• 0 Posts
  • 21 Comments
Joined 3 years ago
cake
Cake day: October 5th, 2023

help-circle
  • If this is really as straightforward as it sounds then I’d consider this the best case scenario. Google could have gone full Apple style lockdown or even just have implemented this flow on a per app basis, but needing to wait 24hr one time to enable unverified app installation isn’t a bad idea from a security perspective. It prevents a bad actor with temporary access from being able to do much while not getting in the way of us power users after the initial 24hr period.

    My bigger problem is how Google is leveraging their monopoly to implement this single-handedly and only for themselves. If they had instead gone through AOSP this perhaps could have been implemented in a better way to allow other parties than just Google to be the verifier, and that 24hr waiting period could be applied to any verifier that is not the phone’s default. I’d argue this would be an equally reasonable security measure considering how many scams are out there preying on those who aren’t technologically savvy, yet would maintain transparency.



  • These attacks are more around the encryption and all require a fully malicious server. It sounds like Bitwarden is taking these seriously and personally I’d still strongly prefer it to any closed source solution where there could be many more unknown but undiscovered security concerns.

    Using a local solution is always most secure, but imo you should first ask yourself if you trust your own security practices and whether you have sufficient hardware redundancy to be actually better. I managed to lose the private key to some Bitcoin about a decade ago due to trying to be clever with encryption and local redundant copies.

    Further, with the prevalence of 2FA even if their server was somehow fully compromised as long as you use a different authenticator app than Bitwarden you’re not at major risk anyways. With how poorly the average person manages their password security this hurdle alone is likely enough to stop all but attacks targeted specifically at you as an individual.



  • This process pretty much summarizes why I’m scared to try changing companies lately. Presumably these measures are to make sure you’re not cheating with AI, but then if you get the job they expect you to use AI.

    I like in-person interviews most, they totally resolve the trust concerns. And to other engineers interviewing you using fewer MS products is typically viewed as a good thing. But getting to the in-person part is difficult in this market even if you’re willing to put up with all their spyware from what I hear.










  • I operate my hard drives totally external to my old PC’s case with a 3D printed holder keeping them together (with a little space between each drive for ventilation). It’s a little ugly, but it lives in a closet so I don’t really care how it looks. More importantly with my old Neatgear NAS I didn’t realize just how much speed I was missing out on. I guess with a modern Synology unit with a SSD cache you’ll likely get similar performance, but it’s so convenient to be able to run Docker containers and VMs on the same machine.



  • AI companies and investors are absolutely overhyping its capabilities, but if you haven’t tried it before I’d strongly recommend doing so. For simple bash scripts and Python it almost always gets something workable first try, genuinely saving time.

    AI LLMs are pretty terrible for nearly every other task I’ve tried. I suspect it’s because the same amount of quality training data just doesn’t exist for other fields.


  • Leaving ADB open to unverified apps is more than I was expecting. ADB is reasonably straightforward to use even without actually being an Android developer.

    There was never any way they’d integrate it to play protect and still allow play protect to be disabled. I prefer this to being required to use play protect personally, though the services do seem somewhat redundant. Presumably the whole point of doing this is to create an Apple style walled garden (which is of course very profitable). Google likely doesn’t want to fully lock it down and risk legal trouble, they just need to make it difficult enough that the masses don’t bother installing unapproved apps that may not act in Google’s interests.

    I still hope the EU takes legal action against this anyway.