Readit NewsTL;DR of article: Signal transfers key material upon migrating to a new device if you use the "transfer messages" workflow. As a result, safety numbers do not change.
I don't see how this is a problem at all. This was actually a feature that many Signal users wanted to use - they didn't want to re-verify safety numbers every time that they had to reinstall Signal or switch to a new phone.
> We don't want anyone to get hurt by way of trusting privacy guarantees which may be more conditional than they appear from the docs!
> If Bob notices the chat safety number with Alice has changed and then Alice sends a bunch of suspect-sounding messages or asks to meet in person and Bob has never met Alice in person before, for example, Bob should be wary. After Alice for example is forced to provide device passcode or unlock their device with their fingerprint or face, Alice's device could be cloned over to a new device by way of quick transfer functionality without Alice's consent, and the messages could be coming from the cloned device rather than Alice's actual device.
Respectfully, this doesn't make any sense. Signal provides security from device to device, it doesn't stop someone from pointing a gun to your head and looking at your messages or pretending to be you after stealing your phone. If someone has the physical possession of your phone necessary to perform a device transfer, then you're already screwed. The idea that a safety number change would alert the person on the other end that you're being held hostage is outlandish and is completely divorced from any normal use of Signal.
You assume here that you are aware of the fact that your device is in the hands of someone else.
I could ask you for your device under the pretense of making a phone call and then secretly transfer your account to my device. I could then secretly read your chats from my device and no one would be aware of it - until you check the amount of active sessions in settings.
No, you're absolutely right. The author complains that with physical possession of the device that it's possible to transfer Signal's private key material to a new device, leaving the old safety number intact.
The author apparently expects the safety number to change in order to alert the person on the other end that there "might be a hostage situation," evidently not realizing that the attacker could just, well, use the unlocked phone right in front of them.
Well, if I assume that I just got temporary access to someone’s unlocked device, then it would probably be a lot more convenient for me to quickly transfer the account to one of my own devices and then access it from there instead of accessing it from my targets device which I might lose access to any moment.
So from that point of view it would be legitimate to argue that I might want to get notified if one of my contacts transfers his account. I can then double check : “Did you just transfer your signal account to a new device or was that an attacker?”
That might only be interesting for high-risk users though and could impair the UX. Why not make it optional?
pennyintheslot commented on A Beginner’s Guide to Getting Started with Bitcoin serhack.me/articles/getti... · Posted by u/onerom
The real tragedy of this whole crypto frenzy is how many people have apparently made it their life's mission to shill random coins on social media.
Isn't it absurd that so many people's primary hope to acquire wealth is by putting their money into something that was recommended to them on Twitter and that they don't even understand?
This is a zero-sum game, where the money you make, someone else loses. Crypto could be incredibly useful if it was simply a fully decentralised, cross-border, (anonymous) payment solution that is pegged to a basket of existing currencies. Wait, we already got that. It's called stable coins. But yeah, no 'get rich quick' in that one, so apparently a lot less interesting.
Who knows what amazing businesses could be created if the crypto preachers focused their energy and attention on actual value-producing entrepreneurship instead of FOMOing others into buying the random coin of the day.
pennyintheslot commented on Apple watch keyboard developer put off by app store scammers twitter.com/keleftheriou/... · Posted by u/masalah
Apple seems to be far more concerned with getting their (30/15) percent cut than with how that revenue was generated. The App Store is full of such examples. As long as you pay the baron his share and don’t upset him with unwelcome thoughts (Parler) or worldly desires (erotica), you are free to reign.
In effect, you're saying that Vancouver has become the laundromat of converting illegitimate capital produced under a shadow banking system into real valuable assets.
This is bad for everyone else in our global economic system. It would be akin to someone in a game of monopoly accepting counterfeit money. The rest of the players have to play the game with actual monopoly rules while one player is allowed to make up whatever they want. Guess who's going to win that game?
Of course its a shadow banking system for a reason, because keeping everything hidden gives them a cheaters advantage. Revealing what happens there would be admitting to cheat and fraud.
China is seriously going full force with deception, passive aggression, claiming innocence, claiming moral high ground, while doing everything that is in the book of machiavellian/art-of-war tactics, and the rest of the world is doing nothing about it. (hardly surprising given their cultural mythologies and inclinations which differ vastly from for example a "liberty, justice, and freedom-for-all" mantra that is the foundation and aspiration of a different nation)
What’s bad about foreign capital influx? Someone has to plan these buildings, someone has to build them. It creates jobs in various sectors.
We should be glad that the Chinese view our countries as safe and want to invest into them.
The real problem is that our local governments are unable to adjust the supply to the demand. THAT drives up prices and nothing else.
/edit: You could even make a law that foreigners can only invest into new construction which would make it impossible to invest without value creation for the local economy.
pennyintheslot commented on Why Segment Went Back to a Monolith infoq.com/news/2020/04/mi... · Posted by u/BerislavLopac
If you're up for a humoristic take on microservices, you could have a look at this video: https://www.youtube.com/watch?v=y8OnoxKotPQ
pennyintheslot commented on Ask HN: Why are there almost no intermediate-level learning resources? · Posted by u/pennyintheslot
https://hi.hyperskill.org/
^This might be a good place to learn the intermediate stuff. Python, Java, Kotlin.
More intermediate stuff goes into the data structures and algorithms. https://sp19.datastructur.es/ ^UCB's Josh Hug is a good lecturer, also provides course textbook, hw, side projects.
For best practices, try to get the Head First Design Patterns PDF.
Common mistakes? Search for "Effective <whateverLanguage>" and you should find a PDF for whatever you're looking for.
Also, goalkicker.com has compiled a lot of intermediate stuff from scraping StackOverflow question-answers.
Thank you for sharing those!
After looking through your suggestions, I think I better understand what I actually meant with 'intermediate-level learning resources'.
I suppose what I am looking for are videos where people walk you through some really advanced open-source applications and explain the application structure and design decisions they have made. That could be relevant for all sorts of tech stacks and combinations.
Basically a video after which you have a good starting ground to build your own application with a similar tech stack. These videos should ideally be made for open-source applications that follow many best practices for the given tech stack.
I think that would be extremely valuable. As of right now, you are stuck reading through random projects on GitHub and often times you don't even feel confident that the way they have approached the problem, is necessarily sane and a good way to go about it.
It would also be a lot more time-efficient if someone explains the application structure and design decisions to you than if you have to figure it out by yourself.
I've wondered about this - but how do you know what you are missing out on? For example, if you were active on twitter or LinkedIn and carefully cultivated those profiles, who knows what life changing connections you may have made? (I've seen several people comment on getting jobs, business partners, fellow hobbyists, etc. on twitter.)
*edit: missed a word
It’s unlikely that you will get good at something you don’t enjoy so I think the moment you can answer that question you should take the consequences.
Not enjoying it -> unlikely to get good at it -> unlikely to reap the benefits -> better skip it or work around it (you don’t NEED those platforms after all)