Why should most apps access anything except their own data?
If I save a document in LibreOffice Writer, and I want to preview it in Word Viewer or send it to someone in my mail user agent, what procedure would you recommend to grant Word Viewer or my mail user agent access to it?
Then what is for versioning of large non-textual files, such as large GIMP, Photoshop, or Audacity projects? Git isn't really built to handle big binaries. And what is for protecting your private Git repositories from unauthorized modification by ransomware?
I don't trust Wine as a sandbox, given that the entire file system is mounted by default under Z:. It's a bit easier to trust running untrusted executables in a separate user account.
If there's whitelists, there will have to be ways to put new applications on the whitelists.
Of course there is. An application's developer pays Microsoft a recurring fee for services that include reviewing each version of the application and hosting the application and its updates in Microsoft's repository.
In a big city with excellent public transit, there's really no need for a car.
What's "excellent public transit"? Is it better than once an hour, nothing at night, nothing at all on 58 days of the year, and nothing at all on Saturdays in outlying areas (source)?
And the word UNIX at this point is just a trademark
A trademark that represents a certification program. A "UNIX" system conforms to the Single UNIX Specification (that is, POSIX). I don't know if macOS does, but some versions of its predecessor (OS X) were certified as UNIX systems. iOS likely does not conform to POSIX because the system lacks a terminal and shell.
So I guess we're going to see yet another different network package management system in Linux soon?
Unless I'm grossly misunderstanding what you mean by "network package management system":
A package management system is an independent process in user space. The only Linux interfaces on which APT or DNF relies are the syscall interfaces, which were already subject to an additional permission.
SQRL and TOTP, the protocol used by Google Authenticator, both have their advantages.
SQRL works without rekeying
TOTP requires the user to look at the device, read a code, and retype it. SQRL allows the authentication request to be transmitted from the display of the friend's computer to the configured authenticator without needing to retype anything.
TOTP works with an offline authenticator
SQRL requires the authenticator app to have access to the Internet. The TOTP authenticator does not need to connect to the Internet during authentication; the device only needs to synchronize its time-of-day clock every so often. This is helpful for a Wi-Fi-only tablet or for a smartphone with limited or no cellular Internet data transfer allowance.
As described on the SQRL page, the procedure is as follows:
1. Install and configure the SQRL authenticator app on your smartphone or tablet. 2. Carry your smartphone or tablet near your friend's computer. 3. Connect your smartphone or tablet to the Internet. 4. Navigate to the SQRL login form on your friend's computer. 5. Open the SQRL authenticator app on your smartphone or tablet. 6. Inside the app, photograph the display of your friend's computer using the camera on your smartphone or tablet. 7. In seconds, your session is authenticated, and the login form disappears.
From swillden's reply: "Use a payphone, if you can find one." I don't see how that would work, as a payphone can't receive text messages, and Twitter can't verify a phone number through a voice call.
Once a prominent contributor takes a substantial stand against this additional permission, watch someone file issues to replace this contributor's contributions.
In 2017 it's no longer acceptable to have a single factor of authentication to a system, especially with the prevalence of TOTP and Hardware key, such as YubiKey.
Which is why I find reliance by Google and Twitter on SMS as the primary second factor, with TOTP and YubiKey relegated to backup second factors, to be unacceptable. What would you recommend for working around this unacceptable situation?
But have you figured out how to U2F key with Google or Twitter without first setting up mobile phone verification? Say I want to have U2F (such as YubiKey) as my primary second factor, with TOTP (such as Google Authenticator) as a backup. But services like Google and Twitter support these only as backup second factors, not primary second factors. If I try to set up one of those as a second factor on Google or Twitter, the site won't let me proceed past the mobile phone verification. I don't want to use a mobile phone as the second factor for two reasons:
Cost
U.S. pay-as-you-go carriers charge 10 cents per received text message, and services like Twitter automatically send the code as a text message to the associated mobile phone even if I have a non-SMS second factor set up.
SIM swap fraud
SMS authentication is vulnerable to social engineering in which the attacker compromises an account by arranging delivery of a replacement SIM to him.
