Yes, exactly. The convention is to use the lowest address in the range (e.g. 192.168.1.0/24), since you’re allowing a range of addresses rather than a single one.

The reason to do this is that many firewall rules will be based on sets of addresses - you might want to allow traffic from any device in your local network without having to add individual rules for each

You might want to use either a /24 address or a /32 address in a firewall rule, depending on what you’re trying to do. The difference is that the /24 one refers to a set of IPs, while the /32 one applies to only one IP.

Say you’re adding a firewall rule like iptables -A - s 192.168.1.123/32 - j ACCEPT. This will accept all traffic with the source IP 192.168.1.123. If instead you use iptables -A - s 192.168.1.123/24 - j ACCEPT, you’ll accept all traffic with a source IP in the 192.168.1.123/24 subnet, which is all the IPs between 192.168.1.0 & 192.168.1.255.

In the case of your WiFi IP, the subnet does something different. It tells you which IP addresses you should expect to be able to contact directly, and which you need to contact via a router. 192.168.1.214/24 says that all the IPs between 192.168.1.0 & 192.168.1.255 can be reached directly, whereas IPs outside that range need to be sent to a router.

ip route will show you the routes a device knows about. It’ll look something like this (simplifying a bit):

default via 192.168.1.1
192.168.1.0/24 dev wlan0 src 192.168.1.214

The first line is the default route, which is used when no more specific route exists. It says that you talk to these IPs by sending your traffic to 192.168.1.1 (your wifi router) and it’ll send it on from there.

The second one says that for IPs in the 192.168.1.0/24, you directly talk to them using your wlan0 interface

Most UK house construction doesn’t really allow for retrofitting cables in the way that seems to be common in the the US

And they’re not going to pay millions to be the default for a browser that no one uses.

Yeah, its not unreasonable that you’d have a remote way to access the device to gather debug data with the customers consent. An SSH key in the firmware is a flexible way to do that, so long as there are good controls in place to ensure that it isn’t misused.

I think multiple people already have access to the databases that store the data the device sends. I don’t really care whether they get the data from the device itself or from the database.

Similarly, I think multiple people have the ability to make changes to the firmware build and the systems that distribute it. So those people already have the potential ability to gain access to the device.

One person or multiple people having unauthorised access are both unacceptable. I’m saying that the users have to trust the companies ability to prevent that occurring, and that therefore this particular technical detail is mostly irrelevant

I’m 90% sure it is not a single user. I just don’t see how that really affects the security of the product, given that the company that sells it can already do the things the author is saying can be done if you have this key.

To be clear, I wouldn’t buy this. I just don’t think the SSH key makes it any worse than it already was

A shared account doesn’t mean everyone who works there has access to it, or that those who do have access aren’t subject to some type of access control.

The article basically goes on to say that the existence of this key makes a huge difference to the security/privacy of the product. It argues that using it, someone could access data from the device, or use it to upload arbitrary code to the device for it to run. However, those are both things the user is already trusting the company with. They have to trust that the company has access controls/policies to prevent individual rogue employees doing the things described. It seems unreasonable to say that an SSH key being on the device demonstrates that those controls aren’t in place.

The email address attached to the public key, eng@eightsleep.com, to me suggests the private key is likely accessible to the entire engineering team.

This assumption is doing a lot of heavy lifting in the authors argument that this is a big deal.

This assumes that the reviewer who gave the rating wasn’t considering value as part of their scoring. I’d expect the reviewer to be scoring a TV based on his good it is compared to similarly priced competitors, not comparing to every other TV on the market

It’s not that you change the passwords for each website often, it’s that you use a different password for each site. That way if one site gets hacked and your password is leaked, it can’t be used to access your accounts on other sites.

Plenty of costs don’t depend on how much usage there is. If a tree falls and takes out a power line it cosrs the same whether that line was being used at 1% capacity or 100%

The upside of IANA doing it would be a standardised place for sites to move to. Without coordination, different sites would move to different TLDs, probably mostly based on what isn’t already registered. IANA could create a new TLD for this and give existing whatever.io owners a chance to register whatever.iox before its generally available

How exactly is it hashed? There aren’t that many possible phone numbers, so it might be viable to just try every valid number until you find one that matches

Blaming Spotify for this is like blaming the company that made your TV for showing you ads that are part of the broadcast. Unless Spotify makes the specific podcast you’re listening to, they’re just playing you the content someone else made, including the ads they included in that content.

It’s marked solved, but since OP didn’t post the solution:

-e uses basic regular expressions, where you need to escape the meta-characters ((|)) with a backslash. Alternatively, use extended regex with -E

$ echo a | grep -E "(a|b)"
a
$ echo a | grep -e "\(a\|b\)"
a
$ echo a | grep -e "(a|b)"
$ echo a | grep -E "\(a\|b\)"

The xz compromise having demonstrated that FOSS projects are totally immune to interference from state actors…

You’re right, my bad. (Source: https://help.kagi.com/kagi/search-details/search-sources.html)

They pay Microsoft for access to the bing index