Proton used to let you buy an account with Bitcoin. Then they started requiring a credit card number or an outside email/phone.
It was clear to me that the perception of security replaced privacy.
I'm not sure what I need Proton for that needs my banking information tied to it.
The article is actually reassuring that I didn't misperceive what was going on.
This immediately came to mind:
So the ransomware must have demanded a certain amount. But if he pays the ransom and keeps a hefty profit, that means the ransom amount is much smaller than what he charges. Why would the victim pay that amount?
Pinhasi pays the ransom out of his own pocket and gets the key.
He tells the victim he used his propriety technology to decrypt the files and sends a bill.
Pinhasi is telling a fib, which is OK in the US. That is, it's OK unless money changes hands, and then it's wrong, because that's how we roll here.
It's not illegal to pay off a ransom for your data. It should be, but it isn't.
It depends.
It is illegal if the ransom is being paid to an entity that is sanctioned or in a sanctioned country such as Russia, Iran, North Korea, etc.
It does not matter that the payer didn't know the ransom is coming from a sanctioned country, the payer is breaking the law.
Here's a source for checkng present sanctions. https://ofac.treasury.gov/
"The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced that paying ransom to cybercriminals is now illegal. In an official advisory, the agency stated that organizations that facilitate ransomware payments to hackers on behalf of ransomware victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, are violating OFAC regulations."
And a cyber crime advisory.
https://ofac.treasury.gov/medi...
It's also illegal to use a third party to facilitate payments to sanctioned entities, or to be the third party.
But it appears to be Ok to pay if you know the ransom is being done by a fellow American or, I suppose, a European. Except for this week, Norwegians.
I've only been paying attention since 1990 but every single time a feature they don't offer "is stupid" until they offer it.
Even when I liked the company this Cluster B behavior always bothered me.
If there's an example of "that's a really nice feature our competitor has but we don't offer it yet" I haven't seen it.
The closest I can think of was offering WebObjects for Solaris. Not sure if that ever shipped or we just had a beta. I bailed from that Healthcare IT team when the CIO pulled funding for two-phase commit among disparate patient medication systems with the rationale "even if medication errors kill someone it'll be cheaper to settle the lawsuits than pay for the license." Enough people left that they outsourced and everybody still hates that replacement system.
I learned too late that MBA's don't care about quality.
> everything you do has fucked the consumers
Say more
Let them do their thing.
I remember in High School the Camaro guys couldn't stop talking about how their Camaros were better than Mustangs but the Mustang guys never felt the need to denigrate the Camaros.
It's a matter of nature.
unrelated: Tailscale is so fooked today:
https://www.bleepingcomputer.c...
Some people here may need to panic right about now.
The right way to do this is to hire a group of developers and have test volunteers report workflow problems - then FIX them - then iterate. That's the point of choosing an open source solution.
Eventually there would be no problems remaining.
But so many possible scenarios exist that it's impossible to guess what happened here.
PS _NSA_KEY
There are apparently other unpatched vulnerabilities that are known but 'too busy':
It sounds like this fix got done because it was 'accidentally' posted as a public PR.
Yeah, the threat actor would need a foothold on the PXE network, which is a private VLAN (or better) in the competent case.
That's why we worry about APT's and such.
Granted, you'll find people on certain cloud providers who do far too much on a public IP.
What if someone has fifty windows open with fifty tabs each?
Asking for a friend.
Solid effort - good job.
It's a bummer if any of the employees got rug-pulled but many of the best employees will strike out on their own, form new companies with working conditions they value, and likely hasten Skydance's demise.
nah, a RS code can correct a tiny bit of loss but two metadata copies can correct a bad sector or even track if you're lucky.
Different requirement spaces.
The idea this guy has might make embedded devices slightly more long-lasting.
They usually have quantity one of a cheap storage part and a bad block in the wrong place could brick the whole thing.
It would only be useful in the case where maybe the build is 12MB and the chip is 16.
Most vendors won't ever pay extra for this.
I suspect the people who hate it don't have problems it solves.
Maybe a very basic home laptop is fine with SysV today and they don't want to learn anything new.
Personally I've been able to retire thousands of lines of scripts I'd written to handle complex things with many edge cases and ugly devops modules that are no longer needed with more recent releases.
There's just no userland interface to many of the events it can respond to and it's not easy to write a new C++ daemon to handle each need that comes up.
At this point it's largely a functional API to kernel events in the way I use it. That's the DOTADIW perspective for me. I still have services call my scripts where it doesn't handle what I need. It would be crazy to ever expect it to handle everything.
But just because I need to handle complex things at scale sometimes doesn't mean everybody else does. If I want to run debian with X11 and emacs and you want to run Devuan with Wayland and vi, you'll get no argument from me.
Who has time for drama these days?
"It ain't so much the things we don't know that get us in trouble. It's the things we know that ain't so." -- Artemus Ward aka Charles Farrar Brown
