ryao

50 ms·

781.
by ryao 2y ago
What is missing from these two representations is the ability for something to become trivially bypassable once you know the trick to it. AnC is roughly that for ASLR.
782.
by ryao 2y ago
If someone can guess the randomization within 1 second using the AnC attack, you can restart as much as you want, but it will not improve security.
783.
by ryao 2y ago
Gentoo Portage had support for running on top of Interix, so it did run on Windows at some point (over 15 years ago).
784.
by ryao 2y ago
That attack does not require a web browser. The web browser being able to do it showed it was higher severity than you would think than if the proof of concept had been in C, since web browsers run untrusted code all of the time.
785.
by ryao 2y ago
https://en.wikipedia.org/wiki/Profile-guided_optimization
786.
by ryao 2y ago
It produces a randomization either at compile time or run time, and the randomization is the security measure, which is obscured based on the idea that nobody can figure it out with ease. It is a poor security measure given the AnC attack t
787.
by ryao 2y ago
I understand the terminology. I even took a graduate course on the subject. I stand by what I wrote. Better yet, this describes ASLR when the AnC attack applies: https://web.archive.org/web/20240123122515if_/https:
788.
by ryao 2y ago
Gentoo lets you do all of the tweaks mentioned here within the system package manager, so you still get security updates for your tweaked build. You can also install Gentoo on top of another system via Gentoo Prefix for use as a userland pa
789.
by ryao 2y ago
A userland package manager like Gentoo Prefix could be used to install a custom build of this and still get security updates.
790.
by ryao 2y ago
ASLR obscures the memory layout. That is security by obscurity by definition. People thought this was okay if the entropy was high enough, but then the ASLR⊕Cache attack was published and now its usefulness is questionable.
791.
by ryao 2y ago
ASLR is technically a form of security by obscurity. The obscurity here being the memory layout. The reason nobody treated it that way was the high entropy that ASLR had on 64-bit, but the ASLR⊕Cache attack has undermined that significantly
792.
by ryao 2y ago
UBSAN is usually a debug build only thing. You can run it in production for some added safety, but it comes at a performance cost and theoretically, if you test all execution paths on a debug build and fix all complaints, there should be no
793.
by ryao 2y ago
How is that enforced as it was billed as certificates are not valid unless published, yet it is obvious certificates for a private CA are not being published and are treated as valid?
794.
by ryao 2y ago
I did a cost analysis for the B580, not the A770. I have no idea what their margins on the A770 look like.
795.
by ryao 2y ago
Server code tends to be extremely portable. Just recompile for the new architecture and you are done. The porting work for servers has already been done by the community. The main exception would be game servers, which are binary blobs, but
796.
by ryao 2y ago
Does anyone do that? The average developer likely would not think to do this because it is too computationally intensive to splice things into A/V streams on the fly. A more clever developer could splice the ad into the video at an I f
797.
by ryao 2y ago
I remember people promising a rogue CA would not work anymore due to certificate transparency requiring certificates to be published in order to be valid, but it is quite obvious here that certificate transparency was not even needed. A pri
798.
by ryao 2y ago
R&D is a sunk cost that is largely paid by their iGPUs. Selling at cost is not a subsidy and that is not relevant here since they should be making money off every sale. I tried estimating their costs a few months ago and found that they
799.
by ryao 2y ago
At current market pricing on dramexchange, 128GB of 16Gbit GDDR6 chips would cost $499.58. That only leaves $100.42 for the PCB, GPU die, miscellaneous parts, manufacturing, packaging, shipping, the store’s margin, etcetera. I suspect that
800.
by ryao 2y ago
They are definitely selling them at close to no profit, but they are not anywhere near subsidizing them unless they botched their supply chain so badly that they are overpaying the BOM costs.
801.
by ryao 2y ago
Other things using the 2.4GHz spectrum might have malfunctioned because of that and the users would have had no recourse. Even if you can, you should not do this unless there are no neighbors within range and you can ensure that you will ne
802.
by ryao 2y ago
> Set your APs to use 20 Mhz wide channels This is not a superstition for 2.4GHz. Other devices sharing 2.4ghz tend to malfunction when 40MHz channels are in use. This is a well known phenomenon. I have been able to reproduce it in my ho
803.
by ryao 2y ago
よつば = yotsuba よっば = yobba As someone who has tried learning Japanese, it took me longer than I am willing to admit that to realize the two were different and things made much more sense after I realized the difference. That said,
804.
by ryao 2y ago
I just realized the example might have had a typo like you said. It is an interesting typo since it reminded me of a similarly absurd expression in English. When the expression is used in English, the entire point is to be nonsensical such
805.
by ryao 2y ago
It says that the grilled eel over rice dined and dashed. It sounds like a euphemism to me. It is not very different from saying the grilled eel over rice developed legs and ran away. In either case, you are suggesting someone stole it.
806.
by ryao 2y ago
うな重が食い逃げした does not seem that crazy to me. It is no different than English speakers saying some variation of “it grew legs and walked away”. Usually, that is hyperbole to make a reduction ad absurdem argument about someone stealing. The Jap
807.
by ryao 2y ago
Japanese is far worse than what you describe as far as knowing what anyone means is concerned. Japanese often omits a noun/pronoun entirely and the verb gives no hint as to what it is. In English, we have verb conjugations like “I am”,
808.
by ryao 2y ago
We had a similar experience at my house one time, except it was in a bowl and all we saw was blood in the yoke. It had not been quite as developed as the one in your egg.
809.
by ryao 2y ago
It becomes worse as the battery continues to degrade.
810.
by ryao 2y ago
I know it is not what you meant, but what you wrote becomes funnier if one reads it as saying “the fact that [buyers of HP printers] aren’t bankrupt at this point is beyond me”.

More ›