OMGWTF

> Doesn't the PDF on their site pretty much prove they can do both of these - at least, in a way? They were able to change the color without impacting the contents of the PDF and get the same SHA1.

I think they prepared both PDFs and then tweaked with bits in both of them. This is much easier than tampering with only one PDF.

So I think it's still very hard to generated a CA cert where you can just copy the signature of an existing cert.

But maybe you can predict exactly what parts from your signing request and what timestamp and serial number and so on the CA will use, then you can maybe precompute a signing request that will result in a cert where you can replace some parts with other, evil, precomputed ones.

The problem is not that we ended up with Trump (or Hillary). The problem is that we ended up with Trump vs. Hillary. The majority didn't care enough for the earlier stages of our democratic process.

Ah, you're right.

  > If the value of the right operand is negative
  > or is greater than or equal to the width of
  > the promoted left operand, the behavior is
  > undefined"

(http://www.open-std.org/jtc1/sc22/WG14/www/docs/n1570.pdf - ISO/IEC 9899:201x (C11 Working Draft N1570): 6.5.7 Bitwise shift operators)

So?

  (i >= i)                           // 1
  ((i >= i) << i)                    // 0x10000 or 0
  (((i >= i) << i) >> i)             // 1 or 0
  (((((i >= i) << i) >> i) <= i))    // ((0 or 1) <= 16) == 1

Where did I go wrong?

Would question 4 have a different answer if it was:

  unsigned int i = 16;
  return (((((i >= i) << i) >> i) <= i));

? (I changed `int` to `unsigned int`.)

Use ":set paste" before you paste. (Disable with ":set nopaste".)

See also: http://vim.wikia.com/wiki/Toggle_auto-indenting_for_code_pas...

Or, if your terminal emulator supports "bracketed paste", use something like this: https://github.com/ConradIrwin/vim-bracketed-paste

Can you provide an example that could be misread?

I think its quite easy to judge whether a downwards accent starts at the top of the line or at the middle, similarly for the upwards accent if it starts at the middle or at the bottom.

After looking at the gossamer thread: Could this be directly related to the current BIOS problems? Lenovo's closed source driver runs into problems -> Lenovo dev wants to commit workaround to Linux, fails -> force different PCI-ID as alternate workaround by crippling the BIOS? Firmware gets copy&pasted to non-servers?

I have found 8 commits (https://anonscm.debian.org/cgit/logcheck/logcheck.git/log/?q...). Seven of those change 1-2 lines, the other updates the copyright file.

As far as I can see:

- 6a4bf69 has not been reverted

- d4a97c5 has been reverted in 8050b2d

- 5f7da05 has been reverted in ccc183d (webmin)

- cf5e9d3 has been reverted in 792a996 (webmin)

- c6634da has not been reverted, he is still listed in debian/copyright.

- 82f8600 has not been reverted (was extended in f24650f)

- 7f8efa8 has not been reverted

- e4f4889 has not been reverted

So, out of 8 commits, 3 have been reverted. The 2 webmin reverts were followed by deletion of the whole webmin file the same day (5785901).

I don't see how three reverts are "a flood of notification e-mails" or that "The lead developer had reverted every single commit I had made."

But I agree that the commit messages of those reverts should have contained a reason.

Obviously something went wrong. But I don't have enough information to call it a dick move.

https://anonscm.debian.org/cgit/logcheck/logcheck.git/log/?o... august, september 2011

For C:

    #if 0
    ...code...
    #endif

> 99% of sites have no business accessing a lot of that stuff and popping up warnings every time they try to would make it a whole lot more obvious when a site is taking advantage of your personal data.

I agree, sites should not have access to that data. I would prefer if those features would be removed again instead of introducing more popups.

Try using the uMatrix browser plugin for fine grained control of what external scripts/frames/etc a website may request.

I'm using it (along with uBlock Origin, EFF Privacy Badger and custom Tampermonkey scripts), and while I like the sense of control, I also think it's obvious that fine grained control for such details or further details like battery status is not what most users want or even could handle.

Sometimes it becomes really annoying and I give up on figuring out what minimal set of features a site needs, and I open it in an incognito tab where only uBlock Origin is active.

