eridius

89 ms·

901.
by eridius 8y ago
None of this is tied to Cloudflare though. Or really to using a cloud provider at all. Of course, if you're not using a cloud provider, then the IP address can be used to figure out what the site is, but the point remains that you can
902.
by eridius 8y ago
When was the last time you actually tried this? Because the reality doesn't match your description at all. First off, you have to put a pretty decent amount of pressure on it to trigger the 3D touch behavior instead of the long press b
903.
by eridius 8y ago
You don't need a link shortening service for that. The website and API can just start changing the URL it includes in the tweet if it determines the original URL is a scam.
904.
by eridius 8y ago
Apple collects less data about you than practically any other company you interact with. They view personal data as a liability, not an asset, and only collect the data necessary to actually provide the revelant service (and they silo it in
905.
by eridius 8y ago
Direct quote from the very first paragraph of the article: > The Birth Trauma Association found that mortality rates are lowest for women who have elective caesareans. The context is comparing maternal death rate for vaginal delivery v
906.
by eridius 8y ago
Code reviews for bugs is very different than security reviews to look for malicious tampering. Apple may have bugs that linger for years, but I'm not aware of any documented case of someone managing to slip a backdoor into Apple softwa
907.
by eridius 8y ago
iOS 12 lets you register a single alternate appearance for Face ID. Assuming the glasses aren't blocking IR, you should be able to register yourself with the glasses as the alternate appearance.
908.
by eridius 8y ago
Maybe for smaller companies, but Apple is very paranoid and AIUI does indeed inspect the hardware to make sure it hasn't been tampered with. I know less about Amazon in this regard but I would expect Amazon to do at least some level of
909.
by eridius 8y ago
FWIW Rust doesn't consider leaking an object to be unsafe. In fact, there's a std::mem::forget() function that can be used to do precisely this. Before Rust 1.0 it was marked `unsafe`, but it was determined that the existence of R
910.
by eridius 8y ago
On the "possible bugs in minimp3" section, the links are all to the current master, which appears to have changed since this was written (e.g. https://github.com/lieff/minimp3/blob/master/minimp
911.
by eridius 8y ago
Apple also said they didn’t even have 7000 SuperMicro servers to begin with.
912.
by eridius 8y ago
The Bloomberg article specifically claimed that Apple themselves discovered the chip in a random spot check. If an Apple employee discovered it, it would have been communicated all the way up to the executive level prior to notifying anyone
913.
by eridius 8y ago
I hadn't seen this before, but searching for "Joe Fitzpatrick Jordan Robertson" finds https://appleinsider.com/articles/18/10/08/security-research... which seems to be what you were referr
914.
by eridius 8y ago
Firefox has something called multi-account containers (this is technically an extension but it's developed by Mozilla) that lets you basically have profiles but on a per-tab basis instead of a per-window basis. It color-codes the tabs
915.
by eridius 8y ago
WebAssembly doesn't really provide any more protection than just highly-obfuscated/minimized JavaScript.
916.
by eridius 8y ago
Using WebAssembly + WebGL/Canvas/whatever to basically replicate Flash is perfectly fine, for games. Using Flash for games was never a problem. Flash was a problem when it was used for non-game things. And I suppose it's poss
917.
by eridius 8y ago
Emscripten let you do that too, compiling to asm.js. WebAssembly certainly is an improvement, but it's not like you couldn't do this at all before. And heck, even without that, there are languages that transpile directly to JavaSc
918.
by eridius 8y ago
It's not clear to me why calling into C++ is expensive to begin with. My best guess is it has to do with switching to a native stack (switching "folders"). So making the stub directly callable from the JIT means not having to
919.
by eridius 8y ago
Any JS engine on an ARMv8.3 chip could benefit from this instruction, not just Apple's JS engine. Sure you can't put other JS engines on an iPhone (at least not without jailbreaking), but this says ARMv8.3 adds it, not "Apple
920.
by eridius 8y ago
Super Micro is a US company. The finished product didn't go through customs. And any individual components that did would have been going to Super Micro, not to Apple or Amazon or any one of the 30 allegedly affected companies.
921.
by eridius 8y ago
If the employer chooses any open-source license whatsoever then you can use the code with the next customer (assuming the next customer is ok with the license). There's nothing special about Copyleft licenses there. Well, except for
922.
by eridius 8y ago
The Bloomberg article claimed Apple employees found the chip. So even if what you're saying is true, the article is at least wrong about how it was discovered, and that casts the rest of it into doubt as well. Also my recollection is
923.
by eridius 8y ago
You could develop software for customer#1 and use the same software for customer#2 with a non-Copyleft license too. The question isn't "does the license enforce that the source must be distributed", it's "will the c
924.
by eridius 8y ago
The fact that "free" in this context means libre is precisely why "free" and "open-source" are distinct concepts, and why you can have something that's "open-source but not free", and even "
925.
by eridius 8y ago
I think these attacks are theoretically real. I don't think these specific instances of the attack as described by Bloomberg are real. The only plausible scenario in which none of Bloomberg, Apple, and Amazon are knowingly lying is one
926.
by eridius 8y ago
No. But gag orders do not require the recipient to lie about it. Someone who is under a gag order simply doesn't comment one way or the other about it. FWIW this is the principle behind warrant canaries. A warrant canary is the practic
927.
by eridius 8y ago
Why not? If Bloomberg's article is true, I'd have actually expected Apple to publish a statement about this a long time ago where they acknowledge the issue (and what it affected and its resolution). There's no reason Apple m
928.
by eridius 8y ago
Or to put it another way: "Apple complies with the laws in the countries where it does business". That said, what you've described is wrong. The data is not "tapped by default". It was widely reported that Apple now
929.
by eridius 8y ago
I can't imagine a universe in which Apple is willing to blatantly lie to their customers in order to please China (especially about such an important topic). That just doesn't seem to be in the realm of possibility. Amazon too I s
930.
by eridius 8y ago
It seems hard to believe that Bloomberg would publish this article if it's completely untrue, but it's also hard to believe that Apple and Amazon would both issue comprehensive denials of pretty much every single claim of the arti

More ›