> For a big enough production run, you'd likely ship an HSM to the factory
I figure that the factory is exactly the adversary in the whole threat model? So why give them the keys to the castle so they can moonlight their own genuine batch?
3,606 karma · joined June 3, 2017
Socials:
- github.com/claui
Interests:
Open source, packaging, CLI, digital inclusion, device neutrality
I figure that the factory is exactly the adversary in the whole threat model? So why give them the keys to the castle so they can moonlight their own genuine batch?
https://environment.ec.europa.eu/topics/waste-and-recycling/...
Of course there was going to be a seam somewhere. Albeit not the kind of seam I expected.
Anecdote: back in 2004, a friend brought home a cheap digital audio player from her vacation to China. IIRC, it said on the front panel that it could play back MP3, MP4, and MP5.
> [list of eight things that may be extremely difficult for people with depression]
.
They keep refusing ideas like these on the grounds of them being “not stupid” and “able to see through such attempts immediately, 100% of the time” and “do you think we’re stupid?”
Except when it de-contains itself.
I can confirm. DataDome has been making my life a living hell. It thinks my phone is a bot, so I can no longer use PayPal and other quasi-monopoly services while on the go. DataDome will reliably block me on the first request.
Fuck DataDome.
See also last month's thread:
No. I don't want to go anywhere anymore. All the sidewalks are full of SUVs, blatantly blocking my way even though it's prohibited.
Police is looking the other way.
City council doesn't react to inquiries because (as stated in the protocol of one of the meetings) "complaints sent by citizens are anecdotal anyway, and they tend to be concerned with just the one street where they live."
I try to avoid leaving the house as best as I can. Going outside has become pure rage fuel for me.
It doesn't matter if page 42 of the Terms and Condition "clearly states it." This does not constitute informed consent.
I use OpenRouter because I prefer flexibility, which means I pay per-million-token prices.
Except for the unfortunate minority of normal visitors who always get misclassified as bots and get denied access regularly.
I wouldn’t be complaining if Cloudflare’s misclassifier bit any user with the same small probability. But it keeps biting the same users over and over again.
Also Cloudflare: let's send normal humans who are trying to go about their daily lives into endless Turnstile spinner loops with absolutely zero recourse, grievance, or support infrastructure.
Your comment compares Lithuanian homebrew tech to Ukrainian military-funded tech and claims that the former is grossly inferior to the latter. That comparison is what they're challenging.
> What are you saying about nukes?
According to your comment, homebrew tech was not going to prevent World War III. This can come across as unconstructive because in general, even small things can make a difference (or be a first step towards something that will.)
Their comeback "explain what your plan is against nukes" is just another way of saying "your comment just dismissed an idea but failed to present a better idea on its own," or more generally, "let's remain constructive."
What's with that "vs" trade-off?
You're saying avoiding detection requires high altitudes.
What do interceptors have to do with that?
Maybe all three are, in their respective current form, good enough. Replacing them would almost certainly be a net loss.
Then don’t install the package.
It’s on you to decide whether you trust upstream or not.
You’re free to use any scanner you want on the upstream sources if it makes you feel safer. (I’m currently working on a makepkg extension that allows just that.)
The core and extra repos are curated, and every package maintainer is doing their due diligence (and more) to protect the users. But on the AUR, nobody is going to do that work for you.
PKGBUILDs are not packages. They’re (user-contributed) instructions on how to build packages.
> available through the OS's repos.
No. The AUR is a platform, similarly to NPM or PyPI, that allows users to upload PKGBUILDs. It is not part of “the OS’s repos,” and it says that loud and clear, multiple times, including on the front page.
That's not the reason why Spotify is not on extra.
Spotify is not on extra because it's not FOSS.