Hacker News Reader

akyuuon Why the Tech World Thinks the American Dream Is Dying

Non-paywall version: https://www.msn.com/en-us/money/other/why-the-tech-world-thi...

akyuuon iOS 26.2 fixes 20 security vulnerabilities, 2 actively exploited

As far as I know, it is factually correct.

https://www.intego.com/mac-security-blog/apples-poor-patchin...

akyuuon GrapheneOS is the only Android OS providing full security patches

Take a look at Jolla and Sailfish OS.

https://news.ycombinator.com/item?id=46162368

https://sailfishos.org

akyuuon German Firms Hand over Secrets That China Could Use for Leverage

https://archive.is/55fHg

akyuuon Ask HN: Yt-dlp no longer downloads videos from YouTube

It's because YouTube is now requiring a full JavaScript runtime in order to download and play videos. There are open issues regarding this in the relevant GitHub projects, but the fix has not yet been released.

https://github.com/yt-dlp/yt-dlp/issues/14404

https://github.com/ytdl-org/youtube-dl/issues/33186

See also previous HN discussion: https://news.ycombinator.com/item?id=45358980

akyuuon Memory Integrity Enforcement

I wonder if these protections will apply to macOS as well.

akyuuon Apple M4 MacBook Air review: I have no notes

I agree. But regarding this specific game, it seems to work through Crossover (emulation) and Parallels (virtualization). You can also try Whisky and VMware Fusion as free alternatives.

https://www.youtube.com/watch?v=iysOgfeWz1M

https://www.youtube.com/watch?v=QZzzPtHcw6k

akyuuon Apple Exclaves

I wonder how this will affect macOS security, since SPTM is not used according to Apple documentation: https://support.apple.com/guide/security/operating-system-in...

For now, I think existing exclaves such as the one that displays the camera indicator do not really apply to macOS (since MacBooks have dedicated hardware for that), but in the future there might be exclaves that do.

akyuuon GrapheneOS blocked exploitation of 3 Android zero-days used by Cellebrite

> caveat: MTE is coming soon on iOS

Do you have a source on that? I'm interested.

akyuuon Protonmail is down (Proton Services Status)

Ongoing incident report: https://status.proton.me/incidents/wt2fwstm0rcg

akyuuon Cross-Process Spectre Exploitation

I believe Chrome is also the only software that enables certain mitigations such as ProcessSystemCallDisablePolicy on Windows and NO_SMT and TECS on macOS [1]. I wonder if some of these OS features have been implemented at Google's request.

However, in the case of Spectre, I think the OS should try to prevent exploitation rather than end programs, with a user-facing toggle to disable mitigations per-program for compatibility reasons.

[1] https://www.malwarebytes.com/blog/news/2021/08/macos-11s-hid...

akyuuon Hacking Kia: Remotely controlling cars with just a license plate

It would be interesting to have a list of modern cars without these kind of connected features, but I haven't found any.

akyuuon Eliminating Memory Safety Vulnerabilities at the Source

Apple is still adding large amounts of new Objective-C code in each new macOS version [0].

I haven't found any language usage numbers for recent versions of Windows, but Microsoft is using Rust for both new development and rewriting old features [1] [2].

[0] Refer to section "Evolution of the programming languages" https://blog.timac.org/2023/1128-state-of-appkit-catalyst-sw...

[1] https://www.theregister.com/2023/04/27/microsoft_windows_rus...

[2] https://www.theregister.com/2024/01/31/microsoft_seeks_rust_...

akyuuon macOS Sequoia makes it harder to run not notarized or signed apps

It also adds a new permission prompt for screenshot and screen recording apps that doesn’t allow a user to permanently grant permission, but requires a weekly re-authorization.

https://9to5mac.com/2024/08/06/macos-sequoia-screen-recordin...

akyuuon Security Vulnerability in Browser Interface Allows Computer Access via GPU

I think you can also disable hardware acceleration and that will prevent GPU from being accessible even with JavaScript enabled.

akyuuon Backdoor in upstream xz/liblzma leading to SSH server compromise

Lasse Collin has been working on xz for decades: https://sourceforge.net/p/sevenzip/discussion/45797/thread/0...

Now, whether his GitHub account is currently being controlled by him is another question.

Also, for some more context: In 2022, Lasse said he was struggling to work on xz and was looking for maintainers, and mentioned Jia Tan: https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h...

akyuuon Chlorpyrifos: Pesticide tied to brain damage in children

Not exactly what you describe, but there's Yuka for processed products (food and cosmetics). You scan a barcode and it gives you a score based on the product composition, it's quite helpful: https://yuka.io/en/

akyuuon macOS Sonoma 14.4 removes critical functions from the fileproviderctl command

Is there any other laptop manufacturer that offers generally better support than Apple? I'm asking because I'm genuinely interested.

akyuuon Microsoft Edge ignores user wishes, slurps tabs from Chrome without permission

You can disable JIT in Chrome (which also enables CET [1], just like in Edge) by executing it with

  --js-flags="--jitless"

You can also disable JIT in Firefox by setting javascript.options.baselinejit, javascript.options.ion and javascript.options.native_regexp to false in about:config, although you won't get CET.

