jedieaston

What happens when iOS 20 comes out and the A11 can’t run it? Is it suddenly okay then to ask Apple’s permission? I don’t think the court would hold up a bootrom exploit in an older chip as good enough for research purposes (what if an exploit only affected the A12 and A13 for some reason?)

If you require the user to hook into iTunes/Xcode, flip the device into recovery mode, click a few buttons, and agree to a "You're hecked if you break it now" policy, it'll be enough to scare off 99.9% of people from getting owned. After that, just have it work like the current profiles/supervision system where Settings makes it clear that non-verified code is running and has a big "make it go away!" button (sideloaded IPAs show up in profiles with a delete app button, and that works well enough except for the time limit).

I wonder how much people are able to publish about the device. I'd expect not much, but it'd be nice to be able to compare a iPhone that was completely unlocked (at least, to whatever that means for Apple) with whatever security they put on the ARM Macs which are supposed to be "open for hobbyists". I'd expect that the ARM Macs have much of the same security stack (by default) that iOS devices have given what they said in the WWDC talks, but maybe that's not the case.

Also, if you found an exploit on a research iPhone because you made use of entitlements that were Apple-only, I wonder if that'd be worth anything bounty wise. Nobody can/should be able to write an that'll get through App Store checks if they asked for PLZ_NO_SANDBOX_ILL_BE_GOOD or something (at least, that's what I thought before the whole Snapchat system call thing happened). But hypothetically the App Store review process is vulnerable to a bad actor inside Apple pushing an update to a big app that included malware, so I'd think that private entitlements shouldn't be available at all to binaries that didn't ship with the device/in a system update (unless some kind of hobbyist flag was flipped by the consumer). So I'd say that would be worth something, even if smaller than a more interesting exploit.

It's just annoyingly expensive for Windows boxes, with all of the licensing and stuff. Microsoft includes licenses for running VDI in Azure with Microsoft 365 now, but it still requires a full on-prem Active Directory setup (which you probably don't have if you are using Microsoft 365). And then on top of those licenses, you also have to get Citrix/VMWare licenses if you don't want to use Azure. It becomes more expensive than hiring a IT person to just manage all of the laptops you deploy everywhere (except in certain scenarios like healthcare).

I want to live in a world where we all have SunRays and I just plug in a card and show my session running in the cloud, but it's too darn expensive still (and everyone in enterprise is too scared to try and build one themselves since the big vendors have Microsoft's blessing when building their solutions). That one time I had a VDI at an internship, boy was it magical. Being able to walk into a conference room, type my password and show people something was extremely powerful.

I’m thinking that someone at Microsoft may have snuck the code for Windows into the archive after it was pulled from Github. Between Windows and OS X, a ton (most?) of the end user software would be unusable to a future generation in its original form since they didn’t have the desktop OS it was used on.

Ironically, 500 years from now, they may think that the year of the Linux desktop was 2008 :-D

Presumptively, the Tech Tree will have some way of bootstrapping a system capable of decoding the tapes. They say in the introduction that it’s nearly useless to access the tapes without a computer and that they expect whoever is reading this is to have a computer that is centuries more advanced than we have now.

Maybe they just zip tied a ThinkPad to the tape reader and pray that it can eat whatever happens to it in the vault.

I don't know, it'd probably take 18F like a month to add a page to whitehouse.gov called "Things the President said", add 2FA and whatever else it needs to be installed on his government phone, and a little bot that listens for whenever he writes something on there and tweets it on Twitter. Then you have a source of truth that we know wasn't modified between the government and the reader, and it doesn't break the social following.

But I guess its easier to just complain about Twitter.

In the other thread, this was phrased as Tesla not allowing those states to release the information of people who bought a car to third-parties because privacy. I'm sure if you wanted to take the survey in one of those states you can just reach out to JD Power yourself, they can't scrape your information though.

I feel like you could just as easily say "Simple. As soon as Google changes their cut to 20% for Android-exclusive apps, developers will move to that store to make more money. Users will follow". They won't. Users won't leave the walled garden, just as people on Android didn't leave it for Fortnite (the most popular game in the world at the time). The App Store comes with the phone and is safe, has customer support and nearly no malware. Any other App Store would require multiple extra steps to install, along with a bunch of "please don't" prompts that Apple would build in to make sure that the user knows what's happening (just like what happens on macOS with unsigned software). It would end up being too confusing for the masses, and they'd just find an alternative that was willing to sit in the App Store (or the nightmare, not use the app at all and go unhappy).

Amazon already tried this exact thing on Android, where the barriers are a lot lower. They've never had success with their app store outside of their first-party devices. Why? Because it's too dang hard, and I'm willing to pay an extra buck for Minecraft if I don't have to track it down in another app and worry about malware coming through the wall.

I'm all for a switch to install unsigned software, but only for development stuff. The App Store serves as a good barrier for 99% of users who just need to turn on their phone and use the darn app. The other 1% just need Apple to put a hidden switch to disable the protections ala csrutil in macOS and we'll be fine.

That's just as true of GitHub though, and isn't the problem. The problem is the related services, like issues, PRs and now CI/CD which all sit with the code but don't come down on a clone. That problem still hasn't been solved, which could mean your whole knowledge base goes missing if you lose access to the server. CI/CD can maybe be replicated from what's on your laptop, but if you don't have the PR history it could spell doom for big codebases that don't use extended commit messages a lot.

Zoom, Slack and Teams all use WebRTC for running their respective clients in the browser.