Sephr

49 ms·

541.
by Sephr 9y ago
NYT is portraying this issue as a technology race when it's really just a surveillance infrastructure conflict of interest. Qualcomm and Broadcom make closed source basebands, which are used (backdoors) and abused (zero-day exploitatio
542.
by Sephr 9y ago
It's described in the first tweet on that twitter link. It will be out this year.
543.
by Sephr 9y ago
Peerweb¹ will be much more user-accessible since it works with normal browsers and retains your current URL structure (even for user-generated content). Additionally, our optional resource sharing permission manager app (which supports Wind
544.
by Sephr 9y ago
OFTN Inc. | Android & Electron Developers | Go & JavaScript (ES8) Developers | Part Time and Full Time | Remote | Hourly We are building an application for Android and Windows that allows users to send audio with low-latency over a
545.
by Sephr 9y ago
Devices that run for 20 to 30 years are bound to be exploitable, even over "isolated" internal networks. A 30 year old no-updates secure webserver seems almost impossible given current security research progress.
546.
by Sephr 9y ago
bit.ly had a similar vulnerability that I detected in 2008 through their bookmarklet. Unfortunately it seems I lost my exploit PoC. https://eligrey.com/blog/bitly-vulnerabilities/
547.
by Sephr 9y ago
This is affiliate link blogspam. You can find the same info about GlassWire written in better English directly on their own website.
548.
by Sephr 9y ago
Maybe for AMD GPUs, but getting consumer Nvidia GPUs working with VT-d on Nvidia's drivers is a little difficult. GPU passthrough is not something Nvidia wants to support on consumer GPUs. Edit: s/very/a little/
549.
by Sephr 9y ago
OEM doesn't mean operating system, it means original equipment manufacturer (e.g. PC maker). You seem to have misread my comment.
550.
by Sephr 9y ago
You will not find significant fundamental hardware differences between the latest high-end Apple and Dell laptops. > As it is, it’s the opposite: Macs run both Windows and Linux “easily”, while other vendors’ buggy hardware has to be pat
551.
by Sephr 9y ago
Notifying the government early would only serve towards helping the government temporarily exploit this vulnerability for intelligence purposes. It wouldn't make sense to notify them until progress was made with mitigations.
552.
by Sephr 9y ago
As a customer and not an OEM, what would they do with this information other than ask other parties to hurry with updates? The mitigations required OEMs to send firmware, microcode, and software updates.
553.
by Sephr 9y ago
Correct, I am referring to Soylent as-is, with its current marketing copy. The company should not have to suggest unhealthy preparations to get around unjust import laws.
554.
by Sephr 9y ago
The corruption is so bad that the sugar industry may have had a hand in writing the import/export laws for Canada. High-fat foods like Soylent are illegal to import there.
555.
by Sephr 9y ago
Microcode is a little more capable than that. See https://media.ccc.de/v/34c3-9058-everything_you_want_to_know... Edit: s/Intel m/M/
556.
by Sephr 9y ago
The author's navigator.webdriver fix is easily detected, though of course it is fixable with changes to Chrome. This cat and mouse game probably isn't worth pursuing against dedicated adversaries. if (navigator.webdriver ||
557.
by Sephr 9y ago
This doesn't prevent your cell carrier from tracking you.
558.
by Sephr 9y ago
Also works with valueOf: let i = 0, a = {valueOf: () => ++i}; if (a == 1 && a == 2 && a == 3) { console.log("all equal"); } Object.defineProperty (modern version of __define[GS]etter__):
559.
by Sephr 9y ago
Do you allow intersex people to join Leap?
560.
by Sephr 9y ago
Correct. I wanted to include that, but I couldn't fit it in the 80 character title limit.
561.
by Sephr 9y ago
Any referred domain had full access to the referring domain (even across multiple redirects). This means badsite.example can have access to your Google account just from clicking on a Google search result. I made an exploit that worked on T
562.
by Sephr 9y ago
Not just for archiving, but also for playing at higher framerates and resolutions. 30fps games give me headaches but the same game running at 120fps can make a huge difference.
563.
by Sephr 9y ago
Those prerequisites aren't necessary if you can figure out how to compromise the secure enclave remotely.
564.
Publicly-disclosed UXSS flaw was exploited against Opera users for over 2 years(eligrey.com)
18 points by Sephr 9y ago|4 comments
565.
by Sephr 9y ago
> who believed that a malicious actor or security breach was to blame This was a security breach. Their anti-spam system should block repos by freezing the module name and returning blank files, not by deleting the entire module and su
566.
by Sephr 9y ago
Not until we have a fully accurate theory of physics and perfect models for the CPUs.
567.
by Sephr 9y ago
This is similar to how I detected total CPU cores in 2013 to implement navigator.hardwareConcurrency: https://eligrey.com/blog/cpu-core-estimation-with-javascript...
568.
by Sephr 9y ago
A Google Project Zero member said that they got Meltdown working on a Cortex-A53.
569.
by Sephr 9y ago
I warned about high accuracy SharedArrayBuffer-based timers on Hacker News[1] when Firefox and Chrome were adding SharedArrayBuffers. Glad to see people finally waking up to the fact that high accuracy timers are security vulnerabilities on
570.
by Sephr 9y ago
These cache vulnerabilities can probably be mitigated with lower performance penalties on CPUs with Intel CAT. It's only available on Intel's Xeon SKUs though.

More ›