Posts by cdrcat 98 posts • joined 24 May 2015
There are multiple hardware mitigations *already* in Apple processors. They are mostly aimed at preventing kernel level exploits, but it seems very likely Apple will continue putting in more security protections into the A* processors.
Intel have repeatably shown they prioritise sales performance before security, sort of like Microsoft of yore, and Intel is less likely to develop mitigations that require tight integration with the OS or deep modification of the OS.
Scroll way down to the heading “iOS kernel exploit mitigations” in this link which details some of the hardware protections: https://googleprojectzero.blogspot.com/2020/06/a-survey-of-recent-ios-kernel-exploits.html
Say you have white (255,255,255). Now you want a red as bright as that white, maybe that should be represented as (765,0,0).
Or maybe you want to have 10 bit colours, so you can choose between (1023,1023,1023) or (255.75,255.75,255.75) as representations that allow ten bits per channel to be declared.
It’s all completely insane of course, since the page would have to say what colour space it was using, the gamma, and what representation it was using. Otherwise a browser couldn’t map the wide-gamut or 10-bit colours when someone used a normal 24 bit colour monitor.
Cristobal Colon is still alive running the show from a secret bunker located under the Vatican. You’ll notice that Christopher Columbus Is an obvious anagram containing “Hitler”, which says it all. “Americans” are actually spy robots - they have to be loud to cover up the noise of their internal machinery (Machiavellian has the same root). If the mods publish this, I will be replaced with a machine intelligence: if the quality of my comments improves then it proves it (or if they get worse it’ll be because they programmed the replacement to act dumb).
Old Android phones remain more secure from attacks via web pages, because the browser is updated regularly. Android 4.4 (released Oct 2013) is still getting Chrome updates. Most other attacks are mitigated by needing to be physically near phone, are filtered by SMS infrastructure, or can be avoided by not installing crap apps.
Anyone on iOS 12 or less is stuck on an old and insecure version of Safari - the recent flaw that gives access to cameras also gives access to stored passwords... Roll the dice on every web page visited!
I generally recommend Nokia phones with Android One (designed by HMD) because they are relatively cheap but good, they get updates, and the Android version is clean (no manufacturer shit).
The Oxford Indian Dictionary will replace the OED.
Soon to be heard from your local chav:
My daughter is convent-educated
My teacher is sitting on my head
My friend is eating my brain
https://www.britishcouncil.org/voices-magazine/ten-surprising-expressions-indian-english
Testable.
Order something that needs delivery from China, preferably that has just become stocked again.
My bet is that China is open for business at the moment - if the US had some real dirt on China they would be printing it no the presses already.
And there are multiple other Asian countries that have functioning economies - the star being Taiwan.
Why would they ever have unused hardware? That would be a waste of money - hardware should be used.
“Google's Borg system is a cluster manager that runs hundreds of thousands of jobs, from many thousands of different applications, across a number of clusters each with up to tens of thousands of machines.”.
The system is set up so that hardware failures are dealt with by restarting jobs. Google have done that since they started (optimising for cheaper machines that are expected to fail, rather than expensive reliable machines).
Assuming 25 critical bugs found per month, for the next three years, means there are 900 critical bugs left to find... this one bug doesn’t matter that much since there are *plenty* left for skilled parties to find and abuse.
https://blog.talosintelligence.com/2020/03/microsoft-patch-tuesday-march-2020.html
Windows Server is amazingly reliable. But what happens when you get that one weird problem?
I regularly see a story about someone’s epic journey starting with an application level bug and ending with debugging some Linux internals and finally solving the problem (some obscure Intel CPU bug, or driver software issue, or epic network race condition etc). Those journeys begin with the belief that with sufficient motivation you can track down any problem on Linux/BSD.
When you watch someone solve a Windows Server bug the “solutions” are very different, and you rarely hear of someone debugging drivers or OS issues.
When I was smaller I wrote embedded software, and tracked down a very-hard-to-find bug in a RTOS.
Disclaimer: The business I helped found depended on Windows Server, and it rarely let us down.
If it is a pandemic, then all tourism will be shut down and probably flights will be very restricted (with a lovely long stay in a quarantine facility on arrival). An individual couldn’t predict the timing of that.
I wouldn’t want to be overseas if travel is mostly shut down: unless you happen to be in a country with better services. I’m in NZ and have enough food/water/medicine to let me hunker down at home for a few weeks. I am also lucky enough to have options to move to rural locations: hospitals won’t be able to help much if a pandemic peaks quickly...
