Veserv

62 ms·

691.
by Veserv 3y ago
Were you involved in a Common Criteria certification at EAL5 or higher? Anything below EAL5 is just paperwork. As stated above, EAL4 is explicitly only intended to certify a system protects against casual and inadvertent attacks. Checkbox s
692.
by Veserv 3y ago
And still, despite the weakening, hardly anybody passed even the watered down requirements. Large vendors like Microsoft complained that the bidding process was unfair because they were not even allowed to compete just because they could no
693.
by Veserv 3y ago
Partially correct. Cybersecurity is broken because there are no consequences, but cybersecurity is not broken because there is no money in it. Large corporations spend literal mountains of money on cybersecurity, but cybersecurity is broken
694.
by Veserv 3y ago
Point to literally anybody on the development team who claims it can stop a small team of professionals with a 10 M$ budget from finding a remote exploit. That is a tiny fraction of what a state actor can deploy and constitutes at best a lo
695.
by Veserv 3y ago
Did you know about this previously? Then why did you lie previously claiming there have been no escapes? If you did not know about this previously, then why should I believe someone who boldly asserted that a system was "virtually impo
696.
by Veserv 3y ago
Really? I typed “Xen VM Escape” into Google and this is the first hit mentioning at least 4 critical escapes between 2015 and 2017. https://www.csoonline.com/article/561467/xen-hypervisor-face... You did not even
697.
by Veserv 3y ago
That is significantly more bandwidth than a DDR5 memory bus. Is there something about PCIe that makes it infeasible to use as a memory bus? Otherwise that just seems like a ton of free memory bandwidth just being left on the table.
698.
by Veserv 3y ago
Because it is important to know who has control of the thing if they control the thing to park illegally, scam people, or dump toxic waste into the river. It does not need to be public, but the responsible party should be identifiable a
699.
by Veserv 3y ago
That is not what they said. If they meant that, they would say: "Apply Pay doesn't collect any transaction information." They explicitly added the clause: "that can be tied back to the user". That means they do coll
700.
by Veserv 3y ago
Excellent, since you wish to run a cost-benefit analysis you can first start by citing the research you used to conclude that the abuses of the current system are small. That would give us a baseline for analysis. It is then easy for you to
701.
by Veserv 3y ago
Why does that matter? I said that pseudonymity is perfectly fine, there just needs to be a straightforward and effective means of piercing it when there are legitimate legal purposes. Are you arguing that because it is not a majority of cas
702.
by Veserv 3y ago
Not all are bad, but they are frequently abused to not only protect privacy, but to protect against legitimate legal need. It is like hiring a contractor on your house who gives you a false name so they can skip out of town when you figure
703.
by Veserv 3y ago
Just ask the penetration testers and offensive researchers if there is any company they and everybody they know can not breach. Anybody who can not protect against even commercial attacks like that is hopeless against state actors. You are
704.
by Veserv 3y ago
I do not work on verification directly, so I do not know the details. I believe at a high level you generally have a automated first pass which generates a source<->machine trace. You then have multiple independent reviews validating
705.
by Veserv 3y ago
What do you want me to say? That is the work that you must do and that is routinely done. It is annoying, but it is not hard or special. Hardly a nightmarish problem if it gets solved routinely at scale across a entire industry.
706.
by Veserv 3y ago
I mean, this class of attack is defeated as a matter of course in high reliability applications like aerospace. You just check the compiler output precisely corresponds to the compiler input. You need to do that anyways to prevent miscompil
707.
by Veserv 3y ago
Yes they have. Tesla Autonomy Investor Day 2019 https://www.youtube.com/live/Ucp0TTmvqOE?si=blLBL58Qv_qjwcAn At 3:13:41. Robotaxis is clearly written on that slide. Elon Musk is talking about robotaxis for minutes as w
708.
by Veserv 3y ago
Even according to the extremely strict standards for fraud in the US, around the time you make unequivocal statements. In 2019:“ I think we will be feature-complete full self-driving this year, meaning the car will be able to find you in a
709.
by Veserv 3y ago
Can you point out where in their contracts or privacy policy they have legally binding terms that irrevocably dismiss their right to give your messages to advertisers? If they have no intention to sell, then they have nothing to fear by put
710.
by Veserv 3y ago
They mean software-filled. On “page fault (really a illegal memory access)” you walk a software data structure to determine if there should actually be accessible memory there then you “page in (update the MPU to make the memory accessible,
711.
by Veserv 3y ago
Costs, not salary. Overhead is usually 1.5x-3x salary and I was throwing in some profit for good measure. So the number I threw out is more in the 150 k$-300 k$ range, not the 500 k$ range like you are thinking.
712.
by Veserv 3y ago
You were a inexperienced beginner finding and exploiting tens of bugs over a 10-15 week course. In between other courses and learning you only had hours to maybe a few days per bug. On Zerodium [1], a generic Linux LPE pays 50 K$. At normal
713.
by Veserv 3y ago
Using existing techniques, the formal specification is almost always multiple times larger than a formally correct implementation. The accompanying proof is then tens to hundreds of times larger than the specification assuming one is even
714.
by Veserv 3y ago
My knowledge derives from personal experience, but if you want digestible evidence you can go read the books: “Click Here to Kill Everybody” by well known cryptographer Bruce Schneier or “This Is How They Tell Me The World Ends” by the lead
715.
by Veserv 3y ago
Your argument is that Elon Musk knows something we do not about how fast they are improving which is why every single year for a literal decade he has promised a unsupervised self driving system and every single year for that decade he has
716.
by Veserv 3y ago
Thank you for resorting to ad hominem, it shows you have run out of real arguments. But it is sad to see that you can not even resort to ad hominem without making logical fallacies. In case you did not notice, it is Elon Musk who made the u
717.
by Veserv 3y ago
Yes. Any org . A few million dollars guarantees you unrestricted access to any network-connected system. The upper bound of security is unable to make attacks with a 10 M$ return unprofitable. Raising the lower bar just raises the barrier
718.
by Veserv 3y ago
Good thing the most stringent generally accepted burden of proof for intent is “beyond a reasonable doubt”, not “100% mathematically certain”. In his situation, no sane person of even average intelligence would have any cause to believe tha
719.
by Veserv 3y ago
No, they were unequivocal lies. In 2019:“ I think we will be feature-complete full self-driving this year, meaning the car will be able to find you in a parking lot, pick you up, take you all the way to your destination without an intervent
720.
by Veserv 3y ago
How about that time they claimed the Cybertruck beats a Porsche in a 1/4 mile race, but they only did a 1/8 mile race and then just made up a 1/4 mile time based on their feelings? [1] Or that time they lied about 120,000 def

More ›