lathiat

One of the often not talked about problems is that lots of masks were terrible and the quality in general was very variable.

There are some really great ones, and there are plenty that are quite difficult to breathe through. The N95 standard for breathability would pass some pretty bad ones.

Most places sold all sorts of badly quality controlled masks and it was a crapshoot what you got. And less breathable didn’t necessarily mean better protection.

Plenty would also collapse onto your mouth or not etc.

Some people definitely had a nicer time than others with them.

You missed this line: “This is from a CDN who has a level of access unmatched by their rivals. CloudFlare are becoming the defualt DNS for browsers and have a VPN service.”

They’ve got a pretty large vector for intercepting real traffic from a substantial number of users.

I'm not sure about this implementation, but the parca implementation only needs the .eh_frame section of the binary (which is part of, but not all of "DWARF") which still exists even in stripped binaries.

However you then still need debug symbols of some kind to convert those to names.

Prices on repair parts is the issue IMHO. I have a $1000 Samsung Washing machine. Had a similar issue with the control board dying. If I had to replace it myself, that circuit board is a $400 part. Without labour. You can't return it if it doesn't fix the problem. I just cannot see how it can cost $400 to supply a board that is part of a $1,000 washing machine including retailer margin. Once you add in $100-200 to have someone actually fit the part... it's just silly.

So the whole thing gets binned. Because for twice the price you get a new everything with 4-5 years warranty. Car spare parts also have this issue. It gets even weirder, every dealer for Mitsubishi Australia sells spare parts for literally 5x the price of the same OEM Mitsubishi part but ordered from Amayama. This held true for a stack of parts I checked from a $0.30 washer to a $120 shift fork to go inside a gearbox. More recently I looked at the ABS Control Module and it was only 2x but that's a $2,000 part. $2,000 OEM from Amayama, $4,000 from a dealer.

I get that there is some overhead in warehousing spare parts for years, but still. There is clear profiteering and something needs to be done if we're going to be remotely sustainable long term.

Never mind that we've been building modern washing machines and dishwashers for 20+ years and yet every model from every manufacturer uses a different unique part, made from scratch, which managed to make the same mistake 100 other versions of that part have made and fixed causing them to often fail.

I'm ranting, oops...

This is a slight variation on the "Poison Tap" attack from Samy Kamkar in 2016, where you do the same thing but with a USB/Thunderbolt network adapter. You plug it into the victim device, advertise two more specific routes of 0.0.0.0/1 and 128.0.0.0/1 and then you get all the traffic in preference to other system interfaces despite interface ordering: https://github.com/samyk/poisontap

I imagine there is also probably some other prior art. But that's a very well known one.

They also claim that it affects all VPN clients in the headline, yet so many such clients setup firewall rules to block traffic to/from the physical interface as they acknowledge in the write-up. Most of the VPNs that are claiming to hide your identity or where such cloaking is important tend to implement that. I'm sure plenty of setups don't have it enabled by default, but I think it would have been productive to document what percentage of leading personal/commercial and corporate VPN solutions have this enabled by default.

A good write-up and explanation for the lay person, but I think the headline over-sells it a little bit given the number of clients that would prevent most of the data leak with those firewall rules and not acknowledging the prior art in this area.

A surprisingly sensible and wonderful set of standards.

Although the 50 miles part seems unnecessarily close.

Yep, plenty of these that have come up over time. Can't think of the names of them at this point but I am sure I recall at least 5+ incidents of exactly this caused by incorrect caching.

However your IOMMU may not actually be in use. It's not in use by default on Linux and on most Linux distros as it tends to break things on random hardware that isn't setup right. It tends to work most of the time on servers.

Ubuntu 22.04 tried to turn it on by default but switched it off again due to random mostly graphics related regressions on random hardware: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1971699

Some other history: https://www.phoronix.com/news/Intel-IOMMU-Gfx-Default-Try

We really do need it though. I am always reminded of the very old Apple "Firewire Memory Bypass" which rendered flames to the screen just by plugging a firewire device in - because firewire had direct and originally unprotected DMA access: https://www.pentestpartners.com/security-blog/hack-demo-vide...

It is for this reason that even without IOMMU, as a workaround, you have to often give permission to thunderbolt devices to connect. Some details on that here: https://wiki.archlinux.org/title/Thunderbolt

There is also a small but noticable performance hit to using the IOMMU, not so noticable on a general setup but if you are doing high-speed disk & network I/O like ceph storage in excess of 10Gbit/s or millions of IOPS you will notice it. You can Google that.

