@ddnomad@infosec.pub avatar

ddnomad

@ddnomad@infosec.pub

Terminal stage of console

This profile is from a federated server and may be incomplete. Browse more on the original instance.

ddnomad,
@ddnomad@infosec.pub avatar

We apologize, but your web browser is configured in such a way that it is preventing this site from implementing required components that protect your privacy and allow you to view and change your privacy settings. This functionality is required for privacy legislation in your region.

We recommend you use a different browser or disable the “EasyList Cookie” filter from your “Content Filtering” settings (found under “Settings” -> “Shields” in the Brave Browser

lol

ddnomad,
@ddnomad@infosec.pub avatar

There are two camps. People will constantly try to drag you into one. They will get mad if you resist. They will call you a filthy centrist if you resist.

It doesn’t not matter what’s your political view, if it is not radical enough, if it does not align unquestionably with one of the camps, people will get mad.

This is just how it is nowadays.

ddnomad, (edited )
@ddnomad@infosec.pub avatar

Switch to Telegram

You know it’s not even E2EE by default, and when it is it uses a homegrown algo that is not exactly well spoken of? (at least V1)

ddnomad,
@ddnomad@infosec.pub avatar

Telegram’s servers are located in US, Singapore, Netherlands (and maybe some other countries) from what I’ve gathered. And all chats that are not E2EE’ed are stored there, encrypted at rest at best with keys in the same database, or somewhere else that can still be accessed in automated way. Maybe it is not even encrypted at rest.

The point is, all those countries are either in 5 eyes or have information sharing agreements with 5 eyes countries. So as far as I’m concerned, TLAs can still have their fingers in those pies, in addition to Telegram’s overall shadiness and Russian ties. So maybe you get KGB strongman keeping a watch over your chats too.

This is not something I’d have much confidence in to be honest.

ddnomad,
@ddnomad@infosec.pub avatar

And E2EE is only available on phones, circa a couple of years ago anyways

Harvard Scientists Find That Eating Red Meat Could Increase Your Risk of Diabetes (scitechdaily.com)

While previous studies have found a link between red meat consumption and type 2 diabetes risk, this study, which analyzed a large number of type 2 diabetes cases among participants being followed for an extended period of years, adds a greater level of certainty about the association....

ddnomad, (edited )
@ddnomad@infosec.pub avatar

Any study that mashes together processed and unprocessed meat in epidemiological setting is next to meaningless in my opinion. You can associate basically anything this way.

Guess where read meat and processed meat intersect? McDonald’s, for example. Now tell me that eating sirloins kills me.

ddnomad,
@ddnomad@infosec.pub avatar

The article you’ve linked ignores two very important points: how much of that land is marginal (not suitable for growing crops) and the fact that our monoculture approach to growing crops is as much (if not more) devastating to our environment.

There’s no way to put it apart from “humans destroy habitats”, and I don’t think that it makes much difference whether the land was dedicated for grazing or crops.

ddnomad, (edited )
@ddnomad@infosec.pub avatar

Even taking this claim at face value, we would have to solve plant based diet issues, such as insufficiencies in some vitamins (e.g. B12), complexity of getting sufficient amount of essential amino acids (esp. omega-3) and omega-3, slow but steady reduction in an overall amount of nutrients present in both vegetables and fruits etc.

And if we say that the answer is to “engineer” foods: fortify grains with vitamins, come up with “equivalent on paper” diary replacements (e.g. oat “milk”) etc, then we need to ask ourselves whether this is actually the answer? Can we effectively reduce foods to a small number of “key ingredients” and add them everywhere? Is this sustainable? What about the environmental impact of running all those factories that “engineer” plant-based alternatives to the foods our ancestors ate for generations?

I do not know the answer, I’m no scientist, nor proponent of any specific way forward. I just read stuff. The only thing that I do believe is that there is no silver bullet.

Books I find very interesting:

UPDATE: Corrected that Omega-3 is indeed not an amino acid

ddnomad,
@ddnomad@infosec.pub avatar

Omega-3 is an EFA

My bad, “I’m not a scientist” bit me hard here lol, though I did read that if you get your omega-3 from plant sources (linolenic acid) its absorption rate is extremely low comparing to sources like salmon.

Regarding supplementation, I feel like having to do that because of inherent issues with your diet is somewhat of a dirty hack (I do take some supplements though, so I’m not gonna pretend like it is not an option).

ddnomad,
@ddnomad@infosec.pub avatar

Please don’t use your password manager for TOTP tokens. It is called two factor authentication for a reason.

ddnomad,
@ddnomad@infosec.pub avatar

You should not assume your password manager is unhackable.

That’s my main point. Perfect is an enemy of good indeed, but I feel that doing things properly the first time is a good idea in general, especially when it as easy as using a different app for your TOTP tokens. It’s a low hanging fruit really.

ddnomad,
@ddnomad@infosec.pub avatar

It is reasonable yet subpar under a threat model where you do not trust any single provider, which is a model I find appropriate most of the time.

ddnomad,
@ddnomad@infosec.pub avatar

Until next time they try to push through something similarly stupid. Now it’s EU’s turn to make their mind too.

ddnomad,
@ddnomad@infosec.pub avatar

Words used to have meaning, you know. Like, for example, the word “private”.

ddnomad,
@ddnomad@infosec.pub avatar

I’d not expect the private booth to have the club’s employee sitting there and waiting for me to do something that is against the rules preemptively.

