0x0

Homebrew is currently shipping 5.6.1 (and was shipping 5.6.0 as well). Hopefully not affected on mac?

> What? How does load on the system affect correctness?

Seen this happen quite often with code that is not multi-thread safe, especially in languages like c# and java, such as using a static class property for data that should be request-scoped, or not using the appropriate concurrent collection classes etc.

There's been plenty of flaws in the app sandbox, but without the ability to execute arbitrary code they are often much much more difficult to exploit since you won't be able to invoke the particular system call or function you want to hit with just the right arguments.

Browsers that bring their own javascript engine will likely also need to support JIT in order to be able to compete with Safari on performace. Doing JIT on iOS requires a special entitlement grant from Apple in order to map memory pages as executable. An application that has permission to map memory pages as executable is a coveted target for spyware and malware as it provides a much better starting point for pivoting to root and pwning the entire OS. Most other regular apps, even if they have a buffer overflow somewhere, will require a lot more fiddling in order to execute arbitrary code, and are thus a lower risk for users to install.

In short, browsers will have higher privileges that normal apps, as they can execute arbitrary code in memory, so they are naturally held to a higher standard.

To be honest I am happy about this. I don't trust a random banking / government / public transport app contracted out to the lowest bidder to be safe from all buffer overflows or other memory safety issues, so making sure they are sandboxed away from executing arbitrary code is a good thing.

Answer: Don't use storyboards.

I think you meant "in theory" instead of "in practice" :)

Sure it does. I'm still dealing with the fallout of old projects built with old webpack which uses md4 (as a file name cache buster only!) which is gone in recent nodejs+openssl binaries.

Yes but you could refuse to deliver whatever the sender is paying for. I mean you need to wait for 6 confirmations or whatever anyway before "approving" the payment transaction.

One bitcoin is very much distinguishable from another bitcoin as they can be traced through transactions and wallets, with the outcome that some bitcoins might be rejected by recipients that are uncomfortable with certain source wallets or mixers.

Pretty sure that's a different thing just to prevent tcp/ip connections to other devices on your local subnet after you have already joined a wifi.

Sucks that it requires iCloud Keychain enabled, and also removing your appleid from any legacy macs and iphones. Wish they explained the reasons for this, because I'm having a hard time seeing one.

The comment about code signing perhaps being a blocked for third party sdk/library deduplication doesn't seem to also consider the fairplay DRM on iOS apps. As far as I know, the code (.text) segment of all iOS app store binaries are encrypted. I don't know the details about the encryption scheme (I would assume it is perhaps uniquely encrypted keyed on the user's appleid?) but it sounds like this would be a larger problem than just code signing signatures varying between publishers (and I would assume all appstore apps are re-signed by a single apple appstore authority, although enterprise/adhoc apps probably aren't).

I wouldn't be surprised if they in fact do have a list of serial numbers for all the mac, ios, tvos devices they have ever sold, linked with some corresponding device-unique public key data?

The moment you have a contact from any other country than your own, you'll quickly learn that green = huge carrier fees and blue = free texting that even works on wifi with data roaming off. Quadruply so for group chats.

Strange error, why does it say "illegal instruction at ffffffff" but then the dump shows CS:EIP as 71a3:000056e5? Shouldn't the EIP part be :ffffffff or what am I missing?

They should have put labels in front of and after the string bytes, then most assemblers would evaluate "(labelafter - labelbefore)" to a constant integer giving the length as needed. No need for a runtime sub instruction either, then.

It's because newer versions of rsync switched license to GPL3 (from GPL2), and apparently Apple is not touching that with a ten foot pole. It's also why the included bash is frozen in time (and probably why they switched to zsh as the default interactive shell)

At least running an .exe should be somewhat obvious to computer literate people. When I saw those signed applet dialog prompts, even as a developer it was not obvious to me that it also meant granting unsandboxed x86 code execution to a .dll/.so from the internet.

Wild. So any other website could then do the same thing as you, accessing the hardware key and all...? Did anyone stop to think maybe this wouldn't be the best way to expose a hardware key? I mean, if you care about security at all, which you probably do if you're even bothering with a hardware key...??!?! %-)

According to wikipedia, bitly started in 2008 and was in fact twitter's default url shortener in 2009, at which point Gaddafi was very much still in charge.

I mean I'm sure there were a million exploits that would bypass even the check and prompt, but that doesn't change the fact that it's pretty crazy that native code execution was part of the design with just one small incomprehensible trust dialog.

Was it even an exploit? I seem to recall reading something about code-signed applets being allowed to load native dlls by design. Which is crazy, one single "trust signature" dialog prompt from infecting a system with malware...

macOS 10.15.6 had a showstopper kernel zpool memory leak if you used virtualization software to run windows VMs, requiring multiple reboots per day in order to stay in place. It was an absolute dealbreaker for productivity as a developer who needed windows vms.

Care to elaborate?

I think the most interesting thing about this post is the pointer to https://rome.baulab.info/ which talks about surgically editing an LLM. Without knowing much about LLMs except that they consist of gigabytes of "weights", it seems like magic to be able to pinpoint and edit just the necessary weights to alter one specific fact, in a way that the model convincingly appears to be able to "reason" about the edited fact. Talk about needles in a haystack!

I ended up having to pay(!) to re-enable middle clicking after magicprefs stopped working at some point in the macos upgrade race. I bought this. https://middleclick.app/

You can have includeIf sections in your .gitconfig that applies only to things within a certain directory. So you if you create top level directories in your $HOME for your various identities, all you need to do is to make sure you are cloning into and working within the appropriate directory hierarchy.

But it's not a random pseudo-reseller? The one github comment from "the founder of Quantum CA" seems to say they are also the creator of HiCA, which is the entity that was exploiting the 0day in acme.sh. And the crt.sh link shows an intermediate CA cert named "QuantumCA", signed by ssl.com.

So QuantumCA == HiCA == exploiters of the acme.sh 0day, it's all the same entity? The intermediate CA could just as well be named "0dayexploitersCA"? Why is it not a huge concern that ssl.com is fine with operating such a "0dayexploitersCA" intermediate?

Am I missing something here?

I find it troubling that a root CA (ssl.com) is apparently OK with lending their name in a business relationship with an actor that is actively exploiting an acme.sh 0day.

So the person claiming to be the founder of "QuantumCA" does not possess the private key corresponding to https://crt.sh/?caid=200960 - can we be sure the private key is only accessible by ssl.com's CA system? So the certificates listed here aren't issued by this person, but by the ssl.com's system? https://crt.sh/?Identity=%25&iCAID=200960&exclude=expired&de...

Also, why would ssl.com even create a subCA named "QuantumCA"? Are they in business with this person claiming to be the founder of "QuantumCA" who appears to be responsible for exploiting this acme.sh 0day? What does this say about ssl.com's trustworthiness? Or is the person in the github comments lying?