bri3d

It is? This is drm-panic qr codes from Linux 6.12. It’s a neat feature but I’m not sure why this random implementation is particularly interesting.

Is there any information about the touchscreen digitizer technology? My understanding is that there are a few different ways touchscreens are integrated into OLED panels (on-cell, in-cell, external grid). I have a Dell 16" laptop with a 4K OLED which happened to come with a touchscreen; I'm not mad about the touch features themselves (although I rarely if ever use them), except, the "on-cell" touchscreen digitizer is slightly visible under some conditions and because the display is otherwise so flawless and amazing, it's pretty annoying.

He also removed the people selling the ads and the people working on the ad targeting platform, mind you. I think that's what differentiates from a normal "PE gutting/squeeze" and what people should be analyzing, but everyone (from "both sides" of the Musk equation) gets caught up on the uptime number for some reason.

Which is where I was going with my (original) post - but the GP post seems to be using this as evidence to disagree, which is confusing.

I strongly disagree with this take; do you think all companies are 80% SREs? Did Twitter make money by serving pages to users?

The Twitter exodus does relate to this, kind of; it's an example of the "fall back on existing revenue streams" strategy (you could call it a private equity playbook, but it's more universal than that) exaggerated by the guy acquiring it not needing more revenue and clobbering the revenue part too.

Twitter pre-Musk had an _enormous_ amount of experiments going on. They were building streaming services, clones of every social network you can think of (Spaces etc.), an entire sports brand around MLB, and so on and so on.

They also had an army of sales people who sold ads and an army of engineers building and optimizing an ad platform, which is (or was?) their actual business.

The "platform going down" narrative from both sides was 100% irrelevant to what was actually going on. "We laid off PMs, salespeople, and engineers and the system didn't crash" is a complete non-sequitor that should be obvious to anyone who's involved in software engineering or maintenance. If anything, I'd expect laying off most of any company to make it much more stable; when you don't change things you introduce fewer bugs.

Before getting wrapped up in the usual LLM vs anti-LLM narratives, note that like many of these recent layoffs, this is essentially reversing 2020-2022 net headcount growth.

IMO a lot of these layoffs are companies going from an experimental fiscal mindset to a conservative fiscal mindset - ie, rather than acquiring companies and hiring to grow into new markets, a lot of organizations are falling back on what they know works, independent of any productivity impact of LLMs.

For what it's worth, TPM supports session encryption, but the compatibility is poor due to bad TPM implementations (which is a whole extra can of worms), so it isn't enabled by default in most configurations. If this threat model is meaningful to you (which it probably is if you're using TPM-backed FDE), it's worth looking into what it would take to set up (and switch to fTPM if possible).

Although, if anyone wants an RE project, I've always been interested in reversing the ME <-> CPU bus on Intel to see if the ME-embedded TPM is still vulnerable to snooping. And of course all of this is still highly vulnerable to any early-boot / root of trust exploit (ie against Boot Guard / PSB or horrible UEFI firmwares).

No, I think this is a valid threat model and a good rebuttal. The evil maid steals the original laptop, replaces it with a second laptop with a look-alike PIN entry screen without an attestation. You enter your PIN, it is transmitted to the evil maid with the first laptop, and your data is unlocked. You would notice, but your data would be exposed.

Now, to be clear, I don't think this negates TPM-sealed disk encryption or TPM-and-PIN sealed disk encryption; they're still meaningfully better than the alternatives (with a passphrase alone, your data is already compromised regardless in this invented scenario, and all scenarios are equally variable to the swiss-cheesiness of UEFI firmware unless it is replaced). But it is a valid model.

Sealing to a reasonable subset of PCRs (ie, not just 7 like the article) is reasonably strong against point-in-time evil maid, no?

Like, in Evil Maid Scenario 1, where the Evil Maid only has one-time access, if you've sealed to say 0,2,4,7,9 , or 7 and 15 with a reasonable setup for what gets extended into 15, the Evil Maid's Fake PIN Entry Software would _not_ validate in the secured boot configuration and couldn't actually unseal the TPM, only coerce you into entering your PIN. Then the Evil Maid would have to physically return to your "correct" boot state with the PIN to unseal the disk, no?

(this is all modulo firmware and early boot exploits, of course, since in that case the attestation could also be forged also)

AES-CBC is unbelievably popular and relies on the AES inverse block cipher?

> this is incredible stuff...

Is it? The theory and even the implementation is literally a gas station credit card skimmer for crypto. I do agree that anyone dismissing attacks on Ledger was foolish, but mostly because Ledger is an obviously low-quality product on even a cursory inspection, not because we need to become even more paranoid conspiracy theorists.

The hardware is much more sophisticated, miniaturized, and high-speed, and the supply chain is much more generic; a Ledger is a really primitive piece of hardware with a simple display interface and a ton of empty space inside it. An iPhone has no wasted space and extremely high-speed onboard buses that would be hard to sniff. Additionally, with Ledger, you know that every customer is going to be using the device to access crypto, so it's an easy target nearer the head of the supply chain. With an iPhone, you have no idea what end-user to target the implant against.

> So at some point the vendor will go through and patch the holes which the model had exploited and they will have to rewrite their admin architecture, and maybe be liable to some fines with the chip companies if "Intellectual Property" was improperly disclosed by their failure to write good software. And are we any closer to using the products as a general purpose SDR? No, we are not.

What? It tunes and it's streaming IQ over Ethernet. It is a general purpose SDR! You can use it as a general purpose SDR immediately.

I'd like a little more information from someone who actually knew what they were doing (or even just asked Claude to write it out in more detail) about the "real" nuts and bolts of the receiver, too (how's does IQ imbalance calibration work? How much dynamic range does it really have? How much can we configure the frontend, in detail?), but I don't think it's fair to claim this project is skiddie-level or not useful at this stage just because it was written by Claude.

Also, who's going to fine Mediatek for exposing Mediatek IP?

I think the idea here is cross-platform / runtime pluggability: an app can specify what policies it needs and this thing will map those policies onto the specific runtimes available (containers or VMs). It's basically a container security policy orchestration layer, I suppose.

I agree! Don't give it away!

Seriously, though, the popular Ghidra MCP is really badly architected; it's way better to rearchitect it or just script Ghidra directly. With that said, Opus 5.5 seems to have been trained on CoT from the popular Ghidra MCP. This makes it work better, but also makes it even more inefficient if you modify the MCP without changing its name and shape significantly (it will try to make tool calls using the "mainline" format, then have to retry them when they fail).

Even with Opus 5.5, IMO it's better to just ditch the MCP and let the LLMs eat with bintools and headless Ghidra; with both GLM and Opus this produces significantly more efficient results than the popular MCP. On the other hand the IDA Pro MCP is much better architected and seems to be pretty good.