codys

clippy can be used to check some of these conventions. See https://rust-lang.github.io/rust-clippy/master/#wrong_self_c..., for example.

On projects I work on, I include clippy as part of the CI process to check these types of things.

If the state or employer is required or expected to supply additional benefits to people working abroad, the benefit to the state or employer in substituting workers with less ability (legally or otherwise) to claim or obtain those benefits is even larger than it might be in-country. (I'm ignoring the obvious issue of it potentially being less legally or politically easy to handle here as the parent comment does not mention these at all).

It sounds like you have an anecdote about some people you know working on these projects, but the details that seem intended to imply that it's unlikely that _any_ people working these projects are Chinese prisoners actually imply the opposite.

I don't see any photos of it in that article.

There's a drawing of what it will look like when "complete", but no indication of what it currently consists of (and it's still an artist's rendering).

Would be interested in actual current photos.

The general apple documentation for functions, etc appears to be pretty much a customized doxygen. One can see this by reading the header files for some of their frameworks and noting the doxygen comments there match up with their web-published documentation exactly.

That said: some folks didn't really get the memo, because there are important details that are sometimes included in non-doxygen comments in Apple's headers and thus aren't reproduced into Apple's generated/published docs.

In particular, the headers (sometimes) include annotations for specific types included in CF containers for return values.

The insertion of a random factor in hashing/bucketing that you're describing would change the iteration order per _instance_ of a hash table, not per _iteration_ as the parent comment notes is the case for go maps.

A large number of microcontrollers are ARM based, which isn't Harvard architecture. I presume the thinking is that there's some massive number of Harvard architecture chips in mundane things that lets us say "most" are Harvard arch?

Yes, indexing into arrays in C (well, really, de-referencing pointers) in ways that are out of bounds will in the best case result in a fault which results in a BUG() invocation in Linux.

Panicing on invalid slice indexing is a non-issue.

The press release notes that they expect to run the OpenBMC software on this LibreBMC hardware

This assertion ignores that apple makes a profit off the 30% cut. In other words: it doesn't correspond to a real cost to Apple.

I totally agree. I'm amazed by how opaque and difficult to understand the process to create debian packages is because of all the various layers/helpers/tools that can/should be used in different cases and the difficulty in customizing things. There's a slew of interacting tooling (`dpkg`,`dpkg-buildpackage`, `debhelper`, each of the debhelper `dh-*` helpers, `sbuild`, `pbuilder`, `git-buildpackage`) that all has different documentation of varying quality, some of it replaces other pieces, etc.

My best experiences with packaging on linux have been gentoo ebuilds & arch pkgbuilds. These keep the build model pretty straight forward if the goal is to "just build a package".

That said: creating a dpkg is not an impossible thing to do. It's just more painful than it needs to be

`char` is a (internally) a `u32` because it represents any single unicode character. `str` is not a `[char]`, because rust doesn't store strings as utf-32 (system APIs don't accept utf-32, and it tends to waste space in many cases)

`str`'s data layout happens to be `[u8]`, but it's type provides additional guarantees about the structure of the data within it's internal `[u8]` (for example, forbidding sequences of u8 that don't encode valid utf-8).

only clang (not gcc) ships ubsan with support for checking unsigned integer overflow. clang's ubsan does not enable it by default (it must be explicitly enabled).

As a result, it's not clear that it's a false positive in the technical sense here (as one would need to enable checking for unsigned overflow explicitly).

Not necessarily. The non-GPL utilities the GNU coreutils are based on are presumably licensed as MIT, ISC, Public Domain, or similar. If that is the case, those licensing regimes don't forbid adding extra restrictions, so adding the restrictions of GPL would be permitted, and the new derived (again, assuming interfaces are copyrightable) work would operate as being essentially GPL licensed. Things get murky as there are proprietary utilities too that coreutils are probably based on, but then there are also specifications of behavior (SUS, Posix) which might or might not sever the "derivation path" of the work, or might introduce further licensing constraints.

Musk is incredibly high profile and regularly receives negative press.

While it's good that this is finally being provided, it's still somewhat amazing that there isn't any documented API to interact with iCloud.

One can of course, on Apple hardware, use apple proprietary APIs to do some things. Or one can use the iCloudJs stuff from a webpage.

But there's not an official/documented way to, say, write a program that runs on a Linux server to mirror photos in iCloud to disk (or access any other iCloud data).

There are reverse engineered APIs that folks can use to interact with it, but the official iCloud story has been data lock in.

For those just scanning the comments, "full remote access" is just being used to mean "has an automatic update system" here

Ya, I ran for a long time with a passphrase in a system without a TPM. I recently got a TPM for it so I could have it restart without me being present.

I used the `manage-bde` command rather than powershell:

https://docs.microsoft.com/en-us/windows/security/informatio...

The GUI for bitlocker doesn't provide access to all the functionality that manage-bde provides (iirc: if a TPM is present, the passphrase options aren't presented in the GUI. And it used to talk about a "PIN" instead of a passphrase/password, but the "PIN" can (with some gpo tweaking) contain letters/space/punct as well as numbers.

