bdd8f1df777b

11 ms·

91.
by bdd8f1df777b 3y ago
That's the conventional thinking, but it has been proven false by this xz incidence. The maintainer of xz did not inject any malicious code into the git repo, but only in the tarball, exactly because the latter is subject to far fewer
92.
by bdd8f1df777b 3y ago
Ah, I was wrong assuming that npm is cloning every git repo of the dependencies.
93.
by bdd8f1df777b 3y ago
The git repository has been scanned by many eyes. People, other than the authors, do read the source code on GitHub or clone/fork the repo and try to build / modify when they want to contribute. By contrast, almost no one reads th
94.
by bdd8f1df777b 3y ago
I smell a new backdooring opportunity. Modifying .gitattributes to surreptitiously sneak some binary files into the GitHub release tarballs. Few poeple would take a look at .gitattributes.
95.
by bdd8f1df777b 3y ago
Well, I'm certain Facebook would be glad if xz is replaced everywhere by zstd which they maintain. You can't force them to pay for xz when they already maintain a replacement.
96.
by bdd8f1df777b 3y ago
Just a note: sing-box can do the same thing too. ( https://sing-box.sagernet.org/configuration/outbound/wiregua... )
97.
by bdd8f1df777b 3y ago
You are conflating convenience with necessity. Currently large companies also use xz simply because it is configured to be the default in many distributions. If it charges them money, they will just move to zstd, brottoli, gzip or 7z. The f
98.
by bdd8f1df777b 3y ago
Presumably because other people can also utilize the “bug” they create intentionally but looking inadvertently. This backdoor however is activated by the private key only the attacker has so it’s airtight.
99.
by bdd8f1df777b 3y ago
And in this case Facebook did author a replacement--zstd. It just didn't get popular enough. And even when it does get popular, it won't replace all usages of xz, only some of them.
100.
by bdd8f1df777b 3y ago
I would think a Chinese state hacker would not assume a Chinese name, just in case he was discovered like now.
101.
by bdd8f1df777b 3y ago
Bazel has its problems but the readability is definitely better. And bazel BUILD files are quite constrained in what it can do.
102.
by bdd8f1df777b 3y ago
Office computers do not need high end CPUs. In fact, I know that several places have so old computers (with Intel chips) that they are probably slower than modern day Chinese processors.
103.
by bdd8f1df777b 3y ago
It was that in the beginning. Then Zuckerberg had a change of heart and was willing to cooperate with the Chinese authorities on censorship and came to Beijing multiple times to express his newfound friendliness. Yet the Chinese government
104.
by bdd8f1df777b 3y ago
It's my understanding that spore generating vegetables just spread their spores around by wind or other natural means. Unlike angiosperms that often spread their seeds with the help of animals.
105.
by bdd8f1df777b 3y ago
Are you the GPT here?
106.
by bdd8f1df777b 3y ago
Yet it is incredibly difficult to hide the underlying hardware or low level library differences. Not without slowing things down significantly.
107.
by bdd8f1df777b 3y ago
The cookie warning regulation is bad, but only mildly so.
108.
by bdd8f1df777b 3y ago
Maybe imprisonment of the exec would do too. Unlikely to happen though.
109.
by bdd8f1df777b 3y ago
It’s strange that the dating spps company are sitting on a gold mine of user data and has done little on it. Aside from the usual way of monetizing by ads, they may sell courses on how to improve attractiveness and improve profile. Their da
110.
by bdd8f1df777b 3y ago
Because the legality for the paying customers is much more complex to navigate.
111.
by bdd8f1df777b 3y ago
WoW, I thought my VPN failed (to properly traverse the GFW) when the date filter just didn’t show up on iOS.
112.
by bdd8f1df777b 3y ago
That’s only theory. In reality, people who spin everything in a positive light survive longer in a big organization.
113.
by bdd8f1df777b 3y ago
I'm talking about the LAN address. The globally routable address changes every time I reboot my router, so I don't use that for LAN. But my LAN IPv6 address isn't better. I don't know if it is stable, and it is too long.
114.
by bdd8f1df777b 3y ago
From my own experience, 1. Most Chinese websites or apps don't work properly or at all in a pure IPv6 setting. They claim to be IPv6 compatible, but have a lot of problems (e.g. images not loading). 2. Most Wi-Fi networks (be it home W
115.
by bdd8f1df777b 3y ago
I've configured and preferred IPv6 everywhere. My home computer, my VPS, etc. But, local address is something I can't figure out in IPv6.
116.
by bdd8f1df777b 3y ago
You get a new IPv6 address very quickly (mostly every day or every week). That makes tracking difficult too. While the prefix is mostly stable, that is akin to the public CGNAT address.
117.
by bdd8f1df777b 3y ago
I grow up in China seeing news about the policy of IPv6 adoption every year, but the real adoption rate is still abysmal here.
118.
by bdd8f1df777b 3y ago
Is that sarcasm?
119.
by bdd8f1df777b 3y ago
Yes, but not so good when the JIT-ed Python can no longer reference those fast C code others have written. Every Python JIT project so far has suffered from incompatibility with some C-base Python extension, and users just go back to the sl
120.
by bdd8f1df777b 3y ago
Does Google have any say on who is at the helm of Mozilla? A genuine question, not a rhetorical one.

More ›