We mostly argue about semantics, but in this instance you are trying to excuse some very questionable behaviour by companies by saying something along the lines of “well you better go and live in a forest then”. And I don’t think that’s a good take.

For example, how many Lemmy instances are fine with you direct linking to piracy torrents?

Irrelevant, as all content on Lemmy is public in a proper sense of this word.

ddnomad,
@ddnomad@infosec.pub avatar

Scary illigal content here

I guess we test and see whether I get banned.

Also, it’s not the same. A link to a website is not “pirated content”. A link to a website in a “collection” not shared with anybody is not publicly available pirated content.

Why would Google preemptively ban a set of characters that does not constitute a slur and is perfectly legal to exist?

ddnomad,
@ddnomad@infosec.pub avatar

My point is that you should not excuse big corporations for clearly overstepping their bounds when it comes to moderation (as in “minority report” style moderation).

For Google, it would probably be even cheaper to only check URLs in collections that were shared with anybody, at a point the owner attempts to share them. Instead, they preemptively hide them from you, because “this set of characters offends us”.

This is something people should be angry about, not find an excuse for.

ddnomad,
@ddnomad@infosec.pub avatar

Open the link and read the thread, the author is not aware of this “collection” being shared publicly.

ddnomad,
@ddnomad@infosec.pub avatar

And the cringe inducing lttstore and “no sponsored fragment” plugs. Like somehow it sounds like your typical apology.jpeg and “haha funny-funny jokesies” at the same time.

ddnomad,
@ddnomad@infosec.pub avatar

Type hints are cool. Runtime enforced type hints are cooler.

github.com/beartype/beartype

ddnomad, (edited )
@ddnomad@infosec.pub avatar

As a rule of thumb, do not put all your eggs into one basket. No software is infallible and vulnerabilities can be uncovered and exploited in both open and closed sourced applications.

That’s being said, as long as you don’t store all information necessary for a successful login in your password manager, you should be fine.

So storing credentials for your bank account is fine, as long as it is also protected by MFA and you do not use the same password manager for handling that.

You can store PIN codes from your debit cards in the password manager as long as you do not store card number / expiration / CVV2 there too.

Personally, I keep passwords in a password manager, MFA tokens in a separate authenticator, MFA recovery codes go to FIPS 140-2 certified encrypted USB sticks (3 separate copies). I do store debit card PIN codes in my password manager, but only alongside the last 4 digits of the card number.

ddnomad,
@ddnomad@infosec.pub avatar

I agree with you on most of the points. Some security is better than nothing. More security is better than less, layers and all.

Regarding data breaches and malware, and threat models in general. We should not forget phishing too. People voluntarily entering their credentials on a website masquerading as their bank etc.

With all of that, having your credentials split over multiple applications and devices actually saves you from an endpoint compromise and evil maid attacks, at least in a sense of limiting the fallout.

Regarding VeraCrypt and “FREE”. While it is, again, better than nothing, VeraCrypt is fiddly, not always works consistently on all operating systems (I look at you, MacOS), and is susceptible to key logging. I prefer actual certified hardware with physical keypads instead. It is not free and has its own downsides, but it is just something I find more appealing.

ddnomad,
@ddnomad@infosec.pub avatar

For MFA apps, Google Authenticator seems to be the norm.

I personally use OTPAuth with sync disabled and regular backups. Mostly because it is easier to organise and back up.

Regarding hardware security keys as part of MFA, you can either get yourself dual USB-C / Lightning or USB-C / USB-A keys from Yubikey. Then just buy a USB-A to USB-C dongle (or vice versa) and keep it on your key chain. That’s mostly what I do, not ideal but does the job.

I also use OnlyKey for some passwords, especially encryption passphrases on some servers and laptops. I usually need to enter them on boot, and it just takes too long to do that manually and I’m lazy.

ddnomad,
@ddnomad@infosec.pub avatar

Good

ddnomad,
@ddnomad@infosec.pub avatar

Hey, sorry for slow replies, not receiving notifications for replies on Lemmy by design.

You can ping me on Matrix / Discord / Telegram, I’m ddnomad there. We can have a chat :)

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • anitta
  • thenastyranch
  • rosin
  • GTA5RPClips
  • osvaldo12
  • love
  • Youngstown
  • slotface
  • khanakhh
  • everett
  • kavyap
  • mdbf
  • DreamBathrooms
  • ngwrru68w68
  • megavids
  • magazineikmin
  • InstantRegret
  • normalnudes
  • tacticalgear
  • cubers
  • ethstaker
  • modclub
  • cisconetworking
  • Durango
  • provamag3
  • tester
  • Leos
  • JUstTest
  • All magazines
    •