rekoil

Ahhh, true, SSH isn't the same certs, my bad... well, both Github and Azure DevOps default to HTTPS-based cloning anyway...

> probably some that are not going to ever get patched

This is a HUGE deal for embedded devices, we can now mitm HTTPS traffic on lots of embedded devices running Linux produced between 2018 and now.

So you target some host like ssh.dev.azure.com, find all the hooks in the proper repo the client is trying to access, make a new commit that puts your persistence payload in one of them that you expect will be executed soon, this script can additionally "correct" the git state when it finally runs, and moves its persistence to some more appropriate location.

Users will be none-the-wiser because they're not accessing these hosts through a web browser, and you net a few more compromised hosts in your inventory.

This is such an annoying quirk of macOS, I regularly SSH to some servers I need to get my password to from 1Password, and I am apparently incapable of re-programming myself to copy the password prior to starting the SSH connection, so what happens is I SSH, open 1Password quick access (which dismisses my Ghostty-adrum quick-terminal), copy my password, and then frantically spam my quick-terminal shortcut until I remember it's blocked because macOS has decided its not allowed in the current state.

Would be great if we could opt out a few pre-determined key combinations from this system, but I guess that's never happening.

Thanks so much for maintaining Ghostty tabbed quick-terminal by the way, you're a legend <3

Hear hear, I've been running adrums build for what feels like forever now, manually recompiling Ghostty from time to time because I can't use a terminal without tabbed quick-terminal in 2025 let alone 2026. It's a killer feature I can't work without.

It's pretty easy to compromise things like McDonalds or Starbucks WiFi hotspots though, just setup a Pineapple with the right SSIDs and a 5G modem, funnel your target domains through your mitmproxy via the DHCP DNS server you're providing, and that's basically it.

I agree it's not PHP2Shell, but its certainly not being "way overblown" here.

In my mind these two worlds don't have to be incompatible with each other, I am fully aware of the issues with cheating in competitive online gaming and am ready to give up some freedoms to improve the quality of my experience, but I believe we can do this still using Linux clients.

I would not have an issue with having a "gaming kernel" installed that I can reboot to when I want to game, one that gives EAC and other similar softwares access to my hardware so they can do their jobs, I don't love it, but I'm ready to make that sacrifice because I have experienced gaming with rampant cheating.

The problem is nobody is providing that option, and game developers are instead actively excluding Linux as a target platform entirely, e.g. Apex Legends, a game that ran well on Linux until October 2024 when Respawn decided to actively block it from joining online matches by toggling a flag in EAC.

I want to get off Micro$lops wild ride please.

"They were too preoccupied with whether they could, they never stopped to think whether they should"

Jokes aside, very impressive that it works!

I need to see end-to-end encryption on this service before I am in any way interested, it should be a "rendezvous service" connecting clients with servers only, with full end-to-end encryption between them, and Nabu Casa should have zero ability to control the server.

Build that and I'll be interested.

I had the 12 mini (before it I had an iPhone SE, then iPhone X, then the 12 mini), which unfortunately did not work for me because the battery drained too fast.

Really hope you're wrong and we do eventually get some more one-handed phones in the future, especially once battery tech evolves.

Not necessary, corporations can speak for governments these days, its all cool!

I think it explicitly avoids directly saying that the Commission has agreed this resolves the disagreements, again hoping public sentiment will drive the nail all the way.

I am really hoping this isn’t the end of it, general purpose computing devices need to allow its user to choose the security model, in my opinion the entire industry fundamentally depends on it, and without that freedom we will have monopolies deciding everything sooner or later.

Only if consumers would pay it, which isn’t something we can really know.

What's out there?