You can set up https from your ISP DNS name. (If it has one) mine is $ip.$isp
I thought you needed to be able to set up TXT records in order to use the ACME DNS challenge. I doubt an ISP lets a residential subscriber edit the domain's TXT records.
ACME also has an HTTP challenge, but you need to forward a port for that. This in turn means you need your own IP address, as opposed to carrier-grade NAT, and ISPs in less IPv4-rich countries tend to put residential subscribers behind carrier-grade NAT unless they're paying substantially more per month for "home business" service that includes a static IP.
it amazes me they didn't produce an EVM-via-browser standard so you could use a USB EVM port to connect a credit card to your computer.
That means you'd have to buy a computer in order to use a card. Or would the smart card reader also have USB OTG, USB type C, and Lightning plugs for use with an iPhone, Android phone, iPad, or Android tablet?
Soft drink vending machines have a slot to insert bank notes (also called a "bill acceptor"). So do self checkout machines at the grocery store, change machines at the coin laundry, and fareboxes on the bus. But none of the petrol pumps I've seen has a bill acceptor.
Slashdot Mirror
Exactly. It exposes a GUI for mandatory access controls that were already there in the first place.
Why should most apps access anything except their own data?
If I save a document in LibreOffice Writer, and I want to preview it in Word Viewer or send it to someone in my mail user agent, what procedure would you recommend to grant Word Viewer or my mail user agent access to it?
git is for versioning
Then what is for versioning of large non-textual files, such as large GIMP, Photoshop, or Audacity projects? Git isn't really built to handle big binaries. And what is for protecting your private Git repositories from unauthorized modification by ransomware?
I don't trust Wine as a sandbox, given that the entire file system is mounted by default under Z:. It's a bit easier to trust running untrusted executables in a separate user account.
If there's whitelists, there will have to be ways to put new applications on the whitelists.
Of course there is. An application's developer pays Microsoft a recurring fee for services that include reviewing each version of the application and hosting the application and its updates in Microsoft's repository.
(Source: Any article describing Windows 10 S)
If you can show up in some locality and by mere presence claim welfare, that doesn't work.
It can if the countries have a treaty in place to share the cost of a migrant's social insurance for the first few years after migration.
In a big city with excellent public transit, there's really no need for a car.
What's "excellent public transit"? Is it better than once an hour, nothing at night, nothing at all on 58 days of the year, and nothing at all on Saturdays in outlying areas (source)?
And the word UNIX at this point is just a trademark
A trademark that represents a certification program. A "UNIX" system conforms to the Single UNIX Specification (that is, POSIX). I don't know if macOS does, but some versions of its predecessor (OS X) were certified as UNIX systems. iOS likely does not conform to POSIX because the system lacks a terminal and shell.
So I guess we're going to see yet another different network package management system in Linux soon?
Unless I'm grossly misunderstanding what you mean by "network package management system":
A package management system is an independent process in user space. The only Linux interfaces on which APT or DNF relies are the syscall interfaces, which were already subject to an additional permission.
So no non-(console)-game, third party examples.
Tiny Wings is a game exclusive to iOS. It is third party, and not available for a Microsoft, Nintendo, or Sony video game console.
Penultimate is an iPad Pro-exclusive non-game third-party app from the makers of Evernote.
A Google search for apps "not on android" brought me "23 iPhone-only apps that will make your Android friends jealous" by Nathan McAlone and "20 iPad Apps That Will Make Your Android Friends Jealous" by Steven Tweedie.
SQRL and TOTP, the protocol used by Google Authenticator, both have their advantages.
SQRL works without rekeying TOTP requires the user to look at the device, read a code, and retype it. SQRL allows the authentication request to be transmitted from the display of the friend's computer to the configured authenticator without needing to retype anything. TOTP works with an offline authenticator SQRL requires the authenticator app to have access to the Internet. The TOTP authenticator does not need to connect to the Internet during authentication; the device only needs to synchronize its time-of-day clock every so often. This is helpful for a Wi-Fi-only tablet or for a smartphone with limited or no cellular Internet data transfer allowance.As described on the SQRL page, the procedure is as follows:
1. Install and configure the SQRL authenticator app on your smartphone or tablet.
2. Carry your smartphone or tablet near your friend's computer.
3. Connect your smartphone or tablet to the Internet.
4. Navigate to the SQRL login form on your friend's computer.
5. Open the SQRL authenticator app on your smartphone or tablet.
6. Inside the app, photograph the display of your friend's computer using the camera on your smartphone or tablet.
7. In seconds, your session is authenticated, and the login form disappears.
From swillden's reply: "Use a payphone, if you can find one." I don't see how that would work, as a payphone can't receive text messages, and Twitter can't verify a phone number through a voice call.
