Retr0id

8 ms·

1. 181.▲
   by Retr0id 2mo ago

   In the imaginary dream world that Adobe, Google et al live in, the final file does indeed have a signature. Each piece of software in the chain must use TPM-like technologies (yes, even GIMP) to make sure it's running a "legitimat
2. 182.▲
   by Retr0id 2mo ago

   Yes, it's a disaster waiting to happen.
3. 183.▲
   by Retr0id 2mo ago

   Signing doesn't really achieve anything when an attacker can manipulate the device into signing arbitrary pixels. Nobody knows how to make a camera that can distinguish honest vs deceptive photons.
4. 184.▲
   by Retr0id 2mo ago

   I've done this btw. I went for the Pixel Camera app since they were the ones bragging the hardest about their "security". Writeup + PoC should be dropping some time tomorrow. Despite 90+ days from initial report, it remains u
5. 185.▲
   by Retr0id 2mo ago

   Almost everyone I know who applied for CVP was successful, it's worth a try.
6. 186.▲
   by Retr0id 2mo ago

   I'm a fan of omakase computing but in an "install stock fedora or debian" sense. I find the maintainers have great taste. I'm not sure any more ink needs to be spilt than that.
7. 187.▲
   by Retr0id 2mo ago

   Not to be that one guy asking why this is on the front page of HN, but why is this on the front page of HN?
8. 188.▲
   by Retr0id 2mo ago

   I didn't say without any software at all.
9. 189.▲
   by Retr0id 2mo ago

   Opus 5 with CVP, no special prompting. In this instance just about any larger model from the last 12 months would have done the trick.
10. 190.▲
    by Retr0id 2mo ago

    I'd be listing tools all day, it's not worth naming anything specific unless a specific target / use case was named. If someone said "we need good package managers", I'm not going to randomly start listing pack
11. 191.▲
    by Retr0id 2mo ago

    Example: https://gist.github.com/DavidBuchanan314/14ad6977ac3b45af746... (yes, it was a very lazy prompt I could easily have googled, but that makes the refusal even more bewildering)
12. 192.▲
    by Retr0id 2mo ago

    There are plenty of pre-2023 resources out there, especially conference talks. But, Claude has no issues discussing glitching if you have CVP.
13. 193.▲
    by Retr0id 2mo ago

    I'm going to be sad when they retire 4.6. It's not my daily driver but it's still my go-to when the other models are being stupid in one way or another (either being too verbose, or lecturing me about how what I'm asking
14. 194.▲
    by Retr0id 2mo ago

    > The statistics bear this out. 4.8 still dominates. Where can I find these stats?
15. 195.▲
    by Retr0id 2mo ago

    If you're prepared to get out a soldering iron and/or chip-clip, you can usually back up and restore whatever IC stores the firmware you're modifying, giving you a recovery path. > we also need good glitching tools There a
16. 196.▲
    by Retr0id 2mo ago

    Using LLMs for RE and bug hunting is a lot of fun. Today I reported an absolute doozy of a bug to Google's VRP. The vuln was in an HTTP API endpoint I don't have the source for, only RE'd client logic. The idea behind the bug
17. 197.▲
    by Retr0id 2mo ago

    Bluetooth RCEs have happened in the past and will happen again.
18. 198.▲
    by Retr0id 2mo ago

    Auto-playing audio used to be fine too, it took a while for certain websites to learn how annoying they could be with it - give HDR some time!
19. 199.▲
    by Retr0id 2mo ago

    That's scary from a user perspective, but harder to monetise at scale as an attacker. Proxy endpoints are just another commodity (and offer recurring revenue).
20. 200.▲
    by Retr0id 2mo ago

    I hope we see "de-smartification" conversion kits that replace the electronics with more straightforward (and repairable) offline equivalents. The ultimate AV.
21. 201.▲
    by Retr0id 2mo ago

    > Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using “classic” Android malware is infecting the device to recruit it into a botnet People do pair them with their phones, thoug
22. 202.▲
    by Retr0id 2mo ago

    A significant fraction of HN users are either are "tech elites" themselves or have paychecks that depend on them.
23. 203.▲
    by Retr0id 2mo ago

    "Tech elites" are so deeply intertwined with capitalism that they might as well be synonymous.
24. 204.▲
    by Retr0id 2mo ago

    We gave websites the ability to auto-play audio, then they showed they couldn't be trusted with this privilege and we took it away again. We can do the same with HDR images, gating them behind a "click to view", or "allo
25. 205.▲
    by Retr0id 2mo ago

    I'm on an SDR setup so I wasn't expecting to see the proper effect, but the square labeled "SDR White" is actually `rgb(220, 220, 220)`.
26. 206.▲
    by Retr0id 2mo ago

    It seems like opus 5 has fundamentally bad judgement when it comes to writing, and no amount of prompting can fully eliminate it.
27. 207.▲
    by Retr0id 2mo ago

    I was imagining slime-mold-based logic cells or something
28. 208.▲
    by Retr0id 2mo ago

    > The switches are around $3 a piece $3*17*17 = $867 - ouch!
29. 209.▲
    by Retr0id 2mo ago

    Older versions of mspaint had shear but not rotation (to arbitrary angles), and you could use the same approach to achieve rotation via shearing.
30. 210.▲
    by Retr0id 2mo ago

    Stop making TUIs, stop making GUIs, and make more CLIs. Claude can read the help text and efficiently drive it directly, without needing a vision model in the loop. Then I can go outside and do more something more interesting while Claude p