• 0 Posts
  • 22 Comments
Joined 1 year ago
cake
Cake day: June 5th, 2023

help-circle



  • ironsoap@lemmy.onetoNews@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    31
    ·
    8 days ago

    Telling who aided with the brief.

    • Idaho, Alaska, Wyoming and the Arizona Legislature. Iowa, which spearheaded a brief signed by attorneys general from Alabama, Arkansas, Mississippi, Nebraska, North Dakota, South Carolina, South Dakota and Texas.
    • Utah’s entire Congressional delegation, which includes Sens. Mitt Romney and Mike Lee, and Reps. Blake Moore, Celeste Maloy, John Curtis and Burgess Owens, all Republicans. Wyoming GOP Rep. Harriet Hageman also signed onto the brief.
    • The Utah Legislature.
    • The Wyoming Legislature.
    • The Utah Association of Counties.
    • The American Lands Council, a nonprofit organization based in Utah that advocates for access to public lands.
    • The Sutherland Institute, a Utah-based conservative think tank.
    • The Utah Public Lands Council, Utah Wool Growers Association, Utah Farm Bureau Federation, and county farm bureaus from Beaver, Garfield, Iron, Kane, Piute, Sanpete, Sevier, Uintah and Washington counties.
    • The Pacific Legal Foundation, a nonprofit law firm.
    • A coalition of counties in Arizona and New Mexico, the New Mexico Federal Lands Council and New Mexico Farm and Livestock Bureau.

  • If approved, it will affect all Safari certificates, which follows a similar push by Google, that plans to reduce the max-validity period on Chrome for these digital trust files down to 90 days.

    Max lifespans of certs have been gradually decreasing over the years in an ongoing effort to boost internet security. Prior to 2011, they could last up to about eight years. As of 2020, it’s about 13 months.

    Apple’s proposal would shorten the max certificate lifespan to 200 days after September 2025, then down to 100 days a year later and 45 days after April 2027. The ballot measure also reduces domain control validation (DCV), phasing that down to 10 days after September 2027.

    And while it’s generally agreed that shorter lifespans improve internet security overall — longer certificate terms mean criminals have more time to exploit vulnerabilities and old website certificates — the burden of managing these expired certs will fall squarely on the shoulders of systems administrators.

    Over the past couple of days, these unsung heroes who keep the internet up and running flocked to Reddit to bemoan their soon-to-be increasing workload. As one noted, while the proposal “may not pass the CABF ballot, but then Google or Apple will just make it policy anyway…”

    However, as another sysadmin pointed out, automation isn’t always the answer. “I’ve got network appliances that require SSL certs and can’t be automated,” they wrote. “Some of them work with systems that only support public CAs.”

    Another added: “This is somewhat nightmarish. I have about 20 appliance like services that have no support for automation. Almost everything in my environment is automated to the extent that is practical. SSL renewal is the lone achilles heel that I have to deal with once every 365 days.”

    Until next year, anyway.





  • While I agree, I have a hard time seeing how people will stop using it until the field changes. Maybe in 10 years it will the the MySpace of the sitcom era, but right now it’s still growing. That growth is giving it carte blanche to manipulate the users as it sees fit. Regulation might impact it, but it’s still a bit of a Goliath.

    • Compared to 2023, YouTube’s user base has grown by 20 million this year, representing a 0.74% increase. From Global media insights

    Also the active user base is 2.7 billion people in 2024 from the same source above.

    The alternatives are out there, but just not in the same league.





  • If this request worked, it meant that I could use an “encryptedValue” parameter in the API that didn’t have to have a matching account ID.

    I sent the request and saw the exact same HTTP response as above! This confirmed that we didn’t need any extra parameters, we could just query any hardware device arbitrarily by just knowing the MAC address (something that we could retrieve by querying a customer by name, fetching their account UUID, then fetching all of their connected devices via their UUID). We now had essentially a full kill chain.

    I formed the following HTTP request to update my own device MAC addresses SSID as a proof of concept to update my own hardware:

    Did it work? It had only given me a blank 200 OK response. I tried re-sending the HTTP request, but the request timed out. My network was offline. The update request must’ve reset my device.

    About 5 minutes later, my network rebooted. The SSID name had been updated to “Curry”. I could write and read from anyone’s device using this exploit.

    This demonstrated that the API calls to update the device configuration worked. This meant that an attacker could’ve accessed this API to overwrite configuration settings, access the router, and execute commands on the device. At this point, we had a similar set of permissions as the ISP tech support and could’ve used this access to exploit any of the millions of Cox devices that were accessible through these APIs.

    Blows me a away that an unauthenticated API with sensitive controls and data was publicly facing. Corporations these days want all your data but wonder why some customers are worry about how it is protected, it let alone if it’s being sold. Why should I allow you to control my hardware when you can’t protect yourself.




  • Five shareholder proposals With three management proposals, the shareholder proposals are numbered 4 to 8 inclusive.

    4: Employment protection for opinions differing from Apple policy This argues that Apple doesn’t promise not to discriminate against applicants and employees on the basis of “viewpoint” and “ideology.” The proposal expressed a concern that those with conservative views are disadvantaged.

    Apple responds by stating it has a commitment to “a culture where every great idea can be heard and where everyone belongs, including those with differing viewpoints and ideologies.” It says that the company’s existing policies and practices already address this concern.

    5: Report on the company’s removal of religious apps in China Another proposal demands a report into the company’s removal of religious apps from its Chinese app store, and threatened removal of the social network X.

    Apple says that it already offers transparency on this issue, and must comply with the laws of each of the jurisdictions in which it operates.

    6: Report on unadjusted pay gaps for women and minorities Apple currently reports on weighted pay gaps between men and women, and between minorities and non-minorities. This reporting adjusts for factors like time spent out of the workplace for things like childcare. The proposal calls on Apple to also report on unadjusted pay gaps, in order to make visible “structural bias” in pay differentials.

    The company responds that it believes its own reporting provides “more meaningful” data, and that Apple achieved gender pay equity globally by 2017, and full pay equity “at the intersections of gender and race and ethnicity” in the US by 2022.

    7: Prepare a transparency report on Apple’s use of AI The proposal asks that Apple disclose its use of AI, as well as any ethical guidelines it has adopted to govern such use.

    Apple asked the SEC for permission to exclude this proposal, on the basis that it would risk disclosing commercially-sensitive information about the company’s plans. The SEC denied this, and the company now asks shareholders to vote against it for the same reason.

    8: Report on human rights policies The proposal points to “inconsistent” application of Apple’s stated values when it comes to complying with legal demands in China to remove apps and adopt other policies, like introducing a timeout for AirDrop. It calls for the company to issue a report on this.

    Apple says that it already does so.





  • Economical perhaps, but this is the sort of stupid ass shit that epitomizes how fucked the growth based economy is in this climate changed era. Developer’s think a few years down the road, but have no economic incentive to build it as a cradle-to-cradle build rather than a cradle-to-grave build.

    Build the same damn curtain wall floor plans in a dozen cities, so they all look ugly and don’t improve the quality of life, because it’s cheap, makes short term money for people who already have more then they can spend, and leave it to the kids to deal with everything in the future… Grrrr {rant off}

    Sorry, bitter old fart chiming in.