mort96

Is that actually true? Something still handles those packets, are they dropped by the firewall before or after the vulnerable code?

The reason I ask is that I have devices out there like that today and I need to know whether I should be freaking out or be completely calm.

I don't get this vulnerability, it's been out there for weeks, completely public, yet it has stayed extremely opaque. Usually, the day a high profile vulnerability is made public, there's all kinds of guidance out there explaining exactly who it affects how, and there are day 0 patches. This one I still don't know whether is an RCE or not in practice!

For sure, it has been an amazing ride for those using the stock market as a casino.

That's kinda the point; something as important as this shouldn't be a casino.

Does a normal "default deny all incoming" rule with e.g UFW or nftables achieve the same thing?

And the PHP update, it took like an hour after the embargo ended.

Money is a scarce resource and should therefore be taxed.

You could say that it's intentionally kept scarce, and that is somewhat true, but currency is kept scarce because it only functions if it's scarce. Currency without scarcity ceases to be currency.

Can you tell me what I should be doing differently then? I just host some services, among them Nextcloud that's written in PHP, protected by SSL, on a server running Linux. And I feel like the past week has been a lots

I mean if a company doesn't care about protecting its users' data then any conversation about improving security is gonna be inapplicable to them.

I'd also suggest that companies being so blasé is a direct result of lacking regulation. If there was no laws about aviation safety I bet we'd have more airlines with lax safety standards and more accidents.

Nowhere in what you linked describes this as a wealth tax. That link just describes paying people a UBI from the income generated by the land value tax. There's no mention of additional taxes.

Seems my understanding of Georgeism was correct after all. Maybe you're the one who should stop spreading misinfo?

Or did I miss the part where it proposes non-land-value types of tax?

Nobody who claims to be Georgist or support Georgism seem to agree what it actually means. I'm following the traditional definition of having only a land value tax. If you want to propose something completely different you can do that, but I don't even know what "Georgism plus a bunch of extra taxes" is supposed to be mean.

Nah the ideology is just rich people or wannabe rich people wanting less taxes. Having a land value tax makes sense, removing all other taxes does not.

Wait do georgists describe any "finite natural resource" as "land"? Is clean drinking water "land"? Are radio frequencies "land"? Are domains "land"? (I mean domain names aren't "natural" but neither are IPv4 addresses????)

Weird-ass ideology

I responded to a claim about existing hardware/software.

> backwards compatible with existing hardware/software

Absolutely not. Existing IPv4 hardware and software expects addresses to be 4 bytes long. They expect packets to have a 4 byte source address at offset 12 in the header, then a 4 byte destination address at offset 16. Everything breaks if you try to give them a header with an 8 byte source address at offset 12 and an 8 byte destination address at offset 20.

I think you're right that that was their expectation/intention. I think it failed because experts don't just randomly go through old questions and make modifications. What prompts knowledgeable people to share their knowledge is new questions asked by new people.

My biggest issue with SO was that all the answers were outdated. In the beginning, if you found an answer on SO it'd be still relevant because SO was relatively new. But then as it got older, so did the answers to questions.

The ridiculously strict "no duplicates" policy guaranteed that the old, increasingly outdated answers would remain the only answers forever. In retrospect, I believe a site like SO wants to encourage some rate of duplicates, to ensure that answers remain fresh.

Just yesterday I looked something up on SO and the answer was 14 years old. Would've been a pretty relevant answer back when I first started using SO, but not now.

They really killed themselves through strict moderation. It's incredibly sad, it was a good resource while it lasted.

Someone has to decide on a set of default CAs to trust... It's natural that it's your OS vendor, since the trust store is an OS thing.

I use SSH for things which are private or which I may want to push to, but I use HTTPS for everything I just need to download. SSH typically requires that you create an account with whatever the git host is and upload your public key.

I agree that it's incredibly naive, but it's pretty much the sales pitch from the AI industry to the rest of society.

That argument goes the other way though? The only reason TV manufacturers would leave frame interpolation on by default is that a decent chunk of people notice, those people care, and most of the people who notice are "normal people" who aren't repulsed by it.

If only "pro consumers" noticed or cared... well, those "pro consumers" are the ones who think it looks like shit and would rather have a TV without it.

The editor can be React, maybe even Next.js, but why does the generated page need to be?

So you're meant to shell out $2000 for the Duo and then an additional $1200 for an 18 or something?

Is that meant to be a response to what I wrote or did you reply to the wrong comment

Yeah, obviously? Deploy fixes to security issues which apply to you as soon as possible, deploy random feature additions and non-critical bug fixes after some cooldown.

As always, the easiest way to manage this is to have as few dependencies as possible. If you have a lockfile with thousands of entries, you won't be able to go through them and decide which upgrades are legitimate urgent security updates and which can wait. If you have 10? You'll manage.

These chat bots always hedge like that. They will never give you a straight answer, it's always "depending on version and build configuration and system configuration".

Investigate yourself. Read the documentation. Grep for brotli in the source. Don't blindly trust a chat bot when it says it "might happen in certain configurations".

That's not the -preview version which was submitted

How about you give us the source code to that binary so we can see for ourselves?

> a) Why the would you never want to update an OS in this day and age ?

Because updates break the jailbreak. If Apple actually had a sanctioned way to let you do what you want with the device you bought there would indeed be very little reason to not update.

What's the explanation for paths to q00.rs-q36.rs being in the binary?

This is all well and good, I'm not saying it's wrong, but if real world benchmark results of "letting the branch predictor do its job" indicate a 10% performance regression, I would understand why such a change wouldn't get merged even if it was proposed. "Just don't make mistakes" is, for better or worse, the modus operandi in C.