cyphar

6 ms·

31.
by cyphar 3mo ago
Indeed, but they did have code to use "os/user".Lookup() in a fallback path so I wonder if the issue is that they have some NSS module for user definitions (which wouldn't work with osusergo/static or musl-linked bi
32.
by cyphar 3mo ago
In my experience it is really very quick and easy to get a CVE if you contact MITRE directly, and on paper you do not need to disclose too much. The GitHub CNA is (ironically) very slow by comparison but that is a GitHub issue. Tailscale
33.
by cyphar 3mo ago
As an open source maintainer of a fairly large project, we get reports from Ada Logics and similar firms every once in a while and those are absolutely not the same as a proper security audit (which we've also had commissioned in the p
34.
by cyphar 3mo ago
djb proposed Internet Mail 2000 back in the early 2000s as an attempt to solve this kind of problem without micropayments[1]. As others have said, a lot of the useful emails I get are still ones where the sender probably wouldn't have
35.
by cyphar 3mo ago
It really should not be surprising that we can get very high recovery percentages from batteries -- we do not mine elemental lithium, so the processes we use for extraction are already designed to extract lithium from fairly low-purity sour
36.
by cyphar 3mo ago
I am aware of the history behind Zones and Jails, but my point is still the same -- the (lack of) protection you get against kernel exploits should be the same because the only thing protecting you from escapes is kernel data structures. (I
37.
by cyphar 3mo ago
If there was a similar class of bug in the illumos kernel, it would also allow for a container escape, no? There are many issues with the formulation of containers on Linux (though I think people overstate it whenever bugs like this happen)
38.
by cyphar 3mo ago
Root is not just one thing on modern Linux, almost all in-kernel privilege checks are now gated via (slightly) more fine-grained capabilities and the default capability set for Docker containers disallows module loading (CAP_SYS_MODULE) and
39.
by cyphar 3mo ago
But the CPU is not executing the textual description of your architecture. It executes code. Honestly, I've found that the architecture described to and by LLMs is always a more rosy picture than what is actually generated, no matter h
40.
by cyphar 3mo ago
The abolition of slavery in the US is unfortunately a more complicated story than most people are aware. The 13th amendment removed the legal concept of slavery (except for convicts) but it was still not a crime to do slavery. Slavery chang
41.
by cyphar 3mo ago
I am aware of that (the articles I linked even mention it), my point was that modern fears around literacy are based on data suggesting that child literacy rates have recently declined. If lack of phonics was solely to blame then almost
42.
by cyphar 3mo ago
I've heard a lot of people argue that phonics are vastly superior to "whole word" techniques, and maybe that's true -- I'm definitely not an expert, though it is how I was taught English in Australia ~30 years ago.
43.
by cyphar 3mo ago
I really wonder where all of these people who believe that tests perfectly encapsulate the behaviour of software come from. Maybe it's because LLMs happen to work better when you give them acceptance criteria and people struggle to dis
44.
by cyphar 3mo ago
1. Nobody, not even the Googles or NSAs of the world do that. No single entity has the expertise nor resources necessary to maintain a fork for every open source project they use -- forking and maintaining Linux alone takes teams of people.
45.
by cyphar 3mo ago
"You're right to push back on that. Let me take a step back and reconsider the requirements for an application that people might entrust with their lives."
46.
by cyphar 3mo ago
Be honest, in the counterfactual where he had said that "AI" agents are the next industrial revolution and there is no future for human skills and so on -- would you have still valued his opinion as being effectively worthless?
47.
by cyphar 3mo ago
The man page does say that but there is no mechanism to actually make use of that at the moment. It's not enough for it to be encrypted, it needs to be encrypted with a single-purpose key that is not known by the user. Otherwise the us
48.
by cyphar 3mo ago
To be fair the security argument for secure boot is weakened by the fact that everything is signed by the same set of trusted keys when using the default Microsoft trust root, but on paper it does protect against certain kinds of attacks. (
49.
by cyphar 3mo ago
> Can I ask one question? Why not use hibernation at that point? Not GP but hibernation is completely disabled for lockdown kernels[1], which is always enabled when booting under secure boot for kernels trusted by the Microsoft secure
50.
by cyphar 3mo ago
I'm confused why you're saying this is a Debian-specific thing -- luksSuspend is upstream and was added back in 2009[1] in release v1.1.0[2]. I've used it (though somewhat sparingly) on Arch and openSUSE in the past and it de
51.
by cyphar 3mo ago
Would that be pheonixmaxxing or pheonixxing these days?
52.
by cyphar 3mo ago
I'm also taken aback with how naive folks are about companies, they really seem to have bought the whole "capitalism is efficient" maxim hook, line, and sinker. I really struggle to imagine how anyone in a corporate environme
53.
by cyphar 3mo ago
Why would a carpentry shop buy hundreds of thousands of dollars of power tools without consulting with their employees to see what they actually need to get their job done more effectively? The logic of buying the tools then forcing the emp
54.
by cyphar 3mo ago
I use Cozette[1] at the moment, which is basically a modern form of Dina (the first bitmap font I started with ~15 years ago now). It is pretty nice, though they recently started adding some kanji and I don't particularly like the styl
55.
by cyphar 4mo ago
I'm more of a bitmap font guy (at least, as long as my eyes continue to forgive me for it) but I'm always interested to see what other fonts there are around. It does look quite nice. I must admit when I ran across the second real
56.
by cyphar 4mo ago
I mean, cultures are also a kind of technology, arguably one of the first we developed as Homo Sapiens. In my view the actual issue has always been that cryptocurrency folks don't understand what purpose money serves, mostly because th
57.
by cyphar 4mo ago
"This particular band of gambling addicts have bet money on a particular outcome at a ratio of 68:32, so there is a 32% chance of it happening." Wow, how informative. Maybe I should go check my horoscope for if the Iran war will e
58.
by cyphar 4mo ago
Their point is that that functionality is not available on older kernels (such as those in RHEL 9 and 10) and so most sandboxes will continue to block it outright for a while, though eventually one would expect Red Hat to backport it. (We h
59.
by cyphar 4mo ago
Sure, but that falls under the "no unauthorised GET data" thing I talked about...?
60.
by cyphar 4mo ago
Japanese also underwent simplification post-WW2, but there is important context here. In both cases, the original plan was for Chinese characters to fall out of use entirely via gradual simplifications, but in both cases the simplifications

More ›