Retr0id

20 ms·

511.
by Retr0id 4mo ago
> every step from data wrangling to *publication* Do they have no shame? Edit: seems like no https://news.ycombinator.com/item?id=48736814
512.
by Retr0id 4mo ago
I question the usefulness of Auditor. It can flag if a modified version of GrapheneOS has been booted, for example. But flashing a modified version of GrapheneOS requires erasing userdata, which you'd notice the moment all your data is
513.
by Retr0id 4mo ago
Hmmm. I have a T500 I could use, but it's not that old (a mere 18 years!) - I'd mostly be running the same software and doing the same things, just a bit slower. Going back another decade I also have a Pentium MMX system, and th
514.
by Retr0id 4mo ago
A slight tangent but BGA rework is pretty easy to learn, and I recommend doing so. I find it an invaluable skill for upgrading/repairing/hacking modern hardware.
515.
by Retr0id 4mo ago
A hypothetical useful use of attestation is that a company promising to process personal data securely could actually prove it to end-users, by open-sourcing their server-side code and using reproducible builds combined with remote attestat
516.
by Retr0id 4mo ago
Allowlisting GrapheneOS's AVB keys does not meaningfully achieve 2, see https://news.ycombinator.com/item?id=48732675 It would be a win for GrapeheneOS users though, so I hope they do get support.
517.
by Retr0id 4mo ago
Android Key Attestation produces attestations that are signed with a certificate chain rooted in the hardware vendor's CA. If you use Key Attestation on GrapheneOS on a Pixel device for example, it attests that you're using Graphe
518.
by Retr0id 4mo ago
You can store key material in hardware-backed enclaves without involving remote attestation. If someone has a modified device/client that stores the keys elsewhere, that's on them - they're only weakening their own security.
519.
by Retr0id 4mo ago
No! An open standard for remote attestation would still be remote attestation.
520.
by Retr0id 4mo ago
Special-casing support for GrapheneOS would be a band-aid, they should find a way to avoid requiring remote attestation in the first place, so anyone can use whatever OS they like on whatever hardware they like.
521.
by Retr0id 4mo ago
That's Vercel for you I guess.
522.
by Retr0id 4mo ago
Most recent one was vercelslop too https://news.ycombinator.com/item?id=48062178
523.
by Retr0id 4mo ago
> you do need a fast LAN connection Huh, how come? Low-latency I can understand, but I was under the impression that token throughputs were still barely exceeding dialup bandwidths.
524.
No Code Exec? No Problem Living the Age of VBS, HVCI, and Kernel CFG (2022)(connormcgarr.github.io)
4 points by Retr0id 4mo ago|0 comments
525.
by Retr0id 4mo ago
Oh. I assumed an article that references hand-writing things would be hand written. Silly me :(
526.
by Retr0id 4mo ago
I was going to say dual-kernel seems pretty pointless other than that it's something you can prompt an LLM to implement.
527.
by Retr0id 4mo ago
Interesting to see PAC mentioned on the slide, I'd have assumed security features would be a waste of transistors on something so compute-optimized - but maybe they want to isolate workloads from each other?
528.
by Retr0id 4mo ago
Most of those GB are probably data rather than executable code, it might not be quite as bad as you're imagining.
529.
by Retr0id 4mo ago
I'd love it if there was some way to contribute to ongoing game decompilation projects, with a similarly streamlined web interface - it's something I'd be willing to dedicate some brain time to every so often, but setting up
530.
by Retr0id 4mo ago
I can't see how it could possibly be read as sarcasm.
531.
by Retr0id 4mo ago
It wouldn't be the first time!
532.
by Retr0id 4mo ago
You don't need to be pissed off to decide that immediate public disclosure is the best option.
533.
by Retr0id 4mo ago
No, the days start counting from the availability of a patch.
534.
by Retr0id 4mo ago
Why is that surprising? LLMs can churn out arbitrary volumes of "documentation" in an instant.
535.
by Retr0id 4mo ago
I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1... The first requires being able to overwrite binaries in t
536.
by Retr0id 4mo ago
"bypassing DRM" is explicitly illegal according to DMCA. Don't conflate "unenforce{d,able}" and "legal".
537.
by Retr0id 4mo ago
You are only able to do this because the DRM was cracked long ago.
538.
by Retr0id 4mo ago
DVDs degrade naturally. Good care will extend the lifespan but not indefinitely.
539.
by Retr0id 4mo ago
However, you will stop owning that copy the moment the DVD deteriorates to the point of becoming unreadable. Physical media is a good start, but DRM-stripped digital is the ideal.
540.
by Retr0id 4mo ago
No? AOSP is open source.

More ›