VogonPoetry

The 20 seconds first start is because it is only an x86_64 binary -- no native Arm build.

I think you conflating bugs. Apple doesn't use Xpdf as the basis of the PDF Framework. The NSO bug exploited a bug in the JBIG2 file format. The same implementation of this code was included in both Xpdf and the Apple PDF code. That is why Xpdf needed to also fix the same code.

Consider N devices behind a NAT. They all make requests to a service.

If the service can learn the individual but current values of mach_absolute_time, then after a minimum of two requests you can likely compute N and distinguish between each device making a request.

This is possible because devices never reboot at exactly the same time.

This is an analogy. a^2 - b^2 = aa - bb. This can be factored to (a+b)(a-b). In the first expression there are two multiplies, in the factored version there is only one.

However, from a numerical analysis / accuracy standpoint, evaluating the factored expression can result in loss of precision in the result when a is close to b. This is especially true if you repeatedly and sequentially do a lot of these operations. Loss of precision can be a problem in numeral modeling (like climate simulation) -- long term predictions diverge.

Given that there is a drive to use greatly reduced precision in ML engines, loss of precision might have an effect on how a model performs. Then again, it might not. I haven't read a lot of papers on ML, but I don't recall seeing ones that try to quantify how sensitive a model is to error propagation. (I am making a distinction between tests where the precision is reduced to see where it breaks down v.s. calculating / understanding what the error level actually is in a model)

It seems like you want to delete all of the photos on your iPhone.

I have not tested this because I don't want to delete all my photos and I don't have a 2nd set of systems to try this out with, but I think this can be done by creating a "shortcut" to do it. (Shortcuts are like AppleScript for the iOS ecosystem).

To do this, search for the "Shortcuts" app and run it (it usually isn't visible).

- Create a new shortcut - Add the "Find Photos" action - Add the "Delete Photos" action

This should connect the two actions together. You can then run it using the play button.

This will take a very long time to run if you've got a lot of photos and it will ask to confirm using a popup. It might be worth trying to remove items in smaller chunks by using a filter (perhaps based on date or some other criteria).

I hope this helps.

Not sure exactly which way round you are asking -- should requests be tied to the person or be generic?

In the HomePod settings there is a section for "Personal Requests". When enabled, adding reminders will then go to the device / account of the person speaking. I'm not sure what the behavior is when set to off. You can change the setting for each HomePod.

I'd recommend setting up some Shortcuts with the addresses that can be triggered from Siri. For example, "Siri, we're going to the office", "Siri, let's go swimming",

One nit with this is that I haven't been able to make it automatically transition into navigation.

I think the software decoding technique used here is incomplete.

Consider what would happen if a data sector contained 12 * 0x00, 3 * 0xA1, 0xFE, ... then this implementation could mis-sync. On real hardware you'd have to be even more unlucky to have the CRC match -- which also isn't checked in this implementation. Using this as-is on real floppies could result in reading corrupt data. It would be possible to construct a floppy that would read correctly on real hardware and sometimes mis-read data with the current SW implementation.

The problem is that the 0xA1 bytes on the disk are special. The 0xA1 bytes are MFM encoded with a missing clock pulse -- making them "0xA1 syncs" that don't match an 0xA1 data byte.

This is what I think dragontamer is alluding to in another thread -- you cannot properly decode the header unless you also recognize the missing clock pulse. So it is important to do the clock recovery in order to notice this.

The special encoding is also present for 5.25 and early hard drives using MFM encodings.

Unfortunately I don't think this is the first time he has been socially manipulated in this way. Mr Krebs does seem to have a habit of only getting the details from one side of things and only writing things from that side of the story. Perhaps due to the nature of some of his investigations.

Everyone has weaknesses to being socially manipulated. One way to mitigate this is to open a dialog with "the other side" to check and seek out inconsistencies. Perhaps not revealing everything in your exposé story or leaving the veracity of it somewhat ambiguous until things develop further. This could weaken the impact of your initial story. Dialog is probably not easy when the other party is undoubtably criminal and you can get blocked from reaching the right people. In this case, the accusations were against a corporation. They can be good or bad, but ultimately legal processes will reveal things.

I do think Mr Krebs has upped his game in recent years and enjoy reading his stories, but I read them like fiction rather than actual verified facts.

