danarmak

That the process/thread enters kernel mode and then is suspended waiting for IO or for some other event. As long as the thread is running your code (or, is scheduleable) it's not blocked. And then the async implementation can ensure your code cooperatively gives up the CPU for other code.

No, if the memory-mapped page you're accessing is in RAM, then you're just reading the RAM; there is no page fault and no syscall and nothing blocks.

You could say that any non-register memory access "blocks" but I feel that's needlessly confusing. Normal async code doesn't "block" in any relevant sense when it accesses the heap.

It will at the very least notice that the read data does not match the stored checksum and not return the garbage data to the application. In redundant (raidz) setups it will then read the data from another disk, and update the faulty disk. In a non-redundant setup (or if enough disks are corrupted) it will signal an IO error.

An error is preferred to silently returning garbage data!

I assume you mean extensions, not plugins. No, Chrome doesn't support extensions on android, but some Chromium reskins do.

That said, the most important extension usecase is adblocking, and with Manifest v4 and FLoC/Topics and SafetyNet/remote attestation, well...

If a kernel with the restriction removed is compiled locally and is never redistributed, why would it be illegal?

> Clearly the sync between devices works, so they have solved this problem.

Presumably they don't use CSV to sync, they're using a saner json/etc. data structure that they're not letting us export ourselves. Seriously, being limited to CSV in this day and age...

Should say, [2007]

How can the employer prove a negative?

At most I imagine the plaintiff is allowed to do discovery, and then has to prove positive discrimination based on that.

I got a papercut and I'm made out of meat!

The second link doesn't mention "as-is", the first one does. I'll assume that's what you meant. It says,

> Though manufacturers cannot so easily escape liability, sellers can escape liability by informing the customer before the purchase that a product must be taken "as-is,” which means how the product was found when it was purchased in-store. “As-is” works because the buyer has an opportunity to inspect the product and decide whether to buy it given its condition.

On that analogy, Github and RedHat aren't liable, but the original author of the software still is.

If I build an unsafe boiler, and gift it to you, and then it explodes and kills you - am I not liable because it was a gift and not a sale? Can I disclaim away any liability and "fitness for purpose" when I gift you the boiler?

ETA: the first couple of Google results say that no, product liability can't be disclaimed away - particularly when there is no contract or opportunity for bargaining. I am very much not a lawyer but this sounds correct to me (i.e. this is what the law is).

https://www.findlaw.com/injury/product-liability/are-product...

https://www.eltonlaw.com/does-a-disclaimer-mean-you-cannot-f...

He posted again later clarifying which systems and configuration were vulnerable:

https://twitter.com/aionescu/status/1393955460517040129

> * AMD Zen "Summit Ridge" Stepping B1. That is Ryzen's 1xxx series.

> * AMD Zen2 "Matisse", "XT" series only. That is Ryzen's 3xxx series.

Other info at:

https://twitter.com/aionescu/status/1394039410300051456 https://twitter.com/aionescu/status/1394359314102427650 https://twitter.com/aionescu/status/1394359317038452738

Regardless, the vulnerability is in the driver, not the CPU / microcode. Also in the WHQL process that signed such a 'fake' driver. Until the signature is revoked, it might be possible for an attacker to manually install the signed driver on other system configurations too.

He also says,

> But even better, it has a security descriptor allowing Everyone + Low IL R/W Access, and an IOCTL interface with absolutely no Probes/SEH, which yes, dereferences wild pointers. They don't even bother checking for input size or output sizes.

If that's true of the driver, then it's a sec vuln regardless of what the MSR bit does or doesn't do, no?

Governments that issue patents on math/algorithms/software already claim the power to forbid you to use them. They just need to patent all public encryption algorithms, in perpetuity.

(Sarcastic? Who knows?)

It's been proposed before! https://www.jpost.com/opinion/an-israeli-suez-canal-393225

It would be less than 3x the length, not 10x. The mountains are a problem; it could go around but would still need to dig a lot. And it doesn't seem feasible politically right now, but it could be a really cool project.

(If it was built, then a side-canal to irrigate the Dead Sea would be a relatively cheap value-add.)

If you've heard of KOffice, this is a fork from 2010 which didn't inherit the project name but eventually became the official / only KDE office suite project.

> That a lot of parents who cannot work from home, like say cashiers or construction workers who still have to go out, do not even really know right now how to manage their kids.

And further confusing the issue, many other parents / families who are forced to stay home do know how to interact with their children productively, and those children have a much better time of it.

Even assuming purely good intentions, the government would want to use the key very often (hundreds or thousands of concurrent investigations) and in many large unrelated organizations (eg police + FBI + NSA + CIA + DOD + ...). It would be impractical to authorize each individual use, let alone authorize it by several parties each time.

Instead we'd see 'ongoing' authorizations on the level of an investigation, a person or team, or a whole sub-organization (modulo clearance / position in that organization). And so you'd have copies of the complete key going around.

