BootHole is a GRUB2 vulnerability that could allow a local attacker to bypass Secure Boot protections. The patches for RHEL/CentOS lead to failures in booting due to a crash in the UEFI loader for GRUB2.
687 karma · joined February 1, 2016
TL;DR: Phones starting in February 2022 without 4G LTE and HD Voice will no longer work. AT&T poorly communicated this, and even customers of devices such as the Samsung S10e (still listed on Samsung's website with AT&T support[1]) are being contacted with this email even though it's on their "supported" device list [2].
There has also been an updated article outlining the confusion: https://www.androidpolice.com/2020/07/22/no-your-phone-is-no...
[1]: https://www.samsung.com/us/mobile/phones/galaxy-s/galaxy-s10...
[2]: https://www.att.com/ecms/dam/att/consumer/help/pdf/Devices-W...
> "The start order in the first run is determined by a combination of a draw and your standing in World Cup rankings. For the second, the top 30 skiers start in reverse order (so the 30th person goes first) to even out their chances. The later on you start, the worse your course conditions will be, sometimes with gnarly ruts, holes and bumps." [1]
While yes, a better athlete would start later, and therefore be at a disadvantage, it evens out the field so that they can close the gap in the effects of the course conditions.
[1]: https://qz.com/1202352/a-short-guide-to-understanding-alpine...
Plus, because you can drop anywhere, it's possible that some players fight sooner than others, creating yet another source of luck that can not be controlled. And yes, this could be controlled too, but again, Fortnite has not done so as it could result in removing one of the core aspects of the game.
Fortnite still has a large amount of luck involved. Even the most skilled players have to rely on luck to be able to get the high leveled items they need to succeed in the long game. While current competitions have tried to lessen this by having multiple rounds over and over in attempt at giving all players a fairer chance, the luck aspect is still there.
All other games with a heavily established esports base uses games with much lower levels of luck, and are centered around the balance of skill and strategy. CS:GO, League of Legends, Rocket League, Valorant, Super Smash Bros, etc. are all centered around the player or team's skill and/or strategy. Luck is either minimal or non existent.
The Olympics should be about skill, never about luck.
The good news is that GitLab uses Ed25519 keys as the recommended default [0]. GitHub still recommends RSA keys by default [1].
[0]: https://docs.gitlab.com/ee/ssh/README.html#generating-a-new-...
[1]: https://help.github.com/en/github/authenticating-to-github/g...
Slightly more technical information from Wired: https://www.wired.com/story/dejablue-windows-bugs-worm-rdp/
TL;DR: Remote Code Execution via RDP on all windows versions, including 7 and 10.
Wired Quote:
> "Microsoft today warned Windows users of seven new vulnerabilities in Windows that, like BlueKeep, can be exploited via RDP, a tool that lets administrators connect to other computers in a network. Of those seven bugs, Microsoft's advisory emphasized that two are particularly serious; like BlueKeep, they could be used to code an automated worm that jumps from machine to machine, potentially infecting millions of computers."
> "Unlike BlueKeep, however, the new bugs—half-jokingly named DejaBlue by security researchers tracking it—don't merely affect Windows 7 and earlier, as the earlier RDP vulnerability did. Instead, it affects Windows 7 and beyond, including all recent versions of the operating system."
> Here’s a summary of the information we’ve added to our terms:
> How we make money: We include more details on how we make money, including a new introduction explaining that we don’t charge you money to use our products because businesses and organizations pay us to show you ads.
> Content removals: We provide more information about what happens when we remove content that violates our terms or policies.
> Your intellectual property rights: We clarify that when you share your own content — like photos and videos — you continue to own the intellectual property rights in that content. You grant us permission to do things like display that content, and that permission ends when the content is deleted from Facebook. This is how many online services work and has always been the case on Facebook.
> What happens when you delete: We’re providing more detail about what happens when you delete content you’ve shared. For example, when you delete something you’ve posted, it’s no longer visible but it can take up to 90 days to be removed from our systems.
[1]: https://www.fool.com/investing/2019/01/09/why-canopy-growth-...
Imagine waking up in the middle of the night with a need to call 911, but your ISP purposely broke your internet just to sell you a “security offering.”
