J-Kuhn

Photos of your hand?

What is next? Run some arbitrary command? Make photos of your feet?

We really ought to think what is an acceptable way to verify that someone is an actual human.

It even works on Windows.

> We would prefer the Play Integrity API being banned by regulators but this is good enough for now.

Unfortunately, the EU is currently developing their age-verification-app, and it mandates hardware attestation[1], and it seems that their reference implement those requirements using Play Integrity[2].

[1]: https://news.ycombinator.com/item?id=49148128 [2]: https://github.com/eu-digital-identity-wallet/av-doc-technic...

Yeah, its the "well, legally, we have to provide the source code, but we make it as painful and slow for you as we can without it becoming a blatant violation of the GPL."

Alternative Phone Line? You want the bootstrapping problem?

Exactly.

You can make it not throw by adding `--add-opens java.base/java.lang=ALL-UNNAMED` or similar to the command line, but breaking things like this is becoming harder.

For me, Nix(OS) solved most of the problems:

* Getting a dev env with `nix-shell -E '(import <nixpkgs> {}).somePackage'` where I can edit the source and compile it with the various `runPhase` commands[1]. Yes, a bit cumbersome, but it works and it is the same for all packages.

* Integrating the resulting patch into the package manager using overrides[2]. Sure, applying the patch may break at some point, but I am more comfortable reviewing that by hand than rely on an agent that does it for me.

[1]: https://wiki.nixos.org/wiki/Nixpkgs/Create_and_debug_package... [2]: https://wiki.nixos.org/wiki/Overlays#Adding_patches

Before openjdk did move to github, they made sure they had a solution for those problems:

* Contributors without github accounts * Moving away from github (when needed) * No vendor lock-in for github stuff.

I personally think, this is a good idea - a lot of work, but may be worth it in the long run.

The problem is not that the array is mutable, but that the size of the array may differ for different strings. (In fact, it usually* does differ if the string length is different).

This makes it impossible to flatten - as the VM needs to know the total size when creating the memory layout for a class...

* (with a small exception: if the strings use different coders, one can be twice as long and the backing arrays would still have the same size)

Such hacks will slowly stop working (without explicitly allowing it from the command line.)

In this example, it would throw an IllegalAccessException, because java.base doesn't open java.lang.

I changed the sudo settings to not require a password.

Now an application on my computer can obtain root without user interaction.

Where is my CVE?

By some logic:

* If they want to tell someone personally what to do or not to do, is some form of employment.

* If it is not paid, it can be considered slavery.

* It is usually possible to quit jobs.

Systemd (part of many major linux distributions) has for example machine-id[1], readable by anyone on the machine under /etc/machine-id.

[1]: https://www.freedesktop.org/software/systemd/man/latest/mach...

Sarcastic view: Doesn't matter - the EU wont listen, then pull a surprised pikachu and make laws to force googles play integrity to attest that other devices are genuine, because obviously, the problem is google, not stupid design decisions made while creating the app.

You can do GET & POST requests without preflight.

The logic behind this is: It was possible to do this before the introduction of those APIs anyway - but you could not read the response.

You could send a GET request by, for example, embedding an image. And you could send a POST request by submitting a form - even if the form did only consist of hidden elements.

Those are called "simple requests": https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...

It is expected from web application that they can correctly handle those requests, even when they were sent from a different origin (for example, blocking them by using a CSRF token).

It was however not expected that existing web applications could handle non-simple requests - as the ability to do so was restricted either to command line tools or required other user interaction/configuration. This is where the preflight request comes in - send an OPTIONS to check if the other side is okay with that kind of request.

But what CORS do is: It can make the response available to the requesting script - the request did already happen if it didn't require a preflight.

Yes, the EU calls it "digital sovereignty" and is currently "in" with the EU.

To my knowledge, any app can just instruct the installed browser (Google Chrome, Vanadium, Firefox...) to open http[s]://tracker.evil-ad-network.example/?installedId=012345.

Or simply forgetting to renew the domain, at which point an attacker can deliver arbitrary files through correctly signed TLS.

There is also Idris 2 for JVM (https://github.com/mmhelloworld/idris-jvm)

Frege targets Java source code, which is then compiled by javac - the downside of that approach is you can not preserve the line numbers for debug information.

At a quick glance, it seems to be missing some hook to resolve class hierarchies - which is needed when merging stacks with different types. Consider

    var foo = expr ? new Foo() : new Bar();

For such an expression, some superclass or superinterface for both Foo and Bar has to be chosen.

What I am curios about is, if the java classfile API[1] provides a good model that could work in Haskell as well - I always had the impression that it was heavily influenced by functional programming, for example it uses "lifting transforms"[2].

PS: Good work on the label resolving part - this model is also used by the Java Classfile API and before it, ASM.

[1]: https://docs.oracle.com/en/java/javase/26/docs/api/java.base... [2]: https://docs.oracle.com/en/java/javase/26/docs/api/java.base...

This information is shown on the site of the breach, as example: https://haveibeenpwned.com/Breach/BakerDistributing

This is a bad idea, for multiple reasons.

https://www.troyhunt.com/here-are-all-the-reasons-i-dont-mak...

You assume that the EU acts in a coherent manner.

I think that premise is wrong - there are many interest groups, and by luck/lobbying/reaching critical mass/... they manage to put one of their interests into a law.

Fun Fact: When Cookies were introduced into Netscape, you got a browser permission prompt. Then browser vendors set it to allow by default.

And then legislation required those consent boxes back, so everyone built their own, instead of demanding that the default should be changed back.

Oh, I also got one: https://wiki.archlinux.org/index.php?title=Special:CreateAcc...

> To protect the wiki against automated account creation, we kindly ask you to answer the question that appears below (more info): What is the output of: LC_ALL=C pacman -V|sed -r "s#[0-9]+#$(date -u +%m)#g"|base32|head -1

Wait, they really do that...

Inspired by this, I wrote a quick prototype using MethodHandle combinators: https://gist.github.com/DasBrain/19804df69c78cee257dd0294b00...

It doesn't have all the bells and whistles - so no support for annotations or arrays, but for ~2h of work, it shows what is possible without resorting to bytecode generation.

I think they point weird-eye-issue wants to make is: Students attend college to become qualified to work.

In some parallel universe, they may still have it built in.

Still has the same vibe as "she did consent by wearing such a short skirt".