2,656 karma · joined August 8, 2018
Linux kernel is one of the most audited open-source projects ever. I guarantee you that someone did reverse the patch.
> but forgot to tell the distros
Probably an oversight, but irrelevant. The bug was in the linux kernel. It's insane to suggest that they should have notified everyone shipping the linux kernel.
Considering that the patches have been available for a while, someone surely reversed what they were for and was actually exploiting this in the wild.
In the age of AI, I’d argue that “responsible disclosure” is dead. Arguably even in closed source projects. Just ask Claude to do a diff between the previous version and to see whether anything fixed in there could have had security implications.
We’re not there yet, but very soon the only way to responsibly disclose a vulnerability will be immediately.
USB 4 is actually going into an even worse direction. USB 4 = Thunderbolt 4, except everything is optional. e.g. USB 4 might not even support DP Alt mode. Thunderbolt 4 always will.
Except active optical cables. None exist yet that I'm aware of though.
They are everywhere. It's a global carrier. Carriers also know no geographic boundaries.
And yes, absolutely. All you need is a bootchain exploit. However unlike in the old jailbreaking days when people found and publicized them for fun, these days they are worth millions. Apple will pay you $500k for sandbox escape into the kernel. If you nail the bootchain, it'll be in the millions. From Apple. And god knows how much such a thing would go for in the black market.
Not always + there are no consequences whatsoever.
Plenty of leasing services will just provide you with IRR & RPKI, without ever touching the actual records.
> Ping time from different locations on their upstream AS gives a good guess.
Upstream AS is meaningless if it's a T1 carrier. Ping AS6939. They are everywhere.
That’s been the case for 5+ years :)
How do you determine to whom an IP is even registered to? They get sub-leased all the time.
The best you can do is check who has administrative control over the prefixes RIR info, but that doesn’t mean that anyone with control is the factual user of the IPs.
You could check the IRR for the ASN and base it on that, but still.
There's also no way to actually know _where_ an IP actually originates from. Only its AS path.
The DFZ contains all prefixes announced everywhere, for the internet is completely decentralized.
what do you mean, IPs from Frankfurt?
IP addresses are just IP addresses, they know no geographical boundaries. In RIR DBs you can geolocate them to wherever you want. Which is the entire reason why Geo IP DBs even exist - they triangulate.
The other week I had a fun project to implement IPv6 support in TempleOS. I did stop to think whether I should, and determined that absolutely not.
I asked Claude to start planning on doing it. It started referencing ZealOS, which is a fork of TempleOS and already has a functioning TCP stack.
That's when I determined that it would no longer even be fun, because someone else had already done all the heavy lifting, and gave up.
But with bioweapons, yeah, that should be a solid zero. The ones actually doing it off an AI prompt aren't going to have access to a BSL-3 lab (or more importantly, probably know nothing about cross-contamination), and just about everyone who has access to a BSL-3 lab, should already have all the theoretical knowledge they would need for it.
There are several open source models with no built in (or trivial to ecape) safeguards. Of course they can afford that because they are non-commercial.
Anthorpic can’t afford a headline like “Claude helped a terrorist build a bomb”.
And this whataboutism is completely meaningless. See: P. A. Luty’s Expedient Homemade Firearms (https://en.wikipedia.org/wiki/Philip_Luty), or FGC-9 when 3D printing.
It’s trivial to build guns or bombs, and there’s a strong inverse correlation between people wanting to cause mass harm and those willing to learn how to do so.
I’m certain that _everyone_ looking for AI assistance even with your example would be learning about it for academic reasons, sheer curiosity, or would kill themselves in the process.
“What saveguards should LLMs have” is the wrong question. “When aren’t they going to have any?” is an inevitability. Perhaps not in widespread commercial products, but definitely widely-accessible ones.
What line are we talking about?
Granted, they are slowly but surely killing it, but it’s still going quite strong.
But it's make-believe. Tesla is a car manufacturer. They haven't shipped anything else other than cars. And they even suck at making cars these days. Tesla Semi? All but dead. The new roadster? Also dead. Full Self Driving? Doesn't exist. Robotaxis? Even if they got them to work, at this point the brand is too toxic for widespread adoption of those.
They could have persisted at being a disruptive car manufacturer and still held a several hundred billion dollar valuation. Now they are a very mediocre car manufacturer, with their only actual success being conning everyone into believing that they are a bleeding-edge tech company so their $1.5Bn valuation seems justified.
For many people, the very term EV itself is still ubiquitous to Tesla.
And somehow Tesla is still worth more than every other non-Chinese automaker combined. $1.5T.
GM? $80B. Stellantis? $40B. Toyota? $280B. Mercedes-Benz? $60B. BMW? $55B. Volkswagen Group? Also $55B.
I’m sure I’ve missed plenty of others, but I could miss some 18 $50B automakers, and Tesla would still be worth more than all of them combined.
If Tesla was valued fairly, it would probably be at the tune of $5B. But I’ll never bet against it, because the markets can remain irrational for longer than I can remain solvent. And for some unbeknownst to me reason, the markets value Tesla as a hot tech company, not a 3rd rate automaker, which is what it actually is.
And to add insult to injury, even GM Super Cruise is widely renowned as better and safer than Tesla’s current “FSD”.
You run your Windows Server as a DHCP server? That's $5/mo for the clients to get a DHCP lease.
Of course, one CAL covers all services for the entire client, but it's still funny to me.
Oh wow, I hadn't even paid any attention to that. To me Windows 11 was released on October 1, 2024, when the LTSC version came out, and is roughly when I upgraded my gaming PC to the said LTSC build from the previous Windows 10 LTSC build.
Vista is different. Vista was _not_ bad. In fact, it was pretty good. The design decisions Microsoft made with Vista were the right thing to do.
Most of the brokenness that happened on Vista's release was broken/unsigned drivers (Vista required WHQL driver signing), and UAC issues. Vista also significantly changed the behavior of Session 0 (no interaction allowed), which broke a lot of older apps.
Vista SP2 and the launch version of 7 were nearly identical, except 7 got a facelift too.
Of course, the "Vista Capable" stickers on hardware that couldn't really run it didn't help either.
But all things considered - Vista was not bad. We remember it as bad for all the wrong reasons. But that was (mostly) not Microsoft's fault. Vista _did_ break a lot of software and drivers - but for very good reasons.
If anything, they are evidence that serious attempts are foiled by intelligence services long before the perpetrators get anywhere near an airport, and the others were just incompetent idiots.
have there?
It's not your connection. It's your ISPs. They are also their IPs.
> Noone has a right to dictate what services I run or don't run, what protocols I speak or don't speak, what traffic I accept or deny, but me. That's the whole point of being on the internet rather than Prodigy or Compuserve or something.
Then become your own ISP. Get an ASN (easy), acquire your own IPv4 and IPv6 space (also easy, but v4 is expensive), get a commercial connection that'll allow for BGP, and go ahead, do whatever you want with your IP addresses.
> The physical location of that connection is irrelevant.
It's not about the physical location, it's about who's IP addresses are you using. If they are not yours, the service provider has every right to restrict what you do with them.
This one I actually agree with.
There are no sane and legitimate reasons for running an SMTP server on a residential connection. Even most server providers will block it unless you give them some very good reasons.
Blocking 53 is just weird though.