Also, while I hate t link to a lifehacker article, the lead photo is pretty hilarious in terms of the need for that many adapters to connect an iPad or iPhone to Ethernet and to keep it charged. (https://lifehacker.com/hack-together-a-way-to-connect-an-ipa...) Android isn't much better, but at least it uses a more common and cheaper USB-micro or USB-C.
The problem with the block chain is privacy. Publishing people’s votes can and will have a huge impact on their life. It would also make buying votes much easier.
A block chain solution would have to find a way to ensure that only valid voters can place a vote, ensure that only people that could vote were the only people that placed a vote after the fact, and ensure that none of this can be tied to a real identity. Otherwise, either bad actors could place votes, or a complete voting record for a person is published.
Solve all of the above, and a block chain may be an acceptable way to go, though it would be a waste of energy in my mind compared to a normal database, which could easily be exported with only the vote and signature stating it was a valid and verified vote for a person.
In the end, we have just made something more complicated than a paper ballot, which has been shown to be reasonably secure against foreign and/or national actors attempting to influence an election, except in already corrupt nations, especially those without term limits...
[1]: Chrome stopped asking and won’t run Flash until they click though a couple menus to enable it.
---
Edit: I just remembered that WebAssembly has JavaScript based polyfills. Disabling WebAssembly does not do me much good, as it will still run. No dialog can really stop that...
---
I understand that the page I linked to does not have a solid argument for why it should be disabled. There is a point though the author made that I do agree with, but they did not detail it well.
I could be understanding what WebAssembly has and what it could bring, but the way I have read it is that WebAssembly allows users to create desktop like apps with better performance than JS. I am fine with that.
The problem lies with in the sandboxing model. Sandboxes work great in principle, except that more toys that get added, the harder it is for the sandbox to keep all of the sand in. Just recently JavaScript had a small bit of that problem with WebUSB. See https://news.ycombinator.com/item?id=16501400 and https://news.ycombinator.com/item?id=17332340
In JavaScript at least, the browsers could change how the APIs respond to fix the issue. In the case of WebAssembly, I honestly do not know if they are able to shut down vulnerabilities as quickly. My understanding is that these binaries are similar to compiled apps that you can run directly on your desktop. Now it would seem that we would have to run virus scanners directly in our browser on every binary that wants to run.
Am I be over reacting to all of this? Probably. But I would rather be overly cautious that be caught up in a exploit on a service that is not used much. I would prefer WebAssembly is treated in the same fashion as Flash until the standard has settled and it’s security is proven.
---
I have yet to see a real reason for browsers to enable WebAssembly with out at least a permission dialog like location services, alerts, flash, etc. The only thing I have heard that uses the feature is the CryptoCurrency miner mentioned in the article and some random demos released by Mozilla.
First thing I am doing when I get back to my laptop is finding where the hidden flag to disable WebAssembly is in Firefox and Chrome, as an ad blocker can only go so far with blocking this. I could be very wrong, but I see noting but potential for abuse. If I run across a legitimate use case, I can re-enable the feature on demand.
Edit: https://github.com/stevespringett/disable-webassembly/blob/m...
Seems like disabling the feature is a difficult task in all browsers that have WebAssembly except Firefox.
The exact commit is as follows:
libobs: Add scene item grouping
Allows the ability to group scene items. Groups
internally are sub-scenes, which allows the ability to
add unique filters and transforms to each group.
This is all personal preference though...
For example, my username is enzanki_ars. Let's say I set up enzanki.ars at home as a host for an in home only server. Now let's say that a new country registers .ars as a new TLD, for example Argentina as ARS is the ISO 4217 currency code for the Argentine peso. Now I am stepping over someone else's TLD, an someone could even register enzanki.ars before me and start using it.
My personal policy is "just because you can doesn't mean you should." If I wanted to disrespect the process we have in place to prevent people from stepping over other people's domains, I would have set up enzanki.ars already. Until then, 192.168.0.0/16 is how I reference my hosts at home.
Edit: See also: https://www.iana.org/assignments/special-use-domain-names/sp... for an up to date list of special use domains. "home.arpa." was recently assigned as one, and I may start using that one at home.