tetrep

Here's my favorite: https://support.microsoft.com/en-us/help/2553549/all-the-tcp...

article about it: https://blog.ctm-it.com/it-support/blogs/matt-cannon/2013/49...

edit: If you want to be especially cynical, you can note that this wasn't discovered for a while because everyone running Windows reboots it regularly because of its notorious instability issues (the bug was found in 2013 and dates back to at least Vista, which was last updated in 2009).

> images are meh, just press shots. Was hoping for more on how it was built

If you scroll to the bottom of the page there's a few links to "raw video clips" and "how we did it". I'm downloading them now but the names of the files sound like they're exactly what you want.

If you find the default font size too small, I know at least Chrome and Firefox support a minimum font size in their settings.

I personally set my minimum font size to 9. While I can't easily read font that small, I can at least notice it is there and zoom or otherwise compensate if I care what it says while still mostly preserving the aesthetic of the web page (assuming the font is purposefully small for a reason).

And Apple forces you into this exchange. You can't ask them to simply host a product page like Amazon and leave everything else to you, the app developer.

There's many good UX reasons why Apple does this, but you can't seriously think that they're charging app developers anything reasonably close to the cost Apple incurs because they have literally no incentive to do that; they have a monopoly on iPhone users (much as Google does de facto for Android users).

> An older parent might not "fit in" with a team of 22 year-old fresh grads, but still provide valuable experience and perspective in a way that an additional 22 year-old might not. You can probably extrapolate how this might also affect women and minorities.

And someone who doesn't do any work might not "fit in" with a team of people who are doing work, but I'm not going to hire them for the sake of !current_culture.

There's a reason it's a "culture fit" or "match" and not "culturally identical" or "culturally homogeneous." The phrase as it is is sufficient and can describe a healthy way of hiring people who are compatible with your current team. If we assume our current team has a healthy culture, finding people who are compatible with it, that can effectively perform their professional duties without disrupting the ability of other employees to do the same (and, ideally, improving the ability of others to do the same), is exactly what we're looking for when hiring someone (other than technical aptitude).

Sure, it can also be used to illegally or unethically discriminate, but so could any concept you could conceive of to describe "they won't perform well with our current team." Before "not a culture fit" was a popular it was "not a team player."

Hell, it's not different than being in the same room as other players. I've yet to hear of any games that ban teams sharing the same IP address.

Presumably because the "fake it" time is invested in a fake solution that is scalable, so they can fake many projects at once.

And then your boss will ask you why your phone is on silent/in airplane mode. Don't think the app can't or won't track such juicey details ;)

But how can we prevent situations like what happens to coyotes who learn not to be scared? http://www.epsilontheory.com/too-clever-by-half/

> US Freedom is misinterpreted to mean individual freedom at all costs. US Freedom is not just individual freedom, it's local rule and local soverignity.

Not even that local. With the few exceptions from the Constitution, U.S. states wield supreme power and can override any actual local attempt at governing.

Freedom is freedom for the States, not the people.

TL;DR: This doesn't really do what it claims to do (prevent injection), but it does slightly mitigate some attack vectors. It's security through obscurity, which is useful as defense in depth (see: ASLR), but hardly stops all attacks (or even a motivated attacker). If someone ran around declaring the end of buffer overflow exploits because of ASLR, I'd have a hearty chuckle.

    root:/pwd# cat scrambled.php
    <?php
    arFktyO “Hello, “;
    arFktyO “Small World.\n”;
    ?>

In the above example, arFktyO = echo. This doesn't fix (imo) the most common instance of [something]-injection, which usually stems from string concatenation, i.e.

    sqlQuery = "SELECT * FROM table WHERE owner=" + userInput
    execute(sqlQuery)

or

    command = "ls " + userInput
    eval(command)

Critically, that option only appears after Maps hijacks your view to wherever it pleases. The same applies to other filters too, such as "open now."

I'm stil amazed how hard Maps makes it to view a street name. I can fill my screen with a street and nothing else, and I still won't see its name. I feel like they actually do it on purpose to breed dependence on Maps for navigation references.

an update to the title would be nice. these security holes are for "git-annex" and the new library is "http-client-restricted". i don't think the library's name needs to be in the title, but at least "git-annex" should be.

