philodeon

This is an interesting tale, because Drunkenbatman ducked out of public view after he gave a speech at the C4 conference which we would now call “woke”. He called everyone in the room racists because there weren’t many bl*ck Apple customers or developers, and in 2007, you were allowed to disagree with such ideas.

https://redsweater.com/blog/383/drunkenbatman-is-not-a-racis...

But as of the M4 Macs, Apple is preventing the Asahi team from learning how the drivers work with a “bug” in the bootloader: https://social.treehouse.systems/@sven/114278224116678776

The audience was real for the Statue of Liberty. The “magic” was developing ball bearings smooth enough to allow the audience’s seating to be turned without them noticing, in order to give them the same view as the television audience.

Yes, the myth of Linux kernel security is just that, a myth.

Dude, the Laundry is trying to relax on the weekend. Don’t make them call the Plumbers out.

Isn’t that what the vows were for?

Just as movie stars get paid a lot to compensate for dealing with the unpleasant life-ruining consequences of fame, CEOs get paid a lot to compensate for the monotony.

Given that the researchers published working exploits that you can modify for your own use, it’s PR.

Yes, the Asahi Linux reverse engineers said in their commit message for the Linux apple-nvme driver:

“Add a driver for the NVMe storage controller integrated on Apple SoCs. This NVMe controller isn't PCI based and deviates from the NVMe standard in its implementation of the command submission queue and the integration of an NVMMU that needs to be managed. This commit tweaks the core NVMe code to support the linear command submission queue implemented by this controller. But setting up the submission queue and managing the NVMMU controller is handled by implementing the driver ops that were added in an earlier commit.“

The NVME controller on Apple Silicon is not PCI-based, so there are no pcie lanes going to the storage chips at all.

“Words ought to be a little wild, for they are the assaults of thoughts on the unthinking.”

—-John Maynard Keynes

Diversity is about enjoying the benefits of a team filled with different perspectives.

Discussing how those perspectives might vary is very, very prohibited.

The actual logical problem I was pointing out was in tptacek’s implied argument that “if a field is 80+% one gender, the only possible explanation is that the dominant gender is gatekeeping the minority gender”.

“Veterinary medicine has been predominantly female in the US since 2009. That trend is continuing, with 87.3% of current veterinary school applicants identifying as female, as well as 88% of veterinary technicians.”

(Source: aaha.org)

Given that the gender imbalance in physics/engineering/CS is always blamed on men pressuring women against participating, one wonders, what kind of monstrous women are gatekeeping the veterinary field, and what kind of harassment are they inflicting on men who try to participate?

I think that McCartney’s performance of Wonderful Christmastime is absolutely dreadful.

The song itself is not bad. This can be demonstrated by listening to Tuxedo cover it (it’s on YouTube)

To sum up the HN wisdom on Apple Silicon Macs:

Before the M4 models: omg, Apple only gives you 8GB RAM in the base model? Garbage!

After the M4 models: the previous laptops were so good, why would you upgrade?

The stereotype sounds way more homophobic to me than racist…

Book recommendation for you: “IBM And The Holocaust” by Edwin Black.

If IBM (then known as Hollerith) could do that much damage with German census data on punchcards…

Two-word phrases are rarely preferable to a single word. So let’s just use “hybristophilia” instead.

> It is literally the worst plan, because it leaves every PQC-protected system in the world exposed to _everybody in the world_.

No, it leaves every SIKE-protected system in the world exposed to _everybody who reads obscure algebraic geometry papers from 1997._ We got really lucky that the two dorks who do read those papers decided to share their insights.

For all you know, there’s a paper sitting at the Institute For Advanced Study that would let you write a marvelous pq-crystals-shattering Python script, but they’ll never tell you the combination to the safe.

(Again: TAOSSA contained 0day exploits, and few noticed for a decade.)

You obviously know that the Python script wasn’t submitted to NIST along with the draft standard.

Is Dual-EC-DRBG fine because we never saw the FVEY Python exploit that breaks it?

I think my theory here is that NSA coordinated an action whereby they figured no one was reading obscure algebraic geometry papers from 1997. In our low-attention-span world, it’s not the worst plan.

(Hell, folks didn’t realize TAOSSA contained 0day for a long time. Simply putting something in front of the public doesn’t mean they’ll read or comprehend it.)

A wonderful question that exposes me to legal action if I answer.

A better question: why do you think so many of your cryptographic feline friendz were so excited about isogenies for the past decade? Where do you think they all obtained that identical enthusiasm from? Why do you think SIKE made it so far in the contest and only got eliminated through luck?

NIST didn’t design Dual-EC, NSA did. But NIST did the really hard work, which involved slapping their organization’s name on it, and not asking any inconvenient questions.

Thankfully we found a better way that ensures cryptographic security, which is to get former NSA interns to write the PQC standards, instead of proper NSA employees.

And now you believe it’s impossible for any of the NIST PQC submissions to have been backdoored or weakened. I feel safer already. :D

> and doing what they did with Dual-EC, where it was impossible (apparently) for people to reason about what NSA was up to.

Schneier was clearly able to reason about what NSA was up to, and told everyone in 2007 not to use Dual-EC, 6 years before the Snowden revelations.

I believe you have admitted that you thought that “Dual-EC has a backdoor” was a wild conspiracy theory until the Snowden revelations? Which makes the “impossible (apparently)” part a classic case of projection.

If you’d like to see a pervasive cult of personality in South Korea, check out the Unification Church.

Port knocking is a ludicrous security measure compared to the combination of: * configuring sshd to only listen over a Wireguard tunnel under your control ( or letting something like Tailscale set up the tunnel for you) * switching to ssh certificate authn instead of passwords or keys

Calling this a “detailed review” of two laptops when the author continually asserts that they don’t use their laptops as a laptop is pretty audacious.

To me, this article seems designed to train junior employees to be more exploitable by the tech sector’s psychopathic managerial class.

It’s an interesting choice to announce a brand-new standard for privacy guarantees regarding AI/ML queries…

…then announce a partnership with ChatGPT.