News for hackers. Stuff that matters.

d18g

Re:TCG TPM2.0 implementations vulnerable to memory corruption on Wednesday March 01, 2023 @01:36PM (#34986454)
Got it why I was downvoted. But honestly don't get why parent is the most voted comment on this thread. Maybe I am just super dumb ...
Re:TCG TPM2.0 implementations vulnerable to memory corruption on Tuesday February 28, 2023 @06:26PM (#34976419)
you can assume in good faith that this is barely used feature generally but also most implementations are not really vulnerable so they might have checked but couldn't find anything actually wrong, so there might have been a tremendous amount of effort to actually secure most implementation, on the other hand...
Re:TCG TPM2.0 implementations vulnerable to memory corruption on Tuesday February 28, 2023 @06:14PM (#34976297)
I would not assume so as these are firmware implementations and as such would not use the simulator directly

edit: also look at the link you can see clearly that Intel is not effected but AMD is unknown...

Re:TCG TPM2.0 implementations vulnerable to memory corruption on Tuesday February 28, 2023 @06:11PM (#34976270)
Not all implementations are actually vulnerable as there are dependencies on implementation details.
Re:Disabling the Intel Management Engine on Thursday October 27, 2022 @03:44AM (#33354462)
Disclaimer: A security researcher working on IME. Following is my own opinion.

Used to have really strong uninformed opinions on many things, as often found in young techy-nerd person. It is terrifying how intelligent people are so prone to jump on conspiracy wagons.

The current thread and alike are truly humbling experience for me as a person, I wonder how my comments look like to the in the know personal. If they ever had the misfortune to ever see it, did they at least had a good laugh?

I know I didn't give any arguments. Sadly I can't get into details so I will be pretty handicapped anyway. I do believe good faith dailog is possible, but feel that it is impossible on the wide internet. Would be great to have a serious conversation on the subject in person with the more cool-headed commenters here.

I must thank all of the HN commenters that usually try to be thoughtful, insightful, thought provoking and respectful at the same time.

Learning the syntax of a language is far from understanding the sementics.
>The other issue is that it does not use Windows ca store for certificates

By default. But can be configured to use the cert store [0].

> Apparently the content type is wrong in downloaded file so ff will not associate an application with the file

If it is consistent that shouldn't be a real problem.

[0] https://wiki.mozilla.org/CA/AddRootToFirefox