Denvercoder9

7 ms·

1.
by Denvercoder9 3mo ago
DESIGN.md: > Each rule below is enforced mechanically by the skill, not left to vibes. > R1. Repo docs are the memory; not in HANDOFF.md = didn't happen SKILL.md: > Not in docs/HANDOFF.md = didn't happen. Refuse to j
2.
by Denvercoder9 3mo ago
I'm not up-to-speed with the current state of sandboxing in browsers, but in principle it's (on modern operating systems) not especially hard for them to sandbox the decoding into a separate process with basically no privileges be
3.
by Denvercoder9 5mo ago
> can't all the banks just agree to enforce 3DS They could, but it's one of those things that really only work if everybody joins. Because 3DS is rarely used right now, a portion of merchants don't even support it, so if
4.
by Denvercoder9 5mo ago
Account Updater functionality isn't necessarily even involved there. In the end whether to accept a transaction is up to the issuer, and quite often they'll keep accepting recurring transactions on otherwise outdated card informat
5.
by Denvercoder9 5mo ago
Indeed, I suspect that's what went on here. I don't think there even exist 99 providers of what's customary called a digital wallet (e.g. Apple/Google Pay), and there's no definitely no single person that uses 99 of
6.
by Denvercoder9 5mo ago
> merchants can’t select what level of security they want from the credit card processor That really depends on the processor; many processors do allow merchants specify your acceptance rules in quite deep detail. There's a bit of a
7.
by Denvercoder9 5mo ago
> but things like this are a matter of negotiation between the card issuers and the merchants. Not necessarily, the EU has mandated strong customer authentication by law (PSD2), and as a result has practically universal 3DSecure support.
8.
by Denvercoder9 5mo ago
I'm not advocating for delaying the disclosure at all; my point is, if you see your initial disclosure to the kernel didn't go anywhere, to be responsible is to put in a little extra effort to ensure the fix is picked up before yo
9.
by Denvercoder9 5mo ago
The situation with e.g. BlueHammer is fundamentally different: there, the only party that could act on it (Microsoft) ignored them. In this case, the parties that could act on it weren't notified at all. I'm also not proposing d
10.
by Denvercoder9 5mo ago
> I don't know what exactly can load this module Well, for one thing, opening an AF_ALG socket, as the exploit does.
11.
by Denvercoder9 5mo ago
In my world, responsibility is not just checking a box of following industry practice. Responsibility, as Wikipedia puts it on their social responsibility page, is working together with others for the benefit of the community. And yes, some
12.
by Denvercoder9 5mo ago
None of the distros were.
13.
by Denvercoder9 5mo ago
Not having the module loaded doesn't mean you're not vulnerable, the kernel loads the module on-demand when it's needed. I tried the exploit on such a system, and it worked. However, not having the module loaded does mean tha
14.
by Denvercoder9 5mo ago
Two things can be true simultaneously: the Linux kernel ecosystem should have done better at communicating this to their downstreams, and publicly sharing the exploit was irresponsible. It is not the responsibility of the initial reporter t
15.
by Denvercoder9 5mo ago
There's no contradiction, the point is that Bob is able to produce valid output using LLMs, but only while he himself is being supervised; and that he doesn't develop the skills to supervise independently himself in the future.
16.
by Denvercoder9 9mo ago
> That's why it went beyond web, and why all modern native UI frameworks have a similar model these days. It's more the other way around, this model started on desktop (eg WPF) and then React popularized it on the web.
17.
by Denvercoder9 9mo ago
> It would be infinitely simpler if one could simply 'cross-compile' down to older symbol versions, but the tooling does not make this easy at all. It's definitely not easy, but it's possible: using the `.symver` asse
18.
by Denvercoder9 9mo ago
> why would it be that way? It allows (among other things) the glibc developers to change struct layouts while remaining backwards compatible. E.g. if function f1 takes a struct as argument, and its layout changes between v2 and v3, then
19.
by Denvercoder9 9mo ago
The same's true for the radio on a Raspberry Pi, though.
20.
by Denvercoder9 9mo ago
So yes, in theory you can always deploys sets of compatible services, but it's not really workable in practice: you either need to deploy the world on every change, or you need to have complicated logic to determine which services are
21.
by Denvercoder9 9mo ago
Some smartphones are locked down by their vendors. There's plenty of options to get full root access on something that's for all intents and purposes a smartphone, especially if you don't particularly care about warranty and&
22.
by Denvercoder9 9mo ago
Maybe the database upgrade from v(N-17) to v(N-16) simply takes a while, and hasn't completed yet? Or the responsible team is looking at it, but it doesn't warrant the whole company to stop shipping? Being 17 versions behind is an
23.
by Denvercoder9 9mo ago
https://github.com/jj-vcs/jj
24.
by Denvercoder9 9mo ago
Blue/green might allow you to do (approximately) atomic deploys for one service, but it doesn't allow you to do an atomic deploy of the clients of that service as well.
25.
by Denvercoder9 9mo ago
> Good luck getting 100+ devs to all use the same logical commit style The Linux kernel manages to do it for 1000+ devs.
26.
by Denvercoder9 9mo ago
If my change is small enough that it can be treated as one logical unit, that will be reviewed, merged and (hopefully not) reverted as one unit, all these followup commits will be amends into the original commit. There's nothing wrong
27.
by Denvercoder9 9mo ago
Squashing only results in a cleaner commit history if you're making a mess of the history on your branches. If you're structuring the commit history on your branches logically, squashing just throws information away.
28.
by Denvercoder9 9mo ago
The article is from 2019, things might also simply have changed since then.
29.
by Denvercoder9 9mo ago
That's true for local hooks, but neither a dishonest person nor an LLM can bypass a pre-receive hook on the server (as long as they don't have admin access).
30.
by Denvercoder9 9mo ago
GPS gets its time from NIST (though during this incident they failed over to another NIST site, so it wasn't impacted).

More ›