Lex-2008

Sadly, that's yesterday news.

See here: https://security.stackexchange.com/a/249484

> ... a newly discovered ransomware variant exhibits the ability to detect and compromise partitions (including hidden partitions), a behavior not thought to have been seen before in ransomware.

with a link to original source:

https://www.fortinet.com/blog/threat-research/newly-discover...

quote from that link:

> At the time of discovery, FortiGuard Labs researchers believed the ransomware was seeking out partitions to find possible hidden partitions setup by systems administrators to hide backup files. But further analysis confirmed an even more advanced technique. The DarkSide Ransomware variant seeks out partitions on a multi-boot system to find additional files to encrypt.

do you mean you never received spam from @gmail.com? Lucky you!

looks like geoIP database - for me it gives almost same data as https://www.ip2location.com/demo/

Worth noting that at the same time, "they" weren't good enough at pushing new things that the same time. For example, all new compression methods work only over HTTPS (actually, this alone can be a reason to switch to HTTPS) - because they were incompatible with some HTTP proxies: https://bugs.chromium.org/p/chromium/issues/detail?id=14801

<rant> I'm actually looking forward for them to drop HTTP digest auth, because it's the only auth scheme which doesn't rely on sending shared secret over the wire with each request </rant>

> all of them will be mutually incompatible, with own programming languages and data formats. The future looks bleak.

Server hardware had (still has somewhere): SPARC from Sun, PowerPC from IBM, HPPA from HP, etc... See for example list of supported architectures for Debian4: https://www.debian.org/releases/etch/hppa/ch02s01.html.en

But it feels like amd64 is winning today. Don't you think that eventually one of these architectures you're talking about (Google's, Apple's, Samsung's, CCP's) will win over others, one way or another?

While I agree with you in general, I'd like to comment on

> It's not like everyone's clamoring for their ad blockers to use less resource or for Chrome to be faster.

some people do: https://news.ycombinator.com/item?id=28672377 - "Brave reduces the page load performance cost of its adblocker"

original article having some impressive improvement numbers.

Not to criticize, but to clarify:

> encrypted backups of the e-mails which I store in the cloud, the encryption key never leaves my device.

Doesn't in mean that in (unlikely) case something happens to your device (like harddrive crash), you won't be able to access the backups?

probably worth mentioning this HN thread: "Ask HN: Favorite Blogs by Individuals?" with 273 comments: https://news.ycombinator.com/item?id=27302195

Another data point:

When Windows 10 just came out, many of apps in start menu had a label next to them, which in Russian version said "Создать" (~Create). It took me some time to figure out that it's a poor translation of "New" (~Recently added). Proper Russian translation would be "Новое".

I might be wrong, but I think I've read somewhere (here on HN) that kernel has no idea about disk head position. It's job of HDD's firmware to reorder read/write instructions it received from kernel for optimal performance.

Also, firmware can "remap" some (bad) sectors into reserve area without kernel knowing.

I'm an SQLite fan and not a developer, so I don't know for sure, but I think that they will do the same thing as with generated columns.

Link: https://www.sqlite.org/gencol.html#compatibility

Quote:

Generated column support was added with SQLite version 3.31.0 (2020-01-22). If an earlier version of SQLite attempts to read a database file that contains a generated column in its schema, then that earlier version will perceive the generated column syntax as an error and will report that the database schema is corrupt.

To clarify: SQLite version 3.31.0 can read and write any database created by any prior version of SQLite going back to SQLite 3.0.0 (2004-06-18). And, earlier versions of SQLite, prior to 3.31.0, can read and write databases created by SQLite version 3.31.0 and later as long as the database schema does not contain features, such as generated columns, that are not understood by the earlier version. Problems only arise if you create a new database that contains generated columns, using SQLite version 3.31.0 or later, and then try to read or write that database file using an earlier version of SQLite that does not understand generated columns.

End of quote.

I can't find it easily in documentation, but I've read somewhere that SQLite stores schema in database as text - and reasoning behind this was that it allows SQLite devs change internal representation of schema without worrying about backwards compatibility too much.

Are you describing what is also known as "Tragedy of the commons"? https://en.wikipedia.org/wiki/Tragedy_of_the_commons

But how can you possibly deliver email via IPv6 if their MX host doesn't have IPv6 address at all?

    $ host hotmail.com
    hotmail.com has address 204.79.197.212
    hotmail.com mail is handled by 2 hotmail-com.olc.protection.outlook.com.
    $ host hotmail-com.olc.protection.outlook.com.
    hotmail-com.olc.protection.outlook.com has address 104.47.57.161
    hotmail-com.olc.protection.outlook.com has address 104.47.58.161

On the other side, if a host announces that they have an IPv6 address - do you think they do it mostly for spamers?

    $ host gmail.com | grep handled | head -n1
    gmail.com mail is handled by 5 gmail-smtp-in.l.google.com.
    $ host gmail-smtp-in.l.google.com.
    gmail-smtp-in.l.google.com has address 173.194.73.27
    gmail-smtp-in.l.google.com has IPv6 address 2a00:1450:4010:c1c::1a

Honestly, I don't know.

