• 2 Posts
  • 37 Comments
Joined 1 year ago
cake
Cake day: June 14th, 2023

help-circle


  • (please attend to primaries next time…)

    So… should I have voted for Marianne Williamson or Dean Phillips, keeping in mind Dean Phillips formally withdrew from the race before my state’s primary, and Marianne Williamson couldn’t have won if she had sweeped every state after and including mine?

    I think the problem is mostly that the US system of elections is turbo mega fucked.


  • Not quite. Their “malicious” extension only got a few hundred installs. Using the data gathered by that extension and via other means they were able to locate other actually malicious extensions. Those total in the millions of installations.

    Through this process, they have found the following:

    1,283 with known malicious code (229 million installs).
    8,161 communicating with hardcoded IP addresses.
    1,452 running unknown executables.
    2,304 that are using another publisher's Github repo, indicating they are a copycat.
    





  • Most closely matches the behavior of actual SNES consoles.

    This requires very careful emulation of the timings of the various buses and co-processors, as well as on-cart chips which may or may not be present. For instance, a Speedy Gonzales game has a button in the final stage which crashes almost every emulator because enters an infinite loop reading from an open bus and waiting for the value to attain a specific pattern. However reading from an open bus is generally specified to be the last value loaded into the bus, which in this case is the load instruction itself, $18. So the value is read to be $1818 by most emulators, which doesn’t match the pattern expected.

    However, this is only if you’re emulating with instruction level accuracy. It is possible for the value of the bus to change in between the instruction being loaded and the value of the bus being loaded due to an HDMA load being triggered, but this requires a cycle accurate emulator.



  • I’m not going to weigh in on the specifics of Flatpak vs AppImage, because I don’t know enough about the particulars.

    However, I think the “user choice” argument is often deployed in situations where it probably shouldn’t be.

    For instance, in this case, it’s not the user’s choice at all, but a developer’s choice, as a normal user would not be packaging their own software. They would be merely downloading one of a number of options of precompiled packages. And this is the thrust of the argument. If we take the GitHub rant at face value, some developers seem to be distributing software using AppImage, to the exclusion of other options. And then listing ways in which this is problematic.

    I, for one, would be rather annoyed if my only option were either AppImage or Flatpak, as I typically prefer use software packaged for my package manager. That is user choice, give me the option to package it myself; hopefully it’s already been done for me.

    There are some good things to be said about trust and verification, and I’m generally receptive to those arguments way more than “user choice.”



  • Well, the problem is you don’t know what you don’t know. One of the first example tasks in the paper was regarding implementing a symmetric cipher. Using a weak cipher was recommended by AI tools sometimes, these developers didn’t know that some ciphers were weak. Additionally, even when the AI tool recommended a strong cipher, such as AES, it generated code that screwed up an implementation detail (failing to return the authentication tag), making the result insecure. And the user didn’t know it was wrong because they didn’t know it was incomplete.

    There’s no substitution for domain specific knowledge. Users who were forced to use traditional tools got the answer correct significantly more often because they had to read, process, and understand the documentation for the libraries, which meant they understood why the symmetric cipher was the way it is, and what additional information needed to be reported and why.




  • Because the nix package manager places all system packages under /nix/store/uniquehash-packagename-version/

    Where the unique hash is obtained via a Merkel tree of all the inputs. So in particular, binaries and libraries exist underneath those directories, not in the places you would expect from FHS.

    In order to make the system actually work, environment variables are set up and executables are patched to refer to specific paths within the Nix Store.