[YubiKey] is what I use for Google/Gmail, Facebook, Github
How does that work?
As far as I can tell, U2F on GitHub is incompatible with Mozilla Firefox, incompatible with Edge, and incompatible with Safari. I'm not even sure it works with other Chromium forks, as the page mentions Chrome. In addition, you need to buy a supported smartphone or tablet first because U2F requires working TOTP, and you still need to generate a password for use when pushing.
Once a prominent contributor takes a substantial stand against this additional permission, watch someone file issues to replace this contributor's contributions.
[Pandering to infringers of copyright in GPL works] is like Obama's executive-order immigration amnesty that should be unconstitutional.
If a child is kidnapped by his own parents and smuggled by his parents into the United States, what recourse ought the child to have?
In 2017 it's no longer acceptable to have a single factor of authentication to a system, especially with the prevalence of TOTP and Hardware key, such as YubiKey.
Which is why I find reliance by Google and Twitter on SMS as the primary second factor, with TOTP and YubiKey relegated to backup second factors, to be unacceptable. What would you recommend for working around this unacceptable situation?
But have you figured out how to U2F key with Google or Twitter without first setting up mobile phone verification? Say I want to have U2F (such as YubiKey) as my primary second factor, with TOTP (such as Google Authenticator) as a backup. But services like Google and Twitter support these only as backup second factors, not primary second factors. If I try to set up one of those as a second factor on Google or Twitter, the site won't let me proceed past the mobile phone verification. I don't want to use a mobile phone as the second factor for two reasons:
Cost U.S. pay-as-you-go carriers charge 10 cents per received text message, and services like Twitter automatically send the code as a text message to the associated mobile phone even if I have a non-SMS second factor set up. SIM swap fraud SMS authentication is vulnerable to social engineering in which the attacker compromises an account by arranging delivery of a replacement SIM to him.They can, and have, walked into an establishment and forced everyone who used biometric fingerprints to unlock their phones to do so.
What's the difference between that and "enter your password while I look away"?
and nobody can log in from a different device
Easy. Associate each of your devices to your identity provider as you buy them.
After launching the iPad Pro [Tim Cook] asked, "Why would you buy a PC any more?"
When did he announce availability of Xcode on the iPad App Store?
Under Tim Cook it is doing nothing, and he could easily be replaced by a block of wood and you would see no impact on the company.
That's racist against Pinocchio, Tommy Timbertoes, and other wooden people. #triggered
You can set up https from your ISP DNS name. (If it has one) mine is $ip.$isp
I thought you needed to be able to set up TXT records in order to use the ACME DNS challenge. I doubt an ISP lets a residential subscriber edit the domain's TXT records.
ACME also has an HTTP challenge, but you need to forward a port for that. This in turn means you need your own IP address, as opposed to carrier-grade NAT, and ISPs in less IPv4-rich countries tend to put residential subscribers behind carrier-grade NAT unless they're paying substantially more per month for "home business" service that includes a static IP.
it amazes me they didn't produce an EVM-via-browser standard so you could use a USB EVM port to connect a credit card to your computer.
That means you'd have to buy a computer in order to use a card. Or would the smart card reader also have USB OTG, USB type C, and Lightning plugs for use with an iPhone, Android phone, iPad, or Android tablet?
European gas stations don't accept cash?
Soft drink vending machines have a slot to insert bank notes (also called a "bill acceptor"). So do self checkout machines at the grocery store, change machines at the coin laundry, and fareboxes on the bus. But none of the petrol pumps I've seen has a bill acceptor.
Visit http://example.com/ through cleartext HTTP first in order to trigger the captive portal redirect.