Posts by CoyoteDen

Dutch study finds teen cybercrime is mostly just a phase

It is also how you learn skills that will come in handy if you want a career in cybersecurity.

Remember, anything you do before you turn 18 (with a few exceptions) will not appear on a background check, and that is assuming you even get caught.

Fortytwo's decentralized AI has the answer to life, the universe, and everything

Re: AI@Home

Not necessarily. AI is locally expensive when you have a single large model and compute platform. This shouldn't be any more expensive for any one node than the distributed efforts you did years ago. The total cost is spread out and people donate what they can.

It IS all about altruism. Giving people cryptocurrency for doing this is just going to attract the wrong kind of participant. You donate compute, and you donate your models and tuning. The open source community has been doing this with code, documentation, project management, etc.. for decades. Best part about it is no one org owns what comes out of it, everyone owns it.

This shouldn't be a silicon valley project, it should be a university one.

A single DNS race condition brought Amazon's cloud empire to its knees

But the real failure mode here is...

THE ACTIVE CONFIG COULD BE DELETED.

That should never happen.

The right way to do it would be to copy the active config, insert and delete on the copy, then once nobody is holding a lock on it you sanity check it. If there is nothing obvious (like it being completely empty!) you switch to it.

You also keep the previous config so you can quickly fail over if things crash.

TOCTOU strikes again.

From the postmortem:

"The check that was made at the start of the plan application process, which ensures that the plan is newer than the previously applied plan, was stale by this time due to the unusually high delays in Enactor processing."

time-of-check, time-of-use bug.

You can fix this in one of two ways: Either check immediately before every change to make sure something hasn't updated it behind your back, or put a lock on it at the start so nothing can.

Re: Maybe this issue reveals some design flaws

They are divided into regions. US-1-EAST is the only AWS region that went down, but there is a lot of stuff on US-1-EAST

Re: So, in summary,

Uh huh, I've seen similar things happen on a much smaller scale where I work, after cleaning up the mess I found the guy responsible on Teams and sent him

"it's called a lockfile, USE ONE."

Apple’s AirDrop makes weird latency spikes for Wi-Fi wonks, researcher finds

AWDL wakes up whenever Airdrop is a possibility to see what is nearby.

If you tcpdump the awdl0 interface on a Mac, you'll see periodic mdns advertisements from the local machine and other devices as soon as you pull up a share sheet that has the option to Airdrop on any device. You don't actually have to initiate Airdrop, this is how nearby devices show up as Airdrop targets.

If I turn BT off on my Mac, AWDL shuts down and I can see awdl0 leave the IPV6 multicast group. That interface stays absolutely silent even after turning BT back on... until something might want to Airdrop at which point it wakes up, joins the group, sends out mdns. If I let it sit long enough (about a minute) it will go silent again.

It seems AWDL's wifi component goes to sleep if not used until a BLE ping wakes it up. So if you're seeing wifi latency caused by AWDL taking over the radio, that could be due to other devices preparing to Airdrop, even if you don't actually do it.

Cops want Apple, Google to kill stolen phones remotely – so why won't they?

Re: apple does this already?

Activation lock, and you don't have to do anything special. As long as you have signed into iCloud, it's on by default and will prevent anyone else from activating that iOS/macOS device, even if they wipe it. if you to the DNS bypass thing, you can activate it can't ever sign into iCloud with your own account or it will lock down again.

This does not prevent stolen devices from being chop shopped, nor does IEMI lock.

Internet imbeciles, aka British ISP lobbyists, backtrack on dubbing Mozilla a villain for DNS-over-HTTPS support

Make your home network use DoT/DoH

I have an ASUS router running the AsusWrt-Merlin firmware. DoT/DoH support is baked in. My entire home network uses DNS-over-TLS, round-robined between 8.8.8.8, 1.1.1.1, 9.9.9.9, etc.. If I'm away my phone and laptop can OpenVPN tunnel all traffic back through it.

The router advertises itself as the DNS server, then uses stubby to forward queries over TLS/HTTPS to the servers.