• 0 Posts
  • 17 Comments
Joined 1 year ago
cake
Cake day: June 5th, 2025

help-circle







  • i used to work for a company with sensitive data. disks that did get a certificate, where wiped by our guys first. then a truck from the recycling/destruction company would arrive and disks get shredded 1 at a time. the whole setup was in a way, that you could observe the disks being torn into pieces, somewhat bigger than sawdust.

    two of our IT guys, two of the guys doing the destroying and some C-Suit would have to sign for every disk they observed being torn to pieces. if you do want to make sure your data is gone, there are ways to do it. admittedly, this way is a bit of a stunt. but it was fun being paid for observing bits of metal being reduced to pieces.


  • most people can get behind parental control. that is why bad actors are pushing for age verification everywhere nowadays.

    i think the issue many people have with that field is, that it enables bad actors to do things. all the while, it does not really do the thing it is supposed to do: if i trust my kid with sudo, the field can easily be altered. if i do not trust my kid with sudo, it cannot install anything either way.

    with your last paragraph i (and probably most people) agree. but we already have those tools, right? at least until i knew computers better than my parents, there was no way i could install anything without them being OK with it. even when i was admin on my very own desktop, i was heavily reliant on the parents for everything costing money. yes, even my dumb ass figured out how to pirate stuff. but to do that while being afraid to brick your precious device with some virus - you need some tech literacy, which is for sure beyond changing one value.


  • who and what is your threat model? as @macros@feddit.org pointed out this article was probably rather accurate.

    if you just want to browse anonymously - it is likely, that even the biggest tech corpos can’t de-anonymise you.

    if you do small time crime, like buying and selling contraband - likely law enforcement would try to catch you in the real world. you have more vertices and vulnerabilities there, different enforcement agencies are experienced exploiting these.

    if you paint a big ass target on your back and get the interest of the CIA or similar - you are probably fucked one way or the other. they may have the ability to de-anonymise you. but if you listen to people that did get caught or do the catching (e.g: darknet diaries), most of the times it is a small mistake. if you only ever play defence, that is enough to loose the game. but what are your options if your adversary is a national agency?








  • I have to write so much boilerplate code to make sure my objects are of the correct type and have the required attributes!

    That is the trap that, sadly, my company fell for too. The POC was written in python. very fast i might add. but it was only that: a POC. if the whole backend crashes due to unexpected user input - noone cared. if the frontend displayed gibberish because the JSON made wrong assumptions about not defined data types - sweep it under the rug, don’t do that during presentations.

    but if it came to building a resilient system, which can be shipped to customers and preferably maintained by them (with minimal consulting contract for access to our guys)… we cursed the way python worked.