hnlmorg

34 ms·

511.
by hnlmorg 6mo ago
HN users aren’t typical home users. Also I’m really not seeing many people here “bikeshedding” over their home gear. Are you sure you’re reading these comments and not some other IPv6 discussion? Because those conversations definitely do ha
512.
by hnlmorg 6mo ago
> Are we not? Because I suppose most people here are only disgruntled by a new protocol that changes how their home router works, and having to spend some learning effort. I did make the context pretty clear when I said: > the problem
513.
by hnlmorg 6mo ago
It’s literally in the opening post you replied to: > A local privilege escalation to root via an exploitable service? > Doesn't Linux have one of these CVEs...each week? Why else would people be talking about docker, and user&#x2
514.
by hnlmorg 6mo ago
> and that's fairly easy to reason about for me But we aren’t talking about someone technical glancing at their home routers firewall. We are talking about explaining a network topology to enterprise teams like change management, CI
515.
by hnlmorg 6mo ago
For exactly the reasons I stated
516.
by hnlmorg 6mo ago
Easier if you’re a native English speaker. Harder if you’re not. My only gripe with IPv6 addresses is they look too similar to MAC addresses. But as a representation, I think they’re absolutely fine.
517.
by hnlmorg 6mo ago
The nice thing about NAT is it makes the security model easier to reason about. By this, I don’t mean it’s more secure, because I know it isn’t. But it is a lot easier to see and to explain what has access to what. And the problem with ente
518.
by hnlmorg 7mo ago
But thats not a daemon then. Thats a completely different type of exploit from the ones we were originally talking about. Yes, if a desktop application has a bug then it can do damage. But at that point, who cares about sudo? The exploit al
519.
by hnlmorg 7mo ago
For the reasons I’ve already stated: daemons don’t run with permissions to write into users directories. You’ve shifted goal posts to now talk about desktop applications when the topic was originally about daemons
520.
by hnlmorg 7mo ago
> Interesting. If that’s possible It’s not possible. At least not unless those users have already borked their own system. The previous poster was clutching at straws.
521.
by hnlmorg 7mo ago
How are you going to do that without write access to the users home directory? Like I said before, your RCE exploit will be running as the user and group of the service you exploited. For example www:www So you’re not going to be able to wr
522.
by hnlmorg 7mo ago
Agreed. And since when is forking a web view “light weight” too? It might be lighter than Electron, but that’s such a low bar that it’s not a brag worth making.
523.
by hnlmorg 7mo ago
Of course it matters if they disabled password authentication. If you require password authentication when running sudo then an attacker has to find a RCE exploit and then crack a password. Which is waaay beyond any effort the average att
524.
by hnlmorg 7mo ago
> And if the target uses sudo at all you don't even need an exploit! Why would a target executable use sudo? There are proper mechanisms for automated elevation of permissions and sudo isn’t it. sudo is designed for user interactivi
525.
by hnlmorg 7mo ago
That’s just the docker daemon. The actual docker services would (or at least should ) still be running as its own user/group just like they would if you were running them on the host. And that’s exactly how any reputable image would b
526.
by hnlmorg 7mo ago
Only if you’re running daemons as root. Which would be an idiotic move to begin with because that’s not how distros package their services. So you’d have to intentionally make this mistake.
527.
by hnlmorg 7mo ago
> Every database you have ever used reads and writes to the filesystem, exactly like your code does when it calls open(). Nope. There are non-persistent in-memory databases too. In fact, a database can be a plethora of things and the stu
528.
by hnlmorg 7mo ago
“Higher quality” isn’t an objective measurement though. And it certainly doesn’t matter if the end result is that people cannot afford to buy it. What I’d be interested to understand is whether changes to materials (be that buildings or hom
529.
by hnlmorg 7mo ago
The problem isn’t the present tense. The problem is once those artefacts are destroyed then they’re destroyed forever.
530.
by hnlmorg 7mo ago
Having worked in both the US and EU, I can tell you the quality of life is vastly better in the EU. US does have some perks for sure. But there are so many issues of its own and those issues are almost always pushed downwards to the most vu
531.
by hnlmorg 7mo ago
An earlier build used SDL directly. There were reasons I didn’t choose Fyne and that was basically that the effort wasn’t much less than working directly with SDL due to various (potentially self imposed) constraints. I then switched to Wai
532.
by hnlmorg 7mo ago
A building collapsing isn’t the only way people are affected by choices in construction. But if you want to talk about worst case scenarios then I can pick out some examples in IT too: We constantly see people’s PII leaked on the internet,
533.
by hnlmorg 7mo ago
I’ve done both too. And I honestly don’t like the box model. But I will admit I’ve focused more on desktop than mobile app development. And the thing about sizing stuff is it’s a much easier problem for desktop than mobile apps, which are f
534.
by hnlmorg 7mo ago
This mind set of yours is a relatively recent development. Open source never used to be like that. And in fact, if it did operate the way you claimed, the open source ecosystem would never have grown into even remotely the size it is today.
535.
by hnlmorg 7mo ago
> all of them are side effects of solutions to very real UX problems that couldn't be solved in any other way. Except they had been solved in other ways and the problem was people insisted on using web technologies to emulate those
536.
by hnlmorg 7mo ago
As a user, I don’t really care about the building materials used in construction. But that doesn’t mean builders should cut corners.
537.
by hnlmorg 7mo ago
JavaScript didn’t kill Flash a Java. The web becoming cross platform did. People started browsing on a plethora of devices from the Dreamcast to PDAs. And then Steve Jobs came a long and doubled down on the shift in accessibility. His stanc
538.
by hnlmorg 7mo ago
I wrote web pages in 1995. There was actually plenty you could do, but it was all server side driven. And the ironic thing is you are chatting on a forum that could have easily been built in 1995.
539.
by hnlmorg 7mo ago
Yeah but all of this is a symptom of a broader problem rather than reasons why the history API is useful. SPAs, for example, require so many hacks to work correctly that I often wonder to myself if they’re not really just a colossal mistake
540.
by hnlmorg 7mo ago
> unfortunately the build now fails with "frontend.go:39:12: pattern all:frontend/dist: no matching files found" How are you trying to build it? Are you calling make? Also what OS are you on? make build > i am

More ›