• 3 Posts
  • 373 Comments
Joined 1 year ago
cake
Cake day: August 4th, 2023

help-circle

  • Not really saying otherwise. What I am saying is that for your electronic devices to have “explosives” in them would require that a supplychain attack of a similar sort.

    It’s almost definitely not the case that any electronics manufacturers are systematically putting explosives in every smartphone or whatever that they manufacture and supplychain attacks are much more likely to be a targeted thing rather than “all Samsung phones” or whatever. If they weren’t targeted, it’s pretty certain that the presence of explosives in devices would be noticed even just by regular end-users with a bit of a tinkering proclivity within weeks. So if your devices are more than a couple of months old have been in reasonably normal use for most of that time and you haven’t been specifically targeted by any particular government or anyone who might have the ability to tamper with the supplychain, you’re almost certainly safe specifically from explosive-laced consumer electronics devices.

    Also, it seems unlikely that a state police agency (like the “sheriffs” you’re talking about) could leverage enough power to compel an electronics company to allow such a thing without the FBI or DHS involved. I’d imagine state police folks would more likely resort to more low-tech approaches like the Tulsa race massacre air firebombing.

    Again, I’m not saying it’s impossible that your phone contains explosives. And as I said in another comment, it might be possible to remotely get a device to cause its battery to catch fire. Maybe.

    Also, I am in the U.S., but what made you think that was the case?


  • Wow. Jeez. I’m sorry this is so close to you.

    can they do that to phones, without the phones being rigged?

    I’m not any kind of expert. But as others in this post have said, theoretically… possibly technically yes. If the firmware can be modified remotely to cause the phone to allow, for instance, overcharging the battery, then it’s possible the phone could be made to explode without physical access to the phone.

    How likely it is that you or your family specifically would be targeted, I couldn’t say. It seems unlikely…? And we don’t have specific knowledge that Isreal has tried any such attacks that didn’t involve direct physical access to the devices which later exploded. (And also no indication they’ve targeted any Samsung devices.)

    Again, I’m no expert, but if you wanted to take precautions, I’m thinking the precautions to take would be to put any mobile devices that contain rechargeable batteries and have wireless connectivity far away from your house and your family and stick to devices with no batteries (and preferably ones you’ve had for a “long time”) for a while.

    I’m sorry you’re in a situation where you’re having to weigh these risks. Again, it seems unlikely that you and your family could be in danger regarding ostensibly-stock Samsung phones that you’ve had for a while.

    Also, no condemnation is strong enough for this indiscriminate attack by Isreal on the people of Lebanon. Netanyahu must really be heartless to have authorized this. I hope this results in real pressure on Isreal to stop its indiscriminate terrorist acts.

    Good luck and stay safe.

    Edit: Hmm. Not sure why I’m getting downvoted so much. Maybe the downvoters think I’m making it sound more likely than is realistic that there’s a threat to Peepo specifically?


  • You should understand that what happened in Lebanon involved the government of Isreal physically modifying the pagers (and walkies) in question by adding explosives to them, turning them into remote-triggerable bombs.

    (The term “supplychain attack” has been used a lot to describe this attack. Isreal intercepted the order of pagers between when the order was placed and when the pagers were delivered. And either physically altered the pagers ordered or replaced them with altered/tampered-with pagers.)








  • No joke. I’m ashamed to say I have had to endure Weblogic in the past. God was that time a massive clusterfuck.

    The company I worked for decided to use two particular separate products (frameworks, specifically; ATG and Endeca, even more specifically) to use in tandem in a rewrite of the company’s main e-commerce application. Between when we signed on the dotted line and when we actually started implementing things, Oracle acquired the companies behind both products in question.

    The company should have cut their losses, run away screaming, and started evaluating other options. That’s not what happened. Instead, they doubed-down and also adopted several other Oracle products (Weblogic and Oracle Linux on (shudder) Exalogic servers) because that’s, of course, what Oracle recommended to use with the two products in question. The company also contracted with Oracle-licensed “service integration” companies that made everything somehow even worse.

    And the e-commerce site rewrite absolutely crashed and burned in the most gloriously painful way possible. They ended up throwing away tens of millions of dollars and multiple years on it.

    When the e-commerce site rewrite did happen, it was many years later and used basically only FOSS technologies. I guess at least they learned their lesson. Until the upper management turns over again.




  • Do they play a part in commercial DDOS protection?

