paulmd
Joined 12 years ago
Karma
13,045
Submissions
4,919
Member since
Apr 4
Recent submissions
Comment · 2 years ago
That’s not the case that’s normally referenced, why don’t you cite the 1991 case while you’re at it ;)
Comment · 2 years ago
PS: they did release technical details once the mitigations had been released etc. And these were released to tech researchers earlier, and proof of concepts were shown etc. https://youtu.be/QuqefIZrRWc?t=1005
And, like, the fact that AMD released an urgent patch for it should kind of speak to the severity of the issue in the first place. AMD doesn't patch "sudo lets you do root things", obviously, so it necessarily must have been more than that, and this was obvious even at the time. But we have to go through this dance with literally every single AMD exploit.
AMD has a unpatched exploit in all Zen3 and below processors that leaks data from kernel at a faster rate than meltdown did. It was discovered by the same researchers that discovered meltdown. AMD has chosen to leave that unpatched, and put out a weaselly deflection about "it doesn't cross address boundaries" but they also still refuse to turn KPTI on by default because it would hurt their benchmarks. And without KPTI there is no address boundary to cross, that's the weaselly part. AMD very craftily made it sound like they're saying there's not an issue, but in fact they are fully confirming the finding from the researcher, including the suggested mitigation (enabling KPTI), they just don't recommend that you do it. The statement is deliberately short to avoid inclusion of too many details that might dispel these misleading impressions.
https://www.usenix.org/system/files/sec22summer_lipp.pdf
https://www.amd.com/en/resources/product-security/bulletin/a...
proof of concept: https://github.com/amdprefetch/amd-prefetch-attacks/blob/mas...
tested a few months ago and it's still working: https://news.ycombinator.com/item?id=40850526
This follows that same researcher (who previously discovered meltdown) uncovering a prior series of vulnerabilities in the cache ways predictor that also nullify KASLR... which AMD refused to patch because it "didn't leak actual data, only metadata"... the metadata being the page-table layouts. That one is still unpatched too - as the researchers note, AMD never actually mitigated this either, just more weasel words.
https://www.tomshardware.com/news/new-amd-side-channel-attac...
https://mlq.me/download/takeaway.pdf
(this one literally doesn't even seem to have a security bulletin page for itself so I guess they have fully shoved this one down the memory hole now, but here's the news item from wayback) http://web.archive.org/web/20200325045817/https://www.amd.co...
After 6+ years of watching the community defend this behavior, downplay exploits from their favorite megacorporation, etc, it just gets old. Not liking how CTS labs did it or whatever is fine. It doesn't mean there's not a serious exploit, and so often that is where people end up with these AMD exploits, they like AMD so much that they argue against the existence or significance of the exploit, attack the researchers or whine about research grants, etc.
"Does this really deserve this CVE score" is a constant refrain in AMD vuln threads and it just gets so old. As tptacek noted... intel ME vulns are frontpage news and have people asking where they can buy a processor without ME in it. Literally nobody cares that AMD has had these vulnerabilities left open and unmitigated for years and years even though they're actually worse (as judged by the researcher who found both these issues and meltdown).
People would have flipped the fuck out if Intel left meltdown unpatched and released misleading statements implying that it wasn't an issue etc. It is wild just how much AMD is playing on story-mode difficulty with the average enthusiast, and honestly most people don't even realize they're doing it. And that drives me nuts - just decide if security issues are a problem or not, and if the answer is "not" then let's just turn all the mitigations off and see how long they remain un-exploited. If we want to have the security version of the drug-assisted olympics then fine, there is value in having dragsters that just do the thing as quickly as possible, right? But the double-standard people apply to anything AMD is crazy. Talk about your "tyranny of low expectations".
Comment · 2 years ago
the radio literally has a squelch knob on it, and turning the knob is required if you want to not hear static constantly or if you want to hear your traffic when they call you, so if you somehow manage to own a radio without knowing what squelch is it’s kinda on you.
let’s give users at least a little bit of agency here
Comment · 2 years ago
Wasn’t that judgement recently vacated for failing to prove the case, though?
Comment · 2 years ago
not only are they not going to do that, Sony’s android phones delete the firmware if you unlock the bootloader
Comment · 2 years ago
it's funny that they have to debunk the "root is root, why would AMD patch this" that goes around every time there's a serious issue that allows guest-root escape from virtualized containers.
the same thing happened with the ryzenfall/masterkey exploit, where people were just in utter denial there was an actual exploit there, because root is root! People literally spent more time talking about who released it and their background image than the actual exploit. AMD obvious cannot have exploits, that's only an intel thing. /s
"alleged" flaws" (rolls eyes) https://old.reddit.com/r/Amd/comments/845w8e/alleged_amd_zen...
assassination attempt* https://old.reddit.com/r/hardware/comments/849paz/assassinat...
doxxing the researchers: https://old.reddit.com/r/hardware/comments/845xks/some_backg...
https://old.reddit.com/r/Amd/comments/84tftt/clarification_a...
https://old.reddit.com/r/Amd/comments/8589t2/cts_labs_clarif...
