arsome

Learning dozens specific cloud services and shelling out money everywhere I go is way less appealing to me than buying a cheap dedicated server and firing up exactly what I need.

It'll take me far longer to figure out what FarGate and Cloudflare Pages and all these are and infinitely longer to keep up with the latest and greatest because it keeps changing constantly. And even once I get it, I'll have very limited control or understanding of my stack, and migration? I'm screwed. I'm not interested in playing games like that.

nginx is comparatively simple, run it, it serves. Config is easy, learn it once, run it anywhere, it doesn't get a dozen new features and breaking changes every month, just does its job.

I guess I'd just rather understand the real underlying technologies than some crappy commercial wrapper for them that will differ every time someone tries to rip me off.

Same reason I can't have a hardware keyboard on any modern, reasonably priced phone: lack of demand.

Okay, so Tesla has no or significantly more limited reason to build out a charging network. Good job, you made electric cars worse, thanks government.

Sounds interesting but I'd very much appreciate knowing what the output any exploration capabilities look like in allocscope-view before jumping into installation, maybe add some screenshots to the readme. Poking around the code it looks like a curses-based interface.

So what's the conclusion here? There are good coding styles but we don't know what they are?

Thanks machine learning.

The goal here is to dispel the "extends health" and similar claims often made about light or moderate drinking.

If you take a look at the studies you can determine how much of an increased risk you're comfortable with. For example, figure 5 in https://www.thelancet.com/journals/lancet/article/PIIS0140-6...

When doing this analysis though be sure to note that scientists studying this use 10g drinks, which is 12.5mL of ethanol, one tallboy of 6.5% beer is therefore about 2.5 drinks.

I'm not sure I see your point, the only way to get to a world with L2 chargers at apartment buildings and such is to have demand for it or legislation supporting it, the best way to get that is to champion EVs.

What you're interested in is called Active Management Technology, it's not supported by all boards, but typically if it is there's a bios screen labelled something like "AMT Configuration" where it can be enabled or disabled.

https://virtualizationreview.com/articles/2020/01/13/configu...

Intel ME is its own can of worms and can only be fully disabled by modifying the firmware image, see tools like me_cleaner.

https://github.com/corna/me_cleaner

Oh come on, that one is gender neutral even!

This is actually a pretty nice pro-consumer feature as this makes it trivial to lie to Windows that secure boot is enabled while hooking things.

Great for game cheat developers for example, who often want very deep hooks on the system to bypass anti-cheat tooling and with some modern games requiring secure boot to be enabled, this could provide an interesting alternative strategy.

I think limited rollover is a preferable solution if companies need to get PTO off the books - if you can only bank 4 weeks of vacation the maximizing strategy for people like you and I will be to bank it and then take the rest.

Interesting, looks like a blanket statement that any stablecoin could be considered a security or derivative.

> the CSA is of the view that stablecoins, or stablecoin arrangements, may constitute securities and/or derivatives. Crypto trading platforms that are registered or that have entered into a pre-registration undertaking are reminded that they are prohibited from permitting Canadian clients to trade, or obtain exposure to, any crypto asset that is itself a security and/or a derivative.

Having one piece of detected malware means you probably have more that aren't detected and not having someone take a look at that machine or reinstall the OS means you're probably running a system with active malware.

Wireless only charging would be wasteful as it's rather inefficient (most tests show about 50% more energy put in to achieve the same charge) and this magnetic system is unlikely to work well for anyone who uses a case to achieve good coil alignment... I really hope the market doesn't go in this direction.

Widevine L1 keys have leaked fairly regularly though and many piracy groups have private L1 keys to allow them to get clean webrips from streaming services. These keys get dumped from a vulnerable device and then don't need to be updated unless that device gets breached publically down the line.

Syncthing is really key, no need to pay for photo sync services, just send it to your Nas or desktop, no need to pay for password managers, just sync it, no need to pay for notetaking apps or todo apps, just sync Obsidian or Joplin.