    Absolutely! As well as mitigating other types of threats. “Web Application Firewalls” (don’t be fooled, they’re not like regular firewalls really) are a type of transparent web proxy that watch requests for anything that “looks like” a SQL injection or XSS payload and block those requests if necessary. Transparent web proxies may also do things like caching or even “honeypot” functionality that may shunt likely bot traffic to a fake version of the website to prevent scraping of real site content.


  • Ooo. This is a good one.

    A computer can have more than one network interface, right? (Like, you can be plugged into ethernet at home but also connected to the WIFI of the coffee shop across the street.)

    A VPN gives you a whole new network device (“virtual ethernet card” if you will) that works as if that card was connected to some LAN somewhere else. Typically, you’d forward “all” of your computer’s/smartphone’s/etc traffic through the VPN so that your computer “thinks it’s on that remote LAN” rather than on your home WIFI or whatever.

    Proxies… well the term can mean a few different things in different contexts, really. But generally you’re not forwarding “all” traffic through them, just HTTP traffic (and usually only a subset of all HTTP traffic) or just traffic that is specifically told to be forwarded through them.

    An opaque web proxy is one that you can point your browser (or other HTTP interface) to. It won’t handle protocols other than HTTP. And when you want to use an opaque web proxy, your HTTP client has to know how to do that. (Whereas with VPN’s, it’s your operating system, not your individual applications, that need to know how to forward through it.)

    A transparent web proxy can be something you (and your apps and OS) don’t know you’re even using. When you point your browser or app to a Lemmy instance, it’s almost certain that the domain is pointed not at an application server that actually runs the Lemmy code, but rather at a transparent web proxy that does stuff on the instance-owner’s end like preventing spamming or whatever. This type of proxy is sometimes called a “reverse web proxy” and can also only work with HTTP.

    A SOCKS proxy, like an opaque web proxy, requires applications to know how to use it. (Ok, technically that’s not 100% true. It’s possible in some cases to have a transparent proxy of some sort forward through a SOCKS proxy in a way that the application doesn’t know SOCKS is involved. There are also some cool OS-level hacks that can force an app to go through a SOCKS proxy without the app knowing anything about SOCKS. But if you’re doing those things, you’re a hacker.) And with a SOCKS proxy, your computer doesn’t “think” it’s connected to a whole different LAN. Individual applications know that they’re forwarding through SOCKS. SOCKS supports more protocols than just HTTP. Probably all TCP-based protocols, but I don’t think it has any support for UDP. So you won’t be torrenting through SOCKS.

    That’s all I can think to say at the moment. There are special-purpose proxies for things like security auditing (like Burp Suite, for instance.) But I’m guessing that’s not the sort of thing you’re asking about.


  • I cannot think of any other methods

    Exactly. What you’re describing isn’t “AI.” It’s “magic.” And “AI” can’t do what OP wants either.

    No “AI” solution we have any reason to expect we’ll be able to create in anything approaching the foreseeable future is going to be able to do anything remotely like this without ridiculous amounts of false positives and/or false negatives.

    By false positives in this case, I mean things like not coming back from the cool little slideshows until a minute past the end of the commercial break or obscuring important details of the show having falsely “concluded” that it’s a logo or some such.

    And I would have assumed “without a lot of false positives” would have gone without saying. If OP is comfortable with lots of non-ad content blocked/obscured along with the ads, then I’ve got a 100% guaranteed zero-false-negatives solution that’ll fit OP’s requirements without involving a speck of “AI” anywhere that OP can implement right now: turn the TV off.


  • A pet pieve of mine is people randomly sticking the term “AI” into a description of some particular tech solution.

    You want ad blocking. (Which is based.) But you don’t want “AI”. If this can be done in a way that doesn’t qualify as “AI”, that would satisfy you, yes?

    And using the term “AI” that way makes it clear you haven’t really thought through what you really even want in that feature. (Not that there’s anything particularly wrong with that, especially in a showerthoughts community, but it’s still kindof a “slaps me in the face” kind of thing.)

    And the term “AI” is so imprecise anyway.

    And particular kinds of “AI” are such a bubble right now. And that’s why everybody is sticking the word “AI” into random contexts for no fucking reason. But it’s also just a gimmick at best and a huge scam at worst.

    And “AI” is inevitably bad about false positives and such.

    I’d really rather see the word “magic” than “AI” in this context. Because at least that admits that this is an idle wish and not something you think actual real-world adult humans should be seeking venture capital to attempt.

    I’m sorry for taking this out on you specifically. You’re definitely not the first person I’ve seen do this.