Readit News logoReadit News
cestith commented on The RCE that AMD won't fix   mrbruh.com/amd/... · Posted by u/MrBruh
thedanbob · 2 days ago
The update check is HTTPS, only the files themselves are HTTP.
cestith · 2 days ago
TLS doesn’t mask the IP of the server. The updater probably isn’t using DNS over HTTPS. If I can determine that a user’s updater just hit the update check server, I can start impersonating the update server.

That takes it out of the one day away territory, but it does allow an attacker to only have a malicious HTTP capture up and detectable during the actual attack window.

Then, of course, if you’re also being their DNS server you can send them to the wrong update check server in the first place. I wonder if the updater validates the certificate.

cestith commented on GOG: Linux "the next major frontier" for gaming as it works on a native client   xda-developers.com/gog-ca... · Posted by u/franczesko
akdev1l · 9 days ago
Companies can already do that. This is how redhat works in its entirety.

This has nothing to do with the base distribution

cestith · 2 days ago
I don’t remember ever having to activate a piece of RedHat code after downloading it. I do remember paying a subscription to have authentication to particular repos. It’s been a while, though.
cestith commented on 1 kilobyte is precisely 1000 bytes?   waspdev.com/articles/2026... · Posted by u/surprisetalk
cmovq · 5 days ago
The mistake was using the "Kibi" prefix. "Kibibyte" just sounds a bit silly when said out loud.
cestith · 4 days ago
I usually just say kilobyte when speaking, and say “binary kilobyte” or “decimal kilobyte” if it’s not clear from context. I still (usually, but I forget) use the IEC symbols when I mean binary and the SI symbols when I mean decimal. The extra ‘i’ doesn’t cost that much.
cestith commented on GOG: Linux "the next major frontier" for gaming as it works on a native client   xda-developers.com/gog-ca... · Posted by u/franczesko
TingPing · 9 days ago
It makes zero sense for traditional distros to have payments. They exclusively repackage software. You want direct to customer platforms (Snap, Flathub, etc).
cestith · 9 days ago
The dnf, deb, or pacman tools could point to a repo where the packages have paid activation.
cestith commented on Russia using Interpol's wanted list to target critics abroad, leak reveals   bbc.com/news/articles/c20... · Posted by u/breve
JasonADrury · 12 days ago
Besides, you'd probably want to know about a blue notice.
cestith · 12 days ago
I’d like to know if I’m the subject of any of the Interpol notices. That is, unless it’s a Black Notice and it’s correct. Then I couldn’t really care. Even that one, though, if my name’s attached and it’s wrong that seems really bad.

https://en.wikipedia.org/wiki/Interpol_notice

cestith commented on Russia using Interpol's wanted list to target critics abroad, leak reveals   bbc.com/news/articles/c20... · Posted by u/breve
ljsprague · 12 days ago
Do we believe some countries' spy agencies are scrupulous?
cestith · 12 days ago
I think people tend to have a range of scruples they expect. How someone is targeted is often far more lax on standards than who is targeted and for what reasons.
cestith commented on Why does SSH send 100 packets per keystroke?   eieio.games/blog/ssh-send... · Posted by u/eieio
mgiampapa · 16 days ago
56k was also unidirectional, you had to have special hardware on the other side to send at 56k downstream. The upstream was 33.6kbps I think, and that was in ideal conditions.
cestith · 16 days ago
The special hardware was actually just a DSP at the ISP end. The big difference was before 56k modems, we had multiple analog lines coming into the ISP. We had to upgrade to digital service (DS1 or ISDN PRI) and break out the 64k digital channels to separate DSPs.

The economical way to do that was integrated RAS systems like the Livingston Portmaster, Cisco 5x00 seriers, or Ascend Max. Those would take the aggregated digital line, break out the channels, hold multiple DSPs on multiple boards, and have an Ethernet (or sometimes another DS1 or DS3 for more direct uplink) with all those parts communicating inside the same chassis. In theory, though, you could break out the line in one piece of hardware and then have a bunch of firmware modems.

cestith commented on cURL removes bug bounties   etn.se/index.php/nyheter/... · Posted by u/jnord
capitainenemo · 17 days ago
Amusingly, exactly opposite experience here. That said, our on-prem is jira and confluence integrated with db on same machine, and apache in front doing additional caching. I imagine like so many things it is how you set it up...
cestith · 16 days ago
If you read my previous comment, I said it was largely the specific poor plugin that caused most of the performance issue with the database queries. I never complained about the overall speed of on-prem Jira. That was the assertion of the person who’s only ever used the cloud version.
cestith commented on cURL removes bug bounties   etn.se/index.php/nyheter/... · Posted by u/jnord
arionmiles · 18 days ago
You're referring to the on-prem Jira. That might suck, sure. My experience has been purely using Jira Cloud and Confluence Cloud, both of which I've found to be snappy and responsive.
cestith · 16 days ago
My last company switched several teams to Jira Cloud. My current company started with Cloud when we moved over from other tools.

Cloud does not give you the flexibility of your own plugins, your own redundancy design, or your own server upgrades. On top of that, the performance is pretty variable and is far worse than a self-hosted Jira on fast hardware.

It’s interesting to me that your lack of experience to make a comparison qualifies you in some way to criticize the experience I actually have.

cestith commented on cURL removes bug bounties   etn.se/index.php/nyheter/... · Posted by u/jnord
epolanski · 18 days ago
The purpose of a tool is important.

Guns have no other purpose than doing harm.

E.g. We don't blame cars, the tool, for driving into a gathering of people that can kill a dozen of them, we blame the driver. The purpose is transport, the same way LLMs for coding are a tool for assisting coding tasks.

cestith · 18 days ago
Technically an LLM is a tool for extracting candidate responses to plain-text requests. Since (textual) programming languages are languages, they can create passable candidate responses to queries about those. Certain LLMs such as Copilot and Claude have had their training focused a bit more towards programming tasks, but saying that LLMs as a class are for coding assistance is a little narrowly stated.

It would maybe be handy to feed the responses from an LLM through a computational reasoning engine to grade a few of them.

u/cestith

KarmaCake day2596February 4, 2008
About
i fix things
View Original