Typically compilers have a "frontend" which turns code into a syntax tree and different "backends" for each architecture they need to support. For example, clang is the C front-end for LLVM while Emscripten is a backend that allows it to output Javascript.

Though for highly specialized calculations like that. they're often written into popular libraries like OpenSSL with inline assembly for all relevant architectures.

It seems some of the malicious applications were pre-installed system update tools on cheap MediaTek devices, so no sideloading needed if that's the case.

Good catch after looking into it more this may be related to subcontractors providing vendors with malicious update tools that they then sign.

https://maldroid.github.io/docs/vb_2022.pdf

It's possible Mediatek (or an unrelated contractor) did the firmware work for them all so they're the ones holding the keys in the end.

I'm not sure of the validity of the key, it's possible it was simply an untrusted key that had "Android" in the common name and got removed from the post as it was unrelated, but I'm curious if any more details surface on that one.

Take a look here, I found some strings mentioned on VirusTotal for the malware in question (drv.androidsecurityteam.club) here in the slideshow. Sounds like malicious updaters are being signed by some vendors perhaps?

https://maldroid.github.io/docs/vb_2022.pdf

I'll be curious when more details come out, but there's not much to go off yet.

EDIT: Sounds like this may all tie back to a contractor providing OTA update applications, either being compromised or directly malicious themselves: https://wuffs.org/blog/digitime-tech-fota-backdoors

"They provide Android ODMs/OEMs with the SystemFota updater APK, instructions on how to build OTA packages and a web portal where they can upload them and view statistics."

One interesting thing is 2abeb8565c30a3d2af0fc8ea48af78a702a1c3b432845e3f04873610fac09e1b was mentioned in the original description 1 but removed in 2/3.

That package is signed with an Android key instead of a vendor one...

https://www.virustotal.com/gui/file/2abeb8565c30a3d2af0fc8ea...

How is this single tenant? Is it running on dedicated physical hardware or just difference instances on the same cloud provider?

Getting costs down often requires preparing for mass production, prior to this, mass production was not viable, this is the necessary next step.

It's more "why should a government expect any foreign company to follow the law".

Personally I run a small business, GDPR came out, our solution is to just violate it and not care. They have no legal jurisdiction over us so their laws do not matter.

If we had to comply with every jurisdictions special laws on the entire planet we'd surely waste most of our time doing it.

Maybe I'm just not in with the cool kids but it feels like social media in general is just kind of dying in a lot of circles, outside of content platforms like YouTube and TikTok at least. Direct group chats via Discord, Telegram, Signal, etc are the main ways of communicating and beyond those do you really need - or have any desire - to communicate with random strangers?

It seems the like vanity and excitement of the early internet is dying out and more normal social circles are being established.

> but libraries cannot

Why don't they try it and find out? Seems like if anyone should have the legal right to do so from purchased books it should be them.

Internet Archive is trying something similar in court right now with their "controlled digital lending" concept. The ReDigi case was a true shame, but that doesn't mean we shouldn't be willing to propose other concepts and try to legalize some case here.

So basically, even sketchier.

I've always been curious about this one - what kind of exploits are you concerned about that could wind up with those sorts of consequences? Most of the security updates tend to patch things which are local only or barely exploitable in the first place. Assuming you're not installing entirely untrustworthy software on daily basis, it's probably not much of a difference. Looking at the latest Android security report, even the "Critical" vulnerability reported is a code injection in data that's usually only available to the app that wrote it in the first place.

Important applications like the browser, webview, media players, etc are patched via Play Store regularly so untrusted data is usually processed through those pipelines regardless. Perhaps hardware decode on untrusted content could still provide a vector there, but judging by the practice it's not exactly a large one.

There haven't exactly been worm-grade exploits flying around in the mobile space, even big public things like StageFright pretty much turned out to be non-starters and the targeted attacks are so far ahead that I wouldn't even worry about public exploits - the private ones have you covered already even on the latest OS.

Maybe I'm the minority here, but I wouldn't exactly rush out and blow $1000 over anything short of an unpatched and readily exploitable RCE.