0x0

67 ms·

1. 661.▲
   by 0x0 8y ago

   The security page just says "iOS 11.4: Details available soon" https://support.apple.com/en-us/HT201222 - is that normal, or is there a particularly nasty security bug fixed here that they want to keep on the
2. 662.▲
   by 0x0 8y ago

   Of course not. The browser performed its primary task, and the consequences are reasonably obvious to the user, who can at least make an informed corrective action. Is the difference not obvious?
3. 663.▲
   by 0x0 8y ago

   Why not just make the logging opt-in then? Opt-out for non-primary features like sneaky telemetry is not reasonable. There's a difference between not being bug-free, and purposefully implementing a user-hostile feature like this. Pleas
4. 664.▲
   by 0x0 8y ago

   Any tool that purposefully builds in unnecessary minefields like these deserves to be shamed.
5. 665.▲
   by 0x0 8y ago

   Invalid comparison, in my humble opinion. Pushing a secret API key to github, even accidentally, does not happen covertly or as an unexpected side effect of some other tool written by github, and you'll soon realize what happens becaus
6. 666.▲
   by 0x0 8y ago

   But it's not aggregated, and the combination of geolocation + os kernel build number + runtime id + osversion + sdkversion could very well be unique. Just take a look at some choice lines from one of the .tsv files at https:/&#x2
7. 667.▲
   by 0x0 8y ago

   They do collect at least the first argument, how else do they end up with "bulid"? Accidents happen and someone could paste or tab-complete a confidential thing in that spot...
8. 668.▲
   by 0x0 8y ago

   Collecting command line arguments is a HUGE invasion of privacy. Imagine I ran a command "make.exe my-secret-project-name" or "make.exe process_gdrp_removal_request SOME_SSN". And as the linked page admits, they really d
9. 669.▲
   by 0x0 8y ago

   The option to suppress sponsor offers is still there in the control panel for Java 10.0.1. It's of course possible that some users don't experience these "sponsored offers" due to geotargeting, A/B-testing, lack of
10. 670.▲
    by 0x0 8y ago

    Is opt-out a valid strategy for GDPR compliance? I got the impression that these things had to be opt-in?
11. 671.▲
    by 0x0 8y ago

    Java has been pushing "sponsored offers" (i.e. unwanted spyware like browser toolbars and similar user-hostile software) in their installers for years, so they're not exactly a shining beacon of light.
12. 672.▲
    Reverse emulating the NES to give it SUPER POWERS(m.youtube.com)

    5 points by 0x0 8y ago|0 comments
13. 673.▲
    by 0x0 8y ago

    Facebook was a lot more fun when there was a chronological timeline of non-rich-text status updates and comments from friends. These days it's all semi-spam from pages and random week-old friend's FB activities being surfaced in a
14. 674.▲
    by 0x0 8y ago

    If a presentation layer API (=HTML) provides developers with the convenience of composing UI elements by concatenating markup with remotely sourced input, and at the same time allows inline scripts to be eval'ed when merely present in
15. 675.▲
    by 0x0 8y ago

    Yeah, NameCheap is pretty flaky with the warning emails. I once had their WhoisGuard service expire (it was on a different renewal phase from the actual domain, for some reason), and I never received any warnings about the service expiring
16. 676.▲
    by 0x0 8y ago

    I think the hardware breakpoint support is for breaking on memory accesses to a particular address. Setting a breakpoint on the execution of a particular opcode at a particular address is easier and can be done by just swapping in an &q
17. 677.▲
    by 0x0 8y ago

    Sounds really complicated, couldn't you just replace all that blockchain verification code with an "if (firmwareToInstall.version < firmwareCurrentlyInstalled.version) return false" after the signature check?
18. 678.▲
    by 0x0 8y ago

    I don't get it, do you allow adversary participants in on the network to vote on firmware consensus? What's wrong with regular vendor digital signatures, like everyone else does? :)
19. 679.▲
    by 0x0 8y ago

    I looked at https://github.com/dg92/Performance-analysis-es6/blob/master... briefly and saw that the different algorithms always run one after another. Does the first algorithm get an unfair cold cache disadv
20. 680.▲
    by 0x0 8y ago

    Ah, yes, Electron, where a simple XSS can quickly turn into full account compromise and RCE? :O https://blog.doyensec.com/2017/08/03/electron-framework-secu...
21. 681.▲
    by 0x0 8y ago

    When a vendor talks about adding a "unique blockchain security infrastructure" for firmware updates... I don't even
22. 682.▲
    by 0x0 8y ago

    And furthermore, the current stack address is determined by the combination of two registers: ss for the segment and rsp/esp/sp for the stack pointer within the segment. I guess the strange behavior around modifying ss comes from
23. 683.▲
    by 0x0 8y ago

    Apparently this was already patched in the previous macOS security update, but Apple updated the documentation for it with additional references to this bug only just today. I've seen them do these documentation updates a few times now
24. 684.▲
    by 0x0 8y ago

    > Just like ending files on ctrl-Z (yes, it is End-Of-File, but filesystems know where the end of the file is already) Very old filesystems didn't track file sizes in bytes, just blocks, so a literal EOF byte was needed to know wh
25. 685.▲
    by 0x0 8y ago

    By the way, I've had those top menus that open to left happen when windows installs a touch/ink/stylus input device. There's a control panel setting somewhere for input devices like these, where there's a checkbox (
26. 686.▲
    by 0x0 8y ago

    Most backup systems allow restoring only specific files. It could happen that some random document in an archive was accidentally erased or overwritten, and nobody noticed for a year until they need to reference last year's document. Y
27. 687.▲
    by 0x0 8y ago

    I think that would be counter-productive. One of the main goals is to do research on how the 1.1.1.1-like addresses work in the real world. Offering a nice and free DNS service on those addresses is almost just a side-effect, which obviousl
28. 688.▲
    by 0x0 8y ago

    A similar thing happens with Java's file and directory APIs on Linux. IIRC in Java filenames are Strings. If your vm is configured with utf8 as "file.encoding" and you have non-utf8-compliant filenames on your filesystem, tho
29. 689.▲
    by 0x0 8y ago

    I'm curious about the same. If I've been riding my existing session cookies for a while, am I in the clear?
30. 690.▲
    by 0x0 9y ago

    Leaflet is a nice javascript library for slippy maps, but you still need to bring your own tileserver (OSM is not free to embed for anything beyond light usage I believe)