J-Kuhn

Unfortunately, the EU is currently developing their age-verification-app, and it mandates hardware attestation[1], and it seems that their reference implement those requirements using Play Integrity[2].

[1]: https://news.ycombinator.com/item?id=49148128 [2]: https://github.com/eu-digital-identity-wallet/av-doc-technic...

Comment · 2 months ago

Yeah, its the "well, legally, we have to provide the source code, but we make it as painful and slow for you as we can without it becoming a blatant violation of the GPL."

Comment · 2 months ago

Alternative Phone Line? You want the bootstrapping problem?

Comment · 3 months ago

Exactly.

You can make it not throw by adding `--add-opens java.base/java.lang=ALL-UNNAMED` or similar to the command line, but breaking things like this is becoming harder.

Comment · 3 months ago

For me, Nix(OS) solved most of the problems:

* Getting a dev env with `nix-shell -E '(import <nixpkgs> {}).somePackage'` where I can edit the source and compile it with the various `runPhase` commands[1]. Yes, a bit cumbersome, but it works and it is the same for all packages.

* Integrating the resulting patch into the package manager using overrides[2]. Sure, applying the patch may break at some point, but I am more comfortable reviewing that by hand than rely on an agent that does it for me.

[1]: https://wiki.nixos.org/wiki/Nixpkgs/Create_and_debug_package... [2]: https://wiki.nixos.org/wiki/Overlays#Adding_patches

Comment · 3 months ago

Before openjdk did move to github, they made sure they had a solution for those problems:

* Contributors without github accounts * Moving away from github (when needed) * No vendor lock-in for github stuff.

I personally think, this is a good idea - a lot of work, but may be worth it in the long run.

Comment · 3 months ago

The problem is not that the array is mutable, but that the size of the array may differ for different strings. (In fact, it usually* does differ if the string length is different).

This makes it impossible to flatten - as the VM needs to know the total size when creating the memory layout for a class...

* (with a small exception: if the strings use different coders, one can be twice as long and the backing arrays would still have the same size)

Comment · 3 months ago

Such hacks will slowly stop working (without explicitly allowing it from the command line.)

In this example, it would throw an IllegalAccessException, because java.base doesn't open java.lang.

Comment · 3 months ago

I changed the sudo settings to not require a password.

Now an application on my computer can obtain root without user interaction.

Where is my CVE?

Comment · 3 months ago

By some logic:

* If they want to tell someone personally what to do or not to do, is some form of employment.

* If it is not paid, it can be considered slavery.

* It is usually possible to quit jobs.

Comment · 3 months ago

Systemd (part of many major linux distributions) has for example machine-id[1], readable by anyone on the machine under /etc/machine-id.

[1]: https://www.freedesktop.org/software/systemd/man/latest/mach...

Comment · 4 months ago

Sarcastic view: Doesn't matter - the EU wont listen, then pull a surprised pikachu and make laws to force googles play integrity to attest that other devices are genuine, because obviously, the problem is google, not stupid design decisions made while creating the app.