fguerraz

If it’s freed it can be reallocated, so then you have pointers to the same area of memory used for completely different data structures, and this can go very wrong

I highly recommend this episode of BBC In Our Time: https://www.bbc.co.uk/programmes/b080wbrq

Can we kick SMB implementations out of the kernel please? If not, can we please get PHP mainlined in the kernel?

I find it incredibly naive that they’d hope it would not leak after weeks/months of embargo.

Being given advance notice of an upcoming security fix is an immense privilege, organisations should turn around quickly when given such information, they shouldn’t be given more than a couple of days to update IMHO, it’s not like the rest of the world can wait.

Any legit use case for using SSH over Tor?

In the end, it’s the same answer as to why humans do it: incentives.

Why do we commit financial fraud and destroy the planet? Because there is only one goal that counts: making more money. It’s the only measure of success for powerful people, they are powerful because of it.

The previous design was piss-poor

If it’s being exploited “in the wild”, it means someone has already found how to chain it, otherwise what would be the point?

I'm sure there are people in this category, but there's also the other category who just want their stuff to work, and now can as AI to do it, without having to follow stupid processes (try contributing to QT...) or arguing for months.

These maintainer who’ve held the sacred fire for years…

I mean, they're from Scotland, the watch would have to be pretty water resistant to survive more than one day...

The strong language is fully appropriate given the circumstances.

In 2006, in my first job after uni in France, I wrote a toy PaaS system called CASIMIR based on qemu. It was a lot of fun, I could via a web UI launch VMs, access them via VNC, etc..

I've always had a lot of admiration for Fabrice Bellard, I always wished I was as good an engineer as he is.

Moving to a closed development model => opensource is just a gimmick, especially with a BSD licence.

I feel like the project just died.

It’s a good thing because it’s definitely an interesting company worth investing into long term. But not at this valuation. 10% seems reasonable given the profits perspective.

This is misleading and not the point of the wealth tax.

If you’re lucky enough that you don’t need to work for your income, you should be taxed. A lot. How much? Enough to make sure you don’t become so rich that your children don’t need to work.

Being rich is not fair, it’s very rarely deserved, and it needs to be taxed unfairly.

This is great news, maybe people are going to start caring about their electronic gadgets more and not treat them as disposable? Maybe longevity is going to become a criteria again?

And then Apple pay and Google pay are not going to implement it, and nobody is going to use it.

This is incredibly light in details, no verifiable claim as far as I can tell.

(I’m sure they’re not lying, but we’re not learning anything here)

Does it mean I can finally run Slack on Asahi?

They evolve and they don’t. People call things whatever they want. How is it going for X/Twitter?

I have renamed the bird Türkiye . It was called Turkey in reference to the country, I think it’s fair to rename the bird too.

Well, let's say I just don't understand the popularity of this magazine on HN.

So, nothing new?

The cosmic ray hypothesis has been dominant for a few years now.

This magazine…

That’s… great. But who runs containerised 32 bit applications?

I just contributed this [1] which does what you want for seccomp. Well, not by default, but profiling is now effective against this attack.

Oh, an this [2] just happened

[1] https://github.com/containers/oci-seccomp-bpf-hook/pull/209 [2] https://github.com/moby/moby/pull/52501

However, the author managed to squeeze the word "however" eleven times in this article, however.

In cryptography, you want operations to run in constant time, even if it’s wasteful, otherwise an attacker could guess information about the key or plaintext by measuring execution times.

Modern compilers are extremely clever and will produce machine code that takes full advantage of modern CPU branch predictors, and reorder instructions to better take advantage of pipelining. This in itself will make the same code run at different speeds depending on the input data.

Then there is the whole issue of compiler version roulette. As a developer you have no idea which version of compilers your users and distros will use, and what new and wonderful optimisation they will bring.

Cryptography and video codecs are notable exceptions, they put a lot of effort to making the code provably memory safe: no recursion, limited use of stack variables, no dynamic allocations, etc. As a result, memory safe languages bring nothing but trouble by making it non deterministic, that’s especially true for crypto where compiler “optimisations” guarantee you side channels attacks.