<humour> If you thought global warming was bad, wait till you hear about the problem of universal expansion. How are we going to meet our neighbors? Is this the sign we need that other intelligences are working to stabilize the universe? </humour>

Early in that timeline Solaris was heavily into being a "pure" System V r4. The pipes and sockets implementations were based on System V Streams -- the in joke was that streams were much more like sewers and they weren't pleasant. Numbers wise, they were perhaps 2 orders of magnitude slower than on SunOS (BSD based). At one state university, where a very "beefy" SPARCcenter 2000 was purchased to support 500 simultaneous users, Solaris on this system could barely support 40 users (streams performance was the reason - telnet sessions pushed several streams modules). Sun ended up having to provide 10 SPARCstation 10 systems running SunOS which could easily support 70 simultaneous users each in order to fulfill the contractual obligations. The SPARCcenter 2000 was turned into an NFS file server.

After the early days, Solaris did improve, but I think that was because ideas / pieces of BSD (from SunOS) were put back into the OS.

I don't think Solaris pipes / sockets performed better than Mach.

Need to give the article author a lot of slack! If you are here, please read some more about networking :-).

Networking is dynamic it takes many sequential steps to configure. There is no ZAP, it is done. I don't know of an OS that locks out "user programs" until configuration is complete. Yeah, since networking is dynamic that could never work -- "user programs" would be locked out forever!

At the start of the First Test there are packets going to non-tunnel locations at the same time the VPN is being set up, not a surprise. Packet ordering / routing at this time granularity is also not surprising.

Need to take a moment to review the "drop everything" when a VPN is up standpoint. OS Networking stacks don't really understand what a VPN is, it is just an endpoint to route packets. A TCP connection has internal state that is bound to the addresses that were used when it was set up - which is tied to the state of the routing table. A new point-to-point endpoint, like a VPN would invalidate that state. Most (many?) TCP/IP stacks keep a cache of the initial route on the socket. As long as that is still valid (or updated), that is where the packets go. Killing TCP connections for every (temporary) network flap would make a lot more people MAD.

The "DNS" to NextDNS with DoH connection is interesting. This 100% isn't coming from iOS itself. It doesn't support it. So it must be coming from an App. But what app and how? There is a NextDNS app which up front claims "Encrypt all DNS queries on all networks with the official NextDNS app for iOS". The author does appear to have configured the router to use NextDNS, perhaps they also have that App installed as well and it is also hijacking networking to do DNS? A dunno.

The "flood stuff" is interesting, but I think it might just be an attempt to perform STUN to make sure UPD traffic can be transported - to Apple endpoints. I think "second test" is the same thing happening again.

So what is left is the traffic being sent to apple endpoints. Now I wonder how the VPNs the author is using are implemented. The Big Sur VPN brouhaha was because apps were trying to implement a VPN using NEFilterDataProvider instead of a "tun" interface and routing. I wonder if this is just the same issue but on iOS.

Not related, but I do wonder what these VPN services offer in terms of "Firewall" protection or if when you use them ALL ports are forwarded to your device. This would make all of their endpoints a "great target" for continuous scanning for getting inside a network if the VPN user had something misconfigured, like say an experimental Apache, Nginx, PHP, Rails, Django, MySQL project. Doh. Methinks I should spend some currency and experiment. Sadly black-hats are probably already doing this.

This comment is confusing and perhaps misleading.

The code that creates CP/M-86 (not multi-user) and CCP/M-86 (multi-user) are very similar. Some versions are publicly available. It is possible to download and compare.

All Multiuser capabilities of CP/M, MP/M, CCP/M were for a 4-Bit User (0x0 to 0xF), expressed directly in the stored filesystem FCB format, set by the TPM and inherited by processes. Some fallback file search support existed to User 0 for System Files. No "group" identity ever existed for CP/M. Please double check the CCP/M OS documentation which is available. I re-read to (re)confirm my memory.

(before my involvement...)

CCP/M-86 3.1 existed. Supported only CP/M style media.

CCP/M-86 4.1x existed. Supported only CP/M style media. Internal hints of CDOS :-).

CCP/M-86 5.x existed. Supported CP/M and DOS media. Re/Co-branded Concurrent-DOS 5.x.

