vesinisa

What makes you think that system was implemented securely?

Interesting. The bulletin lists "OpenWrt 19.07, 21.02 (for MT6890)" as vulnerable, but OpenWRT had indeed no security advisory out for this:

https://openwrt.org/advisory/start

Maybe MediaTek has shipped some modified versions of OpenWRT using this "wappd" thing to their B2B customers (as part of the SDK perhaps?) and are now advertising those as vulnerable.

> I'm baffled that anyone even thought about using that, given there's such good mt76 support from mainline kernels with hostapd.

Not sure if you noticed but the OpenWRT 21.02.x series (based on mainline kernel 5.4 series) is affected, and these guys generally know their game when it comes to wireless on Linux. So much so that I think the mainline kernel mt76 driver is actually maintained by an OpenWRT developer.

I live next to a highway on-ramp. The motorcycles are the worst, some of them are so loud while accelerating that it is impossible to have a conversation on my yard, over a hundred meters away.

The city is now investing tens of millions of euros to retrofit a noise barrier to protect our neighborhood. I think our house surfers the most from the noise. Yet - if it only wasn't for those loud motorcycles I would think the noise barrier is unnecessary. It would be much more cost effective to set and enforce noise pollution rules than to build expensive noise protection infrastructure everywhere where people live close to roads.

But that's not what this case was about. Throughout the trial they have been allowed to provide continued digital access to the scanned books, granted they operate like a library (each borrowed book is backed by a physical copy.) The case was launched when during the Covid-19 pandemic they removed the limitations under the veil of "National Emergency Library":

https://blog.archive.org/2020/03/30/internet-archive-respond...

This seemed already at the time completely counter-productive and unnecessary step as it basically forced the publishers to react because it made IA's digital lending indistinguishable from casual e-book piracy.

They have now created a legal precedent that, in addition to finding the "National Emergency Library" illegal, makes the controlled lending they implemented previously illegal. Ever since the district court ruling they have been able to continue digital lending only by negotiating compensation terms with the publishers.

So, instead of expanding everyone's access to the digital archives, they have managed to indefinitely limit it by creating a restricting legal precedent. This was the inevitable outcome of "National Emergency Library" and they knew or should have known it.

Yes, but this case was not about digital presevation but lending out scanned traditional books without proper controls, presented as some sort of a social welfare project. Choose your battles.

Ditto. Worth also noting is that IA lost the case by summary judgement. This usually means that the legal matter was so clear that the judge didn't even see a reason to start a trial. This judgement has now been confirmed on appeal. Just about any lawyer could have probably told them this was the inevitable outcome had they listened.

I personally have donated previously to IA but now it frankly disgusts me that the project's current management has for the last few years had its focus on fighting windmills in court instead of their core mission - preserving our digital history. Hard to think I would ever donate to them again unless there's a change in leadership after this fiasco.

As far as I know, the companies / service providers would love to be able tell their customers that 100% of their data is only stored and processed in the EU. It makes everything GDPR-related simpler for companies, and could be turned into a good advertisement for consumers.

Close. About four of them, or a single 40-track one (the standard one has 10 tracks/lanes.)

27 meter diameter in fact. A 27-meter sphere is about 150 times as voluminous as a 5-meter sphere.

It's still a mind bogglingly small amount considering that humans have spared no toil, sweat and blood on industrial scale gold mining ever since the dawn of written history - and since gold is so valuable and hard to destroy, most of it should still exist to this day in form or another.

Yet, if you smelted it all to a single object it would fit on a typical single family housing plot.

I was recently traveling in London and wanted to buy a Google Pixel phone (it is unavailable in my home country.) I thought it would simple enough as walking into the Google Store and picking the colour I like along with any accessories.

Well, turns out that since COVID there is no such thing as "Google Store" in London. In fact, Google does not have any physical consumer presence whatsoever in the whole of UK. Even the "YouTube creator space" at King's Cross has been shuttered. Their only presence in the city are the offices for their employees.

Google's commitment to removing any ways from consumers to actually interact with the company is truly extreme. And probably results in people turning to desperate measures when they run into troubles with Google products.

You're excused. After all, the original comment failed to use the correct SI unit (BPa).

How do you use uBlock to inject CSS?

> for a duration of about 1 hour

Not even remotely correct.

Most computers that were affected by the fault needed physical remediation via safe mode boot to fix the issue because they were not able to download a fix because of being stuck in a reboot loop. The understanding is that for most cases, the fix needed to be applied by an IT technician dispatched to physically access the computer.