You can also run into other weird behaviour, for example when using kdump to create a kernel crash dump it will kexec from the old kernel into a new kernel to produce the crash dump. The system doesn't go through a firmwire/uefi/bios reset so the hardware state of network cards, etc, doesn't get reset. So if you have any hardware driver state that isn't properly reset, you might for example have your network card DMA a packet directly into host memory in the time window before it gets reset. With IOMMU that might trigger errors, with it off it will hopefully not overwrite anything important but may also overwrite something important :)

These things are all of course fixable, but since it's still off by default much of the time, lots of these bugs persist for a long time.

Disclaimer: I am not an expert in this area it's just anecodtes from my life as a Linux Geek & Support Engineer. Should be about 90% accurate but I am sure I glossed over some solid details :)

Many IRC networks were early to IPv6

-2 points, yikes.. not sure if if that's 3 angry people that had to deal with LILO not working or 3 people thinking I was just spamming who never had the pleasure of dealing with LILO.

I see ads for these devices and the possibility of suffocating in your sleep just terrifies me. Sure most of the time you might wake up but still :/

Fortunately CPAP therapy works fantastically for me, and the CPAP masks have anti asphyxia valves to prevent you rebreathing your CO2 in the event the machine stops working (I wondered about that for a bit).

LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI LI

You're a young apprentice working at a shop who is too cheap to purchase those safety devices for their employees. What do they do?

Probably because Google are designing the entire hardware (its not a Dell rack server) and data center together, they are also responsible for the entire workload if something goes wrong and likely also have data center redundancy for an entire power loss for the entire workload there.

In third party data centers you're co-located with other customers that have mostly comodity server hardware which won't have those options, they generally (at least in my experience) all provide UPS power as part of the facilitiy so you have it already and something like a fire if it did happen, would impact lots of other customers who likely don't have redunancy between data centers or fire compartments.

Additionally depending on your exact setup (it's possible you may have dark fibre directly out of the facilitiy, but often not) you're likely to be uplinked through powered equipment at the same facility, that wouldn't have the extra UPS power either.

Plus as others mentioned, the loss of cooling is the biggest problem. In fairness maybe that would buy you a few minutes for the kindof automatic switchover they talked about. But that's quite a bit of co-ordination to have your own power, to not rely on anyone else being powered and then to be able to co-ordinate your shutdown before the room gets too hot - and not be at risk of overheating the room for others.

Plus there are safety issues like emergency power out for fire fighters etc which again, I'm sure Google could deal with at a facility-wide level, but if you're a small fish in a much bigger data center its harder to co-ordinate that kindof thing.

So while I'm sure it's all possible, there are obvious headwinds in many directions.

The distributions often run the same tests after it’s built to make sure it’s working correctly as built in the distribution environment. This can and does find real problems.

tunsocks would work, there also seems to be an openvpn fork with that functionality built in: https://github.com/bendlas/openvpn-tuna

Otherwise you may be able to use SSH's SOCKS proxy mode if you can directly SSH, e.g. ssh -D 3128 user@host .. will listen on port 3128 as a SOCKS proxy.

Counterpoint: I was professionally diagnosed as a child, my mum got me medicated, my dad got me off it a year later because it was "all about discipline".

Typical untreated ADHD style I excelled through early school until the later years of high school and struggled hard with procrastination, etc.

Got lucky with work for the first 8 years of my career in support work that is constantly changing, often high pressure which tends to capitalise on the ADHD brain but always struggled with anything long term, any project or case that takes more than a few days or weeks is a struggle.

Finally got re-diagnosed as an adult and it was LIFE CHANGING. Been on medication for about 10 years now. My psych retired and I was off medication for about a month and then briefly tried a different medication for another few weeks before going back to my original and it was miserable, I got almost nothing done for those 2 months.

I promise you, I just cannot think or disclipline my way out of it :)

I am not an expert in this so I can't explain it in any truly deep detail, and you might be right in terms of "Masking" the identity of the card number if you think this is a privacy feature, but there is much more to it than security theater of a per-device DAN.

Both when using EMV Contactless and when using Apple Pay on the web, some kind of dynamic and/or encrypted data is signed by the secure element of the device. EMV Contactless definitely signs the whole transaction, with Apple Pay on the web in at least some cases it will use either a dynamic CVV code and/or "cryptogram" containing the transaction data similar to the contactless protocol that verifies that specific payment request was signed by the secure device/card.

The payment processors can use this to know the transaction is freshly authorised and is not a replay of a skimmed credit card number/CVV (whether skimmed from another apple pay transaction, or skimmed from entering the static physical card details).

On the merchant/processor side, I believe in some cases you may get a better rate or different fraud protection for such transactions (especially at a large scale), or, it will also factor into the fraud control and the bank/payment network/etc are less likely to reject such a payment as fraud where as it may be more likely to reject the static physical card details as fraud, etc.

If someone knows better or different then please do share.

Some references: https://support.apple.com/en-au/HT203027 https://developer.apple.com/documentation/passkit_apple_pay_... https://support.apple.com/en-au/guide/security/secc1f57e189/...

