Gaelan (u/Gaelan) - Readit News

Gaelan commented on Spyware vendors use 0-days and n-days against Android, iOS and Chrome blog.google/threat-analys... · Posted by u/satoshiiii

varenc · 3 years ago

Is there any indication if iOS’s Lockdown Mode[0] would have stopped these exploit chains?

[0] https://support.apple.com/en-us/HT212650

Gaelan · 3 years ago

Yes (from the Google blog post linked elsewhere in the thread):

> CVE-2022-42856, a WebKit remote code execution exploiting a type confusion issue within the JIT compiler (0-day at time of exploitation).

Lockdown mode disables the Webkit JIT.

Gaelan commented on FedNow FAQ federalreserve.gov/paymen... · Posted by u/hnburnsy

miohtama · 3 years ago

Why bank routing numbers would be sensitive? Aren’t they public information?

Gaelan · 3 years ago

Routing numbers aren't, but account numbers are: traditionally in the US it's possible to use a routing+account number to withdraw from someone's account.

Gaelan commented on Killbutmakeitlooklikeanaccident.sh gist.github.com/moyix/95c... · Posted by u/app4soft

Gaelan · 3 years ago

Perhaps even more evil:

kill -SEGV $1

Gaelan commented on The Kia Instrument kia.com/us/en/movement/ou... · Posted by u/rgbrgb

djxfade · 4 years ago

I couldn't find any details on the website. Is this a VST/Audio Unit or a standalone application?

Gaelan · 4 years ago

Looking at the contents of the macOS installer (I haven't tried to run it), it seems to be both. Looks like it's based on https://www.cabbageaudio.com?

Gaelan commented on Why Remotion is a native macOS app, not Electron remotion.com/blog/why-rem... · Posted by u/ushakov

throw10920 · 4 years ago

No, this isn't a reason. They're Mac-only because they used Cocoa, which is exclusive to macOS. If they'd used GTK or Qt they could have shared 90% of their application code between at least the three major desktop operating systems, without using Electron.

Gaelan · 4 years ago

Well yes, but GTK and Qt apps feel about as native on macOS as Electron apps do.

Gaelan commented on Why Remotion is a native macOS app, not Electron remotion.com/blog/why-rem... · Posted by u/ushakov

flanbiscuit · 4 years ago

Teams 2.0 in Windows is moving away from Electron but still using web based technology. It's not going to use Chromium to render, it'll use Edge Webview2 that comes with the OS.

https://techcommunity.microsoft.com/t5/microsoft-teams/teams...

https://docs.microsoft.com/en-us/microsoft-edge/webview2/

Gaelan · 4 years ago

Isn't Edge just Chromium these days? The page you linked says:

> Evergreen distribution. Rely on an up-to-date version of Chromium with regular platform updates and security patches.

Gaelan commented on FoundationDB: A distributed unbundled transactional key value store muratbuffalo.blogspot.com... · Posted by u/eatonphil

travisd · 4 years ago

i’m also not a db engineer, but i think this is true-ish. however building and maintaining those index tables is hard and probably prone to issues if you can’t update multiple as part of the same transaction.

the other major thing you’d miss is smarter joins. the distributed databases do a lot of work to be able to push down predicates as far down as possible to the physical nodes storing the data.

there’s probably more as well.

Gaelan · 4 years ago

> probably prone to issues if you can’t update multiple as part of the same transaction

IIRC one of FoundationDB's features is that it does support such transactions, so you can easily implement indexing on top of it.

Gaelan commented on A Proposal for Type Syntax in JavaScript devblogs.microsoft.com/ty... · Posted by u/soheilpro

frankjr · 4 years ago

Why not support TypeScript natively in browsers instead?

Gaelan · 4 years ago

This is essentially doing that—it would allow browsers to parse and run TypeScript. What it isn't doing is actually having browsers do type checking, for good reason: the TypeScript type checker is a large and complex piece of software, so browsers would either have to incorporate it (and they're probably not excited to have a large chunk of JS code in the critical web-page-rendering path, nor would they be excited to have a critical chunk of the browser with a single implementation), or reimplement it themselves (which would be a huge amount of work, and make changes to the language much slower and more difficult).

Gaelan commented on Linux's GPLv2 licence is routinely violated (2015) devever.net/~hl/linuxgpl... · Posted by u/ladyanita22

tsimionescu · 4 years ago

Let's imagine the following scenario. I am creating and distributing a program that, when run on a user's system, will dynamically link with a copy of libc. I am not distributing this copy, but my program will fail to run if no such copy exists. Furthermore, I tell my customers that the only lib C I officially support is FictitiousLibC, released under the full GPL (not the LGPL like the real GNU Libc).

The question is now: am I breaking any laws by delivering my program this way? According to the FSF, which believes an explicit linking exception to the GPL is needed - the LGPL - for such uses, then YES, I am breaking the copyright of FictitiousLibC, and so would need a license from FicititiousLibC to be allowed to distribute my code. But, if copyright law actually says "no, your program is NOT a derived work of FictitiousLibC", then the license is not needed. I don't know if this has ever been tested in court, but nothing would stop Congress from explicitly legislating this way and basically removing the difference between GPL and LGPL.

For an example of where this sort of logic applies is building programs to be run on an OS. If I build a program that only runs on Windows, but don't include any of Microsoft's code in my program, it is well established that my program is not a derived work of the Windows OS, so I can freely distribute it under any terms I want (not that Windows is special, the same is true of Linux or iOS or any other OS). I am not claiming that running on an OS is the same as dynamically linking with a library, just that in general something can be related to a copyrighted work without becoming a derived work by virtue of copyright law, not license terms.

Edit: note that if I want to distribute a bundle of my program + FictitiousLibC, that may infringe on FLC's license even if my program alone wouldn't, as FLC's license's terms of what constitutes a derived work could, in that case, go beyond copyright law definitions, and I would obviously need that license to be allowed to re-distribute FLC.

Gaelan · 4 years ago

> I am not claiming that running on an OS is the same as dynamically linking with a library

In pretty much any case, it literally is: you're dynamically linking against the libc. This is a little fuzzier on Linux (because, as you mention, multiple libc implementations exist), but on Windows, macOS, and the BSDs, the only supported way to make syscalls is to make calls into a dynamically linked libc, provided by the operating system.