Comments URL: https://news.ycombinator.com/item?id=47886967

Points: 5

# Comments: 0

For Cisco they literally keep doing it year after year. They are like the Boeing of the IT world. Its unbelievable how they are still in business and growing...and then people worry about Mythos… :-))

Even Bruce Schneier said that Cisco products have had hard-coded passwords made public repeatedly, and "you'd think it would learn.": https://www.schneier.com/blog/archives/2023/10/cisco-cant-st...

Cisco your core vendor...this is way the CEO earns the big bucks...

2010 (CVE-2010-1574): Cisco IE3000 switches shipped with hard-coded SNMP community names public and private.

2017 (CVE-2017-3834): Cisco Aironet 1830/1850 Mobility Express had default credentials that could let an unauthenticated remote attacker take control of the device.

2017 (CVE-2017-6689): Cisco Elastic Services Controller had a default weak hard-coded password for the admin user in the ConfD CLI.

2017 (CVE-2017-12317): Cisco AMP for Endpoints used a static key to protect the connector password

2018 (CVE-2018-0141): Cisco Prime Collaboration Provisioning 11.6 had a hard-coded SSH account password that could allow local access to the underlying Linux OS.

2018 (CVE-2018-0150): Cisco IOS XE had an undocumented privilege-15 account with a default username and password, allowing unauthenticated remote administrative access.

2018 (CVE-2018-15389): Cisco Prime Collaboration Provisioning’s install flow could leave a default hard-coded web admin username/password in place.

2019 (Cisco advisory; credential issue documented in the advisory): Cisco Small Business RV160/RV260/RV340 firmware images were found to contain undocumented accounts and hardcoded password hashes

2021 (CVE-2021-34795): Cisco Catalyst PON ONT devices had a default Telnet credential vulnerability when Telnet was enabled.

2021 (CVE-2021-34757 / CVE-2021-34744): Cisco Business 220 Smart Switches had a static-password issue and a static-key issue

2023 (CVE-2023-20101): Cisco Emergency Responder shipped with static root credentials that could not be changed or deleted, enabling unauthenticated remote login.

2024 (CVE-2024-20412): Cisco Firepower Threat Defense for Firepower 1000/2100/3100/4200 had static accounts with hard-coded passwords

And Juniper? And Fortinet ? Yeap...Our CEOs earn big bucks too...

- Juniper

2015 (CVE-2015-7755 / CVE-2015-7756): Juniper disclosed unauthorized code in ScreenOS that enabled unauthorized remote administrative access and, separately, VPN traffic decryption on affected versions.

2017 (CVE-2017-2343): Juniper SRX Integrated UserFW had hardcoded credentials in its authentication API.

2019 (CVE-2019-0020): Juniper ATP shipped with hard-coded credentials in the Web Collector instance.

2019 (CVE-2019-0030): Juniper ATP used DES with a hardcoded salt for password hashing

- Fortinet

2016 (CVE-2016-1909): FortiOS, FortiAnalyzer, FortiSwitch, and FortiCache had an undocumented Fortimanager_Access account with a hardcoded SSH passphrase.

2019 (CVE-2019-6698): FortiRecorder set a hardcoded admin password on managed FortiCameras.

2019 (CVE-2019-6693): FortiOS / FortiManager / FortiAnalyzer used a hard-coded cryptographic key for sensitive config data

2020 (CVE-2019-16153): FortiSIEM had hard-coded PostgreSQL credentials in its database component.

Comments URL: https://news.ycombinator.com/item?id=47873983

Points: 4

# Comments: 0

https://www.rtl.nl/nieuws/economie/artikel/5587827/de-econom...

From the Dutch to English translation for the ones who need to brush up on their Dutch:

"...More than half (53 percent) of Dutch people aged 18 to 35 have no desire to have children, or do not yet know whether they want children. This is according to research by the RTL Nieuwspanel..."

Because they aggregate, resume and translate ( but dont change the content ) to English I can imagine that is why, you see here sometimes posts to them, instead of having the original link in Dutch.

