zb3

That's impressive, I wish they published writeups..

At this point I don't understand - why not do this officially? They're already sanctioned to death...

What is the solution implied here? Attackers - whoever they are - already have them, so perhaps it's time we close the patch gap instead.

Is black transparent there? Are they dimmed? Or just additive?

Note that Claude is resistant to these techniques, because Claude would refuse even without those tricks employed.

When I was a kid, hacking meant breaking into others' systems, I'd not believe if you told me that one day we'd use security vulnerabilities to control products we own and paid for..

So you think they will release the full exploit?

Too bad this will be patched instead of allowing the device owner to control their own device.

Of course it's better that they found that before some shady mercenary spyware company, but I'd also want to control my ios device the same way they did in the video, but no, that's not for us.

I didn't dispute that they're delaying source code releases for security patches, I only pointed out that these regulations can't explain why they choose not to publish QPR1/QPR3 while publishing QPR0/QPR2.

> When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.

"Model of the authenticator" could say almost everything about these if the model was let's say "Google Pixel 10". TEE would refuse to sign the attestation if the bootloader was unlocked / AVB didn't verify.

YubiKey attestation is not a problem because the device doesn't work against me in such a way it would require installing custom software on it. And even if YubiKey went crazy, they're not a monopoly.

Situation with smartphones is very much different..

How does that prevent them from releasing 17 QPR1 now given that 17 QPR1 is already released "by the operating system provider or on any other product of the same brand"?

The second part explicitly addresses this, Pixels getting QPR1 starts the timer.

Apple might do the same, but for $99 annually..

Meanwhile Opus 5.5 didn't even answer my question about reading user memory in a linux die notifier, a question which had nothing to do with security, just low-level system programming..

Oh wait, the author said:

> The attempts with Fable 5.1 and Opus 5.5 were both blocked by Anthropic's cybersecurity safeguards after two prompts.

How unsurprising :)

They don't abuse Google Ads, scams are their casual use case.

Where are the proposals without signing in?