lima

65 ms·

781.
by lima 7y ago
> Mitigations that are Linux only and hardly effective, hence why Android is now going to require hardware pointer validation on Android 11. What do you mean by Linux only? Modern mitigations are very effective at increasing cost of ex
782.
by lima 7y ago
> Given how modern OSes still insist in using C derived languages at their bottom layer, instead of the Pascal and Modulas from the 90's. On the other hand, the bottom layer is exposed to very little untrusted input nowadays, and
783.
by lima 7y ago
A very good IDE with first-party GUI designer integration, and a big ecosystem of third party components for just about anything. The language itself is not impressive compared to today's options.
784.
by lima 7y ago
Qt, for instance, is still very alive and constantly improving.
785.
by lima 7y ago
There's a lot that we take for granted nowadays, that either did not exist back then, or were expensive commercial products: - Ubiquitous transport layer encryption. - Secure memory-safe programming languages. - Structured data exchang
786.
by lima 7y ago
I fondly remember the days of using Borland Delphi, and then Embarcadero RAD Studio, to build fully-functional GUI applications in a matter of hours. As a teenager, no less. You had great libraries like Jedi/JVCL and various data bindi
787.
by lima 7y ago
Jitsi is not P2P for group conversations - all streams are multiplexed by the server (the videobridge). 100% agreed about spotty connections, it does not handle them very well. As long as everyone has a decent connection and enough CPU, it
788.
by lima 7y ago
The working theory is that they had a practical attack on RC4, which made up a significant percentage of SSL traffic back then.
789.
by lima 7y ago
Yes, they can't constantly send microphone data even if they wanted due to power constraints. They use a dedicated DSP chip with the sole purpose of detecting the hot word.
790.
by lima 7y ago
I don't think NSL can even be used request the actual content of the recordings (vs. "just" the metadata) - a judge would have to sign off on that. Now, clearly there's a lot of questionable practices like secret courts,
791.
by lima 7y ago
> You know that, for data on big corporation's servers, the NSA already gets a copy of everything This is squarely in conspiracy theory realm. Nothing in the Snowden documents or other leaks hinted at this (except for the NSA snoo
792.
by lima 7y ago
How so? The ruling is about agents using thermal imaging technology to bust a marijuana plantation, performed from a car on a public street. The court stated that this does not constitute a search, since any random citizen could've don
793.
by lima 7y ago
Many Android phones have always-on "Ok Google" hotword detection that works exactly like the standalone devices. Source: Mine does, very useful!
794.
by lima 7y ago
Firefox did not have process-level sandboxing till Quantum. Exploit a JS bug in the renderer and you had code execution on the host OS. "Fake news" accusations aren't welcome on HN, people here prefer to disagree amicably.
795.
by lima 7y ago
Anyone can easily verify this by downloading the binaries, and running checksec themselves. Here's the output: $ sha256sum palemoon-bin 0b7f4ad73fc671e20bfb2366aa9d9ad81e82a3c8f63acde7f37063e73fda2141 palemoon-bin $ che
796.
by lima 7y ago
We need both - some kinds of applications need direct hardware access. But the kernel attack surface is huge, even with seccomp and friends. An app on my smartphone or - much worse - an Electron app "sandboxed" in a flatpak on my
797.
by lima 7y ago
The opposite is the case - web applications are one of the best things to happen, security-wise, in a long time. Web applications are fully isolated and sandboxed, have fine-grained permissions, are easy to inspect, and the runtime is built
798.
by lima 7y ago
Just ran checksec on Pale Moon's Linux binary distribution - their binaries are built with no mitigations whatsoever. ASLR disabled, no stack canaries, no fortify. This whole project appears to be a security disaster and nobody should
799.
by lima 7y ago
The big difference is that Google is building well-specified new web standards which are quickly adopted by other browser vendors, rather than adding a heap of poor proprietary browser extensions that become de-facto standards. They even de
800.
by lima 7y ago
> I mean, with the dawn of webassembly, I feel as though things are going to get closed off more and more. This is already possible today - many Qt applications, for example, compile to WebAssembly with minimal changes required. Look a
801.
by lima 7y ago
This is only an issue if you put a go.mod file at the top level of your repo. We have monorepos with hundreds of modules.
802.
by lima 7y ago
That does sound like a "you're holding it wrong" issue. As one of the Go team members pointed out, defining a separate module is not a hack, but the intended way of doing it. How would a partial checkout help?
803.
by lima 7y ago
No, it's a separate product and has none of these issues. Classic Hangouts is going to be turned off for GSuite customers such that there's exactly one conferencing tool, and one chat tool remaining. Hooray!
804.
by lima 7y ago
Missing from the list of videoconferencing tools: Google Meet. Hands-down the best and most reliable tool we've used because it "just works", and is already included in GSuite so there's no extra subscription to deal wit
805.
by lima 7y ago
Interesting, I did not expect the high-resolution COSMOS-D2 and ICON weather models to be available free of charge. Cool! Basically, the data is free, but most higher-level processing results are not (like point forecasts derived from the m
806.
by lima 7y ago
Money rules everywhere. Courts in the German state of Baden-Württemberg also recently forcibly privatized the State Forestry Service's logging operations because they were considered a monopoly (the "Forstkartell") and the sa
807.
by lima 7y ago
What about "accept cookies or pay" like some newspapers do? Is that okay?
808.
by lima 7y ago
Not disagreeing, just pointing out that Redis development was sponsored by Pivotal at the time, and antirez was presumably on their payroll: http://antirez.com/news/91 The response by antirez is professional and reason
809.
by lima 7y ago
You are right, of course. My bad!
810.
by lima 7y ago
Still a likely trademark violation. But yes, not something Namecheap should decide.

More ›