Skip Navigation
Crash while scrolling in feed

Hi all,

The following post appears to crash my feed while scrolling:

https://mander.xyz/post/13720820

It is a very long text post with some technicals, so possibly a parsing error in the text preview?

Thanks! Worked around it by blocking the user temporarily.

1
Is it possible to use zero knowledge proofs to verify journalism sources?
  • Possible? Yes. Likely? Not at all.

    To perform a zero knowledge proof, you’d have to have structured data to support the claim, which most whistleblowers would not have. If a whistleblower already had the hard evidence in hand, e.g., serial numbers and timestamps, they could have just provided those anonymously, and someone could follow up. The problem is, you can’t always get a copy of the hard evidence without revealing your intent to the employer, or at least, other employees.

    Presumably most whistleblowers are making unsubstantiated claims that something happened, or maybe with light evidence. Based on who they are, a journalist or investigator may then elect to follow up and dig up the hard evidence to support the claim. This requires revealing your name and position/relationship to at least one person. Rarely, they would be willing to put themselves out there to provide an affidavit under oath, which itself is not enough to pursue criminal charges (though it could help build a case around intent or willful neglect, or help support a warrant or discovery).

    It’s illegal, but not unheard of, to try to force journalists to reveal their sources, but the same protections are not universally in place if you reported a finding to a company’s internal affairs, for example. But unlike attorney-client privilege, or shield law protections, the risk in signing an affidavit is, as we’ve seen in recent US trials, that records will not stay sealed, and your name will be revealed to the defense and/or public.

  • MG EXE181 electric hypercar can go 0-62 mph in 1.9 seconds
  • The Model S Plaid, MG, Rimac Niverra, etc are increasingly limited by regulations more than anything. Quite literally, they are at the limits of rolling friction for street legal tires, which is why you’re not seeing a lot of variance at the top of the market.

  • A doubt in encryption
  • For encryption, the client and server need to share their private keys.

    This is incorrect, for asymmetric (public-private) encryption. You never, ever share the private key, hence the name.

    The private key is only used on your system for local decryption (someone sent a message encrypted with your public key) or for digital signature (you sign a document with your private key, which can be validated by anyone with your public key).

    For the server, they are signing their handshake request with a certificate issued by a known certificate authority (aka, CA, a trusted third party). This prevents a man-in-the-middle attack, as long as you trust the CA.

    The current gap is in inconsistent implementation of Organization Validation/Extended Validation (OV/EV), where an issuer will first validate that domains are legitimate for a registered business. This is to help prevent phishing domains, who will be operating with TLS, but on a near-name match domain (www.app1e.com or www.apple.zip instead of www.apple.com). Even this isn’t perfect, as business names are typically only unique within the country/province/state that issues the business license, or needed to be enforced by trademark, so at the end of the day, you still need to put some trust in the CA.

  • I need to figure out how to prepare baby bok choy
  • When are you adding the bok choy to your stir fry? I’d wager you’re over cooking it; try adding it much later to the cooking process. It should only take a minute or two at most to cook.

    The greens are also quite bitter, so possibly don’t use all of the leaf.

  • Why I ditched Gmail for Proton Mail
  • I believe this is already the case; domain reputation is weighted pretty heavily by Gmail and others, so it will take some months before you’ve established enough rep. Following SPF/DMARC/DKIM is crucial, followed with time your domain has been registered and typical outbound volume from your domain.

  • Why I ditched Gmail for Proton Mail
  • I believe this is already the case; domain reputation is weighted pretty heavily by Gmail and others, so it will take some months before you’ve established enough rep. Following SPF/DMARC/DKIM is crucial, followed with time your domain has been registered and typical outbound volume from your domain.

  • Why I ditched Gmail for Proton Mail
  • I believe this is already the case; domain reputation is weighted pretty heavily by Gmail and others, so it will take some months before you’ve established enough rep. Following SPF/DMARC/DKIM is crucial, followed with time your domain has been registered.

  • Unearthing APT44: Russia’s Notorious Cyber Sabotage Unit Sandworm
  • What’s worrying about this report is that it’s coming from Google itself.

    Google just bought Mandiant, one of the leading cybersecurity and threat intelligence firms. Therefore, Google is one of the leading cybersecurity and threat intelligence firms.

    https://arstechnica.com/gadgets/2022/03/google-makes-second-largest-acquisition-ever-5-4-billion-for-mandiant/

    It’s now expected that Google would release this kind of report, seeing as they sell this as an enterprise service.

    Mandiant has previously released this type of report regularly; for instance, they were the firm that disclosed the SolarWinds hack.

  • CISA Issues Emergency Directive After Midnight Blizzard Microsoft Hits
  • For your last two questions, the counterpoint is, if even Microsoft can’t stop a dedicated nation state, how can any other major service provider say they haven’t been compromised?

    The standard now is, assume breach. While unfortunate, the industry average for MTTD is in months. Microsoft was at least good enough to detect it within six.

    Can Broadcom or Palo Alto say the same? Amazon, Google, Apple, Cisco?

  • Removed
    Tesla is reportedly laying off ‘more than 10 percent’ of its workforce
  • Agreed, the echo chamber is real on Reddit/Lemmy. Easy to hate on Elon, but people are acting as if the old men leading most other Fortune 100 companies think any differently than he does. You can find the rare exception, but you’ll have a hard time living in modern society without your money filtering up to a bigot somewhere.

    Elon just lacks the filter to keep himself from saying it.

  • Best resources to learn more about networking
  • Don’t bother with the cert if it’s not your job, but at least look into CCNA Routing and Switching. There are tons of courses available, both in person and online, as well as numerous YouTube videos on the subject.

    See if your local library or community college has an adult education center that provides a course. At some point, you will need to learn subnetting, which is just math, but practice makes perfect, and your life is easier if you have it committed to memory.

    Proper written work is still one of the most effective ways to do this.

  • InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)CY
    CyberSeeker @discuss.tchncs.de
    Posts 1
    Comments 62