Gaelan

3 yıl öncediscuss

Yes (from the Google blog post linked elsewhere in the thread):

> CVE-2022-42856, a WebKit remote code execution exploiting a type confusion issue within the JIT compiler (0-day at time of exploitation).

Lockdown mode disables the Webkit JIT.

Gaelan

4 yıl öncediscuss

Routing numbers aren't, but account numbers are: traditionally in the US it's possible to use a routing+account number to withdraw from someone's account.

Gaelan

4 yıl öncediscuss

Perhaps even more evil:

kill -SEGV $1

Gaelan

4 yıl öncediscuss

Looking at the contents of the macOS installer (I haven't tried to run it), it seems to be both. Looks like it's based on https://www.cabbageaudio.com?

Gaelan

4 yıl öncediscuss

Well yes, but GTK and Qt apps feel about as native on macOS as Electron apps do.

Gaelan

4 yıl öncediscuss

Isn't Edge just Chromium these days? The page you linked says:

> Evergreen distribution. Rely on an up-to-date version of Chromium with regular platform updates and security patches.

Gaelan

4 yıl öncediscuss

> probably prone to issues if you can’t update multiple as part of the same transaction

IIRC one of FoundationDB's features is that it does support such transactions, so you can easily implement indexing on top of it.

Gaelan

4 yıl öncediscuss

This is essentially doing that—it would allow browsers to parse and run TypeScript. What it isn't doing is actually having browsers do type checking, for good reason: the TypeScript type checker is a large and complex piece of software, so browsers would either have to incorporate it (and they're probably not excited to have a large chunk of JS code in the critical web-page-rendering path, nor would they be excited to have a critical chunk of the browser with a single implementation), or reimplement it themselves (which would be a huge amount of work, and make changes to the language much slower and more difficult).

Gaelan

4 yıl öncediscuss

> I am not claiming that running on an OS is the same as dynamically linking with a library

In pretty much any case, it literally is: you're dynamically linking against the libc. This is a little fuzzier on Linux (because, as you mention, multiple libc implementations exist), but on Windows, macOS, and the BSDs, the only supported way to make syscalls is to make calls into a dynamically linked libc, provided by the operating system.

Gaelan

4 yıl öncediscuss

Laptops have batteries, so an AC power failure doesn't mean they immediately crash: they just keep running on battery until the battery gets low, at which point the system cleanly hibernates.

Gaelan

4 yıl öncediscuss

  +-----------------------------------------------------------------------------+
  | You are entering the operating system shell. By confirming this action in   |
  | the appliance shell you have agreed that THIS ACTION MAY VOID ANY SUPPORT   |
  | AGREEMENT. If you do not agree to this -- or do not otherwise understand    |
  | what you are doing -- you should type "exit" at the shell prompt. EVERY     |
  | COMMAND THAT YOU EXECUTE HERE IS AUDITED, and support personnel may use     |
  | this audit trail to substantiate invalidating your support contract. The    |
  | operating system shell is NOT a supported mechanism for managing this       |
  | appliance, and COMMANDS EXECUTED HERE MAY DO IRREPARABLE HARM.              |
  |                                                                             |
  | NOTHING SHOULD BE ATTEMPTED HERE BY UNTRAINED SUPPORT PERSONNEL UNDER ANY   |
  | CIRCUMSTANCES. This appliance is a non-traditional operating system         |
  | environment, and expertise in a traditional operating system environment    |
  | in NO WAY constitutes training for supporting this appliance. THOSE WITH    |
  | EXPERTISE IN OTHER SYSTEMS -- HOWEVER SUPERFICIALLY SIMILAR -- ARE MORE     |
  | LIKELY TO MISTAKENLY EXECUTE OPERATIONS HERE THAT WILL DO IRREPARABLE       |
  | HARM. Unless you have been explicitly trained on supporting this            |
  | appliance via the operating system shell, you should immediately return     |
  | to the appliance shell.                                                     |
  |                                                                             |
  | Type "exit" now to return to the appliance shell.                           |
  +-----------------------------------------------------------------------------+

Cleaned up formatting

Gaelan

5 yıl öncediscuss

Surely a reasonable court would say that it's very clear what they meant?

Gaelan

5 yıl öncediscuss

Note that they halved the project size in 2021, so the new project sizes are the original pre-2021 size, and the smaller 2021 size.

Gaelan

5 yıl öncediscuss

I'm not too familiar with this, but my understanding is that the push notification just wakes up the Signal app, then the Signal app gets the encrypted message (either from Signal's servers or the push notification payload, I'm not sure) and decrypts it client-side and provides the notification text.

Gaelan

5 yıl öncediscuss

Generally, the idea is that you use a small amount of unsafe code to build a safe abstraction to do what you need, then use that abstraction in many places. So now you only have a few unsafe sections you have to verify for correctness, instead of the entire program like you'd need in C/C++.

Gaelan

5 yıl öncediscuss

@dang could you give "world.hey.com/foo" URLs the GitHub/Twitter treatment where it shows the first segment of the path?

Gaelan

5 yıl öncediscuss

> (unless you remapped another key to capslock (why?))

When I first started doing caps-lock-to-control, I mapped my physical control key to caps lock. Eventually, I stopped bothering and kept it as control.

Gaelan

5 yıl öncediscuss

> Thumb adds many additional instruction encodings of variable length, load/store multiple already had pretty arbitrary latency

Worth noting that, AFAIK, both of these were removed on aarch64 (and aarch64-only cores do exist, notably Amazon's Graviton2)

Gaelan

5 yıl öncediscuss

https://gitlab.com/crev-dev/auto-crev-proofs is an identity that automatically trusts every known reviewer (at level "none"), which is useful for finding reviewers. You can also browse all known reviews online at https://web.crev.dev/rust-reviews/.

Gaelan

5 yıl öncediscuss

I don't think it was MS that did that, just sloppy third-party developers.

Submissions

No Ghosts

ZeroVer

Show HN: How many tabs does Gaelan have open right now?

Ask HN: ReCAPTCHA Alternatives?

Journalist stopped by US border agent 'for being part of fake news media'

Public Statement

Show HN: WordGit – Git diff and merge on Word docs, using Word's native support

Snapchat is down

You Can Trick Self-Driving Cars by Defacing Street Signs

Apple will let developers reply to reviews soon for iOS and Mac apps

Visual Studio for Mac (leaked then pulled)

Analysts: No hope for TPP after Trump win

Former NSA staffer demonstrates Mac malware that can tap into live webcam feeds

Study that found cell phones cause cancer in rats is riddled with red flags

comments