Hacker Newsnew | past | comments | ask | show | jobs | submit | gordonfish's commentslogin

IP addresses aren't linked to a complete street address, and many times don't even show the right town, especially those on CG-NAT or a plain ol' direct public dynamic address. I have seen some IPs, like on AT&T and Comcast home Internet, showing a different state.

So in many cases, you don't need a VPN to prevent revealing your actual geographic location.


And some IPs stick to users for over a decade, and over time the data pieces add up and connect the dots.


I honestly don't understand why any game is even checking if secure boot is enabled.

If anything it's for the OS to care about that, not individual programs. Afaik, secure boot doesn't (on it's own) prevent the running of arbitrary software, so how is it actually preventing cheating?


It does mean that a signed OS image is running, so demonstrates that the kernel was unaltered at start-up.

It also demonstrates further levels of driver signing robustness.


I'm not really familiar with Secure Boot too much. Researching suggests that users can add their own keys so they are trusted by UEFI. Won't this resolve for linux users that must have secure boot on?


No, it's not a given that users can add their own keys - certainly in an anticheat scenario they probably couldn't, or at least if they did then key attestation would stop working.


It's usually a giant pia.

Some distros support it, some make it really difficult.

I like to distro hop. I'll often have to try two or three to get to a working system.


I've had no issues setting it up with Fedora and Ubuntu with kmods/Nvidia drivers. I just say I want it, and I have it. It's really easy now.


What I'm wondering is, why would any app need to actually prevent uninstallation (and thus violate a fundamental right of the user to control their device), when it seems what such app makers would want is to prevent closing the app / escaping to the home screen.

How many people actually decide to uninstall an alarm app as it's going off?


Presumably enough to make it worth Apple's while to implement the option under an umbrella entitlement over tools that may help support perhaps flagging self-discipline. Presumably too, it was worth the app dev's while to go through the effort and process of implementing the assertion. I have some mild doubts about the fundamental efficacy of such an approach, but its motivation seems clear enough.

For any more than that you're asking quite the wrong person, I'm afraid. For one, I don't intuitively understand the use case; the way this works for me is that I set my phone to play reveille when I need to wake up, and when it does, I do. That makes convenient use of some early training which is all well and good for me personally, but it leaves me little able to speak to the concerns of those for whom nothing so simple can serve.


Honestly, this is why firewalls exist. This really isn't problem for anyone with basic computer hygiene.


The prevalence of attitudes like this in the Linux community is why the year of the Linux desktop will never come.

Imagine if your brand new refrigerator, by default, would leak toxic refrigerant into your kitchen unless you adjusted a valve just so. This fact is not called out prominently in the manual, but if you read the fine print in the manufacturer's assembly instructions and have a working knowledge of how a refrigerator operates, you can maybe infer that this valve must be adjusted after purchase to prevent leakage. You go on their support forum to try to figure out why your brand new refrigerator is emitting toxic refrigerant, and you're essentially called an idiot and told you don't have "basic refrigerator hygiene."

People don't want to become refrigerator mechanics. They want cold food.


Why isn't the firewall on by default on desktop systems?


It is ? At least on Fedora Workstation for example, Firewall (controlled by firewalld) is installed and enabled by default.


Bear in mind that the default FedoraWorkstation firewalld policy does not protect TCP/UDP ports >= 1025.

Fortunately, in this case, cups-browsed uses port 631/udp :)


Because you don't need a firewall on a sensibly configured desktop computer.

If you have daemons that listen to incoming connections, you only want to run them if they are sane and secure.

A firewall makes sense when you don't trust the daemons in your lair, eh, network, and you don't have the possibility to replace insecure stuff with secure stuff. But a firewall must be maintained by experts.

For a single computer it is much easier: just make sure it is secure and don't add an extra layer of complexity to it.


That attitude was popular in the 90s but any definition of “sensibly configured” in this century involves a firewall.

The reason is that even experts make mistakes, get busy, or rely on assumptions which turn out to be incorrect. For example, you thought your service which uses strong authentication and encryption was safe to expose – and then Heartbleed or RegreSSHion happened. If you restricted ingress, you slept calmly. If you had it open, you had an emergency rush to patch and look for signs of compromise.


It is on Ubuntu last I checked.


I'm a little confused why this is even an issue. Persistent queues have been an option since the days of Windows 9x.

Maybe it's a Gnome problem. KDE let's me see what I had previously printed if I want to see it, or reprint something.

I also know many people in pre-press who make good use of that.


Windows 9x printing was every bit as bad as CUPS.


The point was about the retention of print jobs in queue, that it was a concept and option since the mid 90s.


> but cups-browsed has to listen on the network to do its job (network printer auto-discovery)

Isn't listening on 0.0.0.0 instead of localhost only needed if the machine itself is hosting a printer that needs to be accessible to other hosts?


I am very unfamiliar with the protocol, but my impression from a little reading is that the sharing computer broadcasts and the receiver listens. This appears to be for some CUPS specific browsing/discovery protocol rather than mDNS/DNS-SD (cups-browsed supports adding printers discovered that way but depends on avahi to handle the mDNS part).

EDIT: Here's a description of the protocol in question: https://opensource.apple.com/source/cups/cups-327/cups/doc/h...


No, per the article, cups-browsed is used so that a printer can register itself to your system. The printer is the one that initiates a connection to tell your system that it is available at some URL.


This is why on public servers I block everything inbound and only allow specific needed services through.


Why does that require so many days? Banking is all digital, yet it is still being treated like it's the 1950s.


Well, the good news is that the Fed recently rolled out the first phase of a replacement ACH system (FedNow) that does instant transfers.

The bad news is that it will be decades before most major payment systems move to it.

I haven’t worked in fintech long enough to tell you why it was modeled to take so long, but I would hazard a guess that it’s because the primary method of moving money was paper checks and physical card impressions until the last couple decades.


> I think the government should refund the airlines the government taxes/fees for canceled/delayed flights due to weather or mechanical issues at least.

It's my understanding that taxes aren't collected until well after the flight (service) has been fulfilled, and cannot be collected when it has not.


Since you mentioned Safari, I assume that you're on MacOS where Firefox and other alternative browsers are effectively hindered at the framework/API level there, as such browsers have problems there that don't occur Linux or Windows.

For example, the audio in FF outside of Apple sounds real clear and overall great in my experience.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: