taviso

14 ms·

121.
by taviso 5y ago
PTT is part of the CPU, no external TPM module is necessary. PTT is Intel's implementation, AMD have something similar called fTPM. You do not need any external module on machines with fTPM/PTT support (i.e. if you bought it in th
122.
by taviso 5y ago
That doesn't sound right, search around in the BIOS for "Platform Trust Technology" or "PTT". If it's disabled, change it to enabled.
123.
by taviso 5y ago
> People don't do kernel reviews themselves. They just use the official kernel, and when someone finds a bug (or spots otherwise bad code), they notify the community. There's a big difference here. When a vulnerability is found
124.
by taviso 5y ago
I would point out that is literally what ccache (and Google goma) does, but doesn't require deterministic builds. Instead, it records hashes of preprocessed input and compiler commandlines. They don't make any security claims abou
125.
by taviso 5y ago
I don't really have any complaints about using deterministic builds for non-security reasons, but the number one claim most proponents make is that it somehow prevents backdoors. Literally the first claim on reproducible-builds.org is
126.
by taviso 5y ago
> With the reproducible build, you can start using the untrusted binary while you are still building your trusted one. That's not how it works, you have to reproduce it before it becomes trusted. > You can also have ten people
127.
by taviso 5y ago
> As a developer, it would be quite reassuring to build my binary (which I already do for testing) and compare the hash with the one from the CI server to confirm nothing has been tampered with. That makes sense! However, this is not a g
128.
by taviso 5y ago
> I really don't understand this argument; compromised infrastructure probably shouldn't be a regular occurrence, and even if so, automated killswitches seem like the vastly more preferable option, no? I'm pointing out how
129.
by taviso 5y ago
> It has nothing directly to do with violence against developers, that's taking many leaps. It is literally the very first claim on the front page of https://reproducible-builds.org .
130.
by taviso 5y ago
I don't really understand what you're saying. If you're saying "reproducible builds are reproducible", then that is obviously true, but the question is what is the benefit? Some people claim that the benefit is that
131.
by taviso 5y ago
I think the workflow you're proposing is to take some trusted source code, then compile it to make a trusted binary. Now compare the trusted binary to the untrusted binary provided by the vendor - If they're the same - then it mus
132.
by taviso 5y ago
> Is it technically pointless if you view it as a check on your own build, rather than a check on the work of others? That depends, I think it's difficult and mostly still pointless. I wrote about this a bit in the blog post I linke
133.
by taviso 5y ago
Every major vendor has vulnerabilities introduced all the time, by accident! No talent is necessary to introduce a bugdoor, just malice. You can already verify that a toolchain wasn't backdoored today, reproducible builds aren't n
134.
by taviso 5y ago
The point was that a reproducible build doesn't mean you don't have to trust the developer. Build servers rebelling was just an example of the additional complexities and attacks that it introduces, for very negligible benefit.
135.
by taviso 5y ago
I don't know what reputation damage will happen, they're just third parties compiling code. There is no reputational damage for operating a malicious tor exit relay, why would this be different?
136.
by taviso 5y ago
Signatures are not technically pointless, they mean you only have to trust the developer - not the mirror operators. Reproducibility is technically pointless, because you still have to trust the developer, and they can still add backdoors
137.
by taviso 5y ago
I don't see a single comment doubting the value of reproducibility, so I'll be the resident skeptic :) I think build reproducibility is a cargo cult. The website says reproducibility can reduce the risk of developers being threate
138.
by taviso 5y ago
I don't really buy the "centralizing" argument, any organization can join the TRR program. The main difference is that you have to agree to a bunch of baseline privacy requirements to join. It turns out that not many organiza
139.
by taviso 5y ago
The primary problem is that a process could exit, and the pid might be recycled, so you kill() the wrong process.
140.
by taviso 5y ago
I always thought it was clever that the PNG format was designed so that readers could catch various kinds of transfer errors, including the error of accidentally using FTP ASCII mode (rather than binary mode). That way you get a very clear
141.
by taviso 6y ago
Off the top of my head, two features I don't think gnome-terminal can do: sixels, this is a terminal graphics format. You could use them to have thumbnails in ls output, or view image attachments in mutt. Tektronix mode, which is like
142.
by taviso 6y ago
I dunno, I use xterm. It's fast, feature-rich, and every minute detail is configurable. I think gnome-terminal is based on vte, which wasn't affected. I have no clue about Konsole.
143.
by taviso 6y ago
Right, but the story sounds plausible because accidentally pasting '# foo > bar' would safely neuter everything else on the line. If # isn't special, then the rest of the line is still parsed, so pasting '# foo || bar
144.
by taviso 6y ago
I've heard this story before, but I don't think it's true. I think the bourne shell copied # comments from csh, which had them first. When sh first implemented them, # comments only worked in scripts, not if you typed them at
145.
by taviso 6y ago
What is the greatest terminal game ever written? I guess rogue, adom, nethack would be popular answers; probably the entire infocom catalog? They're not really my cup of tea, the game I've enjoyed the most is probably asciiportal.
146.
by taviso 6y ago
One obscure shell not listed is Ch, https://www.softintegration.com/docs/ch/shell/ Ch is actually proprietary software, if it was free software, I would probably use it as my login shell. I spent some time wr
147.
by taviso 6y ago
I don't know the answer to your question, but I see no reason I couldn't add hn support to nntpit, if there was interest. https://github.com/taviso/nntpit
148.
by taviso 6y ago
Here's the output of the command the parent told me to run on my Windows workstation: > Get-NetAdapter -Name Wi-Fi | select -ExpandProperty MacAddress Get-NetAdapter : No MSFT_NetAdapter objects found with property 'N
149.
by taviso 6y ago
Right, that's a fairer comparison. So the question is, why is that better?
150.
by taviso 6y ago
Sure, I'm saying that would be a fairer comparison - getting output from something that has no defined interface. So why not compare apples to apples, how would powershell extract the MAC from ifconfig output? If that's more flexi

More ›