brendank310

Not associated with the project but have been following the development, https://5bsd.org/ could be a good answer. Kory’s been adding capability enforcement for the Linux APIs on top of BSD kernel (among other cool features).

Nice! A while back I had started something similar for Azure but it never really got traction (or nearly as polished as this!). It's a rough proof of concept but maybe it'll be useful to Azure users:

https://github.com/brendank310/aztui

Past work in the area by the folks at Immunant (https://immunant.com/) that appears to be on-going https://github.com/immunant/c2rust. I think the project was also DARPA funded for a time.

I got a panicked call from my parents when Facebook deleted my brother's profile, probably 5 or 6 years after he passed away. After looking into just trying to get the profile restored, I came to the same conclusion as the title essentially. The "memories" feature frequently shuffled posts and pictures of him and had become a comfort for them. They bring it up every now and then, maybe some day I'll find a way to sort it out.

I've been off work for two weeks to recover from surgery, and have been playing with a couple projects throughout the day between rest and physical therapy:

- A home-rolled router/firewall: Using yocto to create a distribution for a router/firewall for my home network. It started as an exercise in wanting to have more control over the security of my home network, as well as see how nice of a UI/UX I can tease out of an LLM. It's also part of a (seemingly never ending) consolidation of homelab services.

- A SNES Reverse Engineering setup: A nephew of mine is starting to get into video games and is starting with a SNES but his system broke. I'm working on helping repair the console, but am also trying to set up an effective "LLM + Ghidra + SNES emulator + image generation AI + asperite plugin" to allow him to swap sprites and text in games to add some creativity and learning to the experience.

- A personal assistant system: Experimenting with agents to create a personal assistant for our house, and seeing to what extent the agents can be helpful and how much hardware is required to run something like that in-house.

- aztui: A TUI for exploring and interacting with Azure resources. I'd like to add some caching/pre-fetching logic to make the interaction with the interface snappier (one of the main motivators to create it).

I've been using GPT pretty heavily throughout, and it has been a lot of fun both using it, and spending some dedicated time looking at the models themselves along with the frameworks that support running and integrating them.

Yeah it's a building block for understanding number theory well, which is important in cryptography.

Relatively common nowadays. It used to be delineated as a feature in Intel chips as part of their vPro line, but I think it’s baked in. Generally an IOMMU is needed for performant PCI passthrough to VMs, and Windows uses it for DeviceGuard which tries to prevent DMA attacks.

It's probably no longer maintained, but a former colleague of mine did some work on this for C++: https://github.com/ainfosec/shoulder. Obviously if the docs are lying it doesn't help much, but there was another effort he had https://github.com/ainfosec/scapula that tried to automate detecting behavior differences between the docs and the hardware implementation.

I get the reaction, but what about the trust factor of a box you own and have running on the other side of the world? TPM isn’t an evil concept, it’s fairly useful for some scenarios. Coercion to use TPMs, that sounds evil.

It's been probably 2 years since I've messed with it, but I was still using the tarball download for Xen in OpenEmbedded builds.

As someone noted above the Commercial Solutions for Classified program has been in existence for a long while (probably over a decade). This package is newer but not wildly newer. Installs of the various 'packages' do exist.

My old team did some work in this area a few years ago. We got the Talos II BMC code to be binary reproducible, and had a go at automating David A. Wheeler's compiler diversification to stop compiler subversion. We checked the boxes we intended to, though never got enough funding to polish it up. It's probably broken now, but we did post a portion of our work on gitlab: https://gitlab.com/deepthirst.

At least in NY (and probably true of state/local politics in general) this is not necessarily true. These third parties often will choose a D or R that align with their policy goals. It helps candidates in that their name is on the ballot more (either multiple rows or listing the parties that they are the nominee of)

SB is definitely imperfect, but a useful tool in moving toward a trusted boot. I think we'd all agree having a trusted boot sequence is desirable, the point of contention being who gets to decide the criteria for trust. It's been a few years since I worked in the space but I think SB gets a bit of an undeserved bad rep (I'm sure because people were vocal early on). There is a SB signed uefi application that allows for enrolling other loaders based on the hash of the loader.

