roblabla

18 ms·

31.
by roblabla 6mo ago
It does two things: 1. Do a request to `chrome-extension://<extension_id>/<file>`. It's unclear to me why this is allowed. 2. Scan the DOM, look for nodes containing "chrome-extension://"
32.
by roblabla 7mo ago
> NSA most certainly has a backdoor there and such complete access to any Android phone. Citation needed? > This was common knowledge after the Snowden stuff. Not to me, it isn't? As far as I'm aware, most of the Snowden stu
33.
by roblabla 7mo ago
Did you read my reply without reading the parent I was replying to? I’m talking about not allowing a blocked domain from being able to add new TXT entries as the parent was suggesting. Of course TXT shouldn’t be banned entirely…
34.
by roblabla 7mo ago
There is _some amount_ of justification to ban TXT. There have been a few cases of C2 servers using DNS to send instructions to malware, so letting TXT slip through the cracks would still allow for that. Now whether this downside justifies
35.
by roblabla 7mo ago
> The best solution is skin-in-the-game, for-profit enterprise coupled with rigorous antitrust enforcement. Don't we have enough examples showing that this simply cannot work long-term, because the for-profit enterprises will _inevi
36.
by roblabla 8mo ago
To be fair, that seems to be where some of the IA lawsuits are going. The argument goes that the models themselves aren't derivative works, but the output they produce can absolutely be - in much the same way that reproducing a book fr
37.
by roblabla 8mo ago
> Traits? Nope. We need some way for code reuse. Says who? You can totally do code reuse using manually-written dynamic dispatch in "rust without traits". That's how C does it, and it works just fine (in fact, it's of
38.
by roblabla 8mo ago
At what point did they make it _worse_? Tailwind didn't remove any existing functionality here. What they did was refuse to merge a PR while they're trying to figure out how to navigate a difficult financial problem, all while bei
39.
by roblabla 9mo ago
C and C++ as defined by their current standards are memory unsafe. You may argue that some specific implementations manage to stay as memory safe as they can get away with, but even then, features like union prevents a fully memory-safe imp
40.
by roblabla 9mo ago
While that's true, linux _tends_ to follow the rules a bit better, and not change how APIs work from under your feets. For instance on Linux, permission checks are done when you open a handle. An LSM like SELinux can only allow or deny
41.
by roblabla 9mo ago
There are many a ways to disable CTRL+ALT+DEL on windows too, from registry tricks to group policy options. Overall, SAK seems to be a relic of the past that should be kept far away from any security consideration.
42.
by roblabla 9mo ago
Procmon won't show you every type of resource access. Even when it does, it won't tell you which entity in the resource chain caused the issue. And then you get security product who have the fun idea of removing privileges when a
43.
by roblabla 9mo ago
Linux (well, more accurately, X11), has had a SAK for ages now, in the form of the CTRL+ALT+BACKSPACE that immediately kills X11, booting you back to the login screen. I personally doubt SAK/SAS is a good security measure anyways. If y
44.
by roblabla 9mo ago
In this context, it's talking about Internet Research Agency: https://en.wikipedia.org/wiki/Internet_Research_Agency
45.
by roblabla 9mo ago
Wouldn't it make sense for a remote control to need to access local network & devices? Like, without this permission, the only way the controller would work is through a cloud service, so I would personally be pretty happy to disco
46.
by roblabla 10mo ago
If you're that paranoid, you _can_ just chose not to fly. The bigger problem is if the UK has an extradition treaty with the country you live in.
47.
by roblabla 10mo ago
> I don't think a GPL violation case has yet been litigated. It has, though it has mainly been under the "breach of contract" approach and not under "copyright infringement" approach. See https://en.w
48.
by roblabla 10mo ago
You are fundamentally conflating releasing a binary under an open source license with the software being open source. Nobody is saying that they're violating the license of Apache2 by not releasing the training data. What people are ob
49.
by roblabla 10mo ago
> For instance, it no longer includes mandatory client-side scanning. It's still unclear whether it really is removed. They turned scanning into something voluntary, and then said big chat providers must do _something_ to monitor ab
50.
by roblabla 10mo ago
Google Certified Devices is any device that has GMS (Google Mobile Services) installed - ergo almost all of them. It's worth noting that a _lot_ of apps stop functioning when GMS is missing because Google has been purposefully been put
51.
by roblabla 11mo ago
You can also use phishing-resistant login/2FA like passkeys/FIDO keys, where it is available (and I'm pretty sure amazon supports it), to minimize the risk of accidentally login into a phishing website while under pressure.
52.
by roblabla 11mo ago
Then amazon should make it clear you aren’t buying a book. Putting buy there is deceptive. And also, amazon is on the hook for providing an actual, working app here.
53.
by roblabla 11mo ago
SD/MMC does restrict things a bit, however: 1. SD is not storage-only, see SDIO cards. While I don’t think windows auto-installs drivers for SDIO device on connection, it still feels risky. 2. It’s worth noting stuxxnet would have work
54.
by roblabla 11mo ago
A USB can pretend to be just about any type of device to get the appropriate driver installed and loaded. They can then send malformed packets to that driver to trigger some vulnerability and take over the system. There are a _lot_ of drive
55.
by roblabla 11mo ago
They literally explain in the article they're using FIDO MFA that is phishing proof as the key authenticates the website (it's not your run-of-the-mill sms 2FA, it's using WebAuthn to talk to your MFA). With this setup, you c
56.
by roblabla 1y ago
As far as gameplay goes, palworld is nothing like Pokemon. Sure, you capture monsters in an open field, but its combat is not turn based and it has a large base building emphasis, for instance. Now, the monster design in pal world is (I thi
57.
by roblabla 1y ago
What's frankly ridiculous is that the big softwares like Nginx and Apache don't deal with this on their own. I've been letting Caddy (my http host of choice) deal with TLS for me for _ages_ now. I don't have to think abo
58.
by roblabla 1y ago
I doubt Mullvad has anywhere near the volume of transaction Valve does. And mullvad has plenty of other payment methods, so only a tiny, tiny fraction of their userbase likely pays in mail-in cash. I don't think Valve could feasibly im
59.
by roblabla 1y ago
Is there proof the government actually uses this apparatus? I don't think there's any government involvement necessary here - Mastercard has some censorship apparatus (which they claim to be necessary for their brand's reputa
60.
by roblabla 1y ago
A default linux install is incredibly silent on the network. You might be seeing some mDNS stuff, gnome/firefox may do some requests to detect captive portals, but overall the amount of network traffic is pretty small and manageable. I

More ›