flippingheck

> <StanfordAppliedCyber[m]> one of my friends is a very senior engineer who lead a lot of the sptm work and controls a lot of boot, may talk to him about it (obviously he hasn't told me anything that isn't public)

For the lazy.

Visiting 3D virtual places sounds cool.

What communities do this? Can I do this on my laptop too to trial it?

80% is still pretty high!

Does 80% mean "tastes like a dull chocolate bar, but still basically a chocolate bar", or more like "like a nice chocolate bar but somehow 20% less enjoyable in some looser way"?

Perhaps this is why I can't identify the beat in the music.

I have barely even considered VR until the Steam Frame.

I'm just not interested in closed ecosystems like Oculus.

That said, I have barely looked at VR so much that I'm not sure whether to bother with the Steam Frame.

Is it just for gaming/movies?

Thanks. This was great.

I'm pretty sure I have this, for all senses, and I only just learned there's things other than iñner eye (which I only learned of a few months).

If people have an "inner taste" or "inner hearing", why bother eating a sweet or playing music?

> Asked what sits beside the television, they answer without hesitation, but “we experience these as an awareness of a set of spatial facts.”

This helps me understand what little I do seem to have.

Maybe the most vivid thing that I can imagine is the world map, but... I wouldn't call it visual. But I can recall that Europe is east of US, and Italy looks like a boot.

Perhaps it is just spatial facts.

The device is acoustic. Think of it as a babel fish for telling fire to stop.

It's a big bet to not have a plan for needing power.

I expect as LLMs penetrate further, we'll see much more of it, continually running, and doing more 3D work.

> I need help.

Call SOS on your telegraph?

That is much fewer LoC than I expected.

How is "offline e-reader" handled? Does CUPS retry?

Do you do this outside of your LAN?

> open platform like the Xteink is that it should uncover loads of novel and unsatisfied use cases

+1.

And it's worth celebrating the underlying technologies that enable this: ESP32, and RISC-V.

Anyone know what's needed for eink to become cheaper?

I just read your original comment "is this any conceptually different from using PKCS11 provider for TPM in OpenSSL?" and yes, I agree it's not conceptually different.

Sorry to have missed that!

I thought you was suggesting a TPM wasn't needed at all, but a TPM is needed to get quotes.

That said, TPM quotes are attesting the value of TPM PCRs which are just registers of hashes (representing the state of the machine).

When making a CSR, you can use https://tpm2-tools.readthedocs.io/en/latest/man/tpm2_certify... to attest a key is TPM-resident.

I think your central thesis is that at the time of TLS establishment, why not use PKCS11 (with a cert signed by a CA that has validated a TPM certification), and I agree: services should probably integrate via PKCS11.

Is this is meaningfully different than the risk to any engineer working in security on ~central infrastructure?

> even if you don't have the keys you may still control the implementation

The sorts of places that care about remote attestation also care about insider risk.

> is this any conceptually different from using PKCS11 provider for TPM in OpenSSL?

PKCS11 doesn't allow you to attest that the key is resident in the PKCS11 provider, which as you say, the author alludes to, but doesn't cover.

> with real TPM, the key could be locked to a specific configuration register value, which makes less sense for VMs.

A vTPM is as real as a physical TPM chip.

The question is which TPM endorsement certificate CAs you are willing to trust.

For some that might the manufacturer of TPM chips, for others it might be their VM provider. (For some, none: for some both!)

Trusting their VM provider isn't so crazy if the VM provider is able to influence the guest code anyway.

Yeah, a typical TPM chip has much lower throughput than OP.

Not suitable for servers, since it's such an easy DoS vector.

TPM is just a spec, it isn't necessarily a black box.

ARM TrustZone, for example, can run this OSS TPM: https://github.com/OP-TEE/optee_ftpm

I expect there are equivalents for Intel/AMD.

> through every scandal, Zuckerberg’s net worth has climbed to nearly $200bn, according to Forbes. Fines mean nothing to those with wealth like his, so the first step to safeguard society is to give Meta a fresh start without Zuckerberg’s influence on future products.

What is the author's model of a company?

The greater the dependence, the greater the risk.

Does that somehow also explain why many (most?) desktop users survive with just a browser?

To be clear, I'm not saying it doesn't. I'm saying I don't understand.

> decision we have made

This might oversell the agency that practicioners have.

Sandboxed zero-install delivery will outcompete anything with more frictionful installs.

It's probably not the right model for a pacemaker though.

Web/JS has been a double-edged sword for FOSS: sure, I can run a free OS, but if most of my "apps" happen to be JS that I can't practically control, then I have won a battle and lost a war.