113 karma · joined June 3, 2021
https://seclists.org/bugtraq/1995/Feb/109
> we've installed the NCSA HTTPD 1.3 on our WWW server (HP9000/720, HP-UX 9.01) and I've found, that it can be tricked into executing shell commands. Actually, this bug is similar to the bug in fingerd exploited by the internet worm. The HTTPD reads a maximum of 8192 characters when accepting a request from port 80.
"Verily, verily, I say unto you, Except a corn of wheat fall into the ground and die, it abideth alone: but if it die, it bringeth forth much fruit.”
(John 12:24)
But in all seriousness, if there's an authentication recovery standard, it should serve all people including those who are in seriously difficult circumstances (e.g. homeless or ill). The question then is what should recovery look like in those cases.
To me it looks like good old recovery code on paper is the best solution, as it doesn't depend on ever-changing device ports, or hardware malfunction due to lack of use long-term (such as 10-15 years).
I wonder whether authentication apps nowdays address that aspect and make and I kinda doubt so (i.e. can you print out a QR code with all account information in your typical TOTP app?).
However, there was no perceptible sound and folks describe it kinetic force that causes a state of panic and rush in the chest.
From the other angle: https://x.com/alef_pendule/status/1900980300093468844
This seems like a strong overstatement. We got by for more than 2000 years without computer-readable proofs, relying on intuition and validation.
To clarify, the specificity of Emacs is that it fully exposes it's internal function sets to the world. This could be done by other applications in an organized way. For example, in the picture-editing app example, it would amount to allowing scripting over the features that the app exposes. The scripting feature would come from the environment, not from anything specific the app itself does (apart from being built in that environment). The previously mentioned IDE could then be thought of simply the multi-tasking environment in which such generic applications are running.
Does this roughly correspond to what the project is about?
Also, what is it about Lisp specifically that makes it suitable for this undertaking?
You can't, as "truly interesting" is context dependent, changes over time and something that everyone deems as futile may become interesting - that's the point of research. You just increase the bar of entry to get people who work very hard and leave it to them to decide.
Is this really true? Some notes at https://stallman.org/stallman-computing.html indicate it was a different type of strain injury, unrelated to ctrl/meta key:
> In the mid 90s I had bad hand pain, so bad that most of the day I could only type with one finger. The FSF hired typists for me part of the day, and part of the day I tolerated the pain. After a few years I found out that this was due to the hard keys of my keyboard. I switched to a keyboard with lighter key pressure and the problem mostly went away.
> My problem was not carpal tunnel syndrome: I avoid that by keeping my wrists pretty straight as I type. There are several kinds of hand injuries that can be caused by repetitive stress; don't assume you have the one you heard of.
>The stakes are much higher when money is involved, and if DeFi is permitted to develop without any regulatory intervention, it will magnify the tendencies towards heightened leverage, rigidity, and runs that characterized Shadow Banking 1.0.
> It is not entirely understood why some patients are able to achieve undetectable viral loads without ART.
https://www.quantumlah.org/about/highlight/2019-09-cockroach...
>The award was presented for the paper “In-vivo biomagnetic characterisation of the American cockroach", published in Scientific Reports in March 2018 by Rainer and five collaborators
>Each person engaged in the conversation has a viewport on the screen. Phone can display as many as six viewports at a time. The viewport contains information regarding the user's name, the text of the conversation, and various status indicators, such as who is on hold. User names of people that you have on hold can be temporarily eliminated from the screen to make room for new participants.
ANSWER Answers the phone when you receive a call.
DIAL Places a call to another user.
DIRECTORY Displays a list of the users you can call.
EXIT Exits from the Phone utility.
FACSIMILE Includes the contents of a file in your conversation.
HANGUP Cancels the current phone call.
HELP Displays information on how to use the Phone utility.
HOLD Places the other users in a call on hold.
MAIL Sends a message to another user.
PHONE Places a call to another user.
REJECT Rejects a call from another user.
UNHOLD Reverses the previous HOLD command.> French authorities had been investigating EncroChat since 2017, stepping up efforts in 2019 and secretly installing an implant on all EncroChat devices disguised as a system update. The implant caused the device to transmit all data that had not been erased to a French police server and to Europol and collected data created after the device had been compromised
> For Balkan clients, there were three websites promoting the app in languages of the region – skyecceurope.com, skyeccbalkan.com, skyeccserbia.com.
> .. none of the deleted sequencing runs could be accessed through the SRA’s web interface. In addition, none of the runs could be accessed using the command-line tools of the SRA Toolkit. For instance, running fastq-dump SRR11313485 orvdb-dump SRR11313485 returned the message “err: query unauthorized while resolving query within virtual file system module - failed to resolve accession ’SRR11313485’“.
> However, the SRA has begun storing all data on the Google and Amazon clouds. While inspecting the SRA’s web interface for other sequencing accessions, I noticed that SRA files are often available from links the other cloud such as https://storage.googleapis.com/nih-sequence-read-archive/run....
> I interpolated the cloud URLs for the deleted accessions and tested if they still yielded the SRA files. This strategy was successful; for instance, as of June 3, 2021, going to https://storage.googleapis.com/nih-sequence-read-archive/run... downloads the SRA file for accession SRR1131348
>On May 15th last year, we took an early trip to our family cabin in the central Adirondacks to see if we could catch the beginning of morel season there.
>We walked down a dirt road for a mile until we came to numerous splits in the road.
>While taking a closer look through a loupe, Riitta, who was a few steps ahead, squealed with delight. She had found something special! But it was not a Morchella americana. She knew it as the choice edible Korvasieni (Finnish for “ear mushroom”). We knew it as the deadly poisonous Gyromitra esculenta, the false morel.
>We knew that these were potentially deadly poisonous, but that some people do eat them when prepared properly.
>However, according to Wikipedia “although it is still commonly parboiled before preparation, evidence suggests that even this procedure may not make Gyromitra escu-lenta entirely safe for consumption, thus raising concerns of risk even when prepared properly. When consumed, the principal active agent, gyromitrin, is hydrolyzed into the toxic compound monomethylhydrazine (MMH - a com-ponent of rocket fuel). The toxin affects the liver, central nervous system, and sometimes the kidneys. Symptoms of poisoning involve vomiting and diarrhea several hours after consumption, followed by dizziness, lethargy and head-ache. Severe cases may lead to delirium, coma and death after 5-7 days.” Yikes!
>Rinse the mushrooms thoroughly in plenty of running cold water. Repeat once more the boiling and rinsing of the mushrooms. Drain the mushrooms and use for cooking like any edible mushroom.After doing this with all the windows open in our kitchen, trying our best to avoid inhaling the poisonous fumes, and cautiously boiling twice for 11 minutes, we cooked up the false morels in lots of butter and onions.
There's no "mushroom obsession", JC simply did all the usual stuff that a passionate mushroom hunter would do.
He wrote a book about mushrooms? Obsessed! He accidently poisoned himself? Unheard of for passionate mushroom hunters!
Also E2EE will be an opt-in thing, but a company may enable it by default for all 1:1 calls.
Sounds like this is mostly about companies believing to be more secure if their employees share passwords only with E2EE enabled.