K0nserv

42 ms·

481.
by K0nserv 9y ago
The new Skyscanner(my employer) London office also uses this setup and the times I've been in London and worked from that office I've really enjoyed it. I work in the main office in Edinburgh which is unfortunately an open floor p
482.
by K0nserv 9y ago
Using uBlock Origin, uMatrix, or NoScript gets you very far in this regard. You don't need to whitelist that many scripts on each site before they start functioning.
483.
by K0nserv 9y ago
Nope in Rust you can only do things with generic types that fit the constraints(called trait bounds in Rust) you've placed on them. So with no constraints you can only do things that every single type supports. In essence it's a
484.
by K0nserv 9y ago
Caret, tilde and other loose requirements are fine in Cargo.toml because cargo generates Cargo.lock on your behalf with the exact versions required for your build. This is how pretty much all modern dependency managers work(Bundler,
485.
by K0nserv 9y ago
Boys desire for large pay checks could be explained by patriarchal/societal expectations that they must be the main bread winner in a household
486.
by K0nserv 9y ago
I stil use ESC for visual mode, but as @Pete_D points out you could use jk there too, however it's a much more common input in visual mode so it would probably not work as well.
487.
by K0nserv 9y ago
The best line in my whole vimrc is this https://github.com/k0nserv/dotfiles/blob/master/files/vimrc.... . It rebinds jk to ESC. This has the nice property of being a NOP if you happen do do it in nor
488.
by K0nserv 9y ago
As discussed in the thread[0] on this from the other day it's largely FUD. Fundamentally a VPN service allows you greater control over who you trust with your traffic. You always have to trust someone[1]. For example I trust F-Secure a
489.
by K0nserv 9y ago
Reposting my comment from the other thread: I’ve always been suspicious of services that use SMS as the primary 2FA mechanism. TOTP is more secure and convenient, but it doesn’t allow the service to collect and extra datapoint. Using a comm
490.
by K0nserv 9y ago
I’ve always been suspicious of services that use SMS as the primary 2FA mechanism. TOTP is more secure and convenient, but it doesn’t allow the service to collect and extra datapoint. Using a communication channel intended for security as a
491.
by K0nserv 9y ago
Yeah exactly I was thinking of end users. Since the support in end user's client dictate what websites will implement I think we'll see use of SRI increase over the coming years
492.
by K0nserv 9y ago
SRI[0] is still a fairly new technology with lacking browser support. I expect its usage to grow, but it's worth keeping in mind that the use of SRI does not matter at all if the client doesn't support SRI. 0: SRI - Subresource In
493.
by K0nserv 9y ago
I believe the tracking stuff comes with Like buttons and other Facebook widgets those are what I am referring to when I say "add value". But it could be argued that the tracking alone never adds value to the user.
494.
by K0nserv 9y ago
> 1. they are crawling potentially sensitive information granted by links with tokens Don't put Facebook tracking on sensitive pages. Actually as a service to your users don't put it anywhere where it doesn't add value. &g
495.
by K0nserv 9y ago
I use Fastmail after switching away from Gmail and Google pretty much entirely. The core issue with Gmail and other free services is that since you aren't paying for the service they need to sustain in some other fashion(mining your da
496.
by K0nserv 9y ago
I dunno if I agree, the borrow checker in Rust requires a lot more active thinking and intervention to get memory right. Objective-C and Swift ARC is really straightforward and there are few gotchas. Kinda like GC.
497.
by K0nserv 9y ago
Golang is a language designed for offshoring? It was invented at one of the largest engineering orgs to be used in house
498.
by K0nserv 9y ago
You're right, can't believe I missed that. Edit: See the archive[0] apparently I'm not going mad and it used to say that the patch was applied to Sierra and El Capitan, but Apple has since changed that. 0: https://
499.
by K0nserv 9y ago
The KAISER[0] fix which is what has been patched by OSes for Meltdown only resolves full physical memory and kernel memory access. You can still use Meltdown techniques to read arbitrary memory in your process, but this seems expected. 0:
500.
by K0nserv 9y ago
It is patched on Sierra, this was part of the 2017-002[0] security update on the 6th of December. 0: https://support.apple.com/en-gb/HT208331
501.
by K0nserv 9y ago
I'll try to explain the small snippet from the paper. The exploit uses a Flush+Reload attack to use the cache as a side channel to leak memory read in speculative execution. They use a 256 * 4096 byte memory region to leak a 1 byte val
502.
by K0nserv 9y ago
The exploit is based on reading values that you shouldn't be allowed to access in speculative execution and then using the returned values to create persistent changes in the cache(they persist even after the CPU detects your illegal a
503.
by K0nserv 9y ago
> "read any physical memory" as "read memory in cache" You can force values from any memory to affect the cache in a predictable manner which enables you to read all physical memory. See https://news.ycombi
504.
by K0nserv 9y ago
Thanks for the explanation. So it's down to when the access check is performed. I wonder why Intel did it the way they did, performance maybe?
505.
by K0nserv 9y ago
> We also tried to reproduce the Meltdown bug on several ARM and AMD CPUs. However, we did not manage to successfully leak kernel memory with the attack de- scribed in Section 5, neither on ARM nor on AMD. The reasons for this can
506.
by K0nserv 9y ago
Do you have any source on why AMD64 is unaffected? The paper only mentions that they couldn't make their current approach work on AMD, but it doesn't rule out that it could be improved and made work
507.
by K0nserv 9y ago
I saw some speculation that AMD might raise the kernel memory read exception earlier than Intel which prevents any subsequent instructions from using the value fetched from the kernel address space.
508.
by K0nserv 9y ago
Having just read the Meltdown paper, but not the Spectre paper. My understanding is that yes Meltdown is much easier to exploit and more powerful. I believe Spectre requires the attacker to consistently fool the branch predictor while Meltd
509.
by K0nserv 9y ago
That's great, thanks for the link
510.
by K0nserv 9y ago
So still no fix in sight for 10.12? My personal laptop refuses to upgrade to High Sierra and my work laptop is yet able to upgrade because we have do some work with our mac management before that time. I haven't seen anything from Appl

More ›