Bitlocker can be configured (via manage-bde on the cmdline, iirc) to use a passphrase and not use the TPM at all.

I was curious about this, and went searching, and it's fairly difficult to figure out exactly what is being referenced.

There is a reddit thread that links to deleted tweets that appears like it might be related: https://www.reddit.com/r/browsers/comments/i8nuyb

SSH would not be the way to accomplish that.

Apple is hosting user created content though (in the form of apps). Don't they become liable for that hosting if they don't handle the DMCA request themselves?

Presumably the author doesn't send the IDFA to mapbox, which makes linking profiles here more difficult/less reliable.

I feel like we're missing some of the details/steps here, perhaps because the folks at corellium have a bunch of existing experience with apple SoCs and as a result had non-public knowledge about the platform.

For example: determining that interrupts were being routed to FIQ. It's unclear how one would have figured that was occurring. Or that there was an special AIC (apple interrupt controller) that needed talking to, and how to talk to it. It feels like there's a lot of "reverse engineer some Apple kernel bits" that's potentially being elided over.

Edit: or alternately, some debug interface that isn't being mentioned (swd/jtag/itm).

Maybe I've missed this somewhere, but:

- do you have a finer grained (month by month, for example) break down to support your assertion of the correlation in timing of the NYPD disbanding the "anti-crime" units and the homicide rate?

- if so, is there something indicating there is causation rather than a coincidence?

It appears you've linked to a comment about the lack of a way to backup signal messages on iOS. That is separate(ish) from the importing of messages from WhatsApp.

So, no, they're not interested in WhatsApp import (per the closed ticket liked by the parent).

Additionally, the statement from signal is just PR spew. It boils down to "Nah, we won't make a way to do that.". The "privacy preserving" bit is nonsense because they have an export/import to a file on android.

I'm not sure this comment responds to the parent comment's statements very effectively.

The parent comment is primarily about the non-internet case becoming uncommon enough that it isn't tested (or tested as effectively) as the internet case.

The "first" point here gives some very interesting details on the various timing of data necessary for a fix. But then it confusingly makes the claim that "the idea that GPS chip manufacturers have already forgot how to do offline cold starts is a bit silly". This claim doesn't appear to follow from the details about the offline cold starts. Perhaps some information about when these various methods of offline cold starts might help support the claim being made, but even then we'd have to keep in mind that those introducing new offline cold start methods aren't all gps manufs. We should also be careful not to discount offline warm starts or offline semi-warm starts. (iow: handling various pieces of information necessary for bootstrapping and effectively using all components possible without, say, requiring a full almanac download if a partial had been obtained previously).

The parent comment doesn't make a specific statement about what type of timing for fix when offline (either cold or warm) is reasonable. This makes it a bit funny to talk about the minimums/etc for offline cold start at all. The general thrust is that offline has become the uncommon case.

I would similarly be more cautious in the "second" point here for that reason: because of the proliferation of GPS into cell phones, I would be unsurprised if the majority of GPS devices were in devices that are "online". The GPS in those devices is primarily used for fine position information. While it's true that it can be used when the gross position estimation fails (due to lack of wifi signals or cell towers), because of the additional power consumption of the GPS radio it is less likely to be used for gross position. I would hesitate to describe this as a "prime scenario".

On the "third" point, I think we're ignoring that it's fairly easy to break offline cold starts (or make them very bad) without necessarily breaking ongoing ephemerides data. Certainly, it's very possible to break both, (given that the data is separate subframes), but one could imagine something breaking almanac assembly (for example), without breaking ephemerides subframe reception/decode/handling/etc.

I do this, but I also worry that a result of "Amazon Smile" will be that charitable organizations will be less willing to be critical of Amazon due to donations to them being provided by Amazon.

No, it isn't. It states the issue at hand and gives the facts available to us.

The item you've linked (the filing by the Texas AG against Pennsylvania, Georgia, Michigan, and Wisconsin) is weird.

It seems to think there's some serious difference between mail-in and absentee voting in GA. In GA, the term absentee voting encompasses both early voting and mail in voting. The only absentee voting that has signature verification is the mail-in component (IDs are checked instead for early voting).

And it appears to make the same "error" you've continued to make: it conflates rejection for signature mismatch and rejection for all reasons, when the signature mismatch rejections are a subset of all reasons.

This is state dependent. In some states, voting in person after sending a mail in ballot is a felony.

As others have already told you, the article [1] specifically addresses the distinction here. The "6%" is total rejections, including those that are from, for example, ballots arriving late. Nothing is out of date about it.

The total number of rejected ballots is not known because it isn't necessary to count rejected ballots to determine the election result (ie: they are simply not included in the count).

Again, stop spreading misinformation. Continuing to do so would be malicious.

[1]: https://www.reuters.com/article/uk-factcheck-georgia-rejecte...