startling

It's useful to reframe this from "the manufacturer's fault". Lawmakers have a clear decision to make:

1). Prevent this business from existing.

2). Allow toy magnets to exist, thereby allowing X children to die from swallowing toy magnets.

I don't think this is ZenMagnet's fault. But I think placing a restriction on toy magnets is probably a net positive.

...which is why he used the SYS_ #defines.

I used Digital Ocean for a year. No problems, never sent spam. Then my mail started being spamfiltered, apparently because a neighbor was spamming. Seriously don't recommend using cloud hosts if you care about people receiving your email.

I used DO for a year without a problem, and then my IP was blacklisted (apparently a neighbor was spamming) and I couldn't do anything about it. Be warned, and frequently check if Google accounts receive mail frequently.

It's different because Edge is emphatically not more safe.

Can you blame them? Wine and hacking does sound like fun.

"Illegal" seems stronger to me than "not strictly conforming", I guess (and so does "well-formed", for that matter). But I think we basically agree.

Undefined behavior is not illegal. The compiler can do anything with undefined behavior, including exactly what the author expected.

> No. Just No. > Docker has nothing to do with security.

Docker can totally reduce the risk of in-container services being exploited. It has sane defaults, and makes it easy to distribute other restrictions with the application (seccomp profile, apparmor settings, etc).

I get anxious about this too sometimes, but in my experience the "long lists of conditions that no one ever told me and assumed I knew" are hardly ever relevant.

Black and white horizontal lines or misrendered text for a split second until a white blink rerenders the whole page. Happens somewhat frequently when I have heavy CPU load on a Linux laptop.

Got it. Then ICANN (or whoever) controls all websites, and is responsible for their infrastructure. That may or may not be better than what we have.

Attacking high-value dissidents: https://blog.lookout.com/blog/2016/08/25/trident-pegasus/

I'd assume Chrome is safer than Lynx these days, to be honest.

Not to mention the fact that using Lynx makes you unique enough for it to be a useful tracking indicator.

How do you decide which nameservers to trust about the "ycombinator" domain? What happens if I advertise a nameserver with that domain?

Here's a dynamic approach to stopping rowhammer: http://www.openwall.com/lists/kernel-hardening/2016/10/27/18

Writing parsers is really nice in Haskell: http://www.cs.nott.ac.uk/~pszgmh/pearl.pdf

Trifecta is a nice modern parsing library: https://hackage.haskell.org/package/trifecta

So, what's stopping the wrong site from making those requests to your bank and proxying the image?

I think dynamic analysis would be more useful.

This isn't about you, the consumer, getting root access. It's about a piece of code running on your phone (i.e. maybe part of an app with restricted permissions) getting root access.

...except the whole problem is that they overpaid bonuses.

That's not even true. Functions can map between lots of things, not necessarily numbers.

Functions are one kind of arrow. There are other arrows besides functions.

Renaming "arrow" to "function" is like replacing "number" with "1".

Sure, it can go either way. But in the absence of a kernel 0-day, segregating services on the same host is useful.

This exploit doesn't write to disk at all. It's about modifying the in-memory datastructures that correspond to executables on disk in between when they're read and executed.

It's just the in-memory executable, as I understand it.

> "In almost all cases, whether or not there's a known local privesc bug, assume that code execution on your Linux systems equates to privesc; this is doubly true of machines in your prod deployment environment.

It depends. I've seen "oh well if someone has rce they probably have root anyway" used way too many times as an excuse to avoid defense-in-depth measures.