HackerLangs
TopNewTrendsCommentsPastAskShowJobs

ranger_danger

2,047 karmajoined 5 years ago

Submissions

GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years

nebusec.ai
44 points·by ranger_danger·2 days ago·0 comments

comments

ranger_danger
·4 hours ago·discuss
A comment on another site about this was "One should be aware that for many situations it will not be a drop-in replacement due to its AGPLv3 license"... but my question is, why would that be a problem for many situations?

Doesn't the AGPL only really matter in most cases if you're making modifications to it (even when used as a web service)? It's not like it makes other non-pg code AGPL too, right?
ranger_danger
·5 hours ago·discuss
dupe of https://news.ycombinator.com/item?id=48834309
ranger_danger
·10 hours ago·discuss
At least thanks to GhostLock, just about any Android phone can be rooted now.

I still don't understand how it wasn't bigger news.
ranger_danger
·yesterday·discuss
I was in there for years but never got invited... all I got was banned for having an opinion that was different than theirs.
ranger_danger
·2 days ago·discuss
Could also be https://nebusec.ai/research/ionstack-part-2/
ranger_danger
·3 days ago·discuss
Not sure if you're joking, but both have already done so. And any US company is subject to secret orders forcing them to implement a backdoor if demanded.
ranger_danger
·3 days ago·discuss
This is not true either; to Microsoft, every anonymous GDID is its own unique account on their servers.
ranger_danger
·3 days ago·discuss
q3dm17 for life.
ranger_danger
·4 days ago·discuss
What I'm more interested in is how/where the GDID is used. Imagine if e.g. Edge started sending your GDID as a header in every single web request.
ranger_danger
·4 days ago·discuss
https://www.linux.org/docs/man1/systemd-machine-id-setup.htm...
ranger_danger
·4 days ago·discuss
An MS account is not required for a GDID to be issued.
ranger_danger
·4 days ago·discuss
> A CPU register is naturally 8 bytes in size, and if Oracle extracts 8 bytes from two strings for comparison, then the comparison requires fewer registers and fewer CPU cycles.

Isn't this just a typical SIMD optimization that tons of projects use?
ranger_danger
·4 days ago·discuss
How would a search engine filter that out?
ranger_danger
·4 days ago·discuss
Would love to see a Windows desktop version.
ranger_danger
·5 days ago·discuss
Anyone using reverse proxies, CDNs or anti-DDoS services already voluntarily give full MITM privileges of their unencrypted data to companies like CloudFlare, Amazon, Akamai, Fastly, etc., which is most of the top sites on the internet and a large percentage of the overall internet traffic.
ranger_danger
·5 days ago·discuss
> As part of its efforts to foil Web encryption, the National Security Agency inserted a backdoor into a 2006 security standard adopted by the National Institute of Standards and Technology, the federal agency charged with recommending cybersecurity standards. Credit Patrick Semansky/Associated Press

https://archive.nytimes.com/bits.blogs.nytimes.com/2013/09/1...

Even if you believe they're lying, or think that it's impossible to know because it may be a kleptographic backdoor... the latter at least is understood to be a unique property that most other algorithms do not share, so I think for that reason alone it's enough to assume it is backdoored, insofar as that we should tell people to stay away from it regardless.
ranger_danger
·8 days ago·discuss
Probably because a lot of people here think it's some kind of conspiracy-level private information stealing scheme.
ranger_danger
·9 days ago·discuss
> How long before they designate all ad-blocking software as malware, block installation on all Android certified devices worldwide, and permanently designate all developers of this class of software as malware creators?

Classic slippery slope fallacy.

https://en.wikipedia.org/wiki/Slippery_slope

History shows that when a "slope" appears... regulation steps in, technology evolves to solve the problem, or the culture shifts to reinterpret the thing.

In almost every case, the feared "bottom" of the slope was never reached because humans constantly built ramps or bridges along the way.
ranger_danger
·9 days ago·discuss
> They also don't accidentally end up on the Reddit Front Page and get swarmed

Wouldn't this by definition mean the size of the community must always remain small enough (whatever that magic number is)?
ranger_danger
·9 days ago·discuss
Since davidee mentioned society, I assumed we were speaking in general and not relative to HN.