luch

Well, sorry to break it for you but private companies have done this for decades.

Rupert Murdoch's Pirates is a fantastic book on the subject: https://www.amazon.fr/Murdochs-Pirates-hacking-Ruperts-skull...

Basically pay-for-TV companies went ballistic in the 90s' and 00s' against hackers, and people died in the process.

Not exactly, historically days are counted by how long the editor has provided a patch fixing the bug, as in "you[the adminsys] had X many days to apply the bugfix".

0day means no patch is available, whether the vulnerability is known privately/publicly or not

I don't think this is a thing for two reasons :

* firstly, not many people outside the security world knows that bugs are a valuable commodity for attackers. Same thing with internal orgs diagrams which are something you can sell to economic intelligence firms.

* secondly, top-tier orgs like FAANG usually peppers a lot of telemetry around known bugs in production code in order to see if someone isn't exploiting them (or simply to better track down the root cause).

That being said, attackers are reaaaaaally interested in getting access to internal bug trackers : https://grahamcluley.com/microsoft-bug-tracking-hack/

> The binary TDDP protocol merits further research since it is available on a broad range of TP-Link devices.

The tdpServer binary regularly get abused to root TP-link devices for Pwn2Own Tokyo : https://www.thezdi.com/blog/2020/4/6/exploiting-the-tp-link-...

Also :

- https://mjg59.dreamwidth.org/51672.html - https://www.coresecurity.com/core-labs/advisories/tp-link-td... - https://medium.com/@CoreSecurity/a-story-about-tp-link-devic...

Because if you start to support Linux you actually have to support all the major distribution (Debian, Arch, Ubuntu, Fedora, etc.) with their different idiosyncrasies, package format, libc implementations and/or version, etc.

Basically your testing coverage explodes exponentially. That's why in a former gig the team I was part of decided to go from Linux to only Windows since it way easier to test only for ~3 majors OS versions.

It's pretty reliable in reality, C compilers are actually quite predictible. The only meaningful changes compilation flags do is add/remove basic blocks.

That's also mainly how malware reverse manages to "hunt" APT families, by finding meaningful little patterns in the instructions and look for code reuse in other binaries :D

I remember as a student seeing an Airbus bigwig explain why they created the A380 using a financial diagram : "short couriers costs X€/seat, transatlantic couriers costs Y€/seat and the new A380 will cost Z€/seat" (Z < Y < X of course), disregarding completely the fact that landways needed to be widened/stretched or that airports started to bubble everywhere leading to what we know as the hub-and-spoke model.

In all honesty, I'm pretty sure Airbus exec went with the A380 design as a pissing contest with Boeing.

The Sheet #16 about cookies and third-party trackers is quite interesting:

    ## To benefit from the exemption from consent
    
    **Subject to a number of conditions**, cookies used for audience measurement are exempt from consent.
    **These conditions, as specified in the [guidelines on cookies and other trackers](https://www.cnil.fr/en/cookies-and-other-tracking-devices-cnil-publishes-new-guidelines), are**:
        * To inform users of their use;
        * To give them the ability to object to their use;
        * To limit to the following purposes only:
            * audience measurement;
            * A/B testing;
        * Not to cross-check the data processed with other processing (customer files, statistics on visits to other sites, etc.);
        * To limit the scope of the tracer to a single site or application editor;
        * To truncate the last byte of the IP address;
        * To limit the lifetime of the trackers to 13 months.
    
    Provided that the conditions are met, **we therefore switch from an opt-in to an opt-out regime**.
    It is also possible for the same third party (subcontractor) to provide a comparative audience measurement service to multiple publishers, provided that **the data is collected, processed and stored independently for each publisher and that the trackers are independent of each other**.
    
    ## In practice
    
    **Most large audience measurement offerings do not fall within the scope of the exemption, regardless of their configuration**.

That's what I though, when websites welcomes you with a giant popup "Manage your consent" with a gazillion third-party trackers all opt-in (and you need to disable them one by one) they are actually not GDPR-compliant.

Not sure if that's what you have in mind, but Microsoft now has an ARM-based product line :https://techcrunch.com/2019/10/02/microsoft-launches-the-arm...

They even implemented a x86 emulator in order to run your usual native software on it.

I genuinely thought that was a satire post about over-engineering Python projects

Let's not kid ourselves : European ad-tech companies are not substantially more ethical than their American counterparts.

