shawnz

43 ms·

571.
by shawnz 5y ago
Effectively yes, but the "1.x" format is deprecated since Java 9 and not used anymore, whereas versions 5 through 8 used both notations. See https://openjdk.java.net/jeps/223#Dropping-the-initial-1-ele...
572.
by shawnz 5y ago
What about for communicating with darknet vendors, where PGP is the established standard?
573.
by shawnz 5y ago
Isn't the rollout of this encrypted backup functionality an "action"? And isn't the consistent availability of E2E encryption in WhatsApp an "action"? Whereas it seems to me like the idea that WhatsApp shouldn&
574.
by shawnz 5y ago
I wonder if it wasn't just being used as an excuse for illegal searches. The high price just prevents third-parties from testing its efficacy.
575.
by shawnz 5y ago
What's the deal with all the articles about Z systems getting published lately? A big marketing push by IBM?
576.
by shawnz 5y ago
I think the ability to resist overreaching policies like civil forfeiture is one of the strongest arguments for people in the western world to have access to cryptocurrencies.
577.
by shawnz 5y ago
This only solves the problem of trusting updates, not the initial installation. For new software, "curl | sh" is no different from installing a random deb package from GitHub.
578.
by shawnz 5y ago
The point is not whether it's a solvable problem. The point is that it's not conventional to go to such extents, no matter what kind of packaging you use. This kind of process could be done with either install scripts or deb/
579.
by shawnz 5y ago
I understand. That only moves the problem to where you get the signature from, it doesn't solve it (unless you are using a central repo you already trust for example). Therefore binary packages shipped on a GitHub releases page alongsi
580.
by shawnz 5y ago
All these arguments apply no matter the packaging format. Install scripts can be signed and checksummed too. Only by having your package put into a repository already trusted by the user in advance do you solve these problems, it's not
581.
by shawnz 5y ago
"Hypothetically", JIT can outperform native code given the right circumstances. Why not put more effort into improving JITs instead?
582.
by shawnz 5y ago
Anecdotally I think it's pretty common for mechanics to claim that their competitors don't know what they're doing.
583.
by shawnz 5y ago
At my workplace we use all Dell, including the laptops, and I've been mostly happy with them.
584.
by shawnz 5y ago
I think it's pretty clear that that is NOT the reason why <img> still exists. Otherwise, why not just discourage its use in favour of <object> while still retaining it for compatibility? But actually the opposite is true, &
585.
by shawnz 5y ago
<object> is not a satisfactory equivalent for this <model> tag any more than it's a satisfactory equivalent for the <img> tag itself. <object> is semantically a superset of both.
586.
by shawnz 5y ago
> Apple is demonstrating a pretty bad case of "not invented here" syndrome. I don't think that's the case here at all. Apple's proposal solves a completely different problem, which is to embed arbitrary model for
587.
by shawnz 5y ago
Perhaps he is trying to get ahead of any arguments like, "the drivers weren't paying attention due to over-reliance on the software"
588.
by shawnz 5y ago
What does that mean exactly? Is that the standard by which you hold other medical treatments to as well?
589.
by shawnz 5y ago
I am curious about this line of thinking. If you believe that mRNA vaccines should be considered "gene treatments" then why don't you also believe that traditional vaccines are "gene treatments"? What exactly makes
590.
by shawnz 5y ago
I agree with you in that I don't think the problem is the closed-source aspect. Closed source software can still be audited (with difficulty). The problem is that the source material for the hashes can't be audited, even when we k
591.
by shawnz 5y ago
Sure, but consider how this will impact corporate or educational environments (which in my experience DO usually use full disk encryption). I believe full disk encryption is also on by default for most new OEM machines.
592.
by shawnz 5y ago
> In my experience, it is in fact pretty trivial. If you are talking about scenarios where full disk encryption is not enabled, then that is irrelevant. You may as well say that privilege escalation is trivial because some users don&#x27
593.
by shawnz 5y ago
It's not trivial, and even so that's not a reason to discredit this particular vulnerability just because others also exist. What is the point of downplaying local privilege escalation vulnerabilities just because it's a hard
594.
by shawnz 5y ago
Won't be possible with ESNI, and regardless you could just use an inconspicuous domain name, for example by piggybacking on a common cloud service.
595.
by shawnz 5y ago
If the pipe wrench is getting applied regardless, that's a much different situation. In that case you could simply not comply at all. The duress credentials are meant to create plausible deniability of non-compliance, by giving the app
596.
by shawnz 5y ago
You don't need to make it take any network actions, but even if you wanted to do that you could just use TLS. It would easily blend in with all the other services that use TLS as part of their normal operation.
597.
by shawnz 5y ago
The duress credentials are exactly how you avoid the "pipe wrench" scenario. The point of the FDE in that case is simply to prevent them from looking on the disk without your supervision.
598.
by shawnz 5y ago
The duress login shouldn't reveal that anything is happening, so they have no reason to suspect you're using such a feature at all. Thus there would be no reason to ask you to log in again, and even if they do, you can simply use
599.
by shawnz 5y ago
What does it matter if your drive is imaged if you are using full disk encryption?
600.
by shawnz 5y ago
I really wish I could find a password manager which supports WebAuthn, and can also be unlocked with WebAuthn, so that only one secret needs to be replaced in such a situation.

More ›