Shouldn’t be this hard to find out the attack vector.

Buried deep, deep in their writeup:

RocketMQ servers

• CVE-2021-4043 (Polkit)
• CVE-2023-33246

I’m sure if you’re running other insecure, public facing web servers with bad configs, the actor could exploit that too, but they didn’t provide any evidence of this happening in the wild (no threat group TTPs for initial access), so pure FUD to try to sell their security product.

Unfortunately, Ars mostly just restated verbatim what was provided by the security vendor Aqua Nautilus.

Only the cyber truck. Model S and 3 refreshes are still on the legacy platform, with a lithium ion 12V.

So the article repeats, several times, “waymo relies on remote operators”. I don’t think the author knows what “self-driving” means.

For encryption, the client and server need to share their private keys.

This is incorrect, for asymmetric (public-private) encryption. You never, ever share the private key, hence the name.

The private key is only used on your system for local decryption (someone sent a message encrypted with your public key) or for digital signature (you sign a document with your private key, which can be validated by anyone with your public key).

For the server, they are signing their handshake request with a certificate issued by a known certificate authority (aka, CA, a trusted third party). This prevents a man-in-the-middle attack, as long as you trust the CA.

The current gap is in inconsistent implementation of Organization Validation/Extended Validation (OV/EV), where an issuer will first validate that domains are legitimate for a registered business. This is to help prevent phishing domains, who will be operating with TLS, but on a near-name match domain (www.app1e.com or www.apple.zip instead of www.apple.com). Even this isn’t perfect, as business names are typically only unique within the country/province/state that issues the business license, or needed to be enforced by trademark, so at the end of the day, you still need to put some trust in the CA.

deleted by creator

So if ISPs are once again Title II common carriers, how can they enforce the TikTok ban? 🤔

I believe this is already the case; domain reputation is weighted pretty heavily by Gmail and others, so it will take some months before you’ve established enough rep. Following SPF/DMARC/DKIM is crucial, followed with time your domain has been registered and typical outbound volume from your domain.

deleted by creator

deleted by creator

That’s the benefit of a custom domain, I suppose; you can always change he provider without changing your email.

deleted by creator

What’s worrying about this report is that it’s coming from Google itself.

Google just bought Mandiant, one of the leading cybersecurity and threat intelligence firms. Therefore, Google is one of the leading cybersecurity and threat intelligence firms.

https://arstechnica.com/gadgets/2022/03/google-makes-second-largest-acquisition-ever-5-4-billion-for-mandiant/

It’s now expected that Google would release this kind of report, seeing as they sell this as an enterprise service.

Mandiant has previously released this type of report regularly; for instance, they were the firm that disclosed the SolarWinds hack.

Agreed, the echo chamber is real on Reddit/Lemmy. Easy to hate on Elon, but people are acting as if the old men leading most other Fortune 100 companies think any differently than he does. You can find the rare exception, but you’ll have a hard time living in modern society without your money filtering up to a bigot somewhere.

Elon just lacks the filter to keep himself from saying it.

Don’t bother with the cert if it’s not your job, but at least look into CCNA Routing and Switching. There are tons of courses available, both in person and online, as well as numerous YouTube videos on the subject.

See if your local library or community college has an adult education center that provides a course. At some point, you will need to learn subnetting, which is just math, but practice makes perfect, and your life is easier if you have it committed to memory.

Proper written work is still one of the most effective ways to do this.

Why do you think they all opposed right to repair?

And specifically, right to open repair? They’ll happily send you a $600 TPM-locked biometric sensor, because they would control the market and ROI, but won’t let you buy a $90 alternative from someone else.

While true, it’s pretty asinine to hold companies operating in China accountable for complying with Chinese law. It sucks, but they aren’t just going to abandon the Chinese ~cash cow~ market.

Original Doom was not GPU accelerated.

The games in progress I mark as favorites, I have “Finished” and “Play Next” categories, and I have a big dump category called “Won’t Play”.

Aside from that, I have some big categories for collections of old games from humble bundles and steam sales, like legacy Myst, Wizardry, or Sierra games, or like Star Wars game collections.

NeXT was a mediocre BSD front end and a few interesting Objective-C libraries. Apple’s board of directors pretty much crawled back to Jobs hat in hand after the disasters of Sculley and Spindler.

Or, the real sign of gentrification is that the Google Maps car drives by your neighborhood more than once every five years. Guarantee that’s not happening in the projects.