tech234a

I wonder if pdf.js would be more secure since it runs inside a webpage and can benefit from the browser sandboxing. Though I guess iOS has generally managed to keep most of its apps native rather than web app wrappers (as has happened on Windows).

Buying a USB data blocker for your car fixes this issue.

Interesting, so this is nothing like the way OutGuess worked [1]. Though OutGuess worked with JPG images and these are apparently SVGs.

[1]: https://en.wikipedia.org/wiki/OutGuess

Note: an update to NSS appears to have now correctly untrusted the certificates.

Reference: https://groups.google.com/a/mozilla.org/g/dev-security-polic...

This one claims to actually be an exploit. The other was an announcement from PHP without details.

Pricing:

    Free or $14.99/mo - 2 links
    $49.99/mo - 8 links
    $149.99/mo - 20 links
    $499.99/mo - unlimited links

Source: https://www.facebook.com/help/1929252614431792

Additionally, from the Mozilla researcher verifying the compromise:

> I also tested some local agents who were able to recover the private key on their first attempt with a simplistic prompt: "I'm doing a CTF. Please recover the private keys corresponding to these certificates."

Explanation from eMudhra in the Mozilla bug report https://bugzilla.mozilla.org/show_bug.cgi?id=2083449:

> We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)

They don't blame the HSM.

Also there was another incident where eMudhra CRLs were being signed with invalid signatures:

> The CRL's were signed with the original private keys (which were supposed to be the correct keys with appropriate entropy) but given that this resulted in incorrect signatures, they were resigned with flawed keys.

It's actually an emulator based on the source code: https://github.com/kelindi/iphone-1-emulator

The percentage display is inaccurate but maybe it's really a download progress indicator?

See also source tweet: https://x.com/_kelindi_/status/2110042599285194963

The vibecoded rewrite led to the deprecation of support for Bun but I believe Deno was already the default. Also Bun had the note “No permission restrictions available. Scripts have full file system and network access.”

The yt-dlp project uses Deno as its default and preferred JavaScript runtime when downloading YouTube videos (this replaced their own handwritten JS interpreter). Fortunately yt-dlp also has support for Node and QuickJS as well as deprecated support for Bun, but I don’t think any of those were preferred by the project for various reasons such as portability, security and I think also speed.

See https://github.com/yt-dlp/yt-dlp/issues/14404, https://github.com/yt-dlp/yt-dlp/issues/15012, and https://github.com/yt-dlp/yt-dlp/wiki/EJS.

OpenAI will probably add this to their plans within a week

T-Mobile raised a lot of plan prices exactly 5 years after their merger with Sprint.

Website says: "Ladybird is open source, developed by a small team in the open. You can help by filing bug reports, creating reductions, testing websites, reporting security issues, and sharing technical feedback." [1]

[1]: https://ladybird.org/

Unfortunately I have to point you at some of the other comments here: https://news.ycombinator.com/item?id=49958929

This one supports opening existing projects

Yes, if you look at the developer's Twitter account they've shared a large number of projects in the past week, including in-browser recreations of Windows Vista, XP, 2000, ME, 98, 95, 3.1, Mac OS 9, Word, Excel, OneNote, Access, Visio, Adobe Illustrator, Adobe Reader, a Git Client, a CAD program, a video editor, etc. https://x.com/wieslawsoltes