CDOS 6.x existed. Supported DOS media. CP/M media only via CPM.CMD.

At the time there were OTHER 286 architectures than the PC that DRI Supported. There was an interesting one, by Jarogate (Liam antennae alert!) - the Sprite. It was many times faster than other platforms, so it was being used by DRI for some primary development work. It was a modified S-100 based system and supported a full 16MiB of memory. But CDOS could not use it...

As a Jarogate intern I spent a few weeks during a 198x summer with a rented HP logic analyzer working out what LOADALL (and other opcodes) did. This was based on some photocopy-fax-phlotocrapy-pfrax almost illegible document titled "MIPO News" which had teaser info, but not much more. At the end of my research I provided an ASM file of what LOADALL did and how to use it... I'm pretty sure it was given to DRI.

CDOS 6.x XM. existed. Supported DOS media. LIMS memory + [LOADALL HACK]

If you had a Jarogate Sprite running CDOS 6.2 XM, then it supported a full 16MiB of memory. I still have my Sprite, but it is not currently running :-( due to controller / disk problems.

The Jarogate sprite used an AMD 12Mhz CPU. I do not know how this maps to the Intel versions. But, I think this is where some of the compatibility problems for DR started!

The virtual console system of CCP/M was revolutionary and amazing. It does not get enough credit.

There are perhaps other untold stories of how DRI was trying to move away from hand crafted ASM and PL/M to other high level languages.

I think that a lot of technical books are written from the perspective of already knowing the material or expecting a particular learning path. A lot of important details or framing get left out. The technique of reading multiple sources is very clever because it can fill in these defects - I think I might have subconsciously done this in the past and not fully realized why it worked.

Half width vehicles ignores the following issues.

- Busses. How do you make them half width? (or perhaps, uncharitably, do you think public transportation is worthless?). If busses stay the same width how do you write the driving regulations for mixed width vehicles and retrain the driving public so that fatalities do not skyrocket.

- Bulk delivery vehicles. Same as above.

- Half width means less vehicle stability at speed. Reducing vehicle height is constrained by human size. Worse stability means reduced speeds to reduce fatalities. Consider San Francisco, where a large proportion of the city cars are from commuters traveling 30-60 miles per day. What are the rules for commuter roads with mixed width vehicles?

- Reduced width would likely mean smaller wheels, increasing rotational speed. Tire and brake pad wear is now a non-trivial factor of car pollution. Half width vehicles would / could make this worse.

Booting Apple Silicon has strong cryptographic protections for all of the boot components.

An alternate view on the EULA is that it is a legal statement that nobody can get into trouble with any DCMA stupidity if they want to boot their own OS.

Contrast this with the Playstation 2 debacle, where you were only allowed to boot Sony's Official Linux. Which they then attempted to disable / withdraw when it was used to attack other parts of the Playstation copy protection system.

Apple has also provided a way for ARM Linux VMs to use Rosetta2 for Intel binaries. So they are clearly aware of the wants, needs and usefulness of running other OSs. The cynical might say this was only done to support some internal project that uses Docker, but why put in the effort to make it available to everyone?

The current situation does not preclude providing assistance in the future - Apple still hasn't finished replacing all of the Intel products.

I believe that Apple uses something similar to their "Handoff" mechanism, described in the "Apple Platform Security Guide" [1]. This uses Bluetooth Low Energy out of band paring to establish a shared key. I believe it uses the same identity keys as iMessage to establish the shared key - so you can only offer to share the WiFi password with someone you've been talking to over iMessage and you will see the name of the person you are going to share it with. Sharing the WiFi password is secure from eavesdroppers.

The Bluetooth-less mechanism for WiFi only is an absolutely terrible idea and implementation. It actively leaks the network password to anyone listening. I refuse (and return) any device that requires me to connect it to my IOT network in this way. One can usually detect if this is the setup mechanism by looking at the instructions: (1) Download an App, (2) do something to the bulb (power cycles usually) (3) Setup happens automatically! I think some network stacks don't let non-privileged apps send broadcast addresses, so perhaps the scope of this damaged mechanism is limited.

