mattbee

wine has more backwards compatibility options than Windows itself, but in this project also triggered some different buggy code paths in the original (see cousin comment).

So this game still needed its bugs fixing to run in a modernised Windows, or it would have been stuck in a hardware emulator running Windows 95.

Don't know actually!

But after it was working on Windows, I tried it on Crossover and found that MacOS doesn't allow you to pin to one CPU. So it needed a racey scheduler rewriting.

There was also a difference in the way wine provides printer drivers that caused a buggy code path to run in the game, which caused a crash on the Steam Deck too.

So those bugs would have been critical even if the display implementation had worked.

The patch also adds an OpenGL window & scaling filter as the game's primary output, so it doesn't rely on GDI for pixel output any more.

The reason we (used to) have responsible disclosure timelines is so that the information & software to fix vulnerabilities can be assessed, organised, written up. Builds could get built, attackers and defenders find out at once. But crucially, defenders could use the normal channels to fix their installations and be sure they'd covered themselves.

When a PoC drops before that timeline is up (like now!) the attackers get a head start because they have less work to do - just figure out how to use it to their payload, start spraying it out.

Meanwhile maintainers don't want release an incomplete or misunderstood fix. Otherwise they'd risk people updating and believing that they're safe when they're not. Even a fragment of misinformation from an official channel will spread like wildfire. So when you demand fixes NOW you're demanding something that may not be completely understood.

So (I'm sure we'll find out but) I believe this 2pm timeline was already as soon as is human possible for the PHP team to do a repsonsible job, and not risk us having to come back tomorrow for a fix to the fix.

LLMs gives attackers the advantage for a while, and it means we'll have to tighten the secrecy around even the rumour of a vulnerability.

Since AI companies are doing such a poor job of security maybe we should legislate that they have to run Norton 360 on their agent machines to make sure they can't do anything bad.

After all Norton are the experts in preventing computer badness, and OpenAI can't stop blabbing about how much badness their products are causing. A match made in heaven!

My thoughts exactly.

Anything that randomly makes a Windows 8-style popup offer to keep my login credentials safe makes me want to run farrrrr away.

The vibe of the original criticism, even with its technical flaws was this: are passkeys - as a standard, and a user interface - vulnerable to corporate capture? I think passkey defenders are focusing far more on the theoretical technical superiority, and ignoring how instinctively alarming the average implementation is.

We face a lot a lot of attempts to capture our data, and passkey feels like a new frontier.

For me, I know exactly where I am with my password manager & TOTP. I think the current confusing interface of passkeys will make me less secure rather than more, so I've not invested the time to think about how to use them.

Sooo they were "conducting a test involving interactions with randomly selected websites".

But do we all get that the consequences for this irresponsible behaviour are part of this test?

When there are none, they gradually normalize their naughty robot scamps running around the internet, breaking into other companies or servers run by foreign governments.

This is part of the value AI companies need to convince you of - not just that mistakes by AI products are normal, but criminal behaviour is normal, that their computer will always get a pass.

Sam Altman said yesterday "we believe that the world should accept some bad things happening for the benefits of this technology" - and this an AI company pushing the boundary, continually trying to make you accept those bad things as normal.

At any point we could choose to treat AI companies themselves as the actors behind this activity. We could enforce the laws that these hugely well-funded companies are choosing to break. Until we harm their financial viability, or threaten their executives with jail, this will keep happening.

The BBC in the UK makes a great play of having "no ads" but 6Music (their indie music station) has constant cross-promotions interrupting the music, sometimes for jarring TV murder shows. Cross-promotion is just as annoying as ads for insurance, I hate it!

Yuck, the LLM writing style is obvious, and strongly suggests you didn't do the work you claim. Why should we read this?

Maybe he sold his company, or never completely owned the name himself?

Builders and gamers can install regular Windows. They can run a de-crapifying script to strip it right back - cut the AI, OneDrive, adverts etc. It flies along very predictably without that.

So much is optional and easily removed. You don't even have to pay for it any more, never mind $49. For the power users that he's talking about, I don't see the issue.

(I agree the default state for Windows is completely rotten, and it shouldn't be!)

How is "without being able to really put it in words" a mark of experience? Surely an engineer should be able to justify why an architecture should be arranged the way it is!

The risk of an "upstream cloud provider" is not something you need to tolerate in your supplier of internet infrastructure!