[1] https://github.com/chromium/chromium/blob/12c232c43ce7324d30...

akyuuon WTF Ubiquiti

https://www.turris.com/en/products/omnia/

akyuuon Stealthy Linux rootkit found in the wild after going undetected for 2 years

The Linux desktop technology stack lags behind Windows and macOS when it comes to security. The causes are both technical (see this comment [1] for an overview) and non-technical, often stemming from a fragmented development model where there are no clearly defined security boundaries. For example:

- There is no real concept of base system because distros are usually a patchwork of software from diverse sources. This means stuff like proper secure boot is not really feasible on any distro (although AFAIK the systemd/Fedora people are working on it with signed UKIs and immutable OS images).

- Some features that could live in userland for improved security are instead implemented in the kernel, while both Windows and macOS generally keep moving exploitable features like font rendering to userland.

- Distros often disable or disregard security features such as SELinux or mitigations like CFI.

Here [2] is a more detailed article examining the lack of security of Linux desktops in case you're interested.

[1] https://news.ycombinator.com/item?id=37502088

[2] https://madaidans-insecurities.github.io/linux.html

akyuuon Enable ARMv9 Memory Tagging Extension (MTE) on Pixel 8

Builds are reproducible [1], so you can compile them yourself and check they match the official ones. Additionally, official releases are signed and the update client verifies them and prevents downgrade attacks [2]. You can also install updates offline from a computer if you prefer [3].

[1] https://grapheneos.org/build#reproducible-builds

[2] https://grapheneos.org/releases#about-the-releases

[3] https://grapheneos.org/usage#updates-sideloading

akyuuon Enable ARMv9 Memory Tagging Extension (MTE) on Pixel 8

No, AFAIK Morello project is about designing an Arm CPU with CHERI, a hardware architecture with extra security capabilities that is still WIP: https://tratt.net/laurie/blog/2023/two_stories_for_what_is_c...

akyuuon Enable ARMv9 Memory Tagging Extension (MTE) on Pixel 8

Consider using GrapheneOS instead of stock Android for an improved version of MTE (and extra security and privacy as a bonus): https://discuss.grapheneos.org/d/8439-mte-support-status-for...

> Stock Pixel OS has it as a developer option which isn't usable in practice since it breaks far too much. The implementation is also much less powerful than hardened_malloc.

> We integrated it into hardened_malloc where it's able to provide stronger security properties than the experimental stock OS implementation.

> When fully integrated into the compiler and each heap allocator, MTE enforces a form of memory safety. It detects memory corruption as it happens. 4 bit tags limit it to probabilistic detection for the general case, but deterministic guarantees are possible via reserving tags. In hardened_malloc, we deterministically prevent sequential overflows by excluding adjacent tags.

Also, currently it's not clear if it makes sense to enable kernel MTE:

> MTE support for protecting the Linux kernel isn't enabled yet, but we can likely enable that by default too. However, it's currently part of kasan and is more oriented towards debugging than hardening. It's not entirely clear that enabling it in the current state is a good idea.

akyuuon Germany to Pass Japan as Third-Largest Economy, Helped by Weak Yen

https://archive.ph/sMRUl

akyuuon Snmalloc: A Message Passing Allocator

https://github.com/microsoft/snmalloc/blob/main/docs/securit...

akyuuon Glibc dynamic loader hit by a nasty local privilege escalation vulnerability

From what I’ve read from some security researchers, glibc is not really focused on security. For example, it contains CPU-specific manually crafted assembly for optimization purposes, and its memory allocator implements exploitation-friendly features such as thread caches. I’m not surprised by this vulnerability, and I suspect there are many similar ones that haven’t been discovered yet.

musl (used by default on Alpine and Chimera Linux) and the BSD libc’s on the other hand are much more minimal and conservative.

akyuuon Essence: A desktop OS built from scratch, for control and simplicity

If you mean restricting filesystem access to random programs, I think that's already possible on macOS (with TCC) and Linux (with Flatpak), but the underlying mechanisms aren't very robust and can be easily bypassed by malicious code.

If you mean a true capability-based OS, there is Fuchsia, which doesn't seem to be used yet, and RedoxOS, which is in development.

akyuuon Pixel 8 leak promises 7 years of OS updates

I'm curious about how they're going to manage this at the same time Linux LTS kernels are returning to being supported for 2 years rather than 6: https://news.ycombinator.com/item?id=37591050

akyuuon LaLiga “Talks to Google” About Deleting Piracy Apps from a Million Phones

> And your Mac sends all the hashes as well, whether they are in iCloud or not.

Could you elaborate? I didn't know Macs send local file hashes to Apple even if you don't use iCloud.