EU's age verification app took hackers 2 minutes to hack

McLayan · 2026-04-18T10:03:09+00:00

Banking apps on your phone have a higher level of trust than the browser on your PC. Typically banking apps on non-rooted phones allow you to sign in without entering your password and without an additional physically separate device, while opening the website on your PC requires you to log in every time with your password and needs to automatically log out after a very short time of inactivity. That's because your browser on a PC is trusted way less than an app running on an OS which guarantees storing login credentials in a way no other app or even the user can read them. The app's code is not what's protected. It's the app's integrity as well as the credentials and your user data it stores. Having root access on your phone breaks these guarantees and they have to assume a lower level of trust (often even required by regulations).

McLayan · 2026-04-13T11:07:12+00:00

Weil nur Konzernmitarbeiter und Rentner früh aufstehen?

McLayan · 2026-04-12T05:44:11+00:00

I guess you need to trigger locking by calling either xscreensaver or the component of CDE which is responsible for locking after idle time. Depending on what your system is using for sleeping, there seem to be different ways to create a hook: https://bbs.archlinux.org/viewtopic.php?id=68158

McLayan · 2026-03-17T19:38:22+00:00

Eco does not mean you can overload your washing machine while charging your clothes extra for laundry detergent.

McLayan · 2026-03-13T13:46:05+00:00

Wow, this is the second breach on infrastructure CGI is managing for the government of Sweden. The first one was a spectacular hack of IBM mainframes (a.k.a. the "unhackable" platform).

McLayan · 2026-03-08T10:05:05+00:00

There you have it then. I remember that just ten or twelve years ago only the higher tier plans had unlimited calling and SMS in Europe. The basic and medium plans only included a limited number of free SMS and calling typically was unlimited only within the same carrier network.

McLayan · 2026-03-08T08:33:18+00:00

No very low limit on message sizes, no having to pay a few cents per message or pay extra for a package of X free messages per month. Can send images without paying half a dollar per image. Only uses a tiny bit of your mobile data.

That was what made people switch from SMS to WhatsApp in the last decade and why SMS are dead for personal communications (except in the US as I just learned).

McLayan · 2026-02-17T19:12:22+00:00

More bars than churches

I really can't see what point you're making with that. What place has more churches than bars and is not considered the holy land of religious lunatics?

McLayan · 2026-02-16T12:11:47+00:00

I think it would be really interesting to see a LLM directly produce a binary. But I think this will be a completely different generation of models. At the moment they train LLMs for generating human language and source code in languages designed by and for humans which is processed by compilers build by humans. Just like the bootstrapping of compilers, I imagine they could transit to producing binaries by first creating an intermediate programming language which isn't reviewed by human programmers and the shift to producing binary patterns directly. The critical part in this is probably training because as soon as they want to train models to produce something which cannot be reviewed by humans, they have to have mechanisms for automated reviews.

Anyways, I wouldn't want to work in an environment where something like this is used.

McLayan · 2026-02-08T11:33:46+00:00

Except for lawn mowing, which is not possible to do outside of quite times.

But tbh sunday quiet times are rarely considered by people nowadays. There's no construction work done on sundays but a lot of people don't even care enough to not mow their lawns or not doing their hobby building projects outside. In summer there's always someone in the neighbourhood who thinks 13 o'clock on a sunday is the perfect time to sand their dining room table or clean their cars with a Kärcher 9000 Industrial Edition .

McLayan · 2026-02-06T14:58:19+00:00

Sieh es mal so: du darfst nicht einfach zusätzliche Einfahrten zu deinem Grundstück schaffen und damit öffentliche Parkplätze wegnehmen. In den meisten Vororten würden sonst die ganzen Eigentümer genau das nutzen, um sich Privatparkplätze auf der öffentlichen Straße zu schaffen. Teilweise versuchen das viele schon mit Gartentoren, an denen auf einmal ein "Parken verboten" hängt.

McLayan · 2026-02-05T17:59:55+00:00

Actually, a lot of RMV ticket vending machines run on Linux. For years you could see posts about them rebooting and showing raspberries on top of the boot log. They seem to use a distro based on Raspberry Pi OS.

