kristoff

joined 1 year ago
sorted by: new top controversial old
sport watch supported by Linux/FOSS software in c/linux@lemmy.ml
[–] kristoff@infosec.pub 1 points 2 weeks ago

interesting advice. Thanks!

sport watch supported by Linux/FOSS software in c/linux@lemmy.ml
[–] kristoff@infosec.pub 1 points 2 weeks ago* (last edited 2 weeks ago)

I do not see that as phone-usage, I'm doing an experiment to see how easy / difficult it is to revert the "i need to know the time, so I grab my phone" reflex back to "I need to know the time, so I look at my wrist".

I'm currently reading some books on how easy it is to manipulate peoples behaviour using 'nudging', this to better understand the social engineering tricks used by hackers.

An chapter in one of these books in how social media use tricks to manupale our behaviour that resemble the tricks used by the gambling industry.

One of the things I find intriging is the size of a smartphones today. If you look at it objectively, they are actually so large that most people would consider it to be annoyting: you have to carry it in a bag, in a pocket of your pants -but you have to take your phone out when you want sit-, or ..you carry it in your hands. Have you noticed how many people have their smartphone in their hand when they walk around? But, of course, if you have something in your hand, it is very easy to open it quickly check your notifications; which reinforces the addiction.

So, that's the thing. People do not find it annoying.

So .. as an experiment, I am trying out how easy / difficult it is to break the habbit.

A small sidenote when (or if) I manage to get my garmin vivosmart HR charges, it does rapport activity per week, number of steps and number of floors I went up on foot per day, even without a smartphone app. So that's at least something :-)

sport watch supported by Linux/FOSS software in c/linux@lemmy.ml
[–] kristoff@infosec.pub 1 points 2 weeks ago (2 children)

One of the reasons I am looking for a new sportswatch is because I try to reduce my smartphone use and I noticed that I actually took out my smartphone just to check the time.

I have an old garmin vivosmart HR but I do have a problem with the charging cable. Plus I am not able to download the healthstats with my linux 'daily driver' laptop.

Perhaps I should just get a cheap regular watch somewhere? 🤔

I wrote a Vim Reference Guide (beginner to intermediate level) in c/linux@lemmy.ml
[–] kristoff@infosec.pub 1 points 2 weeks ago (1 children)

I don't. I thought the emoji would have made that clear.

I have been doing cybersecurity awareness lately. We are starting to get over the furst hurdle: make people see the signatures of phishing message. But now we are starting with the 2nd hurdle: make people understand that when they write a genuine post, they should avoid these signatures of phishing, in this case, the "time pressure" argument.

The problem is that the more genuine messages have phising signatures, to more difficult it becomes for people to distinguish a genuine posts from phishing. There is also the risk that you genuine posts will get noted as fake (although that is clearly not the case here :-) )

sport watch supported by Linux/FOSS software in c/linux@lemmy.ml
[–] kristoff@infosec.pub 1 points 3 weeks ago

ah .. currently not available :-/

sport watch supported by Linux/FOSS software in c/linux@lemmy.ml
[–] kristoff@infosec.pub 7 points 3 weeks ago (2 children)

ah. That looks very interesting. And they have a show here in the EU, and it seems to work with gadgetbridge (thx Lambda RX :-))

Thanks!

sport watch supported by Linux/FOSS software in c/linux@lemmy.ml
[–] kristoff@infosec.pub 1 points 3 weeks ago

my daily driver is a ubuntu laptop so I was first thinking about that, but now that you mention a mobile app, ..yes. that would be nice too.

thanks for the food for thought :-)

I wrote a Vim Reference Guide (beginner to intermediate level) in c/linux@lemmy.ml
[–] kristoff@infosec.pub 3 points 3 weeks ago* (last edited 3 weeks ago) (3 children)

A URL 'Free up to some-end-date'. ???

Phishing link? 🤔

45
sport watch supported by Linux/FOSS software (infosec.pub)
submitted 3 weeks ago* (last edited 3 weeks ago) by kristoff@infosec.pub to c/linux@lemmy.ml
23 comments fedilink
 

Hi all,

Simple question. Does anybody know a (not to expensive) sportswatch that is supported by Linux / FOSS software?

(Yes, I know 'FOSS software' is two times the word software) 😀

apps .. repo or not in c/cybersecurity@infosec.pub
[–] kristoff@infosec.pub 2 points 3 weeks ago* (last edited 2 weeks ago)

Hum , interesting point. If you are a hacker, would you not prefer software to be spread out everywhere so people would be even more confused what is the real source for some application?

I guess people would then just depend on their search engine

apps .. repo or not in c/cybersecurity@infosec.pub
[–] kristoff@infosec.pub 2 points 3 weeks ago

Well, in principe I do not see that much different between 'curl | bash', 'sudo apt-get install' or installing an app on your phone. In the end, it all depends on trust.

Considering how complex software has become and on how many libraries from all over the internet any application that does more then 'hello world' depend, I do not see how you can do if you are not prepared to put blind trust into some things.

