cesarb

9 ms·

121.
by cesarb 11mo ago
> USB-C center tongue female design means that the port will break before the cable. With lightning, the cable plug takes all the stress. Are you sure it's the center tongue which takes all the stress, and not the round shell? AFAIK
122.
by cesarb 11mo ago
> Or it could use an RFLAGS bit or a bit in MXCSR or a new register, etc. > Almost anything would be better than an MSR that is only accessible to privileged code. ARM does that: their flag (DIT) is accessible by non-privileged code.
123.
by cesarb 11mo ago
> However, cooperation from the operating system is necessary, as the constant-time execution mode may need to be enabled by setting certain CPU-control bits in protected registers (e.g. IA32_UARCH_MISC_CTL[DOITM]). The way ARM does this
124.
by cesarb 11mo ago
Or an old enough version. For one of the most damaging zero-day vulnerabilities in the Java ecosystem (log4shell), you were vulnerable if you were in the latest version, but not vulnerable if you were using an old enough version.
125.
by cesarb 11mo ago
> Maybe skipping v2 has a negative cost even. I've seen this plenty of times: v1 of some library has one way of doing things, v2 of that library changes to a new incompatible way, and then v2.1 introduces a few extra changes to mak
126.
by cesarb 11mo ago
> Bottom line those security bugs are not all from version 1.0, and when you update you may well just be swapping known bugs for unknown bugs. One great example of that is log4shell. If you were still using version 1.0 (log4j 1.x), you w
127.
by cesarb 11mo ago
> Well, patience as a consumer might pay off in the next year or so when the music stops and hyperscalers are forced to dump their inventories. Their inventories are not what consumers use. Consumer DDR5 motherboards normally take UDIMMs
128.
by cesarb 11mo ago
> Does it route the hot water back into a river? That particular one routed the hot water to a set of fan-cooled radiators (rejecting most of the heat into the air).
129.
by cesarb 11mo ago
Some time ago, I read the environmental impact assessment for a proposed natural gas thermal power plant, and in it they emphasized that their water usage was very low (to the point that it fit within the unused part of the water usage allo
130.
by cesarb 11mo ago
> Real sideloaders (F-Droid users, etc.) When using F-Droid, I don't think of myself as a "sideloader". I'm using an app store (F-Droid), not installing some random APKs. (Yes, the F-Droid store app had to be "si
131.
by cesarb 11mo ago
> This is only true if you use Secure boot. [...] so should be turned off. Then any OS can be installed. You can only turn off Secure Boot because Microsoft allows it . In the same way Android has its CDD with rules all OEMs must follow
132.
by cesarb 11mo ago
> Indeed, an update can't be more malicious than the permissions allow it to be. ...in the absence of sandbox escape bugs.
133.
by cesarb 11mo ago
> Does Google refuse to veriy their firmware if they offer this feature? If a manufacturer doesn't follow the Android CDD ( https://source.android.com/docs/compatibility/cdd ), Google will not allow them to
134.
by cesarb 11mo ago
> Android could have, for example, a 24 hour "cooling off" period for sideloading approval. And, to prevent the scammer from simply calling back once the 24 hours are gone, make it show a couple of warnings (at random times so
135.
by cesarb 11mo ago
> Why should apps have access to a user's SMS / RCS? It could be an alternative SMS app like TextSecure. One of the best features of Android is that even built-in default applications like the keyboard, browser, launcher, etc c
136.
by cesarb 11mo ago
> So.. all this drama over an alert(yes/no) box? A simple yes/no alert box is not "[...] specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from
137.
by cesarb 11mo ago
> And it's the actual GPU that's outputting a HDMI signal over the Displayport connector, which the adapter than rewires in to a HDMI shaped connector. There are two kinds of DP to HDMI adapters. The passive ones are like you s
138.
by cesarb 11mo ago
> There's also the issue that these things have to compete with what's available now . [...] But it'll never be a full-time replacement, because the modern 4k displays I have are substantially clearer. What's availab
139.
by cesarb 11mo ago
> [...] only offers USB-A as far as I know. And many other keyboard and mouse brands are in the same boat. Many new computers (including this Steam Machine) have exactly two USB-2-only USB-A ports (the rest of the USB ports being more ca
140.
by cesarb 11mo ago
> You can't reorder pages. [...] or keep them separated and organized by subject without carrying even more of them. It's instructive to think on how this was done in the pre-computer era. We used ring binders, which allow one
141.
by cesarb 11mo ago
> but label it accurately, it's different hardware so it needs to have a different version label In my experience, TP-Link always has the hardware revision on a label on the outside of the box.
142.
by cesarb 11mo ago
> AI hallucination? --target does not exist in GCC. It might also be someone used to a system which symlinks "gcc" to clang for compatibility (IIRC, that's the case at least on OS X).
143.
by cesarb 11mo ago
> This sounds like a temporary issue. There is nothing more permanent than a temporary solution.
144.
by cesarb 11mo ago
> it will just crash the program, but will not cause an expensive and urgent CVE ticket. Unfortunately, security hysteria also treats any crash as "an expensive and urgent CVE ticket". See, for instance, ReDoS, where auditors w
145.
by cesarb 11mo ago
403 until you go to https://graydon2.dreamwidth.org/ first with JavaScript enabled and temporarily allow third-party scripts from awswaf.com.
146.
by cesarb 11mo ago
> Instead of securing the "chain", we should instead isolate every library we import and run it under a sandbox. Didn't we have something like that in Java more than a decade ago? IIRC, you could, for instance, restrict wh
147.
by cesarb 11mo ago
> the US can update it all remotely, including the hardware now thanks to things like intel ME Let's not be excessively alarmist; AFAIK, the Intel ME is not (unless you're using things like vPro) exposed directly to the network
148.
by cesarb 11mo ago
> Maybe I’m misunderstanding something - if I store my data elsewhere , am I not supposed to encrypt it anyway "Cloud" is not only for storage; it's also for compute. Doing compute directly on encrypted data (homomorphic e
149.
by cesarb 11mo ago
> This applies to any company, doesn't it? Your home country can tell you "Give us your data" and you have to comply. Not all countries have an equivalent to the USA CLOUD Act.
150.
by cesarb 11mo ago
> If you own property in country A [...] But then, that's because you own property in country A, not because you're a citizen of country A! The same would happen if you were a citizen of country B, lived and worked in country B

More ›