There's not a lot of comments here, so I'll give a tl;dr:

They found a "use after free" bug in JavaScriptCore due to some asnyc GC and used it to get RCE in Safari at Pwn2Own. By making a large array of arrays, and then reversing them, they interfered with the "mark" part of "mark and sweep", resulting in some of the arrays not being marked and therefore being swept (freed) and used for other things. Pretty picture showing what's going on: http://blog.ret2.io/2018/06/19/pwn2own-2018-root-cause-analy...

some more details:

- this was found with a fuzzing tool

- they make a large array of arrays (~20k)

- they map over the array of arrays and reverse the arrays inside it

- they print out the contents of all the arrays and find that some of the objects they are printing are not arrays, but are an entirely different javascript object: promises (this is a symptom of the bug)

- they use a very nice debugging tool[0] that let's them step backwards in time, this proves invaluable as they can start with the symptoms of the bug and then go backwards to see what has caused them

- they discover that the memory of the arrays is being marked as "not used", getting freed by GC, and then used by (unrelated) promises. this is a "use after free" bug and they're very serious (this one is used to get RCE at pwn2own) - this happens because the GC is marking this as used in an async manner, so when they make their large array of arrays, not all of the memory allocated for it is actually marked as "in use". as the GC is iterating over everything and marking it as "in use", JavaScript continues executing, and in this case, starts reversing the arrays.

[0]: https://rr-project.org

> That’s one of the reasons you’re required to open them when you take off and land.

I fly pretty regularly in the US and am unaware of this rule, where have you encountered it? I've only ever heard crew request windows be closed to mitigate the greenhouse effect and keep the plane a bit cooler.

I think it's decently plausible if your Alexa hears you, but you don't hear your Alexa. So you continue on your conversation, and you say enough to keep progressing the flow.

I would assume any failed speech recognition attpempts are recorded so Amazon can have a human look at and classify them, but at the very least they probably keep logs, so they should have this information when debugging. Maybe we'll get a more detailed postmortem later.

> I love the ability to batch up the notifications. In my ideal world, I would get notifications at 8AM, 12pm, 5pm and 9pm. And that's all.

Couldn't you do this manually by silencing your phone except for alarms, and then setting vibrate-only alarms at those times?

Alarm goes off, you check your phone and deal with any notifications you have so far, and then you go back to ignoring it.

If you could reject junk mail, junk mail senders wouldn't pay to, well, send it. And the USPS would lose a lot of money.

Imagine how terrible GMail's spam filters would be if spammers paid Google for delivery... Oh wait, Google literally has a dedicated tab for that! For those that find it useful (and I don't doubt it is), imagine what the alternative would be for the spammers, you'd be 100% ignoring it by unsubscribing or filtering it as spam. Now that it's corralled off, you can look at it at your leisure, and Google can keep advertisers happy by offering them a non-zero chance you'll look at their spam.

There's a wealth of public transit options that will reliably get you from Manhattan to JFK in about an hour.

I haven't waited in a security line at an airport for more than 30 minutes in years. When lines get long they drop the security theater and start letting people through very quickly. I imagine people who are willing to pay for SST would also pay the troll toll and spend comparatively very little time in security lines.

For context, I fly (usually coast to coast) about a dozen or more times a year.

But you're not stopping pixel. You're going to be tracked again. All you're doing is resetting the clock. How long after pixel was implemented did it take for the value of Facebook ads to skyrocket? A few years? And Facebook gets to keep all that they learned during that time, just not the original data they've derived all that wealth from. It's like losing training data for ML. It's not a big deal when you get 10s if not 100s of millions or more data points every day.

> If a significant percentage of users actually exercise this option, that will be the end of Facebook as a significant channel for ad spend. It will decimate revenue.

I don't think it would have a significant negative impact on Facebook at all. I see the value of ad networks as primarily resulting from two features: Having a large audience (network), and knowing the audience well (targeted ads).

Facebook will still have a large audience if people keep using it, even if they all delete their information, so a large audience is a given.

Knowing an audience has two large pieces, identity (i.e. you're user X) and derived identity data, i.e. people interested in HN are interested in tech. The biggest use of all this data is associating users together. If all my data across all the internet was deleted immediately, I bet Google et. al would be able to uniquely identify me within a few days, they wouldn't know I'm the same person whose data was just deleted, but they'd know a wealth of targeting information about me again, and within a few years I'd bet they'd know me just as well as they do now.

