This is the World they themselves created by consistently supporting coeporate-controlled computing, in which they are just a guest on their own devices, so my sympathy is limited.
There have been plenty of warnings over the past 20 years that this scenario is unfolding, but people wilfully ignored that because "it just works" and "but what about my banking apps?!".
Maybe it's not appropriate to go Full Stallman on your colleagues, but have you challenged them to change their purchasing choices for the future?
Yes, if it puts the CEO or the company at jeopardy of blackmail or litigation.
As with security vetting interviews they don't necessarily care about the morality of the actions, just that they are wware and can prepare for the consequences.
There was a very simple choice the CEO could have made which would have avoided all this, anyway.
If you are the CEO of a publicly traded company you are essentially the property of the board. Not sure what’s hard to understand here. If you behave “non-robotically” in certain ways, you lose your job.
Shocking how many people think a board could do anything OTHER than firing him even for just what’s known today about fucking subordinates, never mind what the export control investigations find.
"you can be totally trustworthy in the realm of business, yet not in romance."
If you can't adhere to the terms of a voluntarily-entered personal contract with a person to whom you've promised utter faithfulness, why should I believe you'll be trustworthy with regard to some boring, impersonal business contracts?
It's perfectly possible to be trustworthy in one thing and not the other. If you can't trust a lion with your flock of sheep doesn't mean you can't trust it with a bunch of bananas.
"What if the airlines instead focused on delivering great service at a competitive price?"
Germania, IIRC, tried that in the late 90s, offering a flat fare for every seat.
They had to roll it back very quickly because their bookings dropped unsustainably - nobody wanted to pay a fair price for a seat, even if it was cheaper than they might realistically have had to pay under dynamic pricing.
All that potential customers fixated on was that the flat fares were more expensive than the few cheap loss-leader seats advertised on rival airlines.
"The market can remain irrational longer than you can remain solvent" etc etc
If you're using userspace software to decrypt the keys into memory then it's all just security theatre. Any sufficiently motivated actor, ot a comprised package in the software chain, can capture your private key in the clear. Especially if using ssh-agent that keeps it resident in memory 'for convenience'.
Proper HSM integration with SSH requires challenges signed by the HSM without the private key ever being emitted.
Just keep your SSH keys on disk, one per remote host, with a different encryption password for each target host. If you're worried about threats that can defeat that then they'll just come to your door and beat the passwords out of you.
Only because you clearly don't understand how it works. What's interesting is that you seem to understand half of it... or maybe you don't, and you just repeat stuff you don't understand either?
> If you're using userspace software to decrypt the keys into memory
That's exactly why you don't do it. A Yubikey or a secure enclave create the private key and emit the public key.
Largely, I believe, when phones crossed over from being basic communication devices to being smartphones, but retained their 'appliance' nature.
An entire generation thereby grew up with personal computing represented by vendor-controlled handheld appliances, and naturally regarded actual PCs in the same manner.
And their skills to manage a PC atrophied too, leading to a feedback loop.
I just don't want to have this ongoing relationship with my software vendor. When I buy an Apple computer, I don't want to have a relationship with Apple. I don't want to log in to iCloud. I don't want them deciding what software I can run and what I can't. I don't want them wagging their finger disapprovingly at me when I download and run something not "notarized" by them. I don't want them mediating my use of my own computer! When I buy a Windows PC it's even worse. Again, I don't want to log into a Microsoft account. I don't want them pushing other software on me via in-OS ads. I don't want to send telemetry back to them. I don't want them recording my screen and saving it god knows where for nebulous "features".
When I buy a table saw, I don't expect DeWalt to hang around my workshop telling me what I can and can't cut, watching and logging what wood I use and when I use it, what my finished product looks like, changing the features and buttons on the saw in the middle of the night. Why the fuck do we tolerate this from software??
It's gotten to the point that Linux is the only sensible option, and not all distributions! Some of them are letting telemetry and metrics and A/B testing creep in. And some third party Linux software is just as intrusive and demanding as commercial Windows/Mac software.
> I just don't want to have this ongoing relationship with my software vendor.
This is precisely it.
When I buy a screwdriver, I just want to use it when I need it. I don't want to have an account with Craftsman and give them any PII, etc. No, I just want to use the product I purchased.
It is really the same with any tech product. I bought it, I want to use it. I want zero contact with the manufacturer (even if I like them).
Then how is your Philips screwdriver going to send an alert to your phone when you insert it into a JIS screw? I mean just because you know the difference (Craftsman screwdriver engineers are shaking their heads) doesn't mean that the average Joe doing a household repair does! /s
You bought a Mac that comes with Apple things. Macs don’t ship without Apple things. You get them for Apple things. You entered into the relationship explicitly. What’s the gripe?
I don't think anything has changed in the world. I suspect that you, like I, and lots of other hackers, had a very different group of friends growing up, and you didn't realize how insular your community was. Now as an adult you're seeing kids who are outside that particular narrow friend group, and attributing the change to the kids, rather than your to wider perspective.
>asking if things are "allowed" or assuming things are illegal by default.
There are plenty on HN who are "old enough to know better" who do it anyway. The most evil know that's not how things work and do it as a performance to influence others.
In some Linux distros like Debian, everything is illegal/prohibited until you explicitly allow it and only comes with the bare minimum of software necessary to make the OS work. Contrast that to other distros like Ubuntu where everything comes preinstalled and is very permissive. These obviously target different audiences. Smart phones are targeting different audiences too. The power users annoyed by the dumb things the device does just means you're not the target audience and are just bonus buyers for their bottom line.
> In some Linux distros like Debian, everything is illegal/prohibited until you explicitly allow it
Bit of a nitpick, but this is certainly not true of their userspace, where an `npm install` can just install a keylogger or read your ssh keys, or do whatever it wants -- except for updating your video card driver.
I would hope that someone deliberately choosing to run a headless Debian install would be wise enough to not go around running `npm install` willy nilly. In my personal experience, I've never once needed an `npm install` in Debian environment. I've only ever used them in server environments and to be honest thinking about it, that was all pre-npm when javascript was kept where it belonged in your browser and not my server. Someone screwed us all allowing JS on the server, but that's an entirely different conversation.
Well, it's enough to use a trusted app as your own user on non-trusted data. The former just has to have a memory vulnerability, which is not rare given most of it is C.
So yeah, don't be so confident in it working out. Unfortunately gnu/linux desktop is severally lacking in security (and by desktop I mean a headless personal use as well)
I used to run npm install unsupervised from a script on headless Debian that I deliberately chose dozens of times everyday. Later I moved my CI to Alpine.
As much as a sibling comment gets it right, this is wrong:
> And their skills to manage a PC atrophied too, leading to a feedback loop.
They never built those skills. I know that a lot of us cheered the computer revolution, thinking that everyone born after would understand the things that older generations didn't get, but most didn't care and didn't learn.
I don't think you understand how much faff is involved using the card reader for every single payment. Make multiple payments a day and that becomes incredibly time consuming and tedious. As I said, the app does away with this.
This is the World they themselves created by consistently supporting coeporate-controlled computing, in which they are just a guest on their own devices, so my sympathy is limited.
There have been plenty of warnings over the past 20 years that this scenario is unfolding, but people wilfully ignored that because "it just works" and "but what about my banking apps?!".
Maybe it's not appropriate to go Full Stallman on your colleagues, but have you challenged them to change their purchasing choices for the future?
reply