But Wikipedia says it was a ligature of two letters ("Ь" and "I"), which later changed their values: https://en.wikipedia.org/wiki/Yery#Origin

Some say that Cyrillic letter Ы is a single character for "lol".

It might be difficult on a different level.

Dr.Hipp mentioned GMail bouncing email sent to him - but hosting email yourself, will just move you to a different side of the bounce - now GMail will be bouncing emails sent by you! See, for example, first comments on the recent HN thread here: https://news.ycombinator.com/item?id=27707857 (ctrl+f for "pain in the" if it's not the first one).

So it looks like convincing GMail to respect your small server is a non-technical problem, which might be an issue for a person with "only engineering" mindset. On the other side, Dr.Hipp looks like a right person to try to convince GMail to respect smaller mailservers!

> Also, be aware that free 3rd-party mail hosting with a custom domain does not exist.

I believe two of them still exist in Russia.

* Yandex even has a page in English: https://360.yandex.com/business/tariff

* Mail.Ru has a page only in Russian: https://biz.mail.ru/mail/#tariffs

To my inexperienced eye, it looks like a ship to cargo unpackaged grain, not containers - see https://en.wikipedia.org/wiki/Bulk_carrier

To be fair to Mail.Ru, I believe maps.me is one product which became better when owned by them:

* they dropped paid version in dec 2014 (with all "pro" features, like bookmarks, being merged into free version)

* they opensourced it in 2015

* they added some OSM-editing capabilities in 2016

* they added bike navigation

I can't say how much of it is thanks to Mail.Ru, and how much - thanks to original developers, but it looks like the app was improving.

Note that in November 2020 it was sold to a new owners, - and after that, I believe, jumped down.

Now it has big glaring "YES."

Postfix has a similar note:

> NOTE: By turning on TLS support in Postfix, you not only get the ability to encrypt mail and to authenticate remote SMTP clients or servers. You also turn on hundreds of thousands of lines of OpenSSL library code. Assuming that OpenSSL is written as carefully as Wietse's own code, every 1000 lines introduce one additional bug into Postfix.

http://www.postfix.org/TLS_README.html

how I understand it after reading the original article:

in plaintext http world, man-in-the-middle (MitM) can redirect your browser request for www.bank.com to their own evil server which will pretend being www.bank.com.

in https world this wouldn't work since evil server doesn't have a valid TLS certificate for www.bank.com and thus your browser will refuse to talk to it.

However, MitM might redirect your request for www.bank.com to this bank's ftp server ftp.bank.com. If this mail server uses wildcard certificate *.bank.com - then your browser will accept it and start talking HTTP to it.

this article analyzes how various (email and ftp) software reacts when sees a browser talking http to them. If an ftp server saves such request (in plaintext form) to a world-readable file - hacker can read it and we're in trouble.

hmm, they don't mention `eval()` being blocked in executed functions. Is it mentioned elsewhere?

Also, can't executed function just add `<script>` tag with given `src`?

looks cool!

BUT: 2nd question in "hello_world/" expects two last names in a very specific order. If I sort them - it considers answer to be invalid. But should it?

good point!

But as soon as browsers stop autocompleting fields marked with autocomplete="one-time-code", won't website developers start marking _all_ input fields with this tag? After all, why do people put autocomplete="off" on input fields anyway?

I assume you're not in Apple Store team, then.

Because they do put autocomplete="off" on login form, username, and password fields. At least for me:

https://imgur.com/a/Ygb371g

UPDATE: please help me write a sarcastic comment about Apple Store team putting autocomplete="off" there, and Apple Safari browser ignoring it.

OTP one-time-password fields

not OP, and not Arch, but Manjaro (so you can take it with a grain of salt), reporting from memory so details might be incorrect.

* after "BootHole" GRUB vulnerability, I've read that upgrade requires re-installation of the bootloader. And just in case, did run `sudo grub-install …`. After reboot, system didn't boot. Had to use installation USB to restore.

* More recently, during routine upgrade pamac (Manjaro's pacman alternative) GUI showed me some "transaction can't be completed" error message. Shuddered it away - few days later pamac wasn't starting at all. Starting it from terminal showed error message about some missing *.so file. Googling showed that this is a required file for pacman (Arch package manager) to function. Typing `pacman` in terminal showed "command not found" error message. Restored the missing *.so file from snapper snapshot (thanks btrfs!), after that pamac started fine and happily upgraded my system.

I'm not sure what happened in second case and why pamac left system in broken state (looks like it wanted to upgrade pacman by first removing old files and then putting new files in place, but aborted in the middle), but first one might be quite distro-independent.

Also, reading through recent Arch news, I believe this could bite someone:

https://archlinux.org/news/sshd-needs-restarting-after-upgra...

> After upgrading to openssh-8.2p1, the existing SSH daemon will be unable to accept new connections. When upgrading remote hosts, please make sure to restart the SSH daemon right after running pacman -Syu. If you are upgrading to openssh-8.2p1-3 or higher, this restart will happen automatically.

I believe I saw it in the FAR file manager.

> Now if you unexpand the arrow, you get 1, but if you expand it you get 3 =)...

Moreover, if you expand arrow next to {value: 0}, you will see literally this:

    v {value: 0} [i]
        value: 3