Concerning CrowdStrike, I am just reading an book on human behaviour (very interesting for everybody who is interested in cybersecurity), and I am just on the chapter about the fear of deciding with unknown parameters vs. the fear of not deciding at all. Any piece of software will brake at some point, so will you wait forever to find something that will not have any vulnerabilities?

apps .. repo or not in c/cybersecurity@infosec.pub
[–] kristoff@infosec.pub 2 points 3 weeks ago

Obtainium seems to have a very interesting take on this. Thanks for the link! I will check it out 👍

apps .. repo or not in c/cybersecurity@infosec.pub
[–] kristoff@infosec.pub 1 points 3 weeks ago (2 children)

The problem is here is this: how is a user supposted to know if the official website of an application is organicmaps.app, organic-maps.app, organicmaps.org or github.com/organicmaps?

And even if she/he knows, hackers do ways to make you look the other way. The funny thing in this case is that the original author complained that the app was removed from google playstore, and did so on the fosstodon mastodon-server. Although I guess this was not at planned, he made the almost perfect social-engineering post. :-)

7
apps .. repo or not (m.krbonne.net)
submitted 3 weeks ago* (last edited 3 weeks ago) by kristoff@infosec.pub to c/cybersecurity@infosec.pub
11 comments fedilink
 

Hi all,

Interesting problem. An open-source project gets their app removed from google play, so they post a message on mastodon that -for the time being- you can download the app via direct download.

I post a reply saying that directing people to a direct link is not a good idea, as hackers could start doing the same to spread malwhere, better use an official repo (like f-droid, where they are already on).

A typical problem of somebody who writes a genuine post, but without realising it himself writes something that is very close to what a phishing message would look like.

However, this got me thinking. What you want to avoid is that people get used to the idea that it is OK to download and install apps from a random URL. But if you point people to f-droid, they need to also download the apk for that, and configure the security on your phone that apk's downloaded via may be installed.

I guess, the later should surely be avoided as most people will then leave that option enabled. (I had to search deep into the security setting to find the option to switch it off again).

What are your opinions on this? What would be the best way to do this and not teach people bad security habbits?

Direct download or f-droid? Other ideas? Is there a good sollution for this?

Kr.

55
basic UI programming in linux (infosec.pub)
 

Hi all,

Perhaps a stupid question. Some time ago, I received a rpi zeroW as a gift, but as I did not have any use for ii I passed it to somebody else in our electronics-group. Now, that person has had a +30 year carreer as self-taught programmer -starting out with BASIC on DOS machines- so he showed of some of his old BASIC applications in dosbox on the pi.

So far so good, but he had an interesting question: Years ago, I wrote a library in BASIC for screen / window applications in DOS. (you know, pop-up text-windows and so on). How do I do that on linux (in C)?

As I myself only do 'backend' coding (so no UI), I have to admit I did not have any answer to that.

So, question, For somebody who has mostly coded in BASIC (first DOS and later Visual Basic) and now switched to C and python, what is the best / most easy tool to write a basic UI application with window-function on linux/unix. I know there exist things like QT and ncurses, but I never used these, so I have no idea.

Any advice?

Kr.

12
replacing memories (infosec.pub)
 

An open question, related to cyberpunk culture.

Considering the possibilities of current social-engineering as used by social media and desinformation, to what degree ido you think it is now possible to 'implant' fake memories into somebody's consciousness, without that person noticing it.

0
what if your cloud=provider gets hacked ? (www.bleepingcomputer.com)
 

Hi all,

As self-hosting is not just "home-hosting" I guess this post should also be on-topic here.

Beginning of the year, bleeping-computers published an interesting post on the biggest cybersecurity stories of 2023.

Item 13 is an interesing one. (see URL of this post). Summary in short A Danish cloud-provider gets hit by a ransomware attack, encrypting not only the clients data, but also the backups.

For a user, this means that a senario where, not only your VM becomes unusable (virtual disk-storage is encrypted), but also the daily backups you made to the cloud-provider S3-storage is useless, might be not as far-fetches then what your think.

So .. conclussion ??? If you have VMs at a cloud-provider and do daily backups, it might be usefull to actually get your storage for these backups from a different provider then the one where your house your VMs.

Anybody any ideas or remarks on this?

(*) https://www.bleepingcomputer.com/news/security/the-biggest-cybersecurity-and-cyberattack-stories-of-2023/

0
Selfhosting jitsi meet ? (infosec.pub)
 

With jitsi meet now requireing registration (something I do understand, .. but I just happen not to have a google, MS or meta account), I am looking at selfhosting a jitsi meet for personal use.

Has somebody already done this? What are your experience? What are the hardware requirements? Docker or native? Linux or other OS? (FreeBSD)?

1
disinformation videos on AI ? (infosec.pub)
 

Hi all,

Had a small chat on #AI with somebody yesterday, when this video came up: "10 Things They're NOT Telling You About The New AI" (*)

What strikes me the most on this video is not the message, but the way it is brought. It has all the prints of #disinformation over it, .. especially as it is coming from a youtube-channel that does not even post a name or a person.

Does anybody know this organisation and who is behind it?

Is this "you are all going to lose your job of AI and that's all due to " message new? What is the goal behind this?

(Sorry to post this message here. I have been looking for a lenny/kbin forum on disinformation, but did not find it, so I guess it is most relevant here)

(*) https://www.youtube.com/watch?v=qxbpTyeDZp0

view more: next ›