arsome

That or someone wrote them just for this blog post...

So the opening of the dialog happens when user association hash verification fails if I recall correctly.

Shell32.dll has the code for it under QueryUserAssocAndVerifyHash I believe. Perhaps they've interfered with the hash interpretation for Chrome or Chrome is hooking into it in a different way - Firefox directly computes and writes a new hash to the registry.

Wow that article that completely misses the point, yes, Chrome has better sandboxing, which offers it marginally better security, but that has nothing to do with Firefox's far better privacy features.

For people who are not spies or hoarding millions worth of cryptocurrencies on their desktop PCs, they're not likely running across zero day exploits on the regular. They are however running across trackers galore and Firefox's tracking protection and anti-fingerprinting features are likely to make a larger difference in practice for all but the most targeted of individuals.

> no code can be art. For instance, videogames.

I feel like this is probably a pretty bad example, generally the "art" in video games comes from things like dialogue, storytelling, level design, graphical art, not the physics engine or the renderer. There is simply not art there, it's more engineering.

There's little more art in the code portion of video games than there is in a jet engine.

> What is all this wealth and automation and productivity growth for, then?

Why, more wealth and automation and productivity growth to no end of course.

I just did this the other day and fairly quickly confirmed the crack patch replaced only the RSA key, then they keygen'd the rest.

The higher risk thing tends to be downloading cracks from torrents or usenet where there's 3rd parties between you and a scene group.

Absolutely, but like I mentioned in the prior post, these are local privescs. You basically need to go out and install malicious apps.

If you can use Windows without it getting full of malware, you can handle unpatched Android LPEs too.

Keep in mind, Webview, browsers, email clients, etc are patched via app update mechanisms.

The threat was arguably exponentially worse during the XP era - Windows boxes with a huge default attack surface were directly connected with public facing IPs to a 32-bit IP space that could be trivially brute-forced by worms. There's a reason we haven't seen anything as bad as Blaster in the past decade: NAT.

The rate of finding exploits and what the definition of a vulnerability is really what has changed - now the definition of is much broader while at the same time, exploitability has dropped off due to mitigation in modern operating systems, compilers and CPUs. Overall, we get far more exploits, but far less of significance.

To fully patch, yes, but the point is that Play Protect is detecting them before installation before they can be exploited, ie: on submission to Play Store or on installation on devices.

Yes, this is still a risk - if you tend to install random apks from the internet and disable Play Protect or run across an undetected modification of the relevant exploit code. But most users don't do that.

A bit silly to link a page about malware that Play Protect prevents, largely local privescs that are being detected by the OS or Google Play beforehand.

An average user installing apps from Play Store has nothing to worry about for those. That's kind of the point.

It's great for these devices to be patched - I'd love it if Google would take more control over the ecosystem to be able to patch this sort of thing, but it's much worse for users to just throw out otherwise working devices with limited-to-no real-world security issues.

Most code that interacts with the internet is updated via other mechanisms. For example, web browsers are kept up to date via Play Store: Firefox for Android, Chrome and even the embedded WebView are all updated there.

Yes, it exists, but is it actively exploitable? A cursory search turns up no working exploit code. Given modern exploit mitigations many theoretical vulnerabilities turn out to be nothing-burgers, as far as I can see there's certainly no worm running around popping phones with it.

For sure, if you're paranoid or a high-value target, update, buy a new phone. But normal users don't need to care unless there's actually something on the line.

Not really - Android has for many versions now been updating the embedded webview component via play services.

Honestly, unless it's a remote, worm-grade exploit or you're a high value target, you can probably just stop caring about software updates.

Your threat model might be different but I don't get out of bed for anything but RCE personally, let alone spend a penny.

Pixel 2 is not impacted by this vulnerability as it doesn't have a Samsung modem.

Yeah that was a huge mistake on their part and may have cost them an otherwise excellent cause.

Too many things in Gitlab feel half-baked, like their requirements feature which is essentially just their issue tracker, no document management, just toss some issues in the bin. And they expect enterprises to pay for it because they checked the feature box.

https://docs.gitlab.com/ee/user/project/requirements/

Low-level programming is definitely more meaningful, the problem is it fails the HR speak test - they tend to think it means just not very strong programming.

Basically, don't put that on your CV unless you know the company doesn't filter resumes through HR and has somewhat technical management.

Does this actually get 1080p? I thought L3 was limited to 720?

L3 is weak enough that you can dump it by just hooking the decoders.

Tea under Economics and coffee under Technology > Home and family management... some... interesting decisions in here.

I've barely touched the App Store in the past few years while I used to peruse it regularly. Now instead of browsing for top selling games like I used to, I'm back to using a search engine or reading reddit threads for suggestions.

App stores are too polluted with garbage now, they went from being a unique selling point of mobile platforms to entirely useless and I think IAPs are largely to blame.

They have no jurisdiction outside the EU, you can let EU IPs in all you want. I'm sick of people acting like they're some world police. Treat them like the children they are, ignore them.

Is that a straight period of a day or so or do you do 3.5 hrs/day? How does this work?

Hydrocarbons work quite well and are (comparatively) minimal impact on climate change. There's been some paranoia about fires, particularly in automotive applications but it's actually a quite small amount needed to do the job.

That's certainly not a development new since 2010.

Weird, I've lived with dogs my whole life but have never heard of anyone doing that. Must be cultural.

IDA's decompiler is only cloud dependent if you have the crappy version, if you have the full Pro version with the add on its entirely local.

While it's true that malware could hide well theoretically, I'll also add that in my experience investigating malware infections from friends and family and occasionally hunting for malware myself, samples attached to cracked software tend to be things like miners, iStealer, script kiddie RATs, etc using simple "binders" - which are usually incredibly obvious, like extract the real executable into %temp% or the usual RunPE gimmick. People posting malware on torrent sites are not exactly APTs using spear phishing attacks.

If you're pirating IDA Pro, you're probably the type of person who can figure out which cracks are real and which aren't pretty quick.

Ah, on the client side not the server, makes sense. I was doing the math as the full IP + port, which would offer 48 bits, but with only one client IP you really only have a client port to play with and you must bind as long as the connection remains open.

"The theoretical limit is 65k connections per IP address"

What's the driving factor for that limitation?