It is better if the ESP8266 is put into a low power Access Point (AP) mode and configure that way - but due to this (usually) not being an encrypted WiFi session, there is also a risk of leaking the network secret unless a way to do a secure key exchange is bootstrapped in the html form or API. Both of these are possible if Javascript is enabled or via an App API. The instructions for doing this might also include downloading an App, but it also ought to require finding and connecting to a setup AP first.

I guess the best way to kill the "leak the password" mechanism is for a better mechanism to be created and incorporated into something like Tasmota or other public IOT ESP8266 codebase so it can be copied.

[1] https://help.apple.com/pdf/security/en_US/apple-platform-sec...

I went and found my code, with a side trip into being able to "unzoo" the archive!

Yes, I agree. I also used SI as the PC so I could use "lodsb" (cute HN name BTW) and "lodsw" for 2 byte args.

My register use was

   286   Z80
   ---   ---
   BX    HL
   CX    BC
   DX    DE
   DI    A
   SI    PC

When emulating the DD, FD and CB prefixes I pre-loaded BP with either IX+d, IY+d (IX, IY were stored in memory) or BX and jumping to common code.

Basic structure was like

  OP_00:
     XOR    AH,AH
     LODSB
     SHL    AX,1
     MOV    BP,AX
     JMP    CS:OP_table[BP]

For OP_02 - "LD (BC),A" I used,

  OP_02:
     XCHG   CX,DI
     MOV    [DI], CL
     XCHG   CX,DI
     JMP    OP_00

I did see some opportunities for additional code-golf. Also noticed that EX AF,AF' did not properly exchange the flags (so that will need to get fixed!).

I was mostly only running m80, l80 and mload.

Given that the 8086 has SI and DI with a +imm8 mode, like the (IX+imm8) and (IY+imm8) instructions on the Z80. I do wonder if Z80 CP/M machines were the real target rather than the 8080.

I did write an 8086 assembly based Z80 emulator (in the late 80's) that was surprisingly compact and had acceptable Z80 performance on a 12MhZ AMD 80286. It passed CP/M system calls to Concurrent DOS.

I should see if I still have the code and run an emulator torture test to see how bad it was.

There was and it ran on quite well on 286 systems. It started out as Concurrent CP/M-86 but evolved into Concurrent DOS. It was able to run simple MSDOS programs and eventually ran from a FAT filesystem. This OS came from Digital Research. The wikipedia page has a lot more info. https://en.wikipedia.org/wiki/Multiuser_DOS.

I can answer this.

Ruby is my favourite language!

Am I a haiku

I think that the plague of speculative execution bugs qualify as a single error in virtual memory systems that cause complete system compromise. This was not a logic error in code, but a flaw in the hardware. It isn't clear to me if CHERI would have been immune to speculative execution problems, but access issues would likely have shown up if the memory ownership tests were in the wrong place.

I have been following CHERI. I note that in order to create the first FPGA implementation they had to first define the HDL for a virtual memory system -- all of the research "processor" models that were available did not have working / complete VM implementations. CHERI doesn't replace VM, it is in addition to having VM.

I've found that memory bugs (including virtual memory ones) are difficult to debug, because the error is almost never in the place where the failures show up and there is no easy way to track back who ought to own the object or how long ago the error happened. CHERI can help with this by at least being able to identify the owner.

Virtual memory systems are usually pretty complex. Take a look at the list of issues for the design of L3 <https://pdos.csail.mit.edu/6.828/2007/lec/l3.html>. The largest section there is for creating address spaces. For the Linux kernel, in this diagram a lot of the MM code is colored green <https://i.stack.imgur.com/1dyzH.png>, it is a significant portion. More code means more bugs and much harder to formally verify.

I am not convinced by the argument that it is possible to take a fine grained system and trivially expand it to a coarse grained system. How is shared memory handled, mmap'ed dylibs, page level copy-on-write?

So I decided to look at the code that implements talking to gs.apple.com on my Mac. It already supports using TLS. If I am reading this correctly, there are ways it could be enabled right now. Out of respect to Apple; as they are clearly not yet ready to enable this for everyone, I am declining to say how.

Here is a thing. The endpoint gs.apple.com already supports HTTPS (and on port 433). In fact, a new cert was issued to that endpoint on 23rd Feb 2022 -- before the date of your article. Something was already afoot before you wrote about it. This new cert also contains a custom OID, which could be used for pinning.

