Forgot your password?
typodupeerror

Comment Re:The last thing I want from Meta. (Score 1) 51

just append '/?variant=following' to the url: https://www.instagram.com/?var...
it will do exactly what you are asking for. it's actually the only way i ever access ig.

it should work even on the phone. if you're using the app then ... just stop doing that. it's documented spyware (thus also a security concern) and user hostile crap sw anyway.

Comment Re:This is great. (Score 1) 71

i have to agree with that. browsers have become the universal interface and that makes a lot of sense for several reasons, but it does come with increased complexity and less transparency. maybe opt-in isn't enough and it would be wise to revisit a "less is more" approach. at present we're moving in the opposite direction.

Comment Re:This is great. (Score 1) 71

WebUSB is absolutely a concern. WebSerial is maybe especially of concern because serial devices generally don't have any security. They're usually very low level and a lot of them are survivors from decades ago.

fair enough, and thanks for the insight. on the bright side users of those devices will rarely be this sort of low-hanging fruit:

one of those people who used to get in trouble for clicking on every link in e-mails clicks on a permission popup and gets a keylogger installed on their keyboard.

we are indeed entertained!

And as I said elsewhere, somebody is absolutely going to have the bright idea to make their SCADA system web based.

why not? a browser is an excellent platform for that and the security considerations seem reasonable too. the problem i see is making it unnecessarily accessible. it should not be enabled by default. all else being equal just making it opt-in would dispell a lot of the (discrete) uncertainty commented here (both technical and perceived), and it would be no problem for anyone wanting to use it. i dunno why this isn't so, that seems to me just a sound principle for any feature that is or even could be problematic in any way whatosever, and is not in the interest of the average user. monkey no see monkey no do. tbh i don't really tinker with this stuff and was a bit surprised that the demo asked me straight away for a device and tried to work out of the box in my browser.

Comment Re:Furthermore Trump is the puppet of the Epstein (Score 0) 180

Every country has problems with the Epstein class. Some more than others.

not *every* country at all. iran, china and russia for instance don't. unless you count the times those reptiles trash putin, which is (i assume) the straws the bbc clasped at to say epstein was, wait for it ... a russian agent. but that was so ridiculous even for their indocrinated populus that even the bbc stopped running that hoax after a week. tragicomical to the extreme.

Comment Re:Misinformation (Score 0, Flamebait) 180

you're blurting out quite outdated propaganda, those fake news are so old that nobody cares anymore. those painstakingly smuggled in starlink terminals were in the end what blew those agitator cells' covers, they didn't live to explain it, and that regime change attempt failed and is now forgotten. in the meantime usrael started yet another military conflict to change the regime and got their ass royally kicked again. it's about nukes again. holy nukes. i mean, fucking update your script, don't you loosers have some pep talks program in your support group?

Comment Re:This is great. (Score 1) 71

Idiots never stop improving, but can we please educate them and not create more security vulnerabilities that will inevitably end up as front page news?
Oh, you meant nice things for you, damn be everyone else. My bad.

ftr, i've no use for this atm. and i understand the security implications. as do the folks at mozilla, i would expect. i just joked about some poster announcing imminent apocalypse, then got pestered about what a serial port is and is not, which is not even related to the main security concern ... go figure.

anyway, nobody is forcing you to use firefox if you want to completely escape this new serial doom. oh wait, chromium based browsers have been supporting this very same nice thing for years already ...

Comment Re:This is great. (Score 2) 71

They don't "identify as" serial devices. The are serial devices.

i don't see how this nitpicking is relevant.

which is why the browser asks the user for permission to acces all these devices

That's a strange way to admit you don't know how security vulnerabilities work. "There's no way someone could get in uninvited; there's a lock on the door!"

that's a disingenuous and dumb adhominem, really. locks exist for a reason. are they invulnerable? no. this is exactly how all security works in software and hardware: puting in locks, all sorts and layers of them. if you want absolute security just airgap your system, bury it in a bunker, hope it is deep enough underground and then for the best.

now, if you have valid criticism as to why you think that this api's implementration or design in particular are flawed or specially vulnerable, or that they somehow are disregarding security considerations, that would be interesting ... i personally haven't looked into the details. apparently it is https only, it enforces same-origin, it requires explicit user permission and activation, and it is revocable. what's missing?

Maybe? But adding a system where javascript can directly and explicitly interact with serial ports is definitely not going to make doing it any harder

what can i say ... people want to use stuff and do things, and security is a process meant to allow them to do that safely.

Comment Re:This is great. (Score 3, Insightful) 71

If by "decades" you mean to this very day.

what else :-?

A serial port is not the physical connector.

you're really splitting hairs, that's not what is meant. a serial port is very much the physical rs232 "connector" or an emulation of it. usb devices can ofc identify as serial devices and prompt the os to provide such emulation. so what?

That's *already* well within the realm of plausible exploits, even without the WebSerial API. This is just another surface to attack.

of course, which is why the browser asks the user for permission to acces all these devices! i do agree that 0.000001 more surface is technically "more surface", but this is splitting hairs, and doesn't help the claim I do love it when malware advert javascripts can upload random new firmware updates into my mouse and keyboard turning them into stealth keyloggers. they can already do that. but it sounds pretty indignant and dangerous which is likely why (as has been pointed out) it has been modded +5 insightful X'D. fine, the internets are very dangerous places, but can we please have nice things?

Comment Re:This is great. (Score 2) 71

in that sense so is every display monitor, but nowadays we use things like hdmi or displayport. this api is about ports that everyday hardware (like e.g. mice and keyboards) hasn't used for decades, and is only used in very specific gadgets or virtualized in tinkering gear sold for people who likes tinkering.

telling you this just so you know that you can safely keep surfing malware ads with your mouse and keyboard, this nasty devil's api will not hurt you.

Slashdot Top Deals

There is hardly a thing in the world that some man can not make a little worse and sell a little cheaper.

Working...