aaaaaaaarrrrrgh

aaaaaaaarrrrrgh t1_jegueko wrote

It is surprisingly easy to move even a relatively heavy ship just by pulling on ropes.

Distance is speed times time. Speed is acceleration times time. Acceleration is force divided by mass. A modest force (let's say 50 kg-force) applied to a large mass (let's say 100 metric tons) for a modest amount of time (let's say 20 seconds), is enough to accelerate the mass to a slow but sufficient speed - in this case, 10 centimeters per second, if you ignore all friction. Then wait a bit, and after 10 seconds, the boat/ship has moved a meter.

Of course, water is low friction, not no friction, so it'll take more force and you'll quickly reach a max speed, but it does work in practice.

This video shows a car doing that with a massive modern ship, but as you can imagine, you can do the same with a couple of strong men pulling on ropes.

1

aaaaaaaarrrrrgh t1_je8r8ji wrote

Any even remotely competently written software will encrypt data when it's sent over the Internet.

A chat app that is not end to end encrypted (E2EE) will encrypt the connection between the app and the server. The server will decrypt the message, then encrypt it again for the recipient, and as a result, it will be able to read it.

If the chat app is end to end encrypted, your phone will first encrypt the message so that only the recipient's phone can read it. Then it will send it to the server (the connection to the server will typically still be encrypted one more time). Now the server can see that you're sending a message and to whom, but it can't see the content.

The hard part is doing it right and making sure you're actually encrypting it to the right recipient. Encryption is usually done with public key encryption systems. A recipient generates two keys, public and private, and gives the public key to everyone. You can use the public key to encrypt a message so it can only be read using the corresponding private key.

But how do you know which public key belongs to the recipient? Usually, you ask the server. The server could instead send you its own public key (pretending that it's the public key of the recipient). Your phone would now encrypt the message using that key. The server could decrypt it, read it, then encrypt it with the recipient's key.

For this reason, apps like Signal let you verify your contact's "safety number" which is the fingerprint of both your and their public keys (if you look closely, one half of your safety number is the same for all your contacts - that's your public key fingerprint!)

By checking this, e.g. if you meet in person, you can be sure that the attack I described above ("man-in-the-middle") is not happening. Some e2ee apps don't do this. This still means the server has to actively mess with the data rather than just reading it, but it's far from perfect.

Even e2ee is no guarantee: for example, a malicious server could send you a software update that just uploads your message history.

WhatsApp and signal use the same encryption, but a) WhatsApp doesn't warn you by default when your contact's key changes (because people lose their phones/reinstall all the time and it confuses people), b) WhatApp pushes really aggressively to back up your chats to the cloud, and once either you or your contact do that, the (already decrypted) messages are backed up to apple/google... (there is some other encryption involved but if someone gets the data from Apple/Google, and a key from Facebook, they can read those backups).

1

aaaaaaaarrrrrgh t1_j2edgf7 wrote

a) zero day exploits really aren't that common anymore - most viruses require a human to manually start them, just visiting a web site and clicking links won't do it

b) most crawlers aren't actually "looking" at most of the content, so they'd just move around the virus without actually being affected by it

c) any exploit would likely be targeted against common browsers - the environment of the crawler would be different and the exploit/virus likely wouldn't work there, unless specifically targeting the crawler (and targeting the crawler is hard, because unlike the browser, it's not public so you can't easily test your attack)

d) if the operators have any common sense, the crawlers running inside a sandbox, so exploiting the crawler does nothing and the sandbox will be automatically destroyed and recreated from a clean version on a regular basis

e) targeting crawlers specifically would be a dangerous game: due to the sandboxing it's not too valuable, but you're exposing your (valuable) zero day to an environment that could be tightly monitored. If you get caught, your zero day will be fixed and become worthless.

0

aaaaaaaarrrrrgh t1_j1t60jm wrote

1

aaaaaaaarrrrrgh t1_iufqqsj wrote

Store and charge large batteries in places where they're less likely to hurt people if they catch fire. Not always possible, but as far as possible from people in a room without much flammable stuff and a solid door is a good start.

Also, don't fuck around with cheap noname stuff when it comes to batteries and chargers.

1