HN discussions were not much better, although tpacek is cool.
https://news.ycombinator.com/item?id=16576342
Comment · 2 years ago
OK? Well, the iphone mini series did not sell fine, objectively so. It was a bad seller even with the bump from the novelty of apple releasing a mini, and it declined even further the next generation. Probably at minimum it's not worth doing more than one every couple generations.
idk why you guys are continuing to rage at the messenger here, I'm not the one who canceled it and the reason it was canceled is widely acknowledged. Your refusal to accept reality does not constitute a problem on my part.
Comment · 2 years ago
"squelch codes" probably conveys the meaning more correctly.
people understand the idiom that just because your radio has squelch set (too high, perhaps) that it doesn't mean someone else can't hear it.
otherwise, CTCSS codes works fine, that's the technical description of what it is. and actually they call them "squelch tones" there. it's only motorola that branded them as "private lines", that's their trademark for an adequately-described term. Much like Tesla "Full Self Driving"/"Autopilot", it's kind of a misnomer and definitely breeds (deserved) confusion.
https://en.wikipedia.org/wiki/Continuous_Tone-Coded_Squelch_...
Comment · 2 years ago
> To bring this point home, for years there was hubub in the industry that Nintendo would bring out some kind of Switch Pro with 4k output and faster guts, rumors swirled around and around until Nintendo finally brought out? The Switch Light.
Switch Lite is not the console people were referring to in that context. And oddly enough, Nintendo themselves have pseudo-confirmed the launch will occur in Q1 next year via various official statements:
https://x.com/NintendoCoLtd/status/1787736518762881197
(and then they later confirmed that they won't discuss it this year... so it's going to be Q1 next year.)
And again, to underline this point: the hardware itself has literally been ready to go since 2022 or before (prominently, there was an enormous amount of stuff in the hacked nvidia data dump and it's all essentially confirmed accurate at this point) and the delay has frankly baffled industry-watchers. It’s not even just Nintendo being nintendo and favoring older cheaper hardware, they seem to have internally had some pullback or change of heart back a year or two ago such that they decided not to release it.
And obviously at some point the hardware will be relatively weaker than the original switch was at its launch, so at this point they may have to update the hardware again.
But yeah switch is a bad example of “see, rumors are sometimes wrong!” when Nintendo literally had a console generation ready to go, as confirmed by multiple sources, and then just inexplicably decided to pull the plug or delay it for 2 years for inscrutable Nintendo reasons. That’s the Nintendo being Nintendo part - and we have their confirmed-in-financials timeline for release now.
Comment · 2 years ago
I don't disagree, but the market placement of the iphone has nothing to do with the continued poor sales of the mini series every time it's been tried.
And the mini ran for multiple generations and none of them sold well.
Much like the 3.5mm jack, people just cannot admit that it's not a very popular idea. Extremely popular among a very small niche, incredibly unpopular if not actively dispreferred outside of it.
Comment · 2 years ago
are you seriously suggesting that sony put used pc hardware in their consoles? that's terrible even as a point of comparison.
Comment · 2 years ago
> Only because they are underpowered with old hardware.
yes, adversity breeds character. did Star Wars get better when Lucas got unlimited money and green screens?
Having hardware limitations forced devs to scope their vision appropriately and focus on the aspects they actually wanted to emphasize.
Comment · 2 years ago
Microsoft was upfront that they didn’t think a mid-gen price cut was in the cards, so here’s the series s, it’s what we can do and we’ll do it right now, etc.
They were right and not only have prices not really come down, but in some ways they’ve increased.
The unfortunate consequences of a post-Moores law reality. Like yeah nothing is getting 2x better for the same price even every 3-4 years anymore. Your expectations based on past history will no longer hold true, and this has been clear for a number of years now.
You can’t make a gamer understand something when his wallet depends on him not understanding it. People have been in active denial for years, in ways that have crossed into objective denial of reality. The "AMD is just choosing to join NVIDIA and gouge!" stuff has been joined by "and sony is in on it too!" etc. Yes, corporations suck but the margins are not actually very fat here, this is just what it costs now.
Comment · 2 years ago
No. Mini did notably terrible across every generation it's been tried.
https://www.slashgear.com/1234403/apples-decision-to-cancel-...
Comment · 2 years ago
iphone 8 plus, bought refurb in early 2019. replaced the battery once (and got a replacement since the battery wouldn't pair). it's getting to be time.
usb-c is a big feature increment for me, and I need to finish the leap away from google voice, since I absolutely know they are not going to bother implementing RCS and will just shutter the service instead. LiDAR also seems extremely useful/cool. On the other hand, I was kinda hoping for thunderbolt support on the pro models eventually. Not sure if I will buy a refurb 15 Pro or a new 16 Pro Max or wait for the next cycle.
that's how you avoid e-waste for real and not as a fashion statement. simply consume less - and that includes not consuming a $300 android phone every 18 months, not just apple - and have it repaired when it needs it. with OEM parts that will last the long-haul and not something off amazon that will need to be changed again in 6 months.
for sale: scalable links, never interfaced.