I think you're largely correct but Google isn't one person so there may be somewhat emergent patterns that work from an SEO standpoint that don't have a solid answer to Why. If I were an SEO customer I would ask for some proof but that isn't the market they're targeting. There was an old saying in the tennis instruction business that there was a bunch of 'bend your knees, fifty please'. So lots of snakeoil salesman but some salesman sell stuff that works.

What do you suspect will be the practical uses of this? Could it help researchers run experiments to develop better fertility protocols? Or depending on costs, fertility clinics could test various protocols to find the optimal "hormone environment" for promoting high quality egg development? Or is this going to a more "out there" direction as in you could grow an egg entirely in vitro for later fertilization and implantation?

Someone already did: https://news.ycombinator.com/item?id=32498435

Overall the timeline doesn't seem implausible to me.

A friend of mine and I explored a similar offering. We've mostly put it on a shelf as it was very duct taped together and we're both short on time. We don't have any monetization plan but would love to hear any feedback: https://divim.shovelshop.io

I'm always a little shocked when I see someone who isn't keeping personal and work devices (and accounts) very intentionally separate.

The flip side of that is it does cost some money to run a monastery, and there aren't a lot of a modern opportunities for them to make money. Nothing wrong with them keeping their trade secret, and not being interested in scaling production.

I saw you present a version of this in probably 2016 or so at little security conference in DC (maybe platform security conference?). Anyhow your talk was a huge deal for defense contractors doing proposal work at the time (and since).

In the DoD space a standard ask in a class of proposals is for having a commercialization plan for dual use stuff. Pushing that open source is commercial created a way for contractors to have their commercialization strategy for a proposal to be 'open source it'. Lots of open source development is out there as a result of your efforts and I can't imagine that was a fun bureaucratic battle to fight. Thank you seems small, but thank you and I owe you a beverage.

Because it is open source. It's not Free Open Source Software (FOSS) as deemed by some foundation or another. There is a lot of great open source software not included in Linux because of licensing issues (e.g. BSD clashing with GPL). Source available has generally meant you can have the source if you meet some criteria (have a license), but the license prevents you from redistributing it. I haven't dug into this license but it seems less restrictive than the AGPL.

OT: You can do that with Qt. We played with implementing it ourselves for a project about 10 years ago. Since then I think there is an official QPA that will render Qt apps within the browser, and there is the Wt project. Might be worth looking at for some needs but I don't see it becoming popular.

Why not? It's not practical for traditional uses of semiconductors, but it has a mechanism to control conductivity.

Keep in mind that there wasn't flexible infrastructure on demand in those days. User run servers was sort of a low cost market based demand scaler for IP owners. If the game is really a dud, they didn't buy N servers and M bandwidth. If it's a hit, they can add an official hosted distinction if it makes sense.

MS was knee deep in anti-trust negotiations with the DoJ around that time so I imagine acquisitions of that size and scope were off the table. Sega probably was small potatoes financially for MS at the time, but buying one of the three companies in that market wouldn't have helped their anti-competitive reputation.

A previous team I was on ended up with this role. Strong writer with no technical skills joined the team and worked hand-in-hand with engineers fleshing out docs. It was productive for the engineers because they needed to articulate the ideas very clearly. The writer has been attached to that project now for 6-7 years at this point, and could probably stand in as a support engineer for some problems. It was a little painful getting HR to approve a tech writer getting paid close to an engineer position (this was after a few years).

I do like the sibling comment calling for a librarian. I imagine that would pay a ton of dividends if the librarian was motivated and got support.

Until the numbers get revised in 4 months.

With RS232 you can hook up an old oscilloscope and measure what the right baud rate should be. Even in the "won't transmit unless it receives" case, a sweep on a waveform generator and well configured trigger will get you on your way. USB you'd need much nicer tools handy to get to the bottom of an issue.

You are right on about the joy of it being 9600 8N1 on the first try.

David Wheeler's Ph.D dissertation on the subject hasn't been refuted as far as I know, so the diverse double compilation method should be sufficient to mitigate the compiler subversion threat. I worked on a project to do this in OpenEmbedded to build firmware for the Power9 Talos workstation firmware and the BMC. Somewhat painful but successful.