Skunkleton

Yes. But they could conceivably already modify Apps at install time or run time, so this is only a new vector for an existing attack.

What do you mean it would "show up in everyones downloads"? Google Play Services are constantly being updated on peoples phones. Literally nothing besides Google's decision not to prevents these updates from containing a backdoor.

Portions of the SDK are open source, portions are not. Android also does not have reproducible builds, so you cannot audit that the open source you are viewing relates to the binaries on your phone. Android also widely depends on binary blob firmwares which also cannot be audited.

As it stands if you buy a normal android phone, then you must trust Google.

Does misspelling count as obfuscation?

If you were to MITM, that would mean all HTTPS connections, not just DOH.

There is less and less choice over your DNS provider. With the classic DNS protocol, requests were routinely hijacked by ISPs. With new protocols like DOH, you now have to go manually configure every application and cross your fingers it does what you want. Not everything can be configured to a specific DOH gateway.

As it stands today, I can no longer reliably block hosts by domain name on my own network thanks to DOH.

The cost is a shame. Still, it will be cheaper eventually.

Your writing doesn't give you away as a non-native English speaker. Please write HOWTOs!

This is often true, but many man pages have a pretty good examples section. Sometimes these are good enough, and are at least worth checking for.

Cashew cheese is really good, but it isn't at all cheese. It can be used in a few applications where cheese is normally used, but not in the vast majority of them.

I have been exposed as someone who doesn't use emacs :)

Oddly enough, almost nothing binds the space bar. I've been using ctrl-spc as my tmux prefix for years without a single conflict. I think this is because there is somewhat limited support for ctrl-space on older terminal emulators.

Advertising the language could attract contributors to the project. Especially true for a newish language that is just starting to gain widespread traction.

True enough, but the same data is also available via your cellular provider, and they are happy to provide it to law enforcement as well. Your cell provider also sells the data for profit.

Yeah, a shell is never going to provide isolation. If you want isolation, then snapshot your filesystem, assign it to a VM and run the script there. But this isn't actually useful because:

1. You probably will need network to run whatever script this is. Once you give the script network access, you are open to a whole bunch of issues. Perhaps your ssh private keys leave your system for example.

2. If you don't give it network access, it probably won't do anything malicious. Most of these scripts exist just to download some "thing", install it, maybe run it, and maybe update an RC file. The malicious code might be in the executables downloaded by the script rather than the script itself.

3. Just because a script does something reasonable in a VM doesn't mean it isn't malicious and won't do something else when it is run on bare metal.

In the end, you have to trust whatever software you decide to run (scripts included). How you gain that trust is up to you. I would steer away from gaining that trust by running the script and seeing what happens. Personally, I just rely on the reputation of the source of the software.

Verifying that some script doesn't screw up the configuration of my machine is a different story. I hate it when some script decides to run "pip install" or some other thing that subverts my package manager. Here, taking a snapshot is a reasonable choice.

Bigger and bigger risk for the likes of Apple and AMD depending so totally on TSMC. I don't see how this dependency benefits them in the long run.

T9 works well for common words. The poor doctor this keyboard(stick?) is being foisted on would not have a good time.

You are on HN. Most of us are software engineers. You aren't telling us something we don't know.

You could snapshot your filesystem, then run the script and diff against the snapshot. Isolating executables (even shell scripts) is really outside the scope of what a shell normally provides.

Yeah, this is an absurd argument. How do I know I can trust Linux unless I personally audit the whole kernel? How do I know if I can trust my processor without an x-ray machine?

That won't handle the case where some coins are stolen and used before they are marked as "bad". Some merchant will be out of luck once the transaction is reversed. Really that is no better than what we already have from credit card payment networks.

That both does, and doesn't solve this problem. If someone pays for services with stolen assets the ideal scenario is that the criminal is apprehended, the service provider doesn't lose money, and the funds can be returned to their rightful owner.

Monero protects the service provider, but doesn't solve the other problems.

Yeah, I realized after my edit window had expired. Should have been "0xf|| x" and "0xfor x".

char is usually some single byte of data. Characters can be multiple bytes. Slicing a string on character boundaries is more coarse grained than slicing on byte boundaries.

I really like pass, but I switched to Bitwarden for this reason. Bitwarden has first party support everywhere I need it. Pass has clients everywhere, but other than the CLI I have not been impressed.

I would have expected the english boolean operators to require whitespace to parse correctly, personally. "0xf||x" makes sense. "0xforx" makes no sense.

I don’t think so. The CPU itself isn’t the big problem here. You can see basic support is already there. The challenge is all of the surrounding hardware.

I am not sure why would would expect better success with this processor than we have had with x86? Most PC hardware is directly supported by the OEM in Linux.

The short answer is that this is a different beast. Much of the hardware in Macs before the M1 was commodity hardware. Now it is all bespoke and undocumented. This is a big undertaking.

I use Fastmail + a custom domain. Because fastmail is the provider, I am not on any spam lists. My emails make it through. My service is very reliable, so I always get my emails. If fastmail decides to hate me, I can just point my domain MX records somewhere else.

TODO: need a non-fastmail backup of my email

Is this also including medical insurance? I can't imagine it is cheap to insure a pool of firefighters and lifeguards...