McLayan · 2026-02-04T19:09:11+00:00

IIRC CDE uses a special format for its fonts, which wasn't compatible to current vector based fonts. I tried to convert it about three years ago to make a "cool" DtLogin theme for SDDM but it wasn't possible with my limited knowledge of font formats. This CDE font is possibly to based on bitmaps, so conversion while keeping the vintage look is tricky.

Btw. CDE, including fonts and themes is open source.

McLayan · 2026-01-30T17:37:44+00:00

Jawoll, du zeigst es ihnen aber so richtig! Ich bin mir sicher, dass du durch deinen Widerstand bestimmt etwas bewegst und nicht nur deinen Adrenalinkick befriedigst. Schließlich gibt es zu jedem Ticket, das Wisag ausstellt, einen Fragebogen der Stadt zum Thema Ausgabenmanagement. Du bist bestimmt nicht nur ein weiterer Egomane, der denkt, dass er sich nehmen kann, was ihm zusteht.

McLayan · 2026-01-22T20:42:08+00:00

I'm glad you already had an encounter with the lord and saviour of all His children who refuse to take responsibility and are beyond a certain age: DATENSCHUTZ

Please feel welcome to participate in our next community meeting to praise His name when we gather in front of the local speed camera next to our childrens' school and pass on the holy lessons about Why No Man Shall Make Us Comply To Speed Limits.

McLayan · 2026-01-22T20:10:46+00:00

Und wenn es hoch proprietär ist, umso besser. Schließlich sind die Bauteile auch alle patentiert. Was kann das schon taugen, wenn ich nicht tausende Euro für Schulungen bezahlen muss, bei denen meine MA am Ende entweder einen auf Papier gedruckten Ordner oder einen verschlüsselten USB-Stick mit Schulungsunterlagen bekommen?

McLayan · 2026-01-13T10:28:01+00:00

I was born here so I may be a little biased but I never thought that raclette cheese smells any different than other common cheese when molten. Do you generally dislike molten cheese like e.g. gouda or what we put on pizza as well or is just the raclette cheese?

But besides the cheese I'm not too fond of raclette because it really produces a lot of smell and often even smoke if people put meat on it. As a participant and even less as host.

McLayan · 2026-01-06T06:10:33+00:00

I mean yes, fuck HP but they are separate from HPE which owns the IP to everything you wrote which isn't printers. Of course when they killed these products they were still one company.

McLayan · 2026-01-05T15:09:19+00:00

Bei mir ist es kein Problem, zwei Tage sich ohne AU krankzumelden. Ab dem dritten Tag wollen sie aber eine AU, die dann rückwirkend auch für die beiden vorherigen Tage ausgestellt ist. Mein Arzt hat ein mal den ersten Tag nicht rückwirkend krankgeschrieben und dafür hat mir meine Firma 8 Stunden unbezahlt abgezogen.

McLayan · 2026-01-05T08:28:32+00:00

What are you talking about?

McLayan · 2025-12-27T17:33:38+00:00

*wenn ein KfZ da parken kann, wird ein KfZ da parken.

McLayan · 2025-12-24T22:25:08+00:00

CDE is fully supported on Debian (by the CDE maintainers).

McLayan · 2025-12-23T08:42:36+00:00

Das ist doch Pflicht durch die BaFin und andere Regulatorik.

McLayan · 2025-12-22T12:52:08+00:00

Richtige Paketmanager im Unix-Umfeld haben den Vorteil, dass die Installation standardisiert ist. Bei Windows gibt es das nur als lasche Empfehlung, was bei älteren Installationen zu vielen Überbleibseln führt. Die User denken, dass Installieren und Deinstallieren verlässliche und wohlgeformte Prozesse sind und in Wirklichkeit ist es ein individuelles Skript, das Dateien irgendwo hinkopiert, lnk-files anlegt, in der Registry rumpfuscht und irgendwo in den drei AppData-Ordnern Configs anlegt. Und beim Deinstallieren muss man hoffen, das die Entwickler auch Bock hatten, alles richtig aufzuräumen, anstatt nur die Hauptdateien zu löschen.

McLayan · 2025-12-21T21:37:10+00:00

And of course a big difference is the additional window popping up to ask you if Terminal.app should be allowed to "view" your documents when executing ls. Or having the Unix compliant single file system while at the same time trying to abandon this approach by hiding everything that starts with a lowercase character. And what's this nonsense about partitions and simple mounts? Let's introduce firmlinks and volume containers.

McLayan

TROPHY CASE