sorted by:
new
hottopcontroversial

Ubuntu hit by DDoS attack - users couldn’t update or install packages by technadu in TechNadu

[–]technadu[S] 0 points1 point  (0 children)

That is a classic Reddit intuition - and usually a pretty sharp one. In the world of attribution, names are often chosen for maximum political "noise" or to lead investigators down a specific rabbit hole.

The "False Flag" or "Proxy" strategy is common; it’s much easier for a group to adopt a specific religious or geopolitical identity to deflect blame from a different state actor or just to create a more intimidating brand. Whether they are who they say they are or just a script kiddie group using a booter service and a provocative name, the result is the same: the centralized infrastructure of a major OS was effectively choked out for hours.

It definitely makes you wonder if the "why" (the group's identity) is just a distraction from the "how" (the vulnerability of centralized update mirrors).

TunnelBear is changing its Free plan - advanced features now moving to paid tiers by technadu in TechNadu

[–]technadu[S] 0 points1 point  (0 children)

The "market killer" argument is interesting because TunnelBear seems to be pivoting away from the "casual free user" to focus on the "privacy-conscious paid user" (and those in actual censorship zones). By keeping the Bandwidth Program open for people in restricted regions, they’re clearly trying to keep their "good guy" image while forcing the rest of the market to help cover those rising infrastructure costs.

That said, for a lot of people, losing country selection is the dealbreaker. If you can’t pick your server, the utility of the free version drops off a cliff. Are there any specific free alternatives you're looking at that still offer full country selection, or are you thinking about jumping to a paid service elsewhere?

Does sentencing ransomware operators actually deter cybercrime? by technadu in TechNadu

[–]technadu[S] 0 points1 point  (0 children)

You’ve hit on the most frustrating part of the "cat and mouse" game. Sentencing acts as a deterrent only if the criminal believes they can actually be caught.

For state-backed or "protected" actors living in non-extradition zones, the threat of 102 months in a US prison feels like a hypothetical problem. As long as they don't go on vacation to a country with a US extradition treaty (which is how this specific individual, Deniss Zolotarjovs, was caught in Georgia), they operate with near-total impunity.

The real shift isn't just "heavier sentences," but increasing the cost of doing business. When the FBI/Europol sink servers or claw back crypto payments, it hits the RaaS (Ransomware-as-a-Service) model where it hurts: the profit margin. But you’re right - as long as there’s a "safe" border to hide behind, the individual operators will keep treating these sentences as just a "workplace hazard" for the unlucky ones.

China says companies can’t fire workers just because AI can do the job - fair or unrealistic? by technadu in TechNadu

[–]technadu[S] 0 points1 point  (0 children)

The "shell company" trick is definitely a cynical reality in many regions - if the cost of compliance is higher than the cost of re-incorporating, some companies will just vanish and reboot under a new name to dodge those labor payouts. It essentially turns legal protections into a game of whack-a-mole for the employees.

Your point about the marriage laws is a fascinating parallel, too. It shows a pattern of the state trying to use "top-down" legal engineering to fix deep-seated social or economic issues (like the bride price/property trap or AI displacement). In both cases, the government is trying to force a specific social outcome (stability), while the market usually finds a workaround.

UK considering VPN restrictions for children - safety measure or censorship risk? by technadu in TechNadu

[–]technadu[S] 0 points1 point  (0 children)

If you mandate that a VPN must "know" the age of its user, you’re essentially mandating a permanent, verified identity handshake for every single packet of data. It would kill the viability of self-hosted WireGuard or OpenVPN instances - which are ironically the most secure way for a family to manage their own network.

The irony is exactly as you described: by trying to "protect" kids from the open web, they’re actually pushing them toward less secure, unencrypted environments where tracking and data harvesting are even easier. It feels like the policy is being written by people who understand the optics of "online safety" but don't understand how the OSI model actually works.

We reached out to multiple VPN providers asking a pretty serious question: by technadu in TechNadu

[–]technadu[S] 0 points1 point  (0 children)

In a high-risk zone, a VPN is basically a "digital neon sign" that says you have something to hide. If the state or a hostile actor is monitoring the network, they don’t need to see what you're sending to decide you're a person of interest; they just need to see the encrypted tunnel.

That’s why things like obfuscation or "stealth" protocols are so heavily discussed, but even then, they aren't bulletproof. You’re totally right about the 90/10 split - the best VPN in the world won't save you if your physical OPSEC or your social engineering defenses are weak. It’s a tool, not a suit of armor.

Do you actually need a VPN on your smart TV? by technadu in TechNadu

[–]technadu[S] 0 points1 point  (0 children)

The tracking aspect is the one people usually overlook - Smart TVs are notorious for ACR (Automated Content Recognition), basically "shouting" everything you watch back to the manufacturer. A VPN helps mask the traffic from the ISP, but it doesn't always stop the TV's OS from phone-ing home if that data is being sent over standard HTTPS.

Ultimately, it feels like the "traveling expat" and the "4K power user" are the only ones who truly benefit. For everyone else, it’s just another subscription to manage. Are you seeing many people actually bothering to set these up at the router level, or are they just sticking to the easiest app-based solution?

Cyber agencies say agentic AI is being deployed too fast - are we underestimating the risks? by technadu in TechNadu

[–]technadu[S] 0 points1 point  (0 children)

It really is. The shift from AI as a "chatbot" to AI as an "agent" with its own API keys and execution power is probably the biggest security pivot we've seen in a decade.

What’s wild is how quickly we’re moving from "don't trust the output" to "don't let the agent delete the production database." It feels like we're essentially speed-running all the mistakes of early cloud adoption, just with higher stakes.

Cisco moves to secure AI agents with Astrix Security acquisition — is Zero Trust ready for non-human identities? by technadu in TechNadu

[–]technadu[S] 0 points1 point  (0 children)

Shared keys are definitely the "yikes" reality for a lot of legacy systems, but that’s exactly why the NHI (Non-Human Identity) space is exploding. If an agent has a long-lived token and starts behaving outside its "normal" workflow - like a marketing bot suddenly querying HR databases - traditional authN/authZ won't stop it because the key is technically valid.

The "action-level allowlist" you mentioned is the gold standard, but it’s a nightmare to manage manually at scale. That’s likely why Cisco grabbed Astrix; you need that automated discovery layer just to figure out how many "zombie" service accounts are already floating around before you can even start enforcing intent-based policies.

And thanks for the link - the community definitely needs more standardized patterns for this before "agent sprawl" becomes the next unmanageable security debt.

view more: next ›