Sorry. I meant to write that closed source software isn’t opaque, technologically. (More opaque, yes, opaque... no.) Legally, it’s different. But closed source compilation alone doesn’t grant a program special privileges or confidentiality or non-reversibility, which is sometimes assumed. It’s just machine code or bytecode either way.
DRM protection sometimes rears its ugly head, and that is worth objecting to, but as someone who has written unpackers and game mods, it’s rare nowadays that DRM prevents modding, unless you’re creating unethical multiplayer hacks. Code that is relevant to modders is usually contained in unprotected script and library assets.
To run afoul of the DMCA a modder needs to (1) strip a binary of its copyright protection (2) distribute the unpacked executable or the unpacker tool (3) likely facilitate mass third-party piracy (more damages = more lawsuit potential). It’s principally warez and hacking groups that meet these criteria, and they probably ought to be sued.
I’ll add a point in your favor and say that for non-games DRM is often a big problem when reversing or patching code.
Sometimes, yes, but not intrinsically. AOSP performs OS and app update authenticity verification via predistributed public keys, as do package managers. In theory, a phone’s firmware can be completely open source and still be unmodifiable. Proprietary software isn’t any more opaque or protected than open source software.
Copyright laws are not what is stopping custom firmware projects on many devices. It’s the inability to flash non-signed firmware. Legal considerations in general have minor pragmatic relevance for modding projects that are not lazily redistributing copyrighted assets or circumventing copyright protection. If you’re engaging in piracy then you’re not just giving people more control over what they own.
I think this is a good argument for the advocacy of GPL-3+ prevalence. It’s also legal, I think, to publish GPL-3 firmware source code, and to disallow custom firmware flashing, as long as the copyright is self-owned. (IIRC the provisions of the GPL don’t give legal standing for suing the author over self-violations.) In this case, would you call the software or code proprietary (which many confusingly do) or would you call the device proprietary?
> Yet since then, I have personally lost control of many of the computing devices I use.
No, you haven't. Or rather, you didn't lose control because of any software license. We lost control because of cryptography and enforced signature verification. Just because software is licensed as open source doesn't mean it allows for third-party firmware modification.
Maybe it's because I came up through the RE scene, but the false association between open source and ownership or security has always stood out to me. Many of the modding and hacking communities that orbit proprietary software are/were more vibrant than anything that exists in the totally open source space.
I don’t know if I dislike GPT for making inauthentic people seem slightly more convincing, or if I like it for confirming that we have always lived among people who are essentially performative NPCs.
Perhaps the biggest revelation from this is that Firefox doesn't implement rebinding protection, and that CGNAT DNS responses aren't dropped by most resolvers. Host validation is preferable anyway [1] but the second problem still has bad implications.
Maybe it’s just me, but I would never go through a random certificate authority like “K Software”. Users are not cryptographically verifying the developer’s signing identity, they are trusting KSoftware’s attestation that the signed binary is authentic.
I'm usually a strong advocate for holding citizens of democratic nations morally accountable for their nation's actions. Asking software authors to martyr and incriminate themselves on behalf of a minuscule fraction of the public, even though they are part of the few doing anything at all, seems exactly backwards. Law reform should start and end with the electorate and their chosen representatives.
What utility does that provide? In time the other provider will be issued a different warrant. The user threat model for every online service ought to include legal and illegal data seizure. Any imaginary nation which doesn't perform this legal function would simply be giving a mandate to adversarial actors to obtain the data by force and espionage.
I was about to mention this. It’s hard for me to take any symmetric or password-based backup tools seriously. User chosen passwords are a disaster for offline encryption. Most tools also use related key input for (non-)authenticated encryption and decryption. A server shouldn’t be able to decrypt backups and authentically encrypt new backups.
Linux and the BSDs really should have a more restricted default desktop capability model compared to macOS by now. It's a shame that Qubes is the main response we have, not because it's bad, but because it's almost necessary.
In most cases, yes, but that's not what the parent meant. In managed environments, it's common to not have root login access, and local privilege escalation is sometimes more critical than normal.
