tbodt

idevicerestore will eventually support doing this from Linux.

Can you help convince me of this?

Also I'd encourage you to contact the owners of the repositories listed in Google's DMCA notice against the Widevine cryptographic key and help them file a counter-notice. https://github.com/github/dmca/blob/master/2020/11/2020-11-0...

Aside from being illegal, defeating the various layers of obfuscation and extracting the private keys requires a very particular set of skills, beyond the reach of most programmers. And then they'll just rotate the key and add more obfuscation, once they're done suing you out of existence.

That tweet is not accurate, but DDOS-Guard is a Russian firm according to https://krebsonsecurity.com/2021/01/hamas-may-be-threat-to-8...

To me that was never the problem. The problem is joining data that doesn't need to be joined.

Which site guideline does this break?

Probably not. But the timing is strange to me

Announced only 4 hours after responding to https://news.ycombinator.com/item?id=25644056? That can't be a coincidence.

I would say the right place for the performance team to apply resources is looking for bugs or missed optimizations that affect everything or nearly everything on the site. Everything is uniformly slow, so there must be a lot of this.

There's also Adobe Animate, which is a rebranding of Flash that can output HTML/JS

tenpo sike suno sin o pona tawa ali!

iMessage is not being attacked because it's not as sandboxed as other apps. It's being attacked because it's accessible with zero clicks.

For an attack like this you need to chain an iMessage exploit with an LPE, and the LPE can be launched from any other app.

Yes, please make a post sharing your knowledge on how to convince them. I suspect most people would have no idea how to pull this off.

The build execution bits of Travis appear to be open source: https://github.com/travis-ci/travis-build https://github.com/travis-ci/worker

It should be possible to make a GitHub action that runs an existing .travis.yml.

Anyone have a link to the original NLRB filing that is presumably the source for this article?

They added 32 bit x86 support to Rosetta apparently just to get CrossOver to work. This could be a reason for them to never remove Rosetta. Maybe they'll just remove the x86 userland.

You'll never guess whose idea this was

The widevine-l3-decryptor takedown wasn't filed by the RIAA

Mozilla's solution to this is to run every single certificate in the CT log through the filter, and remedy any false positives with an extra layer. The filter also has a date attached, so potential false positives that are newer than the filter can be checked with OCSP.

https://blog.mozilla.org/security/2020/01/09/crlite-part-2-e...

They should be downloading a bloom filter of revoked certificates, instead of checking with a server every time.

This is known as CRLite, and Firefox is implementing it for HTTPS certificates. https://blog.mozilla.org/security/2020/01/09/crlite-part-1-a...

The only difference between Widevine and DeCSS is you can rotate the Widevine key.

TL;DR: Travis CI is no longer free for open source projects. Instead you get a free trial good for 1k build minutes, and can email them to beg for more when those run out.

First statement is absolute numbers. Second statement is regarding relative numbers. They can both be true.

> For a limited time, you can redeem the code SPOTIFYSUCKS and get 42.069% off on all plans.

Nice

Serious question: how do you debug C programs? ASLR is inconvenient sometimes, but I've never felt it makes debugging anywhere near impossible.

Unfortunately GWT is deprecated so the chance of this getting fixed is slim. Instead bet on this status page getting deprecated and maybe rewritten by 2021.

Since it's not entirely clear: this works by loading a Linux kernel into unused memory, saving the current state of DOS, turning over control of the computer to Linux, then having the init process start a new that uses the vm86 system call to resume execution of DOS.

Firefox on my mac is over 200MB. Is it smaller on Damn Small Linux?

And yes, there is clearly only an incentive to care on Android. The automated tooling to track Chrome binary size only works on the Android build.

I measured Trichrome, which is the separate APK where the actual rendering engine is stored.