The important part is having physical access to the phone. A targeted attack against you now requires a physical element, rather than being entirely online.
942 karma · joined March 20, 2017
How can you be so disingenuous? You removed ads, then introduced your own advertising. You may see those as two separate events, but the consequence is the same as if you had chosen to replace ads.
> Thank you to everyone who provided valuable feedback on earlier drafts of this post, many of whom are Recursers.
I’ve noticed a few instances of people really drawing attention to having attended, and it always seems a bit awkward to me. Like, if I attended Cambridge and put “thanks to those who reviewed this most, many of whom are fellow Cambridge grads”, it would certainly come across as fairly pompous. I really don’t mean to put down the author, I just don’t understand the motivation for this kind of thing if not to boast, or signal some kind of social status.
Are alumni encouraged to advertise RC wherever possible? Or is it really that life-changing that everyone who’s been wants to share it with the world?
0: https://developer.mozilla.org/en-US/docs/Web/API/console/log
> For example, when a user clicks the element X, then we only allow a website to start the element X from a function that is in the call stack based on the X's “click” event handler.
I could be misinterpreting this, but doesn't that imply that scrolling into view would generally not be sufficient to allow autoplay? Since the scroll event would be on the body/window, and the video itself is not the target of the event?
> These problems are more typo/syntax-based rather than logic-based.
Sure, but you can also see why it could take absolutely ages for a novice to work out what's wrong, right? The bitwise operators will work for evaluating logic like this in some cases, but not all. And the student knows it's something like "&" for "AND" and "|" for "OR". Could be a really tricky bug if you've been introduced to logical operations, but not bitwise ones, and don't therefore realise they could exist & be confused.
0: https://dqydj.com/income-percentile-calculator/
1: https://dqydj.com/income-percentile-by-state-calculator/
2: https://dqydj.com/2018-income-percentile-by-city-calculator/
0: https://github.com/MKorostoff/1-pixel-wealth/blob/master/THE...
It's pretty misleading to frame this as though the UK is drastically lower than any other comparable countries though. The UK's GDP per capita is similar to Canada, France, Israel, Japan. And that doesn't even get into whether GDP is actually a realistic measure of how "poor" a country's people are (c.f: Ireland, which has a much higher GDP per capita than the US, but similar material conditions to the UK).
0: https://en.wikipedia.org/wiki/List_of_U.S._states_and_territ...
From [0], the issue arises when they send "user:pass@host" to SSL_set_tlsext_host_name, which happily sets the SNI to whatever it's given [1]. As a point of comparison, when you create a Rustls client via ClientSession::new [2], you have to pass it a DNSNameRef, which will validate that there's no auth component in the string it wraps, and return an error if you try to set the server name to something involving auth details.
I'm sure there's reasons why OpenSSL is set up to work like this, but I can't see why anyone would ever want to send those auth details in the clear in the SNI, and I wish it provided an API that would anticipate this misuse, like in Rust. The OpenSSL docs don't indicate it's an issue you should think about when invoking this function [3].
I realise I'm picking on OpenSSL here, and GnuTLS appears to do the exact same thing. I'm just not certain anyone not wearing a hazmat suit and being watched by multiple other trained professionals should be handling OpenSSL code.
0: https://www.openwall.com/lists/oss-security/2021/08/07/7
1: https://github.com/openssl/openssl/blob/5cbd2ea3f94aa8adec9b...
2: https://docs.rs/rustls/0.19.1/rustls/struct.ClientSession.ht...
3: https://www.openssl.org/docs/man1.1.1/man3/SSL_set_tlsext_ho...
That all makes sense, I think the reason my uni refuse to allow normal IMAP is because they’re trying to enforce 2FA-only access to their systems, which could become more common down the line.
I think paying 60% tax or higher on income above a certain threshold (e.g: $300,000, just throwing a number out there, so you'd pay 60% tax on $1 if you were earning $300,001, and a lower tax rate for the lower portion) is reasonable.
Regardless, sure, one way is to give the choice to opt out, another is just to lower taxes if it's generally agreed they're too high.
Absolutely. It's a good thing I'm not calling for massively beefing up government then, I'm just advocating that tax laws exist & are enforced, so as to redistribute wealth, which I don't view as oppressive.
> If libertarianism would result in a great many oppressed people, any sort of centralisation of power will result in even more oppressed people.
I disagree with the implied premise that there is not a "centralisation of power" under libertarianism. While there isn't a state to have a monopoly on violence, there can certainly be a centralisation of economic power. And when we rely on money to pay rent, afford food, pay for healthcare etc, economic power is functionally equivalent to power in general.
> the worst oppressors are invariably governments
I wouldn't say invariably. Consider the United Fruit Company for example, or the current prevalence of child labour in tech company supply chains (e.g: Glencore, Zhejiang Huayou Cobalt).