Recent submissions

Comment · 2 years ago
That the process/thread enters kernel mode and then is suspended waiting for IO or for some other event. As long as the thread is running your code (or, is scheduleable) it's not blocked. And then the async implementation can ensure your code cooperatively gives up the CPU for other code.
Comment · 2 years ago
No, if the memory-mapped page you're accessing is in RAM, then you're just reading the RAM; there is no page fault and no syscall and nothing blocks.

You could say that any non-register memory access "blocks" but I feel that's needlessly confusing. Normal async code doesn't "block" in any relevant sense when it accesses the heap.

Comment · 2 years ago
It will at the very least notice that the read data does not match the stored checksum and not return the garbage data to the application. In redundant (raidz) setups it will then read the data from another disk, and update the faulty disk. In a non-redundant setup (or if enough disks are corrupted) it will signal an IO error.

An error is preferred to silently returning garbage data!

Comment · 3 years ago
I assume you mean extensions, not plugins. No, Chrome doesn't support extensions on android, but some Chromium reskins do.

That said, the most important extension usecase is adblocking, and with Manifest v4 and FLoC/Topics and SafetyNet/remote attestation, well...

Comment · 3 years ago
If a kernel with the restriction removed is compiled locally and is never redistributed, why would it be illegal?
Comment · 3 years ago
> Clearly the sync between devices works, so they have solved this problem.

Presumably they don't use CSV to sync, they're using a saner json/etc. data structure that they're not letting us export ourselves. Seriously, being limited to CSV in this day and age...

Comment · 4 years ago
Should say, [2007]
Comment · 4 years ago
How can the employer prove a negative?

At most I imagine the plaintiff is allowed to do discovery, and then has to prove positive discrimination based on that.

Comment · 5 years ago
I got a papercut and I'm made out of meat!
Comment · 5 years ago
The second link doesn't mention "as-is", the first one does. I'll assume that's what you meant. It says,

> Though manufacturers cannot so easily escape liability, sellers can escape liability by informing the customer before the purchase that a product must be taken "as-is,” which means how the product was found when it was purchased in-store. “As-is” works because the buyer has an opportunity to inspect the product and decide whether to buy it given its condition.

On that analogy, Github and RedHat aren't liable, but the original author of the software still is.

Comment · 5 years ago
Comment · 5 years ago
He posted again later clarifying which systems and configuration were vulnerable:

https://twitter.com/aionescu/status/1393955460517040129

> * AMD Zen "Summit Ridge" Stepping B1. That is Ryzen's 1xxx series.

> * AMD Zen2 "Matisse", "XT" series only. That is Ryzen's 3xxx series.

Other info at:

https://twitter.com/aionescu/status/1394039410300051456 https://twitter.com/aionescu/status/1394359314102427650 https://twitter.com/aionescu/status/1394359317038452738

Regardless, the vulnerability is in the driver, not the CPU / microcode. Also in the WHQL process that signed such a 'fake' driver. Until the signature is revoked, it might be possible for an attacker to manually install the signed driver on other system configurations too.

Comment · 5 years ago
He also says,

> But even better, it has a security descriptor allowing Everyone + Low IL R/W Access, and an IOCTL interface with absolutely no Probes/SEH, which yes, dereferences wild pointers. They don't even bother checking for input size or output sizes.

If that's true of the driver, then it's a sec vuln regardless of what the MSR bit does or doesn't do, no?

Comment · 5 years ago
Governments that issue patents on math/algorithms/software already claim the power to forbid you to use them. They just need to patent all public encryption algorithms, in perpetuity.

(Sarcastic? Who knows?)

Comment · 5 years ago
It's been proposed before! https://www.jpost.com/opinion/an-israeli-suez-canal-393225

It would be less than 3x the length, not 10x. The mountains are a problem; it could go around but would still need to dig a lot. And it doesn't seem feasible politically right now, but it could be a really cool project.

(If it was built, then a side-canal to irrigate the Dead Sea would be a relatively cheap value-add.)

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton