rfoo

32 ms·

511.
by rfoo 3y ago
There is also "soft" mitigations vs "hard" mitigations guideline as described here [1]. It's handy when designing new mitigations when there's no meta game. [1] https://googleprojectzero.blogspot.com
512.
by rfoo 3y ago
It isn't. The problem used to be default installed macOS with language set to English put Japanese first (as in CJK) in the language preferences list so they display Simplified Chinese / Traditional Chinese without lang tag wrong.
513.
by rfoo 3y ago
Given that they are originated from China, I'm not surprised. For a while (not any more though) you can't sell an ACR122U RFID card reader online in China, just because mfoc [1] supports it nicely and it got a reputation of "
514.
by rfoo 3y ago
Qualcomm does have similar architecture deployed, here is their hypervisor: https://github.com/quic/gunyah-hypervisor . AFAIK Qualcomm's implementation does include passing touch input / display into the VM an
515.
by rfoo 3y ago
Do you mean that I now have a nice party trick - DoSing friends iPhone from sending iMessage? :)
516.
by rfoo 3y ago
ChatGPT was not blocked by the GFW when it first released for a few weeks (if not months, I don't remember), but at that time OpenAI already blocked China. The geo check only happened once during login at that time, with a very clear m
517.
by rfoo 3y ago
Sure, I just hope people move to contribute hardening features to Firefox, and the first step would be singing out loud that Firefox is not the most secure browser right now. Oh, and I suffer from using NoScript (currently on Chrome, unfort
518.
by rfoo 3y ago
Indeed. Consider my view points biased cause my threat model does contain being popped by North Korean hackers. And I can't use the Internet without a functioning ad blocker so :(
519.
by rfoo 3y ago
> Firefox has always been the most versatile and secure way to browse the web. Currently, a Chrome full-chain is notably harder than a Firefox full-chain, with the former being at "state actor ITW" level, and the latter being a
520.
by rfoo 3y ago
Where is my iPhone 14 mini, then?
521.
by rfoo 3y ago
This feels exactly like "I don't have ethernet cards capable of 100Mbps so scp can't copy files faster than 10Mbps is not OpenSSH's problem".
522.
by rfoo 3y ago
LG Gram is also quite unique in that there's 16 inch variant with only 1.15kg. Right, a 16 inch laptop weight less than a Macbook Air.
523.
by rfoo 3y ago
Well, Pixel is still with unlocked bootloader and is the only phone on the market with which you can bake in your own signing keys, lock the bootloader and have an actually secure boot chain controlled by yourself.
524.
by rfoo 3y ago
Don't forget, they are also forced to buy a Mac. License demand that iOS SDK must be used only on Apple hardware.
525.
by rfoo 3y ago
> It's curious that you say RTT is mostly random noise yet BBR gives you only 45 Mbps. I believe OP meant RTT fluctuate somewhere between 150ms to 250ms completely randomly even with no load at all, hence (the delta is) mostly rando
526.
by rfoo 3y ago
> but I wonder if the bandwidth profile of Hysteria compromises its HTTP/3 masquerade? Most likely so. GFW is not able to reassemble and analyze QUIC (and AFAIK, any UDP-based multiplexed protocol) traffic, yet. If Hysteria takes of
527.
by rfoo 3y ago
They did. But iMessage is end-to-end encrypted. As long as you avoid the iCloud caveat (iCloud backups are by default not E2E encrypted) you get an actual uncensored E2EE messaging app in China.
528.
by rfoo 3y ago
In principal it's easy to explain - as long as you have uncensored content on your website, it's going to be blocked. For example, HN is blocked. If it didn't happen, then it's because you are not big enough. A few cases
529.
by rfoo 3y ago
> Given the material is in Chinese, it stands to reason the bulk (but of course not all) of it will not be in violation of whatever policies. Especially due to no freedom of the press in China (you need a permit for each published book)
530.
by rfoo 3y ago
> Apple is allergic to GPLv3 code because there is a clause in the license requiring you provide a way to run modified version of the software which would require Apple to let users self sign executables. Wow, I don't know this befo
531.
by rfoo 3y ago
> If you are troubled by loading on 64GB M1 Max, then congrats, you are doing workload that no laptop will handle. I can easily buy a laptop with 128GB RAM, eats more energy (100W+) and is more powerful. It's just that it does not h
532.
by rfoo 3y ago
It would be interesting to compare Beijing+Hebei to Shanghai+Zhejiang+Jiangsu. I believe the primate effect works the same way, but Hebei is significantly poorer most likely due to Beijing getting too many preference in policy making. (e.g.
533.
by rfoo 3y ago
I have one and indeed my only use of it is to type in BitLocker password when I'm not at home. I really hope one day I can just ssh in and unlock the disk like what I do with LUKS.
534.
by rfoo 3y ago
> mitigations for newly discovered spectre-like attacks have to be done software side, but successive processor generations will bake those mitigations into the silicon to reduce the performance penalties associated with software fixes.
535.
by rfoo 3y ago
I'm not familiar with WebKit, but I consider Site Isolation a Chromium feature instead of a Blink one. Is it supposed to be solved within the render engine?
536.
by rfoo 3y ago
Font: https://developer.apple.com/fonts/TrueType-Reference-Manual/... , there's a lot of exploits in various implementations about ten years ago: https://security.stackexchange.com/questions&#x
537.
by rfoo 3y ago
> The finer grained synchronization primitives are (a) already available in Python, and (b) necessary even with the GIL for reasons I've given elsewhere in this discussion. The finer grained synchronization primitives does not alrea
538.
by rfoo 3y ago
> Is this a Webkit vulnerability or a Safari vulnerability? This is technically a Hacker News Favorite Processor a.k.a. M1/M2 vulnerability. However all relevant CPUs on the market now has the same vulnerabilities so it became a fea
539.
by rfoo 3y ago
Be ready to say "playing random video off of the Internet is a bad idea" if someone decided JavaScript has to be gone.
540.
by rfoo 3y ago
What you said is precisely what nogil work is about. It's about replacing one global lock with finer grained synchronization primitives without much performance regression.

More ›