> According to Granal, this identifier is sent to youtube.com, google.com, doubleclick.net, googleadservices.com...
The code[1] shows the X-CLIENT-DATA is sent for any google.X domain where google owns the TLD, but if there were any youtube.X domain owned by a squatter then the PII would be leaked to that squatter. I haven’t looked if there are youtube domain squatters that match that restriction...
[1] https://cs.chromium.org/chromium/src/components/google/core/common/google_util.cc?q=IsGoogleAssociatedDomainUrl
A Venn diagramme of WiFi device purchasers and privacy geeks would have a large union set. And surely Ubiquiti sales depend upon nerdigensia influencers - why would they be so stupid to burn their goodwill? I found out about Unifi products via geek forums.
They were my default supplier and I used to recommend them whenever WiFi discussions came up. They lose my voice, although I will probably grudgingly continue to buy their products because they are now the devil I know...
Microsoft have already gone too far.
We had two true Microsoft believers in a team, deep into the cult, but they have slowly become more and more quiet about the wonders of their religion as the OS and development tools have become shittier and shittier.
I have slowly become luke-watm towards some of their open source efforts, but frankly they have to work hard to recover from decades of abuse.
> and any other sane browser choice is glitchy
There is no other sane browser.
Safari, Internet Explorer, Edge (before Blink), and Firefox are all dogs to develop for. I've written and supported a custom web framework, I know the pain. Edge changed engines in part because theirs was so hideously shitty.
You are implying web developers are lazy mindless scumbags, but supporting borken non-conforming browsers takes up 25% to 50% of dev time, so understandably web developers are keener to deliver new work than fight their platforms.
I hate Google's tentacles as much as any card carrying geek, but the Chromium team's engineering is unquestionably superb (and the other browser teams are weenies in comparison).
Your nirvana works for the wealthy (can pay for X people to help them) or it works for a population that doesn't require much help (1 hour of personal help for every 24 of life).
Once a population needs significant help (40 hours per week per week of life) then there is simply not *enough* people to do the "humane" thing.
Even worse, some of the carers are doing shitty inhumane work (lifting the elderly but damaging themselves; elderly looking after the elderly but unwillingly).
We should offload as much of the drudgery as possible and keep our elderly as *independent* as they wish. If we can use machines to do this we should - try telling your mum she should replace her scooter with coolies!
Reserve the human hours for real care - human touch, interaction, and brotherhood.
But the KPI is correct - there's a sunken cost fallacy in there somewhere.
Sell 10 stale buns at $1 each = $7 profit.
Throw away 10 stale buns, make 10 new buns, sell at $2 each = $14 profit.
Throwing away buns is likely to increase profits (assuming most new buns get sold, ignoring elasticity or price discrimination, and ignoring some other issues).
> Full fibre is a vehicle to turbocharge our economy
Such bullshit. The exact same bullshit was said over in New Zealand: but the only measurable result is that we get better NetFlix - that is not something that should be paid for with tax money.
I have high-tech software friends that have stayed on broadband.
They haven't locked down their web app JavaScript includes: Facebook, Hotjar, Amplitude, Google, and others have access to your production SSL keys, code, passwords, etc.
It's a quick smell test for whether a company actually cares about security: what third-party scripts are included in their "secure" web page areas. The default web developer doesn't know better, and it is hard to lock down third parties (best solution is to avoid unnecessary third-party shit like analytics, also can use iframes or more complex solutions like caja).
This guy asked them about this issue 2 years ago, and apparently they haven't done anything much about it which signals CircleCI's security is poor: https://kevin.burke.dev/kevin/circleci-is-hopelessly-insecure/
Same technique as NASA investigated for recapturing a Saturn V booster: The helicopter would be gigantic. The rotor diameter would be over 120 meters. Its empty weight would be over 200,000 kilograms, with a gross weight of a whopping 453,000 kilograms. From: http://www.thespacereview.com/article/3741/1
To see vid, start just before 10 minutes: https://youtu.be/joONWIGtcdY?t=583
Just politely ask. Most people are happy to help, especially when it is something "personalised" like that. It would have to be immediate, and only people with app installed, and located near the device. You want to avoid asking husband John at work about a recording made while wife Julie was shagging the electrician.
Same issue (which I fucking hate) with phone calls where you are told your voice is recorded for quality control etc. Wankers don't provide an opt out.
The Register - Independent news and views for the tech community. Part of Situation Publishing
Biting the hand that feeds IT © 1998–2020