I'm not sure there is much of substance to evaluate. If we fired every technical lead who sometimes "waded into areas with no experience," issued orders, followed a conviction or two and occasionally provided disparaging feedback, there would be no good engineers left. The bullying and devaluing claims are worth investigation, but that's always very subjective and range from "my boss disagrees with me" to horrific abuse.
Based on the article, the private keys for peer enrollment signing are generated locally on each Tailscale client and aren't distributed at all. I don't see why you couldn't write a custom client that approves or denies new peers based on your own criteria. Some of the internal Tailscale API may first need to be officially documented.
That's actually the point of this feature. Before, the key distribution server could add unauthenticated Wireguard nodes to your peer list. Now, the tailnet administrator can tell Tailscale nodes to reject new peer public keys unless the key is cryptographically signed by a trusted node. If you don't trust the implementation, wait until it's audited, I guess.
As an observer since the initial release, Tarn repeatedly refused requests to compromise by expanding the team or involving a publisher. It was a genuine passion project the sort of which rarely succeed financially. I couldn't be happier for them!
I started using std::shared_ptr in every project in 2008. Isn’t it late to denounce the changes now? The state of most C++ codebases is infinitely better today compared to then, partly owed to the added descriptivity.
If this update is like the old version, it has bundled dependencies on glibc and SDL 1.2. You can overwrite the outdated glibc libraries with symlinks to the system glibc. SDL, SDL_image, and SDL_ttf can be relinked to sdl12-compat, which implements the SDL1.2 ABI using the maintained SDL2 libraries. (edit: I forgot this is a Windows-only release, so maybe disregard this.)
Burrows are not something you need as a beginner unless you're doing something unusual. It's best to forget about the feature. For jobs, press (u)nits -> (z)oom -> (p)references -> (l)abors on your dwarves and adjust their professions, then queue up tasks at workshops.
Following up, I find it funny that this old meme comment thought orders and banking are our most trusted activities, and not our communications and data storage.
I trust the cryptography behind TLS. I don’t trust every website using TLS. The difference between end-to-end encryption and transport-layer encryption is the website operator can recover the plaintext. And the point of the comment I responded to was that Bitwarden data is not recoverable. I’m glad that you think E2EE is a waste of effort though.
Anyone who doubts you should run zxcvbn and more modern entropy estimators against their passwords. Our intuitions are not good. Offering password-based encryption to normal users is borderline unethical.
> Further complicating this math is the E2EE nature of it, so it’s not just enough to pwn a server, you’d need to also compromise the client application.
The webvault is both a server and a client, and you can't not use it. As soon as you sign into it once (which you must, with the official apps) you have allowed unsigned ephemeral javascript code to run against your decrypted vault.
The Bitwarden webvault infrastructure is a doomsday target. If it's compromised, no evidence of a client backdoor will exist except in the server logs. You can't avoid using it, because you need to sign into the webvault to configure 2FA. Want to change the encryption passphrase? Guess what, you need to use the webvault. Bitwarden's vault encryption is essentially reduced to the security model of TLS.
Astronauts have spent >736,000 hours in spaceflight, risking their lives for humanity, but the parent believes a 10-minute stunt flight carrying an irrelevant passenger is all that matters. I suppose they also dislike the imaginary adorers, and yet they are no different.
Assuming that you still want offroad capability, you basically just described a cyclocross bike. And going on an ultralight tour on a modified CX bike sounds super fun!
Tires and rims differ substantially but you often don't need to reseat the tire bead if you remove the valve core and inject sealant through the stem. High volume hand pumps and soap can usually seat tires in place of CO2 cartridges. If you do need to insert a tube, the mess from the sealant makes life absolutely miserable, you're totally right.
How feasible are tubeless setups on long tours? I'm curious. Anyone who MTBs knows about the dramatic improvement. In just the past year I would have had 50+ flats using tubes. I'm positive because I pull out thorns by the dozen. None require patching since the sealant fills the submillimeter holes immediately.
Being able to locally resupply with a compatible sealant is the main impediment. 4-8oz spare fluid in a packed bottle covers one refill. How often do you need to replenish sealant on wheels being used all day every day in mixed weather?