Outside of malicious usage, this technique has also been used by VPN providers to support using Video services (Netflix, Prime Video, etc) in other countries. That was certainly the case a few years ago but I am not sure how prevalent that is today.

Most video providers block IP ranges that are obviously from data centers, VPN providers, etc. To work around this, many of them would route the traffic for those providers through other VPN customers in the relevant country.

Curiously, at least a few years ago, they mostly needed to only route the "control"/API traffic, and it still worked if you pulled the actual video data directly from the normal VPN IP ranges. But that is trivial to fix techncially so I was always surprised that seemed to persist and most VPN providers still have working access to such video providers now.

I would be interested to know the state of the art in this battle, but unsurprisingly it's not super commonly written about.

quickemu also does the job, not just for macOS but many operating systems

"Quickly create and run highly optimised desktop virtual machines for Linux, macOS and Windows; with just two commands. You decide what operating system you want to run and Quickemu will figure out the best way to do it for you." https://github.com/quickemu-project/quickemu

You can definitely cause problems by spilling an entire dewer into a smaller room.

Had to calculate this for the safety part of a LAN party event application. Fortunately we had a very big room.

Yeah squashfs is one of the good ones right now.

for sosreports (archives with lots of diagnostic commands and logfiles from a linux host), I wanted to find a file format that can both used zstd compression (or maybe something else that is about as fast and compressible, currently often uses xz which is very very slow) -and- that lets you unpack a single file fast, with an index, ideally so you can mount it loopback or with fuse or otherwise just quickly unpack a single file in a many-GB archive.

You'd be surprised that this basically doesn't exist right now. Theres a bunch of half solutions, but no real good easily available one. Some things add indexes to tar, zstd does support partial/offset unpacking without reading the entire archive in the code but basically no one uses that function, it's kindof silly. There are zip and rar tools with zstd support, but they are not all cross compatible and mostly doesn't exist in the packaged Linux versions.

squashfs with zstd added mostly fits the bill.

I was really surprised not to find anything else given we had this in Zip and RAR files 2 decades ago. But nothing so far that would or could ship on a standard open source system managed to modernise that featureset.

(If anyone has any pointers let me know :-)

It works for a year or two, then enough of a delta builds up that people get confused at why the version is so old. New docs don’t apply, etc. Similar issue has played out with MongoDB and Docker.

Plus it’s basically unmaintained so the bugs will build up and the security burden is higher since upstream will stop making their security patches under the old license (which they especially state they will do in the FAQ).

Best either retired or migrated to a fork (for Debian)

Mailman is most common, however discourse also has a mailing list mode which allows people to get involved and reply by both email and web.

Your biggest hurdle will be email deliverability.

"First, they need the LLM instructions AI thingy to look at your pieces and instantly come up with inspiration. Gamify that."

That exists, though it's not from Lego: https://apps.apple.com/us/app/brickit-app/id1477221636 https://www.forbes.com/sites/barrycollins/2021/07/03/got-a-b...

I mean, yeah, but the odds of someone using "xn--" on the start of a domain are pretty small. The double dash is pretty uncommon.

Another possibility from another top-level comment

"I remember reading in The Signal and The Noise* that people _think_ that forecasts are bad if it rains, but the chance of rain was reported as below 50%. Getting rain when the forecast told you there would probably not be rain is annoying; getting a sunny day when the forecast predicted likely rain is a pleasant surprise. To get what people judge to be a ‘good forecast’, the chance of rain has to be adjusted to be wildly too high - so that’s what consumer-focused forecasters do."

https://news.ycombinator.com/item?id=39684844

One of the realisations I only really had in my early 30s is that whether or not it's raining is much more localised than I thought. It can be raining here, and not at the shops a suburb over.

The percentage chance of rain includes whether or not it might rain in your specific dot of a given forecast area, which might be a suburb or entire city, as spelt out in your quote "at any given point in the forecast area".

The first time I drove over the Nullarbor in Australia, which has an entirely flat and straight 100+ KM section of road, I got to see rain far in the distance and experience driving into it having been able to clearly see it's edge from far out. That was an experience I had never had in the costal city I live in (Perth). That also led into similar realisations as the above.

It sounds so simple in theory but was not obvious to me for a long time :)

When I was trying to learn C at 15 or so I tried to implement Solitaire crypto from cryptonomicon as part of some programming challenge: https://en.wikipedia.org/wiki/Solitaire_(cipher)

Failed but learnt a lot about memory management :)

You can and people already do receive AIS with satellites. So that’s mostly possible without it being peer to peer. AIS only makes it about 50 miles across the ocean due to earth curvature so in sparsely populated areas a peer to peer approach probably won’t tell you too much.