strcat

73 ms·

721.
by strcat 8y ago
To be clear, the signing keys were not Copperhead signing keys but rather signing keys of the open source project they had agreed to support and were trying to take over including coercing turning over personal signing keys used for the pro
722.
by strcat 8y ago
> The email makes it sound like the guy's being fired. The person being 'fired' owns 50% of the company and is the CTO and sole developer of the products, with most of it written on their own time. There's no employme
723.
by strcat 8y ago
Copyright was never assigned to the company so it doesn't own code written outside of work hours.
724.
by strcat 9y ago
There's the reverse of Wine now too with Microsoft's clean room (non-GPL2 and not currently open source at all) implementation of the Linux kernel kernel <-> userspace ABI.
725.
by strcat 9y ago
All of the CopperheadOS source code is still published and can be modified / redistributed. It's not Free Software anymore since that wasn't supported by the community while at the same time it was exploited by (competing) co
726.
by strcat 9y ago
> It might get a bit trickier when WebViews are involved though because, at least on Android, SSL in WebView is subject to different security rules than the java-initiated connections They've started changing that: https:/&#x2
727.
by strcat 9y ago
HPKP doesn't protect against MITM via locally installed trust anchors. It explicitly permits that in both Chromium and Firefox.
728.
by strcat 9y ago
> The reality of the Android market is that Samsung makes 98% of the profit, and the vast majority of flagship devices are being made by the handful of companies that put the most effort into locking down their devices. You know you can
729.
by strcat 9y ago
> Putting aside for the moment your comments about AOSP (the timeline on the slow closing down of the source branches is a great one, particularly as you now watch more of the code move into Google Play services and the AOSP core applica
730.
by strcat 9y ago
It is stored in a register on some architectures like ARM. However, that register gets spilled to the stack to store another return address there when calling another level deeper. It doesn't change much. It does make it easier to impl
731.
by strcat 9y ago
cat /proc/self/maps is a better way to see that. If it's built with PIE, the executable base is randomized. Some distributions use full ASLR across the board (Alpine, Android, ChromeOS, Hardened Gentoo) while others don&
732.
by strcat 9y ago
> all of which are closed down and locked experiences That's not true. Many Android devices have an unlockable bootloader with explicit support for building the Android Open Source Project (AOSP) for the device. Nexus and Pixel devi
733.
by strcat 9y ago
There are some inaccuracies and misleading information here: - Encryption keys are derived from various inputs including the user credentials, not stored in the TEE. The TEE is involved in key derivation and is really supposed to use a hard
734.
by strcat 10y ago
Conversations keeps open a TCP connection and the server pushes new messages. The only kind of polling is a ping to keep the connection alive which can be scaled based on how often it proves to be necessary on that connection. It works the
735.
by strcat 10y ago
So you're using Cloudflare. Do you have Strict SSL enabled? If not, you don't have authenticated encryption. Hiding the problem is not a solution. If GitHub doesn't let you set a custom certificate, Cloudflare isn't a so
736.
by strcat 10y ago
There's still the connection from Cloudflare to the origin server, which won't have authentication.
737.
by strcat 10y ago
"HTTPS is not supported for GitHub Pages using custom domains." - this is what they mean, they weren't specific.
738.
by strcat 10y ago
It's significantly better on some benchmarks and significantly worse on others. There's no clear winner and ext4 is much more widely tested and has way more development time focused on it. Looking at only a few aspects of performa
739.
by strcat 10y ago
Google uses FUSE for shared storage, not internal app storage. Apps are supposed to keep most of their data in internal storage since shared storage breaks the whole isolated security model. Content providers and other intents are supposed
740.
by strcat 10y ago
> If you use a database for storing your apps data like sqlite, which you should, then you're doing an fsync on virtually every insert/update operation. One of the main reasons for using a database is that it takes away the hea
741.
by strcat 10y ago
They're shared among site instances, not the same domain. It has to do with web standard semantics. Google has been working on https://www.chromium.org/developers/design-documents/site-is... for quite some ti
742.
by strcat 10y ago
> it seems likely that they are all using (and are more secure using!) off-the-shelf iOS or Android phones In what sense are they more secure using stock Android than CopperheadOS? They wouldn't be installing it themselves either wa
743.
by strcat 10y ago
There are alternatives with comparable or better security, but they tend to have other flaws. Most of the alternatives including Wire and Riot ALSO depend on GCM, otherwise they either lack push or force ridiculously bad battery life. They
744.
by strcat 10y ago
The point of CopperheadOS is not that it lacks Play Services... and Play does not provide more secure updates than an app store like F-Droid. In fact, Play abuses system privileges to bypass the signature system used by Android. It will hap
745.
by strcat 10y ago
Sure, although not in mainstream browsers if there's HSTS + HSTS preloading, which can be easily adopted by any site. Outside browsers, HSTS is usually not supported. It was actually implemented by wget, but without preloading, so it o
746.
by strcat 10y ago
Push notifications without GCM can be done without losing reliability or ruining battery life, but it's difficult. There are a few apps like Conversations doing it well but it's quite rare. GCM is still technically more efficient
747.
by strcat 10y ago
It's scaling well enough so far. A domain can be submitted at https://hstspreload.appspot.com/ and doesn't take long to show up in Chromium and then other browsers.
748.
by strcat 10y ago
There's already an open standard for the core functionality of code hosting sites: Git. Projects migrate between GitHub, GitLab, Bitbucket and other alternatives all the time by simply changing the Git remote. There's some lock-in
749.
by strcat 10y ago
LLVM doesn't take shortcuts like that. It's designed as a set of reusable libraries for use in all kinds of tooling. In many cases it even has to continue going after detecting errors and recording a representation of them, so tha
750.
by strcat 10y ago
There were 2 interpreters before. Now there are 3. You're misunderstanding the announcement. Regardless, the Infinality interpreter is the closest to Windows rendering so it isn't what the OP wants. In all likelihood they want hin

More ›