Tharre

8 ms·

61.
by Tharre 10mo ago
Well, the issue isn't kernel vs user space, but you are correct that you still need a custom ROM and/or root unfortunately. I had assumed Android had also allowed netlink sockets for WireGuard but alas they did not. So the app can
62.
by Tharre 10mo ago
Android kernels 4.19 and higher should all have support included for WireGuard unless the OEM specifically disables it: [0]. The Pixel 8 ships with the android 14 6.1 kernel so it most definitely should have WireGuard kernel support. You ca
63.
by Tharre 10mo ago
You're looking at the wrong thing, WireGuard doesn't use AES, it uses ChaCha20. AES is really, really painful to implement securely in software only, and the result performs poorly. But ChaCha only uses addition rotation and XOR w
64.
by Tharre 11mo ago
https://web.archive.org/web/20251107235749/https://kaipereir...
65.
by Tharre 11mo ago
As others have already mentioned, the bit banging part is mostly handled by the PIO, so you mostly just spend CPU cycles on 4b5b encoding and scrambling. The more immediate practical problem though is that this is transmit only, no receive.
66.
by Tharre 1y ago
> Guarantee? Not by law but it will be hard for them to take that away. Last year they removed the ability to register[0] yubikey FIDO2 tokens affected by the EUCLEAK 'vulnerability', despite it not posing any security risk eve
67.
by Tharre 1y ago
You're not thinking this through. Yes resistance goes up the warmer the cable gets, but you know neither the resistance of the cable at 20°C nor the temperature of the cable . Simple example, say the user is charging their phone, you
68.
by Tharre 1y ago
It's not resistance per se that you care about, it's how much the cable is heating up which is mostly dependent on resistance per meter . Imagine 2 cables with the same resistance, one 0.5m long and the other 2m. At a set amount
69.
by Tharre 1y ago
> More evidence that USB-C is an insanely overengineered spec. Cables should be dumb pipes, not devices with their own active circuitry. Why, to what end? They don't add any noticeable amount of cost to the cables and it's a wh
70.
by Tharre 1y ago
The flip side of that of course being that they increasingly force you to do your banking on a locked down smartphone for the same reason. Doesn't seem like there's a lot of middle ground between being responsible for your mistake
71.
by Tharre 1y ago
The number of combinations is irrelevant if you're not relying on randomness. Graphene sets the tag to a static value on deallocation[0] to prevent use-after-free, you don't even need to guess! The same is true for a lot of buffer
72.
by Tharre 1y ago
Very roughly, and assuming mid-range is around 400-500 bucks like the fairphone: - Memory tagging is still pixel exclusive for now, but it's part of ARMv9 so it should be available on more devices in the future unless they disable it -
73.
by Tharre 1y ago
For people out of the loop, parent is referring to TikTag[0], a side-channel speculative execution attack breaking MTE in a probabilistic defense scenario, and the weird cope coming from some people that "MTE was only supposed to be a
74.
by Tharre 1y ago
No secure element, no memory tagging support, no proper cellular baseband isolation, no verified boot, taking months to ship security updates .. the list is long. From a security/privacy perspective the fairphone is on the worse side o
75.
by Tharre 1y ago
> To ensure reproducible / clean builds, I thought makepkg would always be run in a sandbox/chroot environment. The damage done would be localised to that sandbox. makepkg runs in a fakeroot environment, but this is not a secur
76.
by Tharre 1y ago
First of all, this is incorrect, the checking would have to happen _before_ even building the package since malware is already being executed at that point. But more importantly this is a terrible idea in regards to privacy/infosec.
77.
by Tharre 1y ago
They should all show you the PKGBUILD before building, yes.
78.
by Tharre 1y ago
These 183 packages depend on "firefox", and the malicious firefox-patch-bin had a provides=( 'firefox' ) clause in it. That's why they all get listed on that page. The provides clause is useful when you have multipl
79.
by Tharre 1y ago
PKGBUILDs are just bash scripts following a certain function and variable naming convention. Even if you could somehow parse it safely and extract the URLs of the 'source' array, any attacker can just simply put an obfuscated vers
80.
by Tharre 1y ago
On the newer pixel phones (starting with the ones containing the titan chip) you can also mux the SBU pins to the security chip USB interface with "fastboot oem citadel suzyq". And BTW, the SuzyQ cable is nothing more then two pul
81.
by Tharre 1y ago
It's documented here: https://www.rsync.net/products/zfsintro.html Do note the 5 TiB minimum order for it though, it's not something that's enabled on other accounts.
82.
by Tharre 2y ago
> But doesn't the ESP32-S3-WROOM have some large on-chip RAM? They use the same PSRAM chips with relatively bad latency you complained about higher up in the thread. There are boards like those from Pimoroni that even have them on t
83.
by Tharre 2y ago
What difference would the extra 16KiB or whatever instead of the 2 RISC-V cores make? If 520KB is far too little for you, you're likely better off adding a 8 MiB PSRAM chip.
84.
by Tharre 2y ago
I don't see how it would be 'peanuts'. The RP2350 is 2.65x the die size of the RP2040, so about 8000 chips per 3000$ TSMC 40nm wafer gives you $~0.35 per die. Say 10 cents per die for singulation and testing, and another 10 c
85.
by Tharre 2y ago
The RP2350B is the exact same chip just in a larger package with all GPIOs exposed (from 30 to 48 GPIOs). It's the same silicon though with the same E9 errata.
86.
by Tharre 2y ago
Should be noted that this only applies to the rp2040, the ADC silicon bugs were fixed in the rp2350.
87.
by Tharre 2y ago
I have 0 experience in ASIC design, but it's not clear to me that this is fixable at all with just metal layer changes (which are around $50K a pop) like the fixes to previous errata's of the rp2040. And a complete set of new mask
88.
by Tharre 2y ago
It's not an issue for PIO-USB, since the pullup/pulldowns in USB are just used for device and speed detection. And for the pulldowns to do anything the pins have to be high impedance which you can't do in PIO code anyway. So
89.
by Tharre 2y ago
Weird, works for me without javascript. You may be hitting some bot detection thing.
90.
Security through transparency: RP2350 Hacking Challenge results are in(raspberrypi.com)
2 points by Tharre 2y ago|3 comments

More ›