I was recently randomly thinking of Cyrix. I never had one but in retrospect I think they were better than their reputation. A lot of people thought of it as a cheap knock-off, so lesser quality. I think I thought that…
> TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 I know it's customary for HN to edit titles to remove extraneous information, but removing "Linux" here really takes away something useful and relevant. This is a Linux…
I forgot entirely about superfish. That takes me back. My recollection is part of what uncovered it was that the malware broke WebSockets on Lenovo laptops. I think higher end Lenovo laptops with cleaner windows images…
It's not for national security. It's to protect Detroit. Our domestic industry should be laser focused on being more competitive with Chinese vehicles, but if they could do relatively little R&D and keep the status quo…
One of the problems with cryptography implementations is that a bad one will be indistinguishable from a good one on the surface level. Totally broken crypto will superficially look and work as if it it works, and most…
I think it's funny when people show poor knowledge of English grammar and confidently label their own exposure gap as a flaw. Maybe it's a bit stuffy or formal, but yes, "the named sequence" is 100% something a real…
It's pretty trivial to do this. Before the official patches were out on other platforms I did it on a few machines.
I think there is a rise of "this is legal because we used a computer to do it." A HN audience will not appreciate this sentiment, but honestly, a company should not provide tools to do this because they should have a…
Unpopular opinion for this site: Most true facts are not affected by the existence of AI. Most things in life do not need adjustment for "the age of AI". For decades, eery tech boom cycle is filled with people who don't…
This attitude is also very common for law enforcement or prosecutors.
I'm sure that obs can export to something that can be used to stream to rumble.
How was latency for all of this?
It's because from a kernel perspective this part literally needs root: > just trying to execute the command within the child container's filesystem There is no such thing as changing your root filesystem or your uid…
That cannot be true. You need to tell the kernel about the namespaces, cgroups, and the new root. Otherwise it's not a container, and there is no reason or mechanism for a child proc to respect it. And if you let any…
Based on the headline I expected to have opinions about this, but this is about Japanese elections, and I don't know anything about the political factions of Japan. These things don't always translate exactly across…
I would guess that they do that by having a root daemon which authenticates requests from a unix domain socket, possibly using SO_PEERCRED. Or a setuid binary
Care to give some examples? A lot of the more important syscalls involved do require root.
If you're old enough to remember some techniques that people used before docker (like chroot(2)-ing daemons for security), the "containers aren't real" observations are not really new info. When containers came on the…
I think the only thing in the "weird things" list that don't necessarily apply to another container system on linux would be the go-specific issues.
> using "some company in India" made it rather dismissive of the warning, actively taking the company's side(the bad "no keys were issued" defense), whereas just saying "some idiots" had it generally approve the…
I guess everybody is lying when they say to patch nodejs and python's certifi in response to this issue. They should listen to you instead about how it doesn't work that way, and stay vulnerable to MITM.
> It wouldn't let me build any features that track/audit process executions Sounds like waitpid(2) is dangerous!
Update: The OpenBSD errata just dropped.
I have explained it to a few normies. I start by saying this is about the tech behind the S in HTTPS. I say that the main point of this is that when you talk to foo.com, it has to prove that the people behind foo.com…
> They don't. They use the OS certificate store, It appears to me they do, and that is why everybody is saying to patch your python, go, and node infrastructure separately from /etc/ssl. > which on all platforms has…
I was recently randomly thinking of Cyrix. I never had one but in retrospect I think they were better than their reputation. A lot of people thought of it as a cheap knock-off, so lesser quality. I think I thought that…
> TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 I know it's customary for HN to edit titles to remove extraneous information, but removing "Linux" here really takes away something useful and relevant. This is a Linux…
I forgot entirely about superfish. That takes me back. My recollection is part of what uncovered it was that the malware broke WebSockets on Lenovo laptops. I think higher end Lenovo laptops with cleaner windows images…
It's not for national security. It's to protect Detroit. Our domestic industry should be laser focused on being more competitive with Chinese vehicles, but if they could do relatively little R&D and keep the status quo…
One of the problems with cryptography implementations is that a bad one will be indistinguishable from a good one on the surface level. Totally broken crypto will superficially look and work as if it it works, and most…
I think it's funny when people show poor knowledge of English grammar and confidently label their own exposure gap as a flaw. Maybe it's a bit stuffy or formal, but yes, "the named sequence" is 100% something a real…
It's pretty trivial to do this. Before the official patches were out on other platforms I did it on a few machines.
I think there is a rise of "this is legal because we used a computer to do it." A HN audience will not appreciate this sentiment, but honestly, a company should not provide tools to do this because they should have a…
Unpopular opinion for this site: Most true facts are not affected by the existence of AI. Most things in life do not need adjustment for "the age of AI". For decades, eery tech boom cycle is filled with people who don't…
This attitude is also very common for law enforcement or prosecutors.
I'm sure that obs can export to something that can be used to stream to rumble.
How was latency for all of this?
It's because from a kernel perspective this part literally needs root: > just trying to execute the command within the child container's filesystem There is no such thing as changing your root filesystem or your uid…
That cannot be true. You need to tell the kernel about the namespaces, cgroups, and the new root. Otherwise it's not a container, and there is no reason or mechanism for a child proc to respect it. And if you let any…
Based on the headline I expected to have opinions about this, but this is about Japanese elections, and I don't know anything about the political factions of Japan. These things don't always translate exactly across…
I would guess that they do that by having a root daemon which authenticates requests from a unix domain socket, possibly using SO_PEERCRED. Or a setuid binary
Care to give some examples? A lot of the more important syscalls involved do require root.
If you're old enough to remember some techniques that people used before docker (like chroot(2)-ing daemons for security), the "containers aren't real" observations are not really new info. When containers came on the…
I think the only thing in the "weird things" list that don't necessarily apply to another container system on linux would be the go-specific issues.
> using "some company in India" made it rather dismissive of the warning, actively taking the company's side(the bad "no keys were issued" defense), whereas just saying "some idiots" had it generally approve the…
I guess everybody is lying when they say to patch nodejs and python's certifi in response to this issue. They should listen to you instead about how it doesn't work that way, and stay vulnerable to MITM.
> It wouldn't let me build any features that track/audit process executions Sounds like waitpid(2) is dangerous!
Update: The OpenBSD errata just dropped.
I have explained it to a few normies. I start by saying this is about the tech behind the S in HTTPS. I say that the main point of this is that when you talk to foo.com, it has to prove that the people behind foo.com…
> They don't. They use the OS certificate store, It appears to me they do, and that is why everