rekoil

Ahhh, true, SSH isn't the same certs, my bad... well, both Github and Azure DevOps default to HTTPS-based cloning anyway...

> probably some that are not going to ever get patched

This is a HUGE deal for embedded devices, we can now mitm HTTPS traffic on lots of embedded devices running Linux produced between 2018 and now.

So you target some host like ssh.dev.azure.com, find all the hooks in the proper repo the client is trying to access, make a new commit that puts your persistence payload in one of them that you expect will be executed soon, this script can additionally "correct" the git state when it finally runs, and moves its persistence to some more appropriate location.

Users will be none-the-wiser because they're not accessing these hosts through a web browser, and you net a few more compromised hosts in your inventory.

This is such an annoying quirk of macOS, I regularly SSH to some servers I need to get my password to from 1Password, and I am apparently incapable of re-programming myself to copy the password prior to starting the SSH connection, so what happens is I SSH, open 1Password quick access (which dismisses my Ghostty-adrum quick-terminal), copy my password, and then frantically spam my quick-terminal shortcut until I remember it's blocked because macOS has decided its not allowed in the current state.

Would be great if we could opt out a few pre-determined key combinations from this system, but I guess that's never happening.

Thanks so much for maintaining Ghostty tabbed quick-terminal by the way, you're a legend <3

Hear hear, I've been running adrums build for what feels like forever now, manually recompiling Ghostty from time to time because I can't use a terminal without tabbed quick-terminal in 2025 let alone 2026. It's a killer feature I can't work without.

It's pretty easy to compromise things like McDonalds or Starbucks WiFi hotspots though, just setup a Pineapple with the right SSIDs and a 5G modem, funnel your target domains through your mitmproxy via the DHCP DNS server you're providing, and that's basically it.

I agree it's not PHP2Shell, but its certainly not being "way overblown" here.

In my mind these two worlds don't have to be incompatible with each other, I am fully aware of the issues with cheating in competitive online gaming and am ready to give up some freedoms to improve the quality of my experience, but I believe we can do this still using Linux clients.

I would not have an issue with having a "gaming kernel" installed that I can reboot to when I want to game, one that gives EAC and other similar softwares access to my hardware so they can do their jobs, I don't love it, but I'm ready to make that sacrifice because I have experienced gaming with rampant cheating.

The problem is nobody is providing that option, and game developers are instead actively excluding Linux as a target platform entirely, e.g. Apex Legends, a game that ran well on Linux until October 2024 when Respawn decided to actively block it from joining online matches by toggling a flag in EAC.

I want to get off Micro$lops wild ride please.

"They were too preoccupied with whether they could, they never stopped to think whether they should"

Jokes aside, very impressive that it works!

I need to see end-to-end encryption on this service before I am in any way interested, it should be a "rendezvous service" connecting clients with servers only, with full end-to-end encryption between them, and Nabu Casa should have zero ability to control the server.

Build that and I'll be interested.

I had the 12 mini (before it I had an iPhone SE, then iPhone X, then the 12 mini), which unfortunately did not work for me because the battery drained too fast.

Really hope you're wrong and we do eventually get some more one-handed phones in the future, especially once battery tech evolves.

Not necessary, corporations can speak for governments these days, its all cool!

I think it explicitly avoids directly saying that the Commission has agreed this resolves the disagreements, again hoping public sentiment will drive the nail all the way.

I am really hoping this isn’t the end of it, general purpose computing devices need to allow its user to choose the security model, in my opinion the entire industry fundamentally depends on it, and without that freedom we will have monopolies deciding everything sooner or later.

Only if consumers would pay it, which isn’t something we can really know.

What's out there?

Awesome! Been looking for something like this for so long, thanks so much for making it!

Tried it and it seems to work for the most part, but one app where it would be really helpful to me is Ghostty.app, specifically the quick-terminal, and it seems that it doesn't currently handle that, which is unfortunate.

Right, and to be specific, what they also leave out is that the DMA only mandates that third-party providers can request access, the user can be in full control without breaching the rules set by the DMA.

I bought an Arc A770 expecting that this feature would materialise based on it being available on other contemporary Intel GPUs, but it never did.

Does the B70 definitely support SR-IOV from day one?

They have a new type of core on these they refer to as a "low-power efficiency core", which is probably what is enabling these "feats", but as one of the parents to this comment points out we're comparing Windows configured in "Ultra Efficiency" mode to Apple Silicon MacBooks at most configured in Low Power mode...

Anecdotally, comparing to recent (but still older than these) generations of Intel chips I can run my M2 Max MacBook Pro with 78% battery health for longer (without any special considerations) than colleagues running their Windows Intel laptops in Power Saver mode, while performing similar tasks.

Yeah I think if they manage to solve that then we're gonna be cruising. I want to but can't really run AsahiLinux as it stands, my workstation is Thunderbolt-based and that's non-negotiable.

Yeah I think this is the biggest difference. Here in Sweden if I get a headache that's bad enough I'll just take a sick day and there's not really much social stigma about that kind of behaviour unless it becomes a pattern that you don't seek medical help for.

I work in an office, but Swedish law protects blue- and white-collared jobs the same in this regard.

I mean Azure doesn't really support IPv6 well either for a lot of the big-ticket services.

I'm sure the number probably changed a bit, but I can tell you for a fact it isn't like cheaters disappeared overnight just because they banned Linux clients.

All the damn developers keep turning off online play for Linux users though... I play two games a lot currently, Apex Legends and Battlefield 6, both block Linux players from online play thanks to their shitty kernel rootkits not supporting Linux.

Apex Legends at least was running fine on Steam Deck prior to november 2024 when they instituted this change, and I can tell you from personal experience it had very little impact on cheaters, which was their excuse for the change (supposedly most cheaters were connecting via Linux clients).

Fascinating. Could this method be used to boot iPhone OS 1.0 (or at least 1.1.1) on an iPhone 2G with 16GB NAND maybe?

The oldest iPhone OS that natively boots on my particular one is 1.1.4, 1.1.1 (which is the highest version number where you can trivially escape the OOBE via the emergency dialer) fails to initialise the FTL (flash translation layer), probably because the chip is sufficiently different from that used in the older phones.

It would bring me great joy to be able to relive emergency dialer hacktivation again, but I have lost that particular iPhone 2G, and only have this 16GB one left.

I wish the iPhone 12/13 mini had been a few mm thicker for a bigger battery, and had been in the Pro class of devices. As it stands they didn't have a good enough battery to last a day, and most people interested in smaller devices had probably just picked up the new SE that was released just half a year earlier.

Right, in the nginx example above, someone has setup a secondary tool to provide certs at the location referenced, and is also handling renewal of them.

Also, if I want to add another domain that should be accepted and reverse proxied to my application, in Caddy I just do this:

    example.com wp.example.com caddyfreakingrules.example.com {
      root * /var/www/wordpress
      php_fastcgi unix//run/php/php-version-fpm.sock
      file_server
    }

Suddenly not only does my Wordpress site respond on example.com, but also wp.example.com, and caddyfreakingrules.example.com, Caddy will fetch and automatically rotate certs for all three domains, and Caddy will auto-redirect from http to https on all three domains. (Does the ngnix example actually do that?)

Another thing, does nginx with the above configuration automatically load new certs if the ones that were there when the process spawned have since expired? Because not only does Caddy automatically renew the certs, it is handled transparently and there's zero downtime (provided nothing changes about the DNS pointers of course).

Caddy is freaking awesome!

Bonus, if this were your Caddyfile (the entire thing, this is all that's needed!):

    {
      admin off
      auto_https prefer_wildcard
      email [email protected]
      cert_issuer acme {
        dir https://acme-v02.api.letsencrypt.org/directory
        resolvers 1.1.1.1 1.0.0.1
        dns cloudflare {env.CLOUDFLARE_API_TOKEN}
      }
      ocsp_stapling off
    }

    example.com wp.example.com caddyfreakingrules.example.com {
      root * /var/www/wordpress
      php_fastcgi unix//run/php/php-version-fpm.sock
      file_server
    }

    # This is simply to trigger generation of the wildcard cert without
    # responding with the Wordpress application on all of the domains.
    *.example.com {
      respond "This is not the app you're looking for" 404
    }

Then you'll disable the unauthenticated JSON API on localhost:2019 (which is a good security practice, this is my only gripe with Caddy, this API shouldn't be enabled by default), tell Caddy how to use the DNS-01 ACME resolver against Cloudflare (requires a plugin to Caddy, there are loads for many DNS providers), and then tell Caddy to use appropriate wildcard certs if it has generated them (which for *.example.com it will have).

The result of which is that Caddy will only generate one cert for the above 3 sites, and Let's Encrypt won't leak the existance of the wp.example.com and caddyfreakingrules.example.com domains via certificate transparency.

I don't disagree, but if we end up in a situation where users are negatively affected because they chose not to update for fear of shit like this happening, that's not a great position either.

Yeah, I should have spent an extra 10 seconds thinking of the problem here and I'd have realised you can have multiple sensors going to different software on one steering column...

Problem with that is that if it's an online product then the manufacturer also _must_ provide updates to keep the device secure so that it continues to do whatever they sold you in the first place.

Also, adding features on its own is great, but obviously stuff like what happened here can't be allowed to happen, and those Samsung or LG smart fridges that became advertising boards is obviously also not acceptable...

Easy to call the bullshit out, hard to actually define the responsibilities of a manufacturer in a law.

Seems to me a moot point because in the end you still have one system that's always going to be a single point of failure, and that's the steering wheel, if the system taking inputs from that fails to relay them (or fails to register them at all) to one of the two redundant software stacks, you're still up shit creek.