chlorion

25 ms·

271.
by chlorion 4y ago
`curl | sh` is not signed by a CA. With a conventional package manager, the contents of the package itself is signed, not just the connection to the mirror that hosts the package itself. Having a secure connection to the mirror is not nec
272.
by chlorion 4y ago
This seems like a self imposed limit rather than something fundamental. I am not sure why people get so hung up on the stdlib's stability guarantees. We could have a second unstable "nonstandard" library for example, and elim
273.
by chlorion 4y ago
I don't think they are arguing that there should be no bugs. >Security engineering is the field of practical mitigations Somehow I've managed to use bounds checking in anything I create, and I'm not even an engineer, just
274.
by chlorion 4y ago
You can write awk scripts directly if you start a file with a "awk -f" shebang or similar! I am not totally sure if this is what you mean or not, but it's much nicer than embedding the script into a bash source file.
275.
by chlorion 4y ago
>some people get the actual work done and move on These people's "actual work" often ends up causing endless streams of security vulnerabilities and bugs too. Most of the same people you are referring to don't seem to
276.
by chlorion 4y ago
This seems like an example of not reading the manual and then blaming the tool. The switch to dump what is executing is -d or --debug, the manpage has this listed in the list of flags you can pass, and they are even sorted alphabetically wh
277.
by chlorion 4y ago
The Linux firewall is designed specifically to be able to track and count packets by IP address and other metedata, and can do so extremely efficiently. Setting up an IP based rate limiting rule in nftables takes a few minutes at max, and I
278.
by chlorion 4y ago
I have been circumventing this issue purely by accident it seems. I have always had ssh-keygen write out the keys to a custom path like ~/.ssh/keys/$service/$key{,.pub} and configured each host's "identity&quot
279.
by chlorion 4y ago
There are code execution vulnerabilities in common software, including the kernel and your favorite browser, probably at least once a month, and likely more. You can go checkout a CVE listing website if you don't believe it. The thing
280.
by chlorion 4y ago
I understand where you are coming from, but I think at the end of the day, if there are people on $platform who are willing to contribute, that's all that actually matters. If there aren't enough users, there will be nobody to sup
281.
by chlorion 4y ago
Nobody is asking for AI in general to be illegal, only training on code you don't own and then emitting it for profit. Why can't they train on code that they own, such as the windows source code? Why doesn't copyright law app
282.
by chlorion 4y ago
Why are wine developers and similar required to do clean room implementations to not be sued then? Simply reading the leaked source code of Windows makes you not eligible to contribute to wine. Why is Windows source code so much more import
283.
by chlorion 4y ago
Python's pattern matching also isn't an expression, it's a statement and creates bindings that persist outside of the match block! This is a very strange way to do things but python for some reason is allergic to expressions.
284.
by chlorion 4y ago
Map, filter and similar can be chained together and composed much better than comprehensions I think. I realize that it's probably not your opinion that comprehension are superior, (although it might be) but rather the general python s
285.
by chlorion 4y ago
Yeah open source is all about working for free for other people and not about anything else. We can read the story of why RMS came up with the idea of copyleft and it boils down to "I wanted to work for free for other people" and
286.
by chlorion 4y ago
Free software has nothing to do with money or not paying for a product. You can educate yourself with the following resource: https://www.gnu.org/philosophy/free-sw.html
287.
by chlorion 4y ago
Quoting "celebrities" as if their word is infallible for some reason is just silly. Torvalds has ranted about many things he knows nothing about and this is no exception. His opinions belong in the trash bin and should be ignored,
288.
by chlorion 4y ago
On my desktop I have a python script that selects N random words from the list I obtained from the eff website (link below). Something to note is that the regular "random" standard library module in python is not intended for pass
289.
by chlorion 4y ago
It's trivial to prove that this is true for most software. Luckily modern OS's are able to measure and report various performance stats for processes. You can open some software such as htop right now, and it will show how much CP
290.
by chlorion 4y ago
ChatGPT is a language model, it does not "understand" anything, concepts, words or otherwise. It is even programmed to give you a canned response saying something roughly equal to this when asking it about its comprehension abilit
291.
by chlorion 4y ago
Make sure to read this before using vim for anything crypto related! https://github.com/vim/vim/issues/638 To sum things up, the Vim maintainers are totally ignorant on the topic of cryptography, but what&#x2
292.
by chlorion 4y ago
Could you explain a little bit more in depth on how to do this on firefox?
293.
by chlorion 4y ago
You can directly ask it whether it is capable of reasoning and it tells you it's not, and that it's just a language model that is not capable of reasoning or self improvement or something along those lines. Another example, ask it
294.
by chlorion 4y ago
Chrome and Edge not functioning without overcommit is not the fault of the kernel though. The browsers will allocate more memory than is physically available in the system but often not "touch" it. Without over-commit this causes
295.
by chlorion 4y ago
This is a really good example of Torvalds toxic attitude and absolutely horrific attitude towards security. This is an occurring pattern unfortunately. Git not being prepared for this is going to cost a lot of time and money for a very larg
296.
by chlorion 4y ago
You actually think this program is capable of thoughts like an organic being is? That's really scary! We need to educate people about what's going on "under the hood" with these things a lot better I think. This algorith
297.
by chlorion 4y ago
Its only within the last year or so that Firefox supports OS level process based site isolation! Chromium supported it from the start afaik! Even to this day Chromium is superior wrt security, but I am sure the gap has narrowed quite a bit.
298.
by chlorion 4y ago
All drug users are horrible criminals who want to stab you for their next hit!!! There are definitely no drug users who are regular people who don't commit any non-possession related crimes!! Fox news told me drug users are the cause o
299.
by chlorion 4y ago
I have the exact same settings on those specific variables. I do not experience any stuttering at all. I am on a pretty powerful system though, I have a Ryzen 3900x and 32GB RAM which may be why I am not effected by this. I also have the ga
300.
by chlorion 4y ago
There were (or are?) some older call of duty games being sold on steam that had unpatched RCE vulnerabilities in them. Simply joining a server ran by a malicious host can result in the players system being totally compromised. These games w

More ›