that it has been independently audited, but I trust it more than most of the software on my computer. https://github.com/gorhill/uBlock

Yes, but your parent is afraid that an extension's account may be hacked. Now that going forward Mozilla will be doing only minimal manual code review on AMO, this is not an entirely fanciful concern.

We talk about reducing the attack surface of every other program out there, but funnily enough, almost no one mentions reducing the attack surface of the single program that's more exposed than almost any other to exploits: the web browser.

On the contrary we pile it with addon after addon and even the browser makers have long succumbed to feature creep.

Re: A Guide to Not Getting Hacked

#60

Post by Santosh83 »

ikeboy wrote: post #52
tptacek wrote: post #41

Everything that's in this piece that's true is on the Tech Solidarity guide. What isn't, is false. https://techsolidarity.org/resources/basic_security.htm In particular: * Do NOT install antivirus on your computers. Antivirus software is absurdly dangerous. The closest you'll come to benign AV is Microsoft's, but that's an asymptotic kind of safety. * Do NOT go out of your way to funnel your traffic through a commerc…

Is tor browser inside whonix good? Would you recommend a different browser inside of whonix instead?

It is explicitly warned not to use the Tor Browser under Whonix because the browser starts its own instance of Tor while Whonix already funnels every network request through its gateway Tor and Tor over Tor is supposedly undefined behaviour. So you have to go the additional step of disabling Tor Browser from starting its bundled Tor...

Or under Whonix just use any normal browser like Firefox.

Post reply on HN