If its currently 11°C (52 °F) in San Francisco, and I read that on the BBC, the New York Times, or Fox News...that does not change the fact the current temperature in San Francisco is 11°C (52 °F)...

Maybe because is not as serious as them and their title, made it to be? Did you read it fully?

The identifier described is not process lifetime stable, not machine stable, or profile stable, or installation stable. The article itself says it resets on a full browser restart...

So this is not a magic forever ID and not some hardware tied supercookie. Now what should we do with that title, and the authors of it?

Apple should do their due diligence.

Comments URL: https://news.ycombinator.com/item?id=47873636

Points: 6

# Comments: 1

Comments URL: https://news.ycombinator.com/item?id=47873588

Points: 8

# Comments: 2

So this is apparently The Schwarz Group, a parent company of Lidl and Kaufland, and it seems StackIT is their IT division.

Just for fun, just tried two times their online process to open an account, from two difference devices. Send email, get challenge code...bla bla..to be immediately greeted two times at validation time by:

"No authentication process found. Please try again or contact support for assistance."

This is exactly the cluster fuck you would expect from IT run by a German company ( Hetzner being the exception...). Good luck Dutch Central Bank...

Comments URL: https://news.ycombinator.com/item?id=47873433

Points: 44

# Comments: 13

Comments URL: https://news.ycombinator.com/item?id=47864372

Points: 3

# Comments: 0

I remember the iPhone launch queues...as in the strangest ritual in consumer tech. People camping overnight for a device that will be sitting on shelves in unlimited quantities the following week. Like queueing up for a vacuum cleaner and pretending it's the moon landing.:-)

Oh the love for a company, with the battery gate ($500M settlement for throttling phones customers already owned), the CSAM on-device scanning proposal, a decade of Irish tax routing, active lobbying against right to repair, repeated supply chain findings on child and forced labor... and a CEO who hands Trump gold while going quiet on the causes Apple used to grandstand about.

So much much to love on this company. Its poised with assholery of Steve Jobs to its core, and has no salvation. If I want luxury, I buy a laptop from Cartier...

The worst is the tell that an all Apple setup is a the near perfect filter for not a hacker. The ecosystem is engineered against the instincts that define hacking, no sideloading without ceremony, no real repair, no low level access without fighting the OS, no running what you want without Apple permission, no swapping parts that haven't been blessed with the right serial number.

Its computing for consumers, not tinkerers. Which is fine, except the culture around it borrows the prestige of technical sophistication while actively opting out of it. :-)

The Mac in the coffee shop is a lifestyle object. The ThinkPad running Linux next to it is a tool.

Comments URL: https://news.ycombinator.com/item?id=47848487

Points: 66

# Comments: 12

Comments URL: https://news.ycombinator.com/item?id=47848413

Points: 10

# Comments: 0

"A lot of love for Apple" is not evidence of wisdom or merit. It is evidence that Apple has been extraordinarily successful at converting ordinary consumer electronics into a moral aesthetic identity for its customers... Once that happens, public praise stops being about products and starts being about selfregard.

That is why Apple gets discussed in a register normally reserved for institutions that have actually earned public affection. In reality, it is a company that charges luxury prices for tightly controlled products, then persuades customers that the control is sophistication and the markup is virtue. :-)

This is mostly a case study in prestige bias. People are not just evaluating a company but protecting a status hierarchy in which buying Apple signifies discernment.

And the something amazing must be in the skunkworks line is the usual theology that means when the present is overpriced iteration, redemption is always scheduled for a few years from now.

Comments URL: https://news.ycombinator.com/item?id=47841683

Points: 4

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=47836463

Points: 224

# Comments: 238

"...When Peter Thiel said, “I no longer believe that freedom and democracy are compatible,” he wasn’t talking about your freedom. He was talking about his own. You don’t exist. When Musk took a chainsaw to the federal government as part of the inside joke he called DOGE, he did so with the air of a man who believed that nothing matters—poverty, chaos, human suffering. He was having fun. It didn’t even matter that the entire destructive exercise ultimately yielded no practical financial gains. For him, the outcome was a foregone conclusion: He could only win, because losing had lost its meaning...."