My web usage is pretty routine, and humans in general are pretty routine, so I would expect it to generally hold that, without explicit effort to the contrary, we'd all be pretty easily re-identified (at least as much as advertisers are concerned) after deleting our information, and sure, I won't be searching for that exact search query because now my git-fu has improved, but I'm still going to be doing things that identify me as someone interested in and/or using git.

Facebook is going to keep all the derived data from people, and that data is going to allow them to very easily re-target anyone once they have a good feel for what their interests are. And I can't imagine a more transparent display of interests than activity on a social network, it's almost explicitly interest-bound.

That's pretty much WhatsApp. They use their own weird "Fun" version of XMPP with Signal's Noise protocol.

But they don't federate. Which I think is a pretty clear example of why not having one true solution isn't a technical problem, it's a political problem. Companies don't want to make it easy to compete with their products.

I played Riven about a year ago (never played Myst), and it held up pretty well. I think the biggest shortcoming is the standard 90s adventure game trope of arbitrarily obtuse solutions to some puzzles. I ended up needing about 2 or 3 vague hints to point me to certain areas to advance the plot (luckily, though, IIRC no puzzle solutions), usually revolving around not understanding navigation options (like not knowing you could move through a certain part of a screen). I'm not sure how much of that was developer's being tricky or the low resolution of the game making it difficult to discern details, or the general shortcomings of the cursor-based UI.

If I wasn't able to find a walkthrough or guide, I don't think I would have been able to complete the game. But, that was also the era of official strategy guides, so maybe acquiring those would provide adequate context (I know the one for Morrowind makes the game for me. It's written in such a way that you feel like you've got a companion guiding you along with its commentary, providing just enough information to "unblock" you when you're stuck).

I've been drawing a horizontal line, sometimes with a slight arch, for years now. I almost never get a reaction and when I do, it is at most a laugh or giggle. Nobody cares (not that they should). Anything I scrawl is (more or less), by fiat, my signature.

I'm glad we can finally stop wasting time (and resources, for physical signatures).

This is especially fun with e-signatures in California: “Electronic signature” means an electronic sound, symbol, or process attached to or logically associated with an electronic record and executed or adopted by a person with the intent to sign the electronic record.

https://leginfo.legislature.ca.gov/faces/codes_displaySectio...

Well, if you were following along, they mention that the market has not remembered those transgressions, which heavily implies the stock price before this incident will be reached again. The stock will hit a local minima, and then bounce back (the symptom of the market "forgetting").

> Someone in a previous thread mentioned that Uber had disabled LiDAR input because they were testing visual-light-only navigation.

That smells like BS. I can't imagine any serious players in the self-driving field that can't replay all their sensor inputs into models offline to see how things behave. If they wanted to test without LiDAR, they would run this simulations without LiDAR input. No reason to disable it when there's actual consequences.

That being said, I suppose it's possible that Uber have done what I already said, so much so that they were confident it would work and were willing to deploy it. But it still smells funny to me because I would sincerely hope the LiDAR (and other non-visible light sensor input) would be used as a failsafe.

My very limited understanding of autonomous car implementations is that you mix in all your input together to determine your surrounding environment (and all your "what do I do" logic deals with information derived from this input aggregation), so in order to safely test a new model with less input in your car, you'd need at least 2 models (one with all input, one with reduced) running at the same time.

It still seems like it'd be viable to me, and something you'd certainly want to do to avoid situations exactly like this. If you've got 2 models running, it seems like it'd be pretty straightforward to have the "all input" model assume control if it's trying to avoid an immediate collision, basically having it perform a similar role to that of a human behind the wheel during "disengagements".

Could it be a bandwidth issue? I remember reading about 120fps 4k video on an Android phone being limited to only a few (real-time) seconds because there wasn't enough I/O bandwidth to stream the video to storage so it had to stream into a specialized hardware buffer that was relatively small and expensive.

I would treat anecdotes like this being equivalent to anecdotes about not wearing a seatbelt.

> Whether you call the value 1 "bit 7", "bit 8", "bit 1" or "bit 0" is just, pardon the pun, word semantics.

It's extremely important to your mental model to understand how the bits are arranged, or left shift (<<) is going to produce different results in your head. If you think the value 1 is bit 7/8, you get:

1 0 0 0 0 0 0 0

Which would left shift to:

0 0 0 0 0 0 0 0

Which would not be equal to 2.