landr0id

Damned if you do. Damned if you don’t.

An account was suspended for 90 minutes. Why is the automatic assumption that it was malicious?

In fact, if Meta had protections against this I’m sure some people would be crying about “obvious political favoritism”.

Hopefully they can move the needle that makes the system in general harder to abuse. But wow, the outrage is insane.

>Maybe, but that's what the cyber program is for.

I have been in the cyber program since around the time it first went public and recently renewed it with the updated program.

You still trivially hit guadrails. I was trying to reverse engineer some bit of 20-year-old software that already has known, unmitigated exploits and it still downgraded me.

The Rock Band Blitz demo was distributed as a roamable package -- i.e. no license that ties it to any particular console (this was intended for e.g. demos distributed on magazine CDs or whatever).

You can just throw it on the filesystem and the console will accept it. I believe it would require a system update to add the executable to a revocation list, which Microsoft is unlikely to do. It's not the only method of achieving initial code execution either.

BadUpdate works on all revisions. It's just not persistent.

With BadAvatar you get interactionless console exploitation that's good enough for most people.

I was in the Xbox 360 scene back in the day before JTAG hacks existed -- modding savegames, getting a devkit, and building my own private homebrew. For the most part I left the scene around 2013.

The softmod had me seeing what the status quo is and things are... not great.

17 years since the JTAG hack and just as of a couple days ago someone finally vibecoded a non-proprietary SDK. The scene by and large to the masses (or at least, the loudest group) mostly associates homebrew with "stealth" servers aka servers your console connects to which assist in bypassing Xbox LIVE challenges that detect modified consoles. The servers provide mod menus (trainers, basically) for various games and the ability to use older dashboards.

The kicker is the custom servers are not required, code for bypassing challenges leaked ages ago, and people still pay for stealth server access! I can't even imagine who is still playing Xbox 360 titles on Xbox LIVE except people with modded consoles at this point.

Hacking the console is complete. But the state of the scene is a bit sad.

At least now we can vibecode the missing bits of the ecosystem (I say this as I'm literally reverse engineering and reimplementing the devkit debug monitor).

Server racks which are vertically integrated and provide great cooling, are quiet, and fully vertically integrated software (including bootloaders, hypervisor, etc. -- no BIOS!).

This includes everything from the rack itself to the PDU/switch/BMC, to the actual server blade and its chassis.

All presented in a nice package to give you a on-prem cloud-like experience.

Thanks for the links. I'm confused how this works and the USPS report seems to be heavily redacted around details.

I would assume that the tracking number has the address details tied to it (I mean, based on support claims with USPS it definitely does), but maybe there's some obscure package type where destination is not distinct and they abuse that in a pool with other sellers, then at the last mile it gets sorted appropriately?

Seems wild that this market even exists considering how USPS flat rate postage exists.

Was your package something heavy or extremely light which makes weight-based shipping more economical?

It's not just moving a code pointer. They had to migrate CEF runtimes (Alloy to Chrome) which, as I understand from the few minutes of reading I did to understand the complexities outlined in the PR, was necessary because Alloy was removed in M128. So OBS was using the last version of legacy runtime and needed to migrate. I imagine they wanted to do a decent amount of testing to ensure compat.

While problematic, this is pointing the finger at the wrong thing. The version of the browser was from 2024. The permutations of full chain exploits permitting sandbox escape since then is probably pretty high.

It's a patch gap, plain and simple. Removing the sandbox certainly did not help things.

I used to date a girl who was a designer and had to plead with her that breaking behaviors I'm used to is not a positive UX.

"But it adds motion" was the classic reply.

It's useful for security research since you can do kernel debugging and inspection of the device not possible in the simulator.

As others pointed out it's also useful for e.g. click/spam farms which need a "real" iPhone.