• 32 Posts
  • 532 Comments
Joined 9 months ago
cake
Cake day: October 4th, 2023

help-circle




  • and to remote in.

    This is the approach I use with laptops domestically, and I think that there’s something to be said for it. Like, the laptop itself doesn’t store important information. A remote server does. The laptop is just a thin client. If the laptop gets lost or stolen – which I’ve had happen – I revoke the credentials. No important information is lost, and no important information is exposed.

    Whole-disk laptop encryption has improved things too from an exposure standpoint (albeit not a loss standpoint), though I don’t use it myself (don’t want to spend any battery life on it). I assume that smartphones have some form of reasonably-secure storage hardware, but I don’t know if it involves encryption.

    What I found irritating – and this is years back now – was an employer who didn’t care if I took a laptop in or out or what information I stored on it (as long as it was a work system), but who refused to provide remote access to the network, so I couldn’t just keep the important information on the work network. I mean, I get if they want to have some sort of isolated DMZ and require an externally-accessible server to live there, not provide VPN access in to the general network, but not having the ability to have remote network access to work systems at all is just incredibly obnoxious.

    I think that some of it is that Windows is not phenomenal to use remotely. Yeah, there are solutions, but they aren’t great if you’re on a high-latency, low-reliability, or low-bandwidth link. I try to use console Linux for as much of my stuff as possible. That whole ecosystem was designed around thin-client, remote use.



  • The planning board’s decision was based on health concerns due to the possible negative environmental impact of telecommunication on the residents, especially the children studying at the school who could potentially be exposed to electromagnetic radiation. The town felt the residents would be ‘unsafe’ due to radio frequencies and rejected the company’s notion of building the tower on the land.

    I mean, I think that the planning board is idiotic, but I don’t see why T-Mobile cares enough to fight it. If they don’t build it, okay. It looks like the school in question is right in the middle of town. Then Wanaque is going to have crummy cell coverage. Let them have bad cell coverage and build a tower somewhere else. It’s not like this is the world’s only place that could use better cell coverage. The main people who benefit from the coverage are Wanaque residents. Sure, okay, there’s some secondary benefit to travelers, but if we get to the point that all the dead zones that travelers pass through out there are covered, then cell providers can go worry about places that are determined not to have have cell coverage.

    If I were cell companies, I’d just get together with the rest of the industry and start publishing a coverage score for cities for cell coverage. Put it online in some accessible database format, so that when places like city-data.com put up data on a city, they also show that the city has poor cell coverage and that would-be residents are aware of the fact.





  • I don’t really have a problem with this – I think that it’s rarely in a consumer’s interest to choose a locked phone. Buying a locked phone basically means that you’re getting a loan to pay for hardware that you pay back with a higher service price. But I’d point out that:

    • You can get unlocked phones and service now. I do. There are some privacy benefits to doing so – my cell provider doesn’t know who I am (though they could maybe infer it from usage patterns of their network and statistical analysis). It’s not a lack of unlocked service that’s at issue. To do this, Congress is basically arguing that the American consumer is just making a bad decision to purchase a plan-combined-with-a-locked-phone and forcing them not to do so.

    • Consumers will pay more for cell phones up front. That’s not necessarily a bad thing – it maybe makes the carrier market more competitive to not have a large portion of consumers locked to one provider. But there are also some benefits to having the carrier selecting cell phones that they offer in that the provider is probably in a better position to evaluate what phone manufacturers have on offer in terms of things like failure rates than do consumers.



  • If ISP routers are anything like the west that means they control the DNS servers and the ones on router cannot be changed, and likely it blocks 1.1.1.1 and 8.8.8.8 and so on, as Virgin Media does (along with blocking secure DNS) in the UK for example, which definitely opens up a massive attack vector for an ISP to spin up its own website with a verified cert and malware and have the DNS resolve to that when users try to access it to either download the software needed to access this Grid System or if it’s a web portal - the portal itself.

    Browser page integrity – if you’re using https – doesn’t rely on DNS responses.

    If I go to “foobar.com”, there has to be a valid cert for “foobar.com”. My ISP can’t get a valid cert for foobar.com unless it has a way to insert its own CA into my browser’s list of trusted CAs (which is what some business IT departments do so that they cans snoop on traffic, but an ISP probably won’t be able to do, since they don’t have access to your computer) or has access to a trusted CA’s key, as per above.

    They can make your browser go to the wrong IP address, but they can’t make that IP address present information over https that your browser believes to belong to a valid site.


  • I’d also add, on an unrelated note, that if the concern is bandwidth usage, which is what the article says, I don’t see why the ISP doesn’t just throttle users, based entirely on bandwidth usage. Like, sure, there are BitTorrent users that use colossal amounts of bandwidth, will cause problems for pricing based on overselling bandwidth, which is the norm for consumer broadband.

    But you don’t need to do some kind of expensive, risky, fragile, and probably liability-issue-inducing attack on BitTorrent if your concern is bandwidth usage. Just start throttling down bandwidth as usage rises, regardless of protocol. Nobody ever gets cut off, but if they’re using way above their share of bandwidth, they’re gonna have a slower connection. Hell, go offer to sell them a higher-bandwidth package. You don’t lose money, nobody is installing malware, you don’t have the problem come right back as soon as some new bandwidth-munching program shows up (YouTube?), etc.


  • I don’t really understand the attack vector the ISP is using, unless it’s exploiting some kind of flaw in higher-level software than BitTorrent itself.

    A torrent should be identified uniquely by a hash in a magnet URL.

    When a BitTorrent user obtains a hash, as long as it’s from an https webpage, the ISP shouldn’t be able to spoof the hash. You’d have to either get your own key added to a browser’s keystore or have access to one of the trusted CA’s keys for that.

    Once you have the hash, you should be able to find and validate the Merkle hash tree from the DHT. Unless you’ve broken SHA and can generate collisions – which an ISP isn’t going to – you shouldn’t be able to feed a user a bogus hash tree from the DHT.

    Once you have the hash tree, you shouldn’t be able to feed a user any complete chunks that are bogus unless you’ve broken the hash function in BitTorrent’s tree (which I think is also SHA). You can feed them up to one byte short of a chunk, try and sandbag a download, but once they get all the data, they should be able to reject a chunk that doesn’t hash to the expected value in the tree.

    I don’t see how you can reasonably attack the BitTorrent protocol, ISP or no, to try and inject malware. Maybe some higher level protocol or software package.