This website wants to know your screen resolution. [allow] [deny]

This website wants to know the list of fonts installed on your system [allow] [deny]

This website wants to access your location. [allow] [deny]

This website wants to use the css attribute a:visited [allow] [deny]

This website wants to record more than 1 mouse event per second. [allow] [deny]

This website wants to read your battery status. [allow] [deny]

This website wants to disable your ad blocker. [allow] [deny]

This website wants to know your timezone. [allow] [deny]

This website wants to know your device temperature. [allow] [deny]

This website wants to open more permission requests. [allow] [deny]

Practically nobody cares about not draining your battery. All they care about is your attention and/or your wallet.

see: https://news.ycombinator.com/item?id=11851774

I'm playing with http://herbstluftwm.org/ - it's written in C++, has an IPC command line client written in C. The configuration file is a bash script that uses the IPC client, but you can also use a script/program in your favorite language instead.

Solution for square: spawn threads, distribute PIX instructions for each pixel evenly across threads.

Checkerboard and 4 Squares: http://imgur.com/a/dJRhM

My current scores:

  Square:       0x07 cycles
  Checkerboard: 0x4C cycles
  4 Squares:    0x09 cycles

I will post my solutions in 24-48 hours.

You're right, this offers no protection while the server is running.

But: Hard disk die. Usually just a few sectors become unreadable and the remaining part is still accessible. Sometimes you can even read all the data, but S.M.A.R.T. is indicating an impending failure. Of course you want to swap out such a drive as soon as possible. Hopefully the old drive will be disposed of responsibly and securely. But do you want to depend on that? I don't. If I have a failing drive and I can't wipe most of it, I keep it instead of sending it in for warranty replacement.

I have come by several old servers and hard disks that still contained non-empty partitions from the previous owner / user. If that happens, I just wipe the drive before reformatting it. But I always wonder: would they do the same if they got an unwiped drive of mine?

Try https://web.archive.org/web/20151126183335/https://www.jwz.o... if the link doesn't work...

> Flash plugin missing

> Get the latest Flash player to view this content

No, I won't. This scares me too much: https://www.cvedetails.com/vulnerability-list/vendor_id-53/p...

"Tweets by @git_lab" -> "Account suspended"

«Worryingly, it’s very easy to extract and use the encryption key run by Komodia, largely because the password to access all different versions of the certificate is “komodia”.»

No, the problem is that big subsets of affected systems share the same root certificate and private key. How or whether that private key itself is encrypted is less of an issue.

Here I have an explicit "FizzBuzz" but only 2 checks. Do you consider this also broken?

   python3 -c '
     for i in range(1,20):
       print([i,"Fizz","Buzz","FizzBuzz"][int(i%3==0) + 2*int(i%5==0)])'

I tried to reimplement it with less code and data (as x86 instead of x86_64 however).

I stopped at 110 bytes .text and 49 bytes .data: http://pastebin.com/bPfrB165

If the list contains 2 elements, it will overwrite the second parameter, so the total number of arguments is still the same.

I think

    $sth = $dbh->prepare("SELECT document FROM table WHERE tag=? AND security_level=?");
    $sth->execute(foo(), $user_level);

breaks as well, if foo() unexpectedly returns a list.

When will the site be switched off? I.e. when will links/bookmarks stop working?

The basic idea is to encode the array within a single integer:

   0 + [anything, 31,28,31,30,31,30,31,31,30,31,30,31]
  28 + [anything,  3, 0, 3, 2, 3, 2, 3, 3, 2, 3, 2, 3]
              00, 11,00,11,10,11,10,11,11,10,11,10,11

   reverse:   11,10,11,10,11,11,10,11,10,11,00,11, 00
            0011  1011  1011  1110  1110  1100   1100
          0x   3     b     b     e     e     c      c   

We have 4 possible values in the array, so we need 2 bits per value. We have one dummy value + 12 required values, so we need a total of 2*13 = 26 bits which fits easily into a 4 byte integer (either 32 bits unsigned or 31 bits signed). To retrieve one element from the "array", we need to shift our constant 2 bits per month or twice by the numer of months. Then we need to mask everything but the lowest 2 bits (&3).