alcari

The parser as described _only_ cares about identifiers; it has no concept of operator precedence, which is not required for its purpose.

Here's the easy 50% of it: https://github.com/alcarithemad/typetrace

This is a cool idea. Please don't take the below as gratuitous negativity, just a reminder that these are hard problems for which there are no general solutions.

The README says it was tested on ZFS, but I doubt its utility in real-world deployments. I don't know of anyone who has significant data in a ZFS pool that isn't one or more of: raidz, compressed, encrypted, or embedded_data.

raidz implies that logical blocks aren't allocated as single physical blocks, but instead striped across multiple drives. Finding the SBX magic isn't enough to get you the rest of the block, but the checksum might (but, given that's it's CRC16, probably won't) let you try appending blocks from other disks to find the remainder of the block.

Transparent compression prevents you from identifying the magic header on each block, unless you decompress every disk sector that could have data (which is certainly feasible, but complicates recovery if you don't know which compression was in use, and zfs supports at least 3 kinds, and pools will generally have at least 1 in use whether compression is on or not).

Encryption (present in Oracle ZFS) means there's no plaintext data to recover.

embedded_data is a feature flag (and on by default in supporting versions of zfs) that packs blocks into block pointer structs when the amount of data is small. I can easily imagine the final block of an SBX, which may be mostly padding, getting compressed into one of those block pointers, which itself may be embedded in a larger structure which is part of an array that's compressed by default. That array is also probably long enough the compressed stream takes multiple blocks, and you may have lost some of the early ones, making the rest of it unrecoverable.

Here's the requisite cynical comment lamenting the death of "standards".

They could easily have implemented RFC 3091 [0], but instead they chose to create yet another proprietary API with vendor lock in, just as cloud service providers love to do.

[0]: https://tools.ietf.org/html/rfc3091

/s

Regardless of the title editing discussion in the sibling comments, the title at the source was changed to "Omnibox hostname heuristics misunderstand internal redirects.", which accurately reflects the problem.

As an alternative, predating Portmap by around 700 RFCs: tcpmux[0]. Everything connects to port 1 and asks for services by name.

[0]: https://tools.ietf.org/html/rfc1078

OpenJDK was created by Sun.

Are you aware of Spring[0]? It's another open source RTS that's effectively data file compatible with TA.

[0]: https://springrts.com/

The client connects to the backend with a binary protocol that, among other things, gives it a token which it hands off to a web API that returns a valid cookie for the Steam store. They inject that cookie into the integrated browser instance.

That's the tech they already have on hand.

The rationale was that if, password hashes got compromised, the attacker would only have until the next forced rotation to crack the passwords and take over accounts.

edit: or, in particularly terrible systems, if plaintext passwords were leaked.

Of course, that's only useful if it doesn't affect any other password security concerns, and it turns out that users who are forced to change their passwords frequently pick worse passwords, which is a bigger problem than the scenario this was supposed to protect against.

It's not much of a secret: https://en.wikipedia.org/wiki/Truffle#Cultivation

The front page demo does it with the while loop.

The CPUs in question support up to 16 GB of LPDDR3 or 32 GB of DDR4, but do not support LPDDR4. Apple needs the LPDDR* variant to meet their power budget.

They're in the article, and the original post is linked at the end.

Those are symmetric(!); the real killer is the contract duration, the installation/activation fees (up to $1000 total), and the installation time frame (up to 8 weeks).

> >Modern anonymity breaks generally work by getting code to run on your local system

> Would you have any reference to specifics on this?

FBI using a Firefox js bug to unmask tor users a couple years ago:

http://arstechnica.com/security/2013/08/attackers-wield-fire... http://arstechnica.com/tech-policy/2013/09/fbi-admits-what-w...

From a quick look through, most of it. Modern x86 micro-architectures still use integrated memory controllers and ~3 level CPU caches.

All the timings are a little faster, the caches a little bigger, and the buses a little wider, but it's still basically the same stuff with different names.

This was released about 26 hours ago.

Steam says I've played 15 hours.

Send hel--more microelectronics.

It's TIS-100, but with a native multiply! and unsynchronized broadcast! and digit get/set!

Still supremely difficult.

The GP means that the cost[0] is several orders of magnitude below the heat dissipation from resistance, and thus negligible.

[0]: https://en.wikipedia.org/wiki/Landauer%27s_principle

Not likely. That's the comment start marker in many dialects of SQL.

For commands, shell metacharacters like `, |, &, and $() are much more important.

Be aware that there are known issues with the certificate manager, and some changes may not work as you expect: https://bugzilla.mozilla.org/show_bug.cgi?id=585352

That's what I included "for the obvious issue": even in the backdated certificates they still have "reasonable" notAfter dates, and we (will) have a list of every certificate they've issued in the relevant time span.

Some people are also calling for every certificate they've ever issued to be added to the CT logs, but I doubt that'll happen.

We can do it without breaking websites: a TLS implementer could reject all certificates issued by a particular CA after a certain date.

(For the obvious issue) WoSign's recent certificates are in the CT logs and they're promising to put in all their 2015 certificates as well, so they could be whitelisted.

I wish we lived in a world where X.509 name constraints[0] were actually useful, but unfortunately we don't, and I think getting browsers (never mind other TLS clients) to enforce them is even less likely than the various root stores revoking known-bad CAs.

[0]: https://tools.ietf.org/html/rfc5280#section-4.2.1.10

Here's a thread from mozilla.dev.security.policy where the CA responds to this and two other(!) misissuance incidents they failed to report (someone's even claiming a third incident at the end): https://groups.google.com/forum/#!topic/mozilla.dev.security...

PCI-DSS says 112 bits of security is "strong cryptography", just so people can continue using 3DES.

But Valve hasn't locked out the Oculus. Plug one into a computer with Steam and it'll pop up a prompt to setup SteamVR just the same as plugging in a Vive. It even includes a link to Oculus-specific instructions: you need to set it up with the Oculus app and change a setting there to enable the Oculus device for use outside the Oculus store.

(Source: anecdotal experience from plugging a Rift into a computer that didn't have a real GPU; no idea if there are any other issues.)

Mister Rogers[0] was the host of an American children's show, and was known for being extremely nice, both on and off the show.

[0]: https://en.wikipedia.org/wiki/Fred_Rogers