Yes, by giving the government access to one or both of the end devices. (Which is probably already a thing somewhere legally, and very likely is the factory state for some Android phones.)

Note that banning E2EE implies banning encrypted p2p communications entirely. E2EE is a concept that applies only to centralized comms providers where all messages go through a server.

Practically speaking, it's impossible to ban every encrypted protocol (TLS, SSH, ...). It's also (probably) impossible to ban IP communications that don't have an "approved server" participating.

However, comms providers / social networks to date at least manage, authenticate, and introduce users at the serverside. Fully distributed projects have problems with spam. So governments would have to ban comms providers from "allowing" their clients to talk to each other directly and not via the backend. That's a hefty technological restriction, which would block a wide range of protocols (webrtc/SIP, torrents, probably a bunch of other Very Important things I'm not thinking of right now).

The immune system presumably has a limited capacity of circulating antibodies. By introducing new antibodies, do we reduce the amount of previous antibodies, and does this reduce their immune response? Is there a concept or metric of "antibody dilution"?

You're right, my comment was partly wrong (and it's too late to edit it). They don't say that Ethics outweighs Science as a subject matter. They say that Science predicts all three proposals are equally good, and therefore Ethics gets the deciding vote.

(I disagree with the claim that the choice of which group to vaccinate first won't strongly affect the total number of infections and deaths. But that's a different argument.)

And then, within the Ethics group, they say that the deciding ethical factor in favor of vaccinating essential workers is that they have a higher proportion of minorities and low-income families than the other groups (of high-risk and of old people).

They don't give any reasoning, so it's hard to argue with this. Unlike the Science section, which links a study that models deaths prevented by targeted vaccination. The Ethics section lists some unsupported and unquantified claims (table on slide 31) and at the same time judges which outcomes are better.

Crucially, the first line of this table says that ethically it's equally good to either "Preserve services essential to the COVID-19 response and overall functioning of society", or to "Reduce morbidity and mortality in persons with highest burden of COVID-19 hospitalization and death". Why? Based on what refutable data or model or ethical theory? Who knows.

Of course, this is a summary presentation; there may have been something behind it that they didn't refer or link to.

Page 31, table row "mitigate health inequities" says:

An upside (green) of vaccinating essential workers (non-healthcare) first: "Racial and ethnic minority groups disproportionately represented in many essential industries. ~1/4 of essential workers live in low-income families."

A downside (red) of vaccinating adults age >65 first: "Racial and ethnic minority groups under-represented among adults >65".

The next page (32) concludes that "mitigating health inequities" (what the paper calls Ethics) is the metric with the biggest difference in outcome, in favor of non-essential workers. A bigger difference in outcome than the one for "maximize benefits and minimize harms" i.e. preventing the largest amount of deaths.

Of course, the presentation doesn't define how these two different things are supposed to be compared. But its recommendation is that "Ethics" outweighs "Science" (their terms, not mine), and therefore populations with larger ethnic minority and low income representation should be vaccinated ahead of those at higher risk from the disease.

> the partners (Samsung, Qualcomm etc) are the ones implementing the SoC and hence controlling the wider memory system.

And I assume the partners also do some things differently, for at least somewhat legitimate reasons, and no one ARM design can be optimal for everyone.

"We'll do whatever we like, and you're not allowed to do anything, except as required by applicable law".

Then you'll have to withstand at least one party: twitter mobs, editorials, maybe employee protests or resignations. Both you personally, and your company. It's not surprising that many companies give in. They want to make a product and make money, not to make a political or moral stand.

Then all political camps will be against you, as you violate each of their norms in turn.

Once at least one major (political) group calls views held by tens of millions of people hate speech, there is no way to avoid being in someone's black book. This is why many companies are aligning with one party - they can't have both, and it's better than none.

How long until a however-motivated hacker permanently bricks the whole fleet? Or at least makes it stand still and mine bitcoin until repaired at a licensed garage?

I don't know if residents have a special status. But the DOJ appears to claim that Congress could pass a law establishing religion for foreigners, demand other countries extradite all their citizens, and sentence them in the US for not following this law.

Humans can't tell time accurately without external cues about the day and night cycle. We also can't tell time accurately to the minute if we can see outside but don't know how long the day is, i.e. latitude and time of year.

We can tell time inaccurately by timing somewhat regular internal biological events. That pretty much follows from the definition of time as the interval between regular events (which are assumed for physical reasons to be equally spaced). The only question is which underlying events we use and how.

https://en.wikipedia.org/wiki/Time_perception

Measuring regular changes in lighting (the day/night cycle) is actual time. (So would be heartbeats, although heartrates vary so much that measuring them would be very inaccurate on a daily scale.)

All definitions and measurements of time rely on counting events that are believed to happen at regular intervals. A second was defined for most of history as 1/246060 of a solar day, in other words, measuring changes in lighting.