jtaft

Dreams is an awesome “video game creator” game for PlayStation. It uses uses distance fields for geometry, instead of polygons.

You model things inside the game via sculpting by adding and subtracting shapes. Surfaces are covered in “flecks” which gives models a really unique look.

The talk goes into the rendering pipeline, optimizations, and how they and obtained a particular look.

Sorry hacker news title doesn’t match video title. Thought it was more fitting.

Haven’t heard of shadow stacks before. Neat.

I think it’s year over year (same date as last year) , not ytd (since January 1st)

Apple provides their own hypervisor framework and virtualization framework. Roughly 50 lines of code and you can boot up a mac vm which they support.

Meh, I do a lot of technical writing. Documents are very dry to read.

For non technical writing, I really enjoy additional words that invoke emotions.

Please rename the submission’s title.

The above sentence was mentioned in the article (without supporting evidence), and is not the focus of the article.

Tldr of article; abi was chosen not to be broken, which is costing performance. Author argues if std library isn’t optimized, alternatives will keep being developed, and std will be considered dead.

There’s ways around tls, especially if everything isn’t using tls.

For instance, bgp hijacking has been used to obtain valid certificates by hijacking domain names. Yes there are mitigations for this, but not everyone enforces them.

It appears so? https://support.apple.com/en-om/HT212814 mention baseband.

Cool! Can smaller businesses gain access to these funds ?

Do you think the value of Bitcoin will go to zero due to lost private keys?

If your Interested in switch jobs, just try :).

Are you interested working in a particular domain? If you have experience , that will be helpful.

Also, you’re generally hired to provide value. If you’re able to enable your team to solve challenges the company is interested in, you’ll be fine.

Signature verification of releases would of prevented this.

This is really rude.

Impressive :)

I use use a security key to login to personal ssh services, which uses a single key. The key requires a physical touch in order to log in to devices though.

If something more robust is needed, ssh certs and principals can be used.

Some use Pam modules to require 2nd factor too.

Maybe I misread the article. It sounded like they were tracking attention with ordinary TVs?

Ie I wonder if they are relying on smart tv metrics , or tracking volume/people changing channels.

> tracked ad viewership using tools that, instead of just monitoring the television, measured actual viewer presence in the room, and focal attention on the screen

What are these tools and how do they measure?

I don’t think rust got rid of the null dereference problem. Just traded it for something slightly different. ie, calling unwrap when no value exists causes the program to panic.

Congrats :)

> As long as they de-identify the records — removing information like patient names, locations, and phone numbers — they can give or sell the data to partners for research.

I don’t feel this is enough to deidentify.

If timestamps or a patient # is associated with records, should be possible to combine with credit card records to discover who someone is.

I wonder if we can request what is shared.

Good finds :). Most of 2 factor auth or password reset flows I came across while consulting had bugs. One of the more fun findings was an authenticated encrypted username was used for password resets. Another part of the application used the same encryption key and acted as an encryption oracle. Copy ciphertext for the target username into the password reset link, and voila.

Oof. I hate to call C a mistake. I hold the language close to my heart; quirks and all.

Sure there are safer models for computing. But it has served its purpose for a long time. A small language allowing highly performant programs/operating systems to be written. Plus we got to see the beautiful art form of exploit writing. Sure at what cost (lots), but all hackers can appreciate when a system gets owned. It’s the intentions that come after which bother us all.

Don’t get me wrong, I’m excited for newer languages like rust to come along. However, I learned so much about low level computing from c, and I’m forever grateful.

Hats off to Dennis Ritchie. Thanks for creating a language I met so many other hackers through, and sparking the curiosity of hacking within me.

Hmm I don’t totally agree. I get it probably mitigates risk , but it removes to much of the human element and sense of purpose.

I admined game servers and built a couple communities. I made long lasting friends I wouldn’t of met otherwise.

Playing with others gave me a sense of purpose to protect others. Banning cheaters to protect the community from grief felt good and fulfilling. We had some tooling to detect abnormal stats of users to help remove biases. Due to the game mechanics some scenarios were instant red flags.

IMO you should have a protocol in place for bans, and make sure to follow it to remove emotions. Admins should definitely keep each other in check when admin powers are used. Admins should continue listening to community concerns about a particular admin too.

Don’t let someone become an admin for self motivated reasons. Ensure they respect and identify with the community. Great admins often come from being apart of the community first.

According to following, engineers knew this sound would happen during high winds from the west.

https://www.theguardian.com/us-news/2020/jun/06/golden-gate-...

This is quite false! The mere fact that someone asks how to be a hacker shows they are curious.

A true hacker asks a lot of questions. Lots and lots of questions. The longer you hack, the more obscure, interesting, and fascinating the questions become.

In fact, a key part of becoming a hacker is figuring out the right questions to ask. You learn to do so by asking the wrong questions. As you gain experience, revisiting old questions can lead to beautiful solutions.

Another important aspect of being a hacker is sharing knowledge! Hacking is about learning. A lot of what I learned is from reading what others have wrote. Also by failing and experimenting.

When I was a kid, I did ask my friends "how do i become a hacker" and "how do I hack". I'm glad I did, because I've been enjoying the journey ever since.

What's your stance on the term "cracker"?

I was super into reverse engineering and loved the challenge. It seemed at some point "cracker" moved away from someone who can break software protections through reversing to someone who uses tooling to break into systems, without understanding how computers work. I still prefer "cracker" as someone who can reverse and break software protections.

Also, Thanks for helping out with Defcon! Been there a couple times and plan to go again. At the next live con i'm down to meet and talk about hacker lore!

From the paper:

> On these devices, the bitstream encryption provides authenticity by using an SHA-256 based HMAC and also provides confidentiality by using CBC-AES-256 for encryption

> We identified two roots leading to the attacks. First, the decrypted bitstream data are interpreted by the configuration logic before the HMAC validates them. Second, the HMAC key is stored inside the encrypted bitstream

To clarify, do you mean usability as "how easy is it for an end user to perform X?" I feel in general, adding security to a system without security does decrease usability.

I think focusing on "relative usability" is important too. IMO it should be able to increase relative usability AND security.

For instance, I find unlocking my phone and paying with apple pay is easier to use than taking out my wallet and paying with a card. Having my credit card information encrypted on the phone makes it harder for a thief to access, when compared to gaining physical access to the credit card.

I also use a yuibkey to store cryptographic secrets. Generally I leave it plugged into my laptop, so it does not add inconvenience to me in using it. Before I had to type in a long password to decrypt my SSH key. Now it's stored on a YubiKey, protected by a shorter PIN, and requires a physical touch to perform cryptographic operations. By moving cryptographic secrets from a system with a large attack service (the laptop) to a device which requires physical access and has a smaller attack service(the yubikey), I find the system is easier to use, while increasing security.

One could argue a lack of security can lead to a decreases usability. Ex, a system under a successful DoS attack makes the system not very useable. I digress though, as I do not believe this is what you were getting at.

I've been thinking about security and usability for a while. IMO a big part of use-ability issues are related to interfaces people have to interact with. This is mainly concerning authentication and crypto related processes.

I generally like the idea of smartcards, or having some physical thing you carry around which is used to authenticate with systems.