kchr
kchr on Hacker News
> Above a certain complexity, there is basically no 100% open-source hardware out there.
>
> Like none of the Pinephone, Librem, Framework laptops are "open-source" to the bone.
As an aside, GNU Librephone aims to rectify that by reverse-engineering those blobs and develop their own firmware for baseband chips etc. But I am carefully optimistic about the success since it is a relatively new project and quite a moonshot, even though I would personally stand first in line to buy one if it would materialize.
One of the points made in that paper is that you can't even trust the compiler, even if you write the code yourself. I think this is one of the stronger points as it shows you it is unfeasible to require everybody to audit all source code before running it. Be pragmatic, know your threat model, decide who you trust and move on with more important things in your life.
Full disclosure: am free software advocate.
From the TIOBE site[0]:
> Since there are many questions about the way the TIOBE index is assembled, a special page is devoted to its definition. Basically the calculation comes down to counting hits for the search query
>
> +"<language> programming"
I don't think the popularity of a programming language could be measured by how many hits it has on search engines. For example, it may well be that 50% of those hits are forum posts from people being frustrated because the language sucks. In addition, the fact that a language is in use in a lot of existing systems says little about when that code were written, and which options were available at that time.
[0] https://www.tiobe.com/tiobe-index/programminglanguages_defin...
While I appreciate the flashbacks you just gave me, I don't think the enshittifaction of GUI:s is orthogonal to the evolution in not having to deal with hardware issues any more.
You linked the same file twice, was that intentional?
Even approved and trusted admins can be a liability (disgruntled employee, social engineering). Like OP said, mandatory access control (MAC) implementations like SELinux can be used to even further restrict what an administrator (or process running with admin privileges) is allowed to do.
> Interesting, I might need to do some reading,
> Does macOS have any form of MAC yet, or do they just rely on sandboxing?
Kind of. There is a set of permissions an application can request in order to access protected services and areas of the filesystem, but maybe that's what you meant with sandboxing?
https://support.apple.com/en-gb/guide/mac-help/mchl211c911f/...
> No, you create
one account. The root account doesn't have to be created. It's automatically there, built into the system. On Windows, you have to explicitly create two separate accounts, one with Administrator privileges and one without.
Correct, but you're missing the point. There's practically no difference between Linux and Windows when you need to escalate privileges, except having to enter credentials for another (privileged) user than your current (unprivileged) user. The security boundary is there and the user experience is basically the same. Everything else is just nitpicking.
I need a rundown of your clients.
It's AI agents all the way down
They seem happy to host media for other conferences as well! <3
Agreed, but they're not being tossed out into nature the same way these disposable vapes are.
Can you elaborate on how this affects the security model?
This could probably be fixed by tracking whether the mousedown event was started inside or outside the dialog, and only close the dialog if the mousedown started outside it.
For native documentation, why not just search the official docs at
https://docs.python.org/ ?
I find it to be very discoverable if you are looking for docs about a specific function or module.
I believe adding extra components (i.e. custom software) would classify as the "mangling" GP wanted to avoid.
SQL in itself is not the weak point in this case (or any of the other cases of a successful SQLi attack). The problem is the treatment of user-controllable input data and using that data as part of a SQL query without properly sanitising/escaping special characters first.
I can't decide whether it would be considered an SQL injection or a SSRF attack, actually. I'm leaning towards the latter. Or maybe even a reflected XSS?
The IOCCC[1] (International Obfuscated C Code Contest) often features submissions where the source code is formatted to be works of art in itself. Sometimes the source code is also used as input to the program, where the formatting affects how the program behaves.
For example this program, which approximates the decimal digits of pi while having source code formatted to look like a circle:
https://www.cise.ufl.edu/~manuel/obfuscate/pi.c
[1] https://www.ioccc.org/
I can see the appeal, but hope they keep it opt-in so that people can choose their preferred workflow without surprises.
Yeah, I realise now that I read your reply my message was just questioning the broad blame on so called "stupid people", without discussing the responsibility part of it. I absolutely agree the banks should implement more preventive measures to combat fraud where possible. In many cases, fraud is obvious from the bank's perspective but might not be from the victim's, for many reasons.
> The consequence is that the cost of stupid, scammed, customers is passed to all customers, including those that do not send money to scammers.
What you conveniently left out in that cost calculation are the thousands of elderly and mentally ill people falling victims of such scammers. And who are these "stupid" people you mention anyway? Everybody knows social engineering is getting harder and harder to identify, considering how technology advances (spoofing SMS/caller ID, deepfakes, AI etc)
Farbrausch sure has put some incredible stuff on the scene in their time.
Same here, I have a Samsung XCover Pro bought 4+ years ago that still feels the same as when I got it. The only thing that notable is the lack of 5G support, but it's only when I switch between it and my work phone (which has 5G) that I really notice the browser loading times.
My tired mind had to read your comment a couple of times before realising you actually meant Steven, not Nsteve.
From those options, SoundScout for sure!
I guess it could be categorised as a PAM (privileged access management) solution with a built-in IdP?