A week or 168 hours later, there are still many, many computers out there that remain bricked by this fault because it is so heinously difficult to fix.

The implementation is literally just one style on the page:

* { font-family: monospace !important }

You can use e.g. Tampermonkey to inject this style on https://www.google.com/search*:

https://www.tampermonkey.net/documentation.php?locale=en#met...

This is really cool!

One thing I noticed: in the game there are tasks like print the second line and print the seventh line. But both of those lines are empty. So technically e.g. a non-matching grep is a correct solution. :)

CrowdStrike installs as an operating system driver. It becomes essentially a part of the operating system and can do literally anything it wants, and Microsoft can not do much anything about it.

Going forward, I could foresee Microsoft requiring endpoint protection solution providers certify their QA processes to get signing. But staged rollouts and canary builds have already been an industry standard process long before CrowdStrike. There was no way Microsoft could have known that they were dealing with a company so incompetent as CrowdStrike to cause this to happen.

Maybe they have rolled back the update and Windows boxes in Europe are no longer pulling it?

Why on earth don't they have staged rollouts for updates?

Even if it means the attack takes 10x as long, it doesn't seem to be limited by bandwidth, only time. Might not take long before the bots appear that try to automatically exploit this on scale.

Discussion yesterday (97 comments): https://news.ycombinator.com/item?id=40793174

> We have systems being maintained where the team responsible goes "look we have a million lines of SQL stored procs. We don't know what all of them do because most of them were written in the mists of time and there's no documentation, or the documentation is so obviously wrong we can ignore it entirely".

Interesting - when thinking of systems that I've personally worked on which I could never imagine being replaced, the first one that came to mind was one with exactly the same problem: a massive cache of SQL stored procedures at the core that nobody seemed to fully understand. This particular company had even implemented stuff like HTTP auth token validation and all access control with SQL scripts without any centralized access control architecture. It was outright terrifying to touch the SQL.

When I started at the company the manager advertised they "really have no upper limit" on how much they compensate developers who stick with them for years.

I guess a big problem with implementing large parts of the application logic with SQL is that it's simply not a tool fit for the purpose. Incrementally replacing, or even reasoning about, logic splintered accross assorted SQL scripts is very difficult. So nobody has the full picture of what are all the things the monolith does.

Even systems with 15 years of legacy and eons of manhours behind them get replaced. These projects do not always succeed but I've seen it happen.

A rewrite from scratch doesn't need full parity with the old system as long as you can discover, implement and test all the critical business use cases beforehand.

That last part is also the most common reason why large system replacement projects fail, go over buddget, or are not even attempted.

Often the people controlling the money do not have the technical knowledge how much complexity the old system hides. The safe bet is to keep it going.

It would probably relate to this event: https://en.wikipedia.org/wiki/2014_Vrb%C4%9Btice_ammunition_...

At least Wikipedia already treats the involvement of Russian intelligence as a fact.

It might be based on the handwriting standards used in your country. Where I live we were taught at school to draw a horizontal bar on 7 and avoid the serif on 1:

https://is.mediadelivery.fi/img/468/a93c32e08dae4768869a4bda...

No chance of confusion. This seems to have prompted some to add the serif to their 1 for stylistic reasons or whatever, since it's still distinguishable from 7 with a bar.

But then again people following older or newer conventions drop the bar from their 7:

https://is.mediadelivery.fi/img/468/46827e3320294f89b12a9338...

This makes a singular 1 with sloppily drawn serif hard to distinguish from a 7 without horizontal bar unless you can also see how the same person draws the other digit in their style.

The author makes a point of avoiding letters that are hard to distinguish even when spelled out in handwriting, but the example table includes the number 7. I can not count the number of times I have found it hard to distinguish between someone's 7 and 1.

It helps if you draw a horizontal bar on the 7 but many don't, so you can never really be sure if a 7 is in fact a 1 with the serif or vice versa.

> If any middlebox in between does not support it, the returned SYN+ACK packet will not contain MPTCP options in the TCP option field.

That sounds .. quite restrictive. Is the only requirement on a middlebox to just forward the MPTCP options as-is?

It is amazing. Evil genius vibes.

> The reason is known as the birthday paradox.

Right. Forgot about that little thing. You're absolutely correct.

With this taken into account a _single_ person with 1000 pieces of 1000-core, 10 GHz CPUs generating UUIDs will generate a match in a few minutes.

Collecting the dictionary of all swear words for all languages and their dialects might be less trivial. Keeping it up to date would probably take an institute worth of researchers.