mjg59

59 ms·

841.
by mjg59 5y ago
> As for Signal it’s at least open source, but there’s no way to check that the client I’m using, or my friend is using, actually matches that source code. This is… not true? Signal builds are reproducible. You can verify that the apk in
842.
by mjg59 5y ago
I don't think I understand your threat model here. In the dystopian remote attestation future, presumably nobody's going to grant you access unless you're running Windows, at which point Microsoft can impose arbitrary policie
843.
by mjg59 5y ago
This design still relies on prior stages of the boot process handing stuff over to Pluton - if there are vulnerabilities in the OEM firmware, they're still going to be exploitable in this model.
844.
by mjg59 5y ago
If you have an AMD system then there's a decent chance that it's already running a TPM stack on the on-die Platform Security Processor. Pluton isn't really any more tightly integrated, it just means the TPM stack isn't r
845.
by mjg59 5y ago
Microsoft's 32-bit ARM devices were being sold as appliances, their 64-bit ones are being sold as general purpose computers.
846.
by mjg59 5y ago
Firmware updates can't add network hardware where none currently exists. The block diagrams for Pluton don't give it any mechanism to communicate with the network directly.
847.
by mjg59 5y ago
It sounds like they're using UEFI capsule updates for the firmware, so it'll actually be easy to perform the updates under other operating systems - Microsoft just won't have any mechanism to compel you to do so.
848.
by mjg59 5y ago
Via what mechanisms? Nothing we currently know about Pluton would enable it to do anything like that, as far as I can tell.
849.
by mjg59 5y ago
> No I don't want proprietary internet enabled hardware on my PC monitoring my software Good news! Pluton is not internet enabled and can't monitor your software.
850.
by mjg59 5y ago
All Microsoft need to do to block other operating systems from PCs is change their policy around secure boot. All they need to do to prevent unsigned apps from running is change the default behaviour of Windows. The code exists. It's d
851.
by mjg59 5y ago
Everything needed to lock down your computer as much as a phone already exists, there's no need for a TPM or Pluton to do so.
852.
by mjg59 5y ago
> The difference now is that Microsoft are saying they will only support machines which have these TPMs That's a reason to worry about Windows 11 requiring a TPM, rather than a reason to worry about Pluton specifically. But even so,
853.
by mjg59 5y ago
Go to ISC and work on Bind, apparently: https://twitter.com/fanf/status/1465641653788712962?t=iwtAWb...
854.
by mjg59 5y ago
The virus has no idea what's beneficial to it. A virus that infects you for two weeks and which can pass itself on to two other people in that time is going to infect fewer people than a virus that kills you after two weeks but can pas
855.
by mjg59 5y ago
Right. Previously the return code from x509_verify_cert was returned directly to the caller, which was incorrect - ssl_verify_chain_cert was supposed to return -1 if the caller should retry, but would end up doing so on any error that was
856.
by mjg59 5y ago
It's documented as returning 1 when verification succeeds and 0 when it fails, so this appears to turn an error into a failure to verify, which seems to be the intent?
857.
by mjg59 5y ago
If you're defining Linux as a kernel, then yes, the kernel does not impose any constraints on userland that would make this impossible - and I never said it did. If you're defining Linux as a complete OS, then the fact that it&#x2
858.
by mjg59 5y ago
RHEL 8 doesn't ship with GTK 4. How do I ship an application that uses functionality that only exists in GTK 4 if available, but falls back to GTK 3 if it isn't? If libraries had been written with this in mind (like OpenGL was), t
859.
by mjg59 5y ago
Like I said, it's technically possible and that is (outside a very small number of well-defined outliers like OpenGL) entirely irrelevant in terms of whether it's practically possible. Even if we rewrote every library now to have
860.
by mjg59 5y ago
Yes, and for the reasons I expressed it doesn't work that way for most libraries under Linux.
861.
On Flatpak Disk Usage and Deduplication(blogs.gnome.org)
9 points by mjg59 5y ago|0 comments
862.
by mjg59 5y ago
Sure, you could dlopen() different SONAMEs until you find one that works, and now you just have to somehow deal with the structs having changed between versions, and the prototypes of functions not being compatible, so yes it's technic
863.
by mjg59 5y ago
If reducing duplication is a goal, static linking or shipping private copies of libraries works against that. Building against standardised runtimes works much better in that respect.
864.
by mjg59 5y ago
I'm trying to scope the "Just use system libraries" approach into one that's realistically achievable. I agree that this shouldn't be an extreme requirement, but it turns out that most app authors aren't terrib
865.
by mjg59 5y ago
Doesn't Nix ship its own version of every library dependency rather than using system libraries?
866.
by mjg59 5y ago
People have tried to provide a packaging format that would allow apps to declare their depencies in a distribution neutral manner[1]. It was, uh, not a huge success. Let's take an extreme example. If I build an app on Ubuntu and then t
867.
by mjg59 5y ago
The main problem is that you don't have a strong way of establishing that you're talking to the real TPM. It does raise the bar from passive interception to hardware MITM, but it doesn't absolutely solve the problem
868.
by mjg59 5y ago
Sibling comment links to the relevant Wikipedia page, but most people who've dealt with YP probably know it as NIS (turns out using a trademarked term wasn't ideal). https://lwn.net/Articles/874174/ is a
869.
by mjg59 5y ago
It kind of does - you can use IMA to enforce signature validation, even including an x509 chain. But it using extended attributes for this results in a bunch of difficulties, and there's no good distro support for it at present.
870.
by mjg59 5y ago
The PSU fan was fine, but the case fan was (a) basically unnecessary and (b) much louder than I expected

More ›