Posts by Dan 55

And if they do apply for a dev cert, they'd become responsible for everything in their repo. So just one fool would need to complain about homebrew distributing youtube-dl and Apple would revoke everything.

Re: From a developer perspective, it's going to be a very mixed bag.

And the first four words of the title are...?

Re: From a developer perspective, it's going to be a very mixed bag.

From a developer prospective it seems you'll need to generate ad-hoc signatures to run the code you compile on your own computer. So that's a no from me.

As of Catalina Gatekeeper will not allow you to run an unsigned downloaded binary package or downloaded old-style ELF binary and it's only possible to disable that check with the terminal.

Signed software is checked online with Apple's OSCP server but this seems completely unnecessary if there's also an XProtect check which is regularly updated and Apple can feed it a rescinded certificate (see recent HP printer driver story).

Grokking Gatekeeper in Catalina

Amiga UNIX (Amix) was a thing, although Commodore priced it too high. Sun wanted to resell the A3000UX and Commodore screwed up there too.

Linux and NetBSD have Amiga ports, NetBSD for the Amiga came out in the mid 90s.

Many UNIX programs could be ported to AmigaOS as just one more #ifdef in the list of #ifdefs.

If it had an Acorn, Apple, Commodore or Atari badge (i.e. the big players that we all remember and love) then it would run the OS that its manufacturer wrote for it, and no other. Well, no other unless you were prepared for significant jiggery-pokery.

IIRC all of them let you run e.g. some Unix variant and some had PC compatibility. The 8-bits before them let you run CP/M if they had a Z80 CPU. None of them made you jump through as many hoops as Apple does today.

Re: Windows has signed binariee

Play Protect will also scan sideloaded apps if you allow it (and also probably if you don't too, this is Google obvs).

Re: What about Google?

Valve makes it cheaper for smaller developers to sell on Steam and developers can generate as many keys as they like in Steam and give them away or sell them elsewhere and Valve doesn't get any cut of that.

Re: Won't budge from FF 68 on Android

They've added the missing functionality and support for more extensions since release. You may want to take another look. If they'd waited a few weeks before releasing they could have saved themselves a lot of grief.

Re: Time to end this nonsense.

Otherwise we'll be back to where we had an internet connection but no programs to download anything.

Who else remembers trumpet winsock and having to ftp from a command line to download a browser?

So, er, you had a program to download a browser. In Windows 95 it was FTP. In Windows 7 it was the browser ballot screen. And now in iOS it's the first-run process.

When an os is installed or upgraded it should just install the default apps for web browsing and email.

So it should uninstall any other browsers you've downloaded when you update the OS to a later version?

Finally this screen is shown or not depending on where you are. If they had any confidence in their own apps they would offer it to everyone.

Re: "why you’d want to text on a T9 keyboard is beyond us."

I was far more accurate with an on-screen T9 keyboard than a QWERTY keyboard. On a Nokia N8 both were available. On Android I haven't found one one with predictive text yet (which is kind of the point of a T9 keyboard).

Re: Why are the x86 Macs slow?

Terrible cooling design means the CPU never runs at full speed for very long. See the 2018 Macbook Pro for a recent example.

Re: Confusing much?

You can actually change the RAM in a 2018 Mini, no chance with this thing.

Also eGPUs on Thunderbolt are out too. Just waiting for the fanboys to tell me they were never really needed anyway.

Re: Non compatible with regulation

Patentable BS. They'd need my user id and password also. Those aren't on the phone.

Should have explained a bit more. They would use the call centre drone to get round the authentication factor. This can't be done with e.g. a card reader or security key or even an authentication app (clue: SIM swap or take the SIM out one phone, put it in another).

Now tell us what the call center drone *can* do?

In one call you can change your address. In other call you can get a new SIM sent out. If you think you're clever enough you can do both in one call.

Here's the FTC saying that SMS is not suitable if "you're concerned about SIM card swapping" and you should use an authentication app or a security key.

Re: Non compatible with regulation

If sending an SMS message for each transaction is insecure, how about sending one SMS message which effectively authorises all future transactions?

You would have to actually use the authenticator to authenticate so it doesn't authorise every future transaction. If the phone is lost or stolen the shared secret can be disabled meaning that the authenticator will no longer authenticate.

Re: Non compatible with regulation

Banks are dropping card readers and handwaving the "rich context and linkage" into SMS 2FA, so they've decided they can put up with the fraud.

Authenticator apps are probably less susceptible to fraud than SMS because there's no way someone can use SIM swapping to get control of them. With SMS 2FA, if someone wants to target you to empty your account the only thing between them and you is a call centre drone.

Re: Usability

You can encrypt and store your exported file with your other backups.

Your phone's storage is encrypted and has a PIN lock/fingerprint. If someone steals it they'd have to get past that and if they do you'd have problems anyway. If you're bothered about security you probably have some kind of find my phone/remote wipe set up.

On the other hand if I don't have a backup of my 2FA keys and have several accounts, and I lose my phone or it dies or something, it's fucking annoying trying to get back in control.

Part of security is availability.

Re: Or, indeed, an open source solution where you are in control.

It's installing an app from the app store, you either get one and use it or get another and use that. There's little to choose from between authenticator apps, there's no worthwhile support that MS can offer for their own app as it either works or it doesn't and if it doesn't then it's probably something else wrong on the phone anyway, the experience of authenticator apps is practically the same no matter which one you choose, the only difference is open source ones generally export to an open format.

But yes, we have the corporate mindset that is scared of something because it's not from MS. Presumably if something is not an albatross around your neck then it doesn't exist.

Re: Errrr

We're talking about the company selling the toaster, not the customer buying the toaster.

SMS wouldn't even be the cheapest option for the company either, there's the recurring cost of sending text messages.

So it's the least secure most expensive option. There's nothing to recommend it.

Re: Usability

FreeOTP+ allows export/import to/from a json file.

Re: Or, indeed, an open source solution where you are in control.

FreeOTP, FreeOTP+, andOTP, Aegis Authenticator... all on FDroid and have been updated recently.

Re: Errrr

If someone is going to implement MFA on their online service, what's the advantage in choosing the worst option out of all of them?

Re: OMG !

You can specify you want to use an alternative 2FA app, it's buried somewhere in your Office account settings.

Unless your BOFH has a policy which disables that of course.