By BY ANATOLY KURMANAEV from NYT World https://ift.tt/3xAlOaP
via IFTTT
Sunday, November 28, 2021
New top story on Hacker News: Ask HN: What's the best way to secure your workstation?
Ask HN: What's the best way to secure your workstation?
18 by bccdee | 14 comments on Hacker News.
Here's a very plausible threat: Some developer with a left-pad package, some dependency-of-a-dependency, injects malware into their library. A developer (who is broadly trustworthy) updates their package's dependencies without auditing them properly, and the malware ends up in a VSCode plugin that you use. You open VSCode, your system is infected. We know this sort of malware is making its way onto package repositories [1]. We know people are falling for these attacks. How do we protect ourselves against this family of threats? [1]: https://ift.tt/3eIvIio We could trust nothing beyond our base system and our browser, and refuse to use any code we don't fully audit, but this would be an impossibly austere way to live. I expect most of us, when pressed, would admit that we're trusting much more code than we would like to. The alternative is sandboxing, using a lightweight option like firejail (which I use) or a totalizing system like QubesOS. But these systems are awkward to use, and have their own drawbacks. What's the bar for reasonable security, in your opinion? How do you secure your workstation without living like a monk?
18 by bccdee | 14 comments on Hacker News.
Here's a very plausible threat: Some developer with a left-pad package, some dependency-of-a-dependency, injects malware into their library. A developer (who is broadly trustworthy) updates their package's dependencies without auditing them properly, and the malware ends up in a VSCode plugin that you use. You open VSCode, your system is infected. We know this sort of malware is making its way onto package repositories [1]. We know people are falling for these attacks. How do we protect ourselves against this family of threats? [1]: https://ift.tt/3eIvIio We could trust nothing beyond our base system and our browser, and refuse to use any code we don't fully audit, but this would be an impossibly austere way to live. I expect most of us, when pressed, would admit that we're trusting much more code than we would like to. The alternative is sandboxing, using a lightweight option like firejail (which I use) or a totalizing system like QubesOS. But these systems are awkward to use, and have their own drawbacks. What's the bar for reasonable security, in your opinion? How do you secure your workstation without living like a monk?
New top story on Hacker News: Ask HN: Jaded about the Internet?
Ask HN: Jaded about the Internet?
27 by legrande | 29 comments on Hacker News.
Are you jaded about The Internet? I've been online 20 years now and I feel like I've reached the pinnacle of what The Internet is about and have in a way reached the end of The Internet . I've seen just about everything you could want, and participated in many communities over the years, and I feel everything is just 'samey' now and follows the same pattern. It's hard for anything on The Internet to stand out and be unique (at least for me). YMMV on this. Now with Web3/NFTs/cryptocurrency people are building an abstraction layer on top of the web and want to decentralize all the things, which is good to see, but I want to see all that fleshed out properly before I dive into it and leverage it. This is the shiny thing I look forward to on the web, but it's still early days. Other than that, the web seems kinda boring lately. Are you jaded about the web too? I'd like to hear your thoughts!
27 by legrande | 29 comments on Hacker News.
Are you jaded about The Internet? I've been online 20 years now and I feel like I've reached the pinnacle of what The Internet is about and have in a way reached the end of The Internet . I've seen just about everything you could want, and participated in many communities over the years, and I feel everything is just 'samey' now and follows the same pattern. It's hard for anything on The Internet to stand out and be unique (at least for me). YMMV on this. Now with Web3/NFTs/cryptocurrency people are building an abstraction layer on top of the web and want to decentralize all the things, which is good to see, but I want to see all that fleshed out properly before I dive into it and leverage it. This is the shiny thing I look forward to on the web, but it's still early days. Other than that, the web seems kinda boring lately. Are you jaded about the web too? I'd like to hear your thoughts!