It is possible, with an http proxy / pihole to upgrade all of your local network connections to https when speaking to gs.apple.com.

My guess is that a change is coming, but the pieces aren't all in place yet.

What you appear to be saying here is that the "test" is based solely on comparing write performance, not on the conformance to what was written, when it was written and what was written when power was pulled and what was read back later. Is that a fair assessment?

This test seems to be based on how "understood" technology works and an expected outcome. Any technology that works better or differently than what you expect will fail.

Intel has already proposed MRAM -- aka persistent memory. If I am understanding correctly, your tests would claim that MRAM backed disks would fail your tests, they would perform way too fast.

These privatives seem to be super specialized and very dependent on what actually happens. The system call you reference, fsync() was introduced in BSD 4.2 -- 1983. There were no journaling filesystems in 1983. I think it is entirely reasonable to apply ~40 years of filesystem research to invalidate past system call practice and call it out as voodoo / blog fodder without real measurements on current filesystems and hardware and to also document if it fails or succeeds when the plug is pulled.

I acknowledge that doing this is hard work and time consuming. You are not going to get a 10 minute tweet from this, but really, isn't that the point of a robust filesystem?

Opinion. The bizarro thing with this is that O_<xzy> flags are for a per file open, but the guarantees can only be supported by an underlying filesystem.

On Linux you can mount a filesystem and invalidate some metadata updates using options such as noatime. This is also depends on the mounted filesystem, such as FAT, which might not even support the updated attributes. Are these constraints honored in these environments with these flags? (sorry, too lazy to write code and check this)

There is no data on what is actually "broken" or why it might violate POSIX.1-2008. What metadata is actually important or impactful?

I am very, very skeptical of claims made by some database folks, due to past experience. Some Oracle products, and from what I understand, still do not understand that monotonically increasing means greater than or equal to (>=). The equal to is the problem, because calling an absolute value timestamp function to derive a "unique" value will always fail (with the same return value) when you get faster hardware and more cores. In a past life (~2000), I had to add code to bork an operating system to appease this very misguided notion. Last month (May 2022) I got (2nd hand) info that after a hardware update to faster hardware, duplicate unique row_ids were being created in an Oracle DB.

Without additional details, I find it hard to understand what the issue actually is. Is this a detectable temporal violation of order of operations for a live system, or some sort of fail situation where an abort / reboot occurs -- would love to understand how the external logging of this was carried out, because how was that synchronized / timestamped?

This is complicated. It involves identity, credibility (accreditation), reputation and authority.

For me to be taught, my parents ceded authority to the school to appoint credible teachers. Those teachers will have an identity, qualifications and perhaps a reputation. There are consequences for failing or abusing this position.

This is the way a lot of traditional things work.

To directly answer your question, no. A teacher that taught addition would likely be excellent for teaching multiplication.

But, I don't think this is how the internet now works, especially in the social media space. There is infinite identity, which creates trust problems for reputation and credibility. Applying traditional models breaks down. At the moment the dominant factor appears to be who can win a popularity content.

Hacker News is interesting in that karma is currency to build credibility and reputation. This model has flaws too. In my opinion, rewarding the most popular is not a long term winning strategy for a society or community. The demand for change only comes from dissenters. Dissenters and different opinions are the engines of change for any society / community, otherwise, without change, it would stagnate and fall into decline.

But, in the face of infinite identity what is the collective actually trying to say?

Yes, agreed. It is a term of inclusivity that is applied to observations and models, the testable items. I don't think "we" it is acceptably used for individual opinions unless it reflects the opinions of multiple authors.

The followup definitely uses the "I" (for opinion) initially, but then switches to "we".

As a reader I am not a participant in "we" unless I agree with the statements being made. I think it is this is what made me frosty and say who is this other person, because it isn't me.

Yup, it should have been moot.

Governments are in a privileged position to get this data and they likely have it and have reasonable models.

The classic knob to influence inflation is interest rates. This can be also be modeled. Non-politicised civil servants have a good record of being able to do a reasonable job at this - only if the politics are removed. In my opinion, removing all political allegiance for civil servant agencies is probably the best way to get better long term stability and prosperity.