muricula

Python 2 & 3 are developed/maintained by the same people. It's not really a competition.

I don't think that the CCP had this sudden realization recently the same way many HN posters seem to have.

I don't think the CCP cares about an obscure American social network. They know they have a dependency on American software & software distribution mechanisms, & have known far longer than Parler has been around.

Forgot to check for replies. In particular, I was thinking of this blog post: https://windows-internals.com/exploiting-a-simple-vulnerabil... Thanks for the correction, sorry I typoed her name.

Here's a tweet from the original finder: https://twitter.com/gabe_k/status/1330966182543777792?s=20

Yarden & Ionescu's work are both really top notch. Also anything by Google Project Zero if you want to do a deep dive on the subject.

AMD spun out global foundries, and they're not competitive at the bleeding edge today. I fear the fab-only part of Intel would be the same.

Not certain this is the reason why, but there is a real perf hit for full disk encryption which not everyone needs to take, especially for devices without hardware accelerated crypto. Lower end devices can slow to a crawl.

MS source code leaks to the public all the time. I think there was one early last year.

Yardin Shafir's excellent blog post started with a bug found purely through fuzzing by an MS employee security researcher.

This may be the documentation: https://docs.rs/mundane/0.4.3/mundane/ It's not great, but it's something.

You're right though, they should at a minimum link to it more prominently.

codetrotter is right just tune into the stream and ask questions/do some light heckling as appropriate ;)

This is pure speculation, but they may have changed it to foo==false. In C a boolean is just a byte which conventionally has the values 0 or 1, but an attacker which controls a boolean can give it the value of 2, and 2!=true and 2!=false. This has lead to real exploits: https://windows-internals.com/exploiting-a-simple-vulnerabil...

When writing C or C++, never compare against true.

Your suspicions are correct.

I'm not sure if you (or other readers) are familiar with the quote, but the title is a pun. When Caesar crossed the Rubicon river and marched on Rome to declare himself emperor he supposedly said "The die (like dice) is cast (thrown)" -- either he would become emperor or perish trying.

In the case of t article, the Rubicon has been crossed, and also features "cast" into the silicon can't be fixed (most of the time). But you're right, they aren't actually cast.

The Silicon Valley's idea of Big Tech didn't include MS a few months ago when they were leading the pack for most valuable company in the world. And somehow they're escaping anti-trust scrutiny right now too, so maybe it's better to have a less sexy profile.

Were you using WSL 1 or 2? WSL 1 networking didn't work the way I expected, but WSL 2 seems to support proper Linux networking since it's just a Linux VM under the hood.

Here's the article the parent mentioned in passing, it may answer your question: https://www.chromium.org/Home/chromium-security/memory-safet...

It's very Chrome and C++ specific, but the problems will likely be similar in practice.

Source code access makes surprisingly little practical difference for discovering security vulnerabilities. People routinely find security vulnerabilities in major closed source operating systems like Windows and iOS and submit their findings to MS/Apple for bounty, or sell them to exploit brokers. Reverse engineering tools like Ghidra can decompile code back to C to make auditing easier, and black box fuzzers have proven massively useful for discovering vulnerabilities without auditing code line by line.

Tiktok is far smaller, and has a smaller attack surface. If there was money in it, people would audit Tiktok all day.

The community can do an okay job but not a great one. The writing on Wikipedia is shoddy and inconsistent, and there are many many missing sources even if the article is accurate. I'm a huge fan though!

Similarly, many stack overflow questions are out of date, and good luck getting them updated to reflect current best practices. And if you do ask the same question again trying to resurface a newer, better way to do something it will almost certainly be closed as a duplicate. Huge fan of the resource though.

Ultimately, experienced professionals who are paid full time to be both writers and technologists can do a better job, especially over a long period of time.

10nm Intel CPUs exist. I have seen them with my own eyes. Reading the tea leaves from public statements and articles like that, the yields seem to be crap right now.

There will probably be defeats and accidental gadgets for the first couple releases, but this hardware technology has the potential to be better than any software based mitigation with the same goals. Here's a paper with a more detailed security analysis: https://sci-hub.tw/10.1145/3337167.3337175

I haven't read the whole paper, but this has a section on performance and a security analysis of the hardware feature: https://sci-hub.tw/10.1145/3337167.3337175

CET has two parts, a forwards edge protection (indirect jumps and calls like those necessary to execute a C++ virtual function, a Go interface function, or a Rust trait function), and a backwards edge protection to protect against Return Oriented Programming (overwriting the return address to attacker chosen code).

If I recall correctly, Windows will only use the backwards edge protection, since they already have a superior technology for forwards edge protection (CFG and XFG). The backwards edge protection has an impact of 1.65% according to that paper. Forwards edge protection had no impact.

I have to say, this is well worth it.

Nah it exists because an endless stream of security bugs is a headache.

I think the point is that the OS needs to interface with the hardware and read out the data, which is then passed to a program which works with it, part of which is a neural network in this case. Usually there's some marshalling and unmarshalling in there too.

Yes. The talk was given by an xbox architect, and iirc he mentions he's not sure about the state of the PS4. It's a great talk and if you're interested in security you should give it a watch.

Organizations like the FBI, the Department of Homeland Security, the National Guard, and the Bureau of Alcohol Tobacco and Firearms collectively fill a similar role to the gendarmeries in other countries. I'm not sure we need another armed federal agency to enforce the law.

Security analysis is uses framed as finding bugs. There's a few main ways of doing this when searching for bugs in C/C++ code:

* Design consultations early in development to address insecure or risky designs.

* Reading risky parts of the code line by line hunting for buffer overflows and many other things. If you don't have access to the source, you can read the disassembly too, and people find a lot of bugs doing that!

* Fuzzing. Basically hooking up the program to a harness which throws random data at its attack surface until the program crashes, although it can get a lot more nuanced than that.

* Running static analysis tools to search for problematic code patterns.

The C/C++ code which powers all major operating systems and web browsers is rife with security issues. There are also whole other sub-disciplines auditing websites, corporate networks, and cryptography implementations, which generally use analogous techniques.

The city is providing porta potties right now, as are local businesses and there are individually rented porta potties. Sanitation is much better than occupy right now.

The city is maintaining a row of porta potties, and someone rented one privately a block or so away. Some businesses are opening their restrooms too. As of this evening I saw at least three soup kitchens, two well equipped aid stations, a community garden plot with zucchinis and other food, a row of freshly planted trees, planters of decorative plants which double as barricades, and lots of barricades. Half of that wasn't there yesterday.

A bunch of people are calling for defunding the police and not total abolition, although that is what this site says. Socialist City Council member Kshama Sawant has already pledged to bring legislation to cut the police department budget by 50%, and city officials are going over it in depth.

I live down the block. Anyone can wander in. If you're a local politician or an unfriendly news org you might be yelled at by protestors, but that shouldn't be a surprise.