lathiat

Indeed, slightly or even double better performance won't help if you turn it off :)

This seems to be getting published everywhere like it's new, and maybe it's a new exploit, however a group was able to do this in 2021 (which was fixed, so not clear if this is a new exploit): https://cyberhoot.com/blog/apple-airdrop-vulnerability/

Doesn’t require an in-kernel driver which is increasingly difficult in the world of Secure Boot etc. Also more secure since if there’s a bug it doesn’t have kernel level access.

isostick also does this in hardware, $99: http://isostick.com/

I wholeheartedly agree with you in theory.

But I, personally, am happy to accept the 'Human Factors' side of reality.

Yeah, I agree with this.

Not clearly written in the original article is that "many" (I'm not sure what actual percentage, but vaguely "most") packages already have frame pointers enabled.

The problem packages that don't are exactly all of those upstream projects that intentionally compile with -fomit-frame-pointer because of those small performance gains. And those are also usually the exact same projects you end up wanting to profile or otherwise analyse :)

I work in the Support organisation at Canonical and the two most frequent projects I run into this with are Ceph and Openvswitch - they both compile with -fomit-frame-pointer by default upstream (and currently in the Ubuntu packages) which makes using perf (which I often need to do with both of those) a pain.

While you can do it, you have to record ~8kB of stack extra for every sample (times 1000 per second, times the number of CPUs...) and then unwind it later with the DWARF debug symbols. The resulting perf exports are multiple gigabytes for 0-2 minutes. Compared to maybe 25-200MB for frame-pointer enabled cases where I can usually then easily captured.

The problem is the product or upstream project wants to claim the absolute best performance, even 1% better, but the end user rarely needs that last 1% and both them and their support team would like to be able to easily use profiling in production to fix the random much more significant 10-100% performance bugs that inevitably crop up when actually using it and not benchmarking it :)

The building industry in Australia is filled almost entirely with independent contractors. Mostly single people, working on a contract to the house builder/project manager. So there is little room for that.

But I agree, this would be good.

But I think the decision here is basically that, in practice, it's very difficult to actually get people to follow the required practices, in practice. As has been shown in practice.

This was considered but the problem is it’s very difficult to enforce in practice

The product is generally installed onsite in a fast paced building industry that doesn’t have time/room to do it properly and often no supervision (1-2 often independent trades doing the installs) to ensure the appropriate measures are actually taken.

The risk has already been known for a while and in practice still lots of “YOLO” onsite cutting without even respirators.

That is not entirely true. Sure it’s not a 100% reliable signal as routing is asymmetric but it also often isn’t and also gives you an idea of which point to ask first at least.

If the packet loss starts at your wifi router, or your ISPs router. Or the next hop after you ISP. That all gives you a bit of an idea where the problem likely is. I solve problems like that all the time.

Oh, that is great.. I was using dasel to convert yaml to json first ha ha.

Another option is to use the “Guided Access” accessibility mode which lets you lock the phone into the current app, requiring a password/optionally FaceID to unlock it. Can be activated with a triple click on the power/home button. It’s also great to use with kids to stop them switching apps.

It’s effectively a kiosk mode.

The theory has been at some point they'll remove the separate ID and have a single ID that encompasses both. Due to things such as Apple's automatic tracking link removal (but also many others): https://9to5mac.com/2023/06/08/ios-17-link-tracking-protecti...

Similarly I was hoping to run the Bonjour Conformance Test on Linux in CI for Avahi. Which is CLI as well.

Apple accessibility including VoiceOver is amazing and from everything I read second to none. Though I don’t have first hand experience on that, I did spend several hours one time lined up for an iPhone talking with a blind girl - she was showing me how she uses both her Mac and iPhone with voiceover and with the screen totally black. Was a fun night.

While this is cool, I am long entertained by memories of playing music videos through cacalib with mplayer which generates color ascii art video (over SSH no less :)

Wow, that's amazing :) I will watch the talk today but.. amazing work! :)

I have been talking about someone needing to do this recently, uprobes are largely quite slow for tracing (e.g. with bpftrace) because it has to trap into the kernel every single time, unlike tracing anything in the kernel because you're already in the kernel - so no context switch is needed.

It was always possible to do something like this, to inject the bpf code to run in-process and only export data occasionally just like the kernel side version - and the pieces already existed but no one had put all the pieces together, now someone has. Awesome!

Just need someone to implement this seamlessly into bpftrace :) That would be amazing!

If you want to understand why it's slow without this, I recently did a talk explaining the difference in tracing speed between strace and bpftrace (when tracing things in the kernel) that may help! In this case (which I didn't really cover), most function uprobes have to trap into the kernel and back twice (once on function entry and once on return, I explain why) - not as bad as the full strace example I explain in detail in the video - but still comparatively expensive.

https://www.youtube.com/watch?v=ZDTfcrp9pJI "bpftrace recipes: 5 real problems solved"

I re-ran this talk (mostly the same, a few minor updates) at the Riga Ubuntu Summit a couple of weeks ago but the videos aren't up yet. But the version above is mostly the same and was a pretty good recording :)

You would think so, but that's not as simple as you would think. On Earth that cooling generally happens by conduction and convection to the air.

In space there is mostly no atmosphere, you have to radiate that heat which isn't quite as easy as it sounds: https://www.space.com/21059-space-station-cooling-system-exp...

Even with less ports you can use Display MST hubs to breakout 3 displays from one. (But not on a Mac, even intel, they never added driver support. Works in windows boot camp though)

Right, but why can't you disable the internal display to run 2 external displays? That wouldn't be an unreasonble compromise but seems not possible.

Doesn't need to be a dev shop. Go into any standard office and most productivity office workers will be running dual monitors now.

But with the general power of the base model Apple Silicon I don't think most dev shops really need the higher end models, honestly.

I really, really wish they would fix this silly display scan-out limitation. I gave them a (frustrating) pass on the M1 given it was the first evolution from iPhone/iPad where it wouldn't have mattered. But seems silly to have made it all the way to the M3. Wanting to dock onto two displays even at the low end doesn't seem like such a niche use-case.

I'm sure there is some kind of technical explanation but both Intel and NVIDIA seemed to managed 3+ scanouts even on low end parts for a long time.

I think you’re wrong there. There are snow mobiles that do 0-100 in 1-3 seconds but they are all crazy special built machines like this.

4-6+ seconds is much more typical for a normal unit. Which is similar to normal-ish 200kW sports cars. A bit fast but not breath taking.

"The Difference between the UK, Great Britain & England Explained" by CGP Grey: https://www.youtube.com/watch?v=rNu8XDBSn10

A good watch to understand the above

That works for GUI apps I agree though doesn’t work for server side stuff. Which I suspect the software the OP meant is. But yes better than storing the password if you are on a desktop.

The oaith spec requires a callback URL to work and usually that url has to be “registered”/authorised with the server. Most of these apps are using the api “unofficially” and the only way to do that is with browser automation. Otherwise once the login is complete the redirect with the authorised token won’t get to your app - it will go to the official website or app.

They then pluck the authorised token out of the cookie store.

See also, pidfd, for similar reasons: https://lwn.net/Articles/794707/

Before JSON and YAML, XML was all the rage in the sort of 2000-2005 era. Plenty of config files etc using it in the Linux desktop space.

Not sure if it’s related to this case or not but it was once much more popular even for sometimes human written files.

I guess we need a community notes for the community notes.

Somewhat related in 2006 I had a Motorola A1000, very early iPhone sized full screen smart phone with Stylus.

I took it to New Zealand on roaming and despite having a connection it spent so much time looking for the home network (“Three” in Australia) the battery would last half a day.