winstonwinston

Different paths. If you’ve got a “dual stack” on your computer, give it a try.

tracert -4 google.com

tracert -6 google.com

I do get very different hops and latency.

However for “happy eyeballs” algo to fallback to IPv4, latency needs to be very bad on IPv6.

Can you tell some example please, because I see fellow balkans thrive wherever they go. It’s the opposite in my experience when you come to balkan from strict regulatory environment then there are problems.

My bet is on Windows Millennium Edition (Windows ME). That was broken version. Windows 2000 was good.

While WinMe was 98 successor and meant for home use, Win2k was business oriented.

Uh oh, TIL exploder was a thing on a mac. I moved to macintosh when first macbook air was released, so that’s os x leopard or snow leopard.

When you roam phone “leaks” mobile number and identifiers. So receiving a Text (SMS or iMessage) spam would make sense, but email does not.

> Be the change in the world you want to see. Turn javascript off. Use real native applications that cannot change underneath you.

But they can change (underneath). Native app is one bug away from arbitrary code execution. When remote content triggers this bug, it becomes RCE. In this case it was javascript engine bug, in any other it could be your photo viewer or whatever native code you are running with untrusted content. The untrusted content being an image you are viewing.

> This is hyperbolic; the agents were only able to access the internet by finding a zero-day in the internal Artifactory instance that was providing package access for the agents. The sandbox could and should have been better, but it was not as weak as it could have been.

Like we all forgot how sandboxing is done for decades. This brokered thing they call sandbox is not it.

I guess that’s the point. Initial incident reports from all sides were so vague and didn’t disclose anything technical. If it did, it would show a bruteforcing bot let loose to spend millions in infrastructure costs and there’s no ‘intelligence’ in that.

My suspicions for ai all along was that bruteforce approach even if useful will be unsustainable due to high cost in the long run.

General desktop replacement is not easy to pull of (successfully). It seems weird to start with replacing windows or macos rather than SaaS and IaaS, which they are concerned about the most. In the end they still going to use phones with software from Google and Apple.

> I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).

No doubt there exist services that do not offer recovery method for passkey or mfa enabled account. But this is entirely on them (the service), to blame for, not the passkeys or the users. It’s bad implementation.

Imo copying (like carbon copy) makes it fair compared to taking it (without attribution) and claiming it yours.

For example, for software I usually use MIT license, which is a permissive license with attribution.

Why makes no sense at all unless you are very naive trusting they would not jump straight to the endgame if it was possible with the technology available.

The sane way for encryption keys stored in hardware (secure enclave or tpm like) is to onboard user when the key is not derived from user password. Just like they do for FDE to export a recovery key and then you can adjust your expectations when you know (been told) whats going on.

But that’s not backup restore? I’m thinking Time Machine restore on a new Mac when old one is no longer working. Or when the old one had to be wiped and restored.

Maybe but this is unexpected if you need to restore from a backup..

Basically you add more radiators to keep water temperature low or you add a backup heating source such as typical electric water boiler that will be used only during very cold days to increase water temperature when heat pump cannot keep up.

CERN wants x86-64-v1 binaries, not v2.

Alma and Rocky both require x86-64-v2 CPU as a minimum (same as RHEL 9). CERN want baseline x86-64-v1 which Debian provides.

Don’t they openly state that their product may cause IP issues but that is fine because they will take care of your legal problems caused by their product?

In the end, it’s not them stealing, it’s the AI doing stealing. What kind of moral compass are we talking about?

There is a common anti-pattern for heat pumps being installed in large houses. They are almost always more powerful than needed, just to be safe it will be enough, better safe than sorry. But overpowered heat pump will use significantly more electricity. Simply put that would be wasted energy.

Just saying for anyone reading this, it is worth it to ask for a second opinion before heat pump install.

> I prefer to run my own local recursive resolver.

Used to be fine. I stopped doing it when average TTL dropped to 300 seconds and it takes far too long for my local recursor to get the answer >100ms, when 3rd party resolver delivers in <10ms.

When I run a mix of CF and Quad9 resolvers, Quad9 was consistently slower in response times when measured. But it didn’t make any perceivable difference in real usage.

A “swarm” and “hijacked” reads like DoS and spam at the very least, doubt any of those is legal in german law.

If they wanted air gapped environment they would’ve it. I mean, if you want to sabotage your trial by hard constraints you can do it, or you do not do it to see interesting results. They even said it that some constraints were disabled for the test.

No memory ever wasted, consumes all of it.

But this does not seem to be the case anymore. Today I see that eclipse IDE is more memory friendly than Chrome.

I can say that I have used pip only and it does a package manager job well, it just works.

I’m not sure at what uv excel at but reading comments it seems uv is not only package manager but also venv manager.

Do these free HE assigned IPv6 prefix(es) just remain valid indefinitely even when not actually being used/routed?

What a fucked up reality when you need to point out that code contributor is responsible for their code.

Google has been sending some similar alerts long before Apple, those read something like "Government-backed attackers may be trying to steal your password".

`Cryptography` is not a Python stdlib:

  try:
    from cryptography import x509
    from cryptography.hazmat.primitives import hashes
    from cryptography.x509.oid import NameOID
  except ImportError:  # pragma: no cover
    sys.exit("missing dependency: pip install cryptography")

Then it goes on with a subprocess for openssl for a case that `cryptography` package does not handle.

Why not submit issue with `cryptography` project to get it fixed if it is a problem that needs fixing?