evan_a_a
evan_a_a on Hacker News
> After receiving the alert from the affected provider, our engineering team took immediate action. Within 20 minutes, we stopped routing traffic through the server. We then reviewed and preserved the relevant security logs for investigation, securely wiped the server, and revoked its access to our other systems. The affected server has been permanently removed from our infrastructure.
When responding to a potential breach, the correct protocol is to contain the incident and PRESERVE EVERYTHING for investigation. Do not try to be selective at what data you keep or don't keep. They've unfortunately likely destroyed evidence and will not be able to determine if the attacker actually breached the server or not, and if so, how. This speaks to them having a poor or non-existent incident response plan.
Bit of a hyperbolistic title. The core of the bug report doesn't require disassembly of the library. The bug author just went the extra step to do a root cause investigation, which of course requires light reversing work.
>But I'm not aware of a messenger that provides a good UX for that
WhatsApp is the largest messaging app in the world (3B MAU) and does E2EE by default across private chats and groups.
Physical design (what this seems to be targeting) already uses non-deterministic algorithms because floorplanning, placement, and routing are all difficult problems to solve with a deterministic algorithm. Introducing probabalistic approaches helps to find the right fit within the constraints.
A green card is permanent residency, not a visa process.
>>Professors should teach about AI, include how to prompt efficiently and how to critically scrutinize the output
>100% agree, as with any important technology. But this is just a small curriculum change, just one more topic to cover in the lecture, and maybe a class.
Critically scrutinizing LLM output is just critical thinking skills, something universities should already teach.
Healthcare worker shortages are a problem in the US and other developed countries with universal systems. The type of system doesn't really influence the waiting time.
That comes with a contract between the hotel and the block holder.
If the journalist really did make a reservation under the room block for the event, and then was denied attendance to the event, it would seem fairly normal for the reservation to be canceled by the block holder.
Really, if the journalist wanted to cover the event without being noticed he could've done so undercover.
Encryption does not ensure data integrity, sigh...
Translator jobs aren't really getting wiped out according to the stats (in the US). Growth is still projected at 2% in the next 10 years.
They also have this to say about AI:
>Computer tools, including artificial intelligence (AI), are making the work of translators and localization specialists more efficient. However, many of these jobs cannot be entirely automated because computers cannot yet produce work comparable to what human translators do in most cases.
https://www.bls.gov/ooh/media-and-communication/interpreters...
They'll certainly continue wind projects, just not likely in the US and not with this money.
>RWE said that it will now reinvest the sum into conventional gas projects, including $900m (£669m) in a liquefied natural gas (LNG) export terminal project in Louisiana.
If the design is so inflexible that a single requirement shift destroys it, then it wasn't a good design.
This is contingent on the sealing policy including PCRs that would change as a result of booting a different operating system, like PCR 11, which, when booting a UKI, contains those measurements. Only sealing against PCR 7 would allow this attack, since the default platform secure boot policy would not need to change.
The keys can be indirectly sealed against specific system and software configurations such that this attack is not possible. Additionally, as you noted, using custom secure boot keys would prevent the attacker from booting an arbitrary OS.
The disk encryption key(s) isn't typically stored in the TPM, it is sealed by the TPM. A sealed key can only be unsealed if the TPM is in the same state as it was sealed against (simplifying some things here). With the proper selection of Platform Configuration Registers (PCRs), this can prevent the key from being unsealed if the system has not securely booted (sealed against PCR 7). In more complicated configurations, it is also possible to seal the key against a particular phase of boot such that it can't be unsealed once userspace is reached.
In your scenario, yes it is bad if the attacker gets root on your computer, but sealing the key with the TPM means they can't retrieve the key itself. Where the TPM helps is preventing the attacker from establishing low level (kernel, bootloader, or firmware) persistence, since modifications of these components would change the TPM PCR measurements and result in a boot failure.
If the attacker is local and they reset the UEFI, the TPM PCRs are now different and as before, the disk encryption keys will not unseal.
It is also generally recommended to use a pin with TPM, which further complicates this scenario for the attacker because the TPM enforces rate limiting. As the other commenter mentioned, the physical access scenario is commonly a stolen laptop situation, where the attacker would not be in communication with the victim and probably wouldn't return the laptop.
According to stats on a relatively small local sub I mod, most people interact with Reddit through the mobile app these days. All of the web interfaces make up a small percentage of visits, and old.reddit is even smaller.
The author is describing a practice that is already well known: Systems engineering. Applied well, systems engineering helps prevent many of these issues from happening in the first place. Unfortunately, outside of heavily regulated industries or critical systems (like aerospace, as mentioned), systems engineering practices are rarely applied with the proper level of discipline.
>We very much fear at $work that there are vulnerabilities in the Tailscale product awaiting discovery
Spoiler alert: This applies to all software. This is why security preaches defense in depth.
Modern process nodes with smaller feature sizes are likely to fare far worse under radiation than the nodes of 25 years ago.
Additionally, total dose is only one part of the equation. Single Event Effects (SEE) also must be mitigated.
You can read NASA JPL's ASIC design guidance for a brief intro.
https://parts.jpl.nasa.gov/asic/Sect.3.4.html#A0
Yes, the Xilinx space grade devices are engineered and qualified for radiation tolerance. These are FPGA socs and share no heritage with AMD desktop and server processors.
To my knowledge neither AMD nor Intel ship any processors that are rad hard or rad tolerant. For aerospace applications this is a very specific type of device which requires specific engineering work to achieve. You don't just get rad tolerant design through standard error correction and you definitely don't get rad hard without designing for it.
I am a bit confused about your situation. Did you have a stolen card used to make a purchase at ebay that was not under your account? Or did you make a purchase at ebay and have an issue with the product you received?