This server, maintained by Internet carrier Cogent Communications
Found the problem!
So the article repeats, several times, “waymo relies on remote operators”. I don’t think the author knows what “self-driving” means.
For encryption, the client and server need to share their private keys.
This is incorrect, for asymmetric (public-private) encryption. You never, ever share the private key, hence the name.
The private key is only used on your system for local decryption (someone sent a message encrypted with your public key) or for digital signature (you sign a document with your private key, which can be validated by anyone with your public key).
For the server, they are signing their handshake request with a certificate issued by a known certificate authority (aka, CA, a trusted third party). This prevents a man-in-the-middle attack, as long as you trust the CA.
The current gap is in inconsistent implementation of Organization Validation/Extended Validation (OV/EV), where an issuer will first validate that domains are legitimate for a registered business. This is to help prevent phishing domains, who will be operating with TLS, but on a near-name match domain (www.app1e.com or www.apple.zip instead of www.apple.com). Even this isn’t perfect, as business names are typically only unique within the country/province/state that issues the business license, or needed to be enforced by trademark, so at the end of the day, you still need to put some trust in the CA.
That’s the benefit of a custom domain, I suppose; you can always change he provider without changing your email.
Who cares if the code is open source, or pre-training weights are released? Virtually every Masters in CS student in 2024 is building this from scratch. The differentiator is the training dataset, or at worst, the weights after fine tuning the model.
Cost of living, yes, and if you’re a solid performer, 3% is considered good. However, this is a 5% across the board, and a large increase to entry level.
Digital signature as a means of non repudiation is exactly the way this should be done. Any official docs or releases should be signed and easily verifiable by any public official.
When using an external TPM. Which next to no one does.
They’ve been around since 2018, and with only two weeks notice, now are saying they need $150k?! Who the fuck is their CFO, and how did their burn rate get so out of control? Shouldn’t they have started the campaign months ago if this was an expected problem?
This just fucking reeks of embezzlement; grossly mismanaging the funds charitable individuals had entrusted them with.
Any competitor worth their salt will match and exceed that as a signing bonus.
Why are you running a VPN? If you are simply shielding your internet activity from your ISP, Google won’t give a shit where you sign in from.
If you are browsing to shield your identity, you want to be fully disassociated with any non-secure browsing habits. If this is your use case, even if you are using discrete internet accounts, tracking cookies are common enough that, you would still be identifiable from your browser fingerprint. It all depends on what your risk factors are, and how much you want to spend to mitigate them.
Shouldn’t be this hard to find out the attack vector.
Buried deep, deep in their writeup:
RocketMQ servers
I’m sure if you’re running other insecure, public facing web servers with bad configs, the actor could exploit that too, but they didn’t provide any evidence of this happening in the wild (no threat group TTPs for initial access), so pure FUD to try to sell their security product.
Unfortunately, Ars mostly just restated verbatim what was provided by the security vendor Aqua Nautilus.