GDPR (even with its current clumsy implementation) is a much needed piece of legislation since the data processing market have no economic interest in "behaving" ethically.

Because they would do it anyway. I've heard "stories" of attackers gaining control of a sat, "flipping it" to prevent it from listening to incoming commands, and then asking for a ransom from the original owners.

In my country the wealthy went ... in their summer house on the islands.

You know, the typical location which is usually not self-sufficient and definitively not autonomous when it come to medical care facilities.

No unless you're at risk (old person or with medical issues) you usually don't get the flu shot. The reason is to actually to build the so-called "herd immunity" I think. Same thing with antibiotics (no need to give evolutionary "ammunition" to virus and bacteria if we don't need to).

This is really interesting data !

I for once would like to know why they refuse to hire contractors from Western Europe (is it a legal thing ?) :

  {"country":"*","contractor_factor":1.17,"entity":"GitLab BV"}],
    "countryNoHire": ["Iran","North Korea","Crimea","Syria","Sudan","Cuba","France","Italy","Brazil","Spain","Romania","United Arab Emirates","Sweden","Argentina","Philippines","Austria"],

most insurance companies will play the "force majeure" card in order to exempt themselves from reimbursing clients.

No insurance company is solvable against a global pandemic event.

Squid is vastly under-equipped to deal with the security hygiene needed for a project this important.

That's the tragedy of the open source world : mission critical for everyone, but no actor willing to maintain it properly. It's Heartbleed all over again.

this is paid leave (it's only an allowance, not usually a full salary though). Where I live it's up to a year for a father, but most of them do not take it since we are still entrenched in the "father at work/mother at home" society

I know a good amount a professionals using it to dig olders builds of software. The Eye is actually better than Microsoft (at least for people without a msdn account) at archiving VS installers, Windows isos, etc.

> One can imagine what the Uber app would look like if the company operated like Airbnb. A rider would enter her location and destination and get a list of drivers with their fare bids and distances from the starting point. Then the rider would make her choice based on the combination of price and arrival speed. That would make Uber an information provider rather than a taxi service.

Funny, that's precisely what Blablacar (https://www.blablacar.com/) is : a carpooling information provider. Though it is not supposed to be for professional drivers (but Airbnb was not supposed to be for hotel pro either)

it's worse than that : airplane pilots are certified for a particular set of aircraft (and that's why the 737 max came to existence). Even if a company wanted to boycott Boeing, on top of refresh its current fleet it would have to re-train and re-certified all its employees.

Weirdly enough, most of Air France & KLM fleet are comprised of Boeing planes

the current Xbox is running a Windows 10 (one kernel design) while the PS4 run a patched up FreeBSD.

Only Nintendo bothers with writing custom kernels, and historically Sony with the PS2 having exotic "Cell" processor units.

iDrac have a default password : https://danblee.com/dell-idrac-default-username-and-password...

There also quite a number of sysadmins that connect idrac's to the "regular" network, instead of the sysadmin VLAN ...

Sorry but it will take more than a blogpost for me to believe it.

When P0 recruits two prominent Chrome hackers (Ned Williamson & Samuel Gross) and make them work directly on iOS, it look like a hit team to me.

Moreover, people are bad at keeping secrets. Social engineering is clearly a thing, even among infosec circles. Sometimes all it takes is being in the right bar and having a good ear.

And how do you qualify "Meltdown" and it's notorious bad fix "Total Meltdown" in that case ?

To me, the bug fix introduced a clear regression, allowing an even more powerful vuln in the process.

Yep, nobody buy F-35 planes because it's a superior airplane (it's not) countries buy it in order to have better diplomatic relationships with the USA.

It's pretty telling to see Germany refusing to buy F-35 or Hungary buying ones in order to piss off Sweden.

The "cloud" as we know it rely heavily on CPU's hardware security and their virtualization technologies to enable untrusted computation from users.

CPU security is actually one of the few topic Intel is extremely good at (don't trust the RISC/CISC flamewar) and could define the way cloud providers are built upon.

Interesting, in French "retard" is a valid word (it means delay) which could be used as a project's name.

Honestly it's a lost battle to try to censor hurtful projects names. At best you can moderate US-centric ones.

Javascript is actually a sane choice for extending a debugger (event-based, async calls builtins, etc.) it's just that I'm not familiar with :p

I would have expected Windows to go with Powershell as their scripting engine, that's why I was surprised with Javascript.