pilif

37 ms·

361.
by pilif 7y ago
Only, it wasn’t a fake dialog. This is the normal OS sudo dialog which has API to allow the prompt text to be set by the application. The text could have been more specific what they need root rights for and how necessary the root rights ar
362.
by pilif 7y ago
>My position is nobody ought to probably be running as admin for the vast majority of tasks in macOS, even if you run as admin, the only thing that gives you is `sudo` access. Your "admin" user still is a normal user, but it&
363.
by pilif 7y ago
> But the userspace "solution" is to just forbid such usage. which is totally not something the kernel developers want because printk is the one thing that remains even when everything else has gone belly-up. They need a reli
364.
by pilif 7y ago
None of the complexity talked about in the article is about formatting and all of the complexity is about reliability and message durability in light of all the low-level things going on concurrently on actual hardware while still wanting t
365.
by pilif 7y ago
Once IPv6 is available widely enough, prices for IPv4 addresses will plummet because there is a nearly unlimited amount of IPv6 addresses available for much cheaper or free
366.
by pilif 7y ago
They will more than make up the difference by increasing the rent for the public IPv4 addresses they got when they were still available.
367.
by pilif 7y ago
You have to be careful to distinguish what's going on here and who you are getting the IP addresses from. When RIPE is out, the only way to get more addresses is by buying or renting them from somebody else who has a commercial interes
368.
by pilif 7y ago
I think the hope of OP was that the rates for shipments from China would go up and the rates for non-China shipments would do down because they wouldn't have to subsidize the China shipments any more. I countered with the assumption th
369.
by pilif 7y ago
> the rates should more normalize They won’t. The rates for shipments from China will go up and some executives will get higher bonuses
370.
by pilif 7y ago
Back then it turned out the password dialog wasn't fake but was the standard OS dialog apps can request sudo access with. The text in the dialog is app-customizable.
371.
by pilif 7y ago
This isn't as much about what existing extensions do today but all about what potential extension could be doing tomorrow. If an extension doesn't get full access to all the pages you are reading, it can't do bad things with
372.
by pilif 7y ago
AFAIK, Safari supports longer lists than Chrome to the point that you can produce an usable ad-blocker for Safari but not for Chrome because you will hit the limit too quickly.
373.
by pilif 7y ago
It was years ago when Salt was still Orange.
374.
by pilif 7y ago
> Do we need to start throwing around a dictionary definition of the word unlimited? A colleague of mine was told by a Swiss mobile phone provider that "unlimited" was a technical term meaning 5GB.
375.
by pilif 7y ago
Not in a dynamic language. Finding all possible inputs to your method that’s calling float() on its Arguments in a dynamic language is akin to solving the halting problem. Also, error messages in an IDE can be ignored. Compiler errors can’t
376.
by pilif 7y ago
> which will raise TypeError At runtime. In production. A compiler would catch the problem at build time, never causing an error in production.
377.
by pilif 7y ago
Do I read this right? They offered to pay $400K even though they had backups to restore their data from? Does this mean that the restore operation cost more than 400K or was this an incredible sample of laziness? They'd rather pay the
378.
by pilif 7y ago
I’m quite sure this is a response to https://news.ycombinator.com/item?id=20874470 submitted earlier today. I don’t believe there was any malicious intent there, but it’s yet another safety issue in C that anybody tells me
379.
by pilif 7y ago
Is it just my imagination or did that “smart reply” video teaser feature an Apple emoji thumbs-up emoji as an UI element of Android?
380.
by pilif 7y ago
During the San Bernardino case, they have said multiple times that they cannot install software without the user entering their password. And even if you assume a publicly traded company lying outright, what do you think is more likely: the
381.
by pilif 7y ago
>it sounds like you're talking about users relaying and not machines relaying there is such a thing as machine- or even application-specific accounts that can be terminated or their credentials rotated. Even better; you could use
382.
by pilif 7y ago
Last time this happened to Apple they fought it tooth-and-nail and at least from what the public knows they were victorious and did not have to add a backdoor.
383.
by pilif 7y ago
no
384.
by pilif 7y ago
>I disagree. It is a fair mark against postfix if (as I claim) most users really don't need it. if they don't need it, they won't be affected by that vulnerability because it won't be active. >Meanwhile on the e
385.
by pilif 7y ago
I agree. But if the software is lacking essential features so that everybody patches them back in it's a very ineffective strategy because anybody's home-grown patches are worse than properly maintained features. I can put a machi
386.
by pilif 7y ago
Aside of the fact that I doubt your "most people" assertion here, it's beside the point that I was trying to make which is that a CVE affecting a feature of Postfix that qmail doesn't have to begin with is not a fair mar
387.
by pilif 7y ago
> CVE-2011-1720 and CVE-2008-2936 are examples of postfix vulns no one has found, or reasonably expects to find, in djb code. CVE-2011-1720 is related to SMTP authentication which qmail doesn't support out-of-the box. So. Yes you&
388.
by pilif 7y ago
it would be a very small list. However, the exhaustive list of things other MTAs can do that qmail can't would be huge (starting with backscatter-proof bounces for example) qmail was limited back in the 90ies and it's horribly beh
389.
by pilif 7y ago
for all sites memory safety trumps performance. For most sites, performance is a total non-issue for providing the feature-set that qmail provided. And if you are a site that processes enough email for performance to start becoming an issue
390.
by pilif 7y ago
The moment you start patching qmail you're not running qmail any more. None of the CVE numbers are meaningful to your custom-patched qmail. qmail was good when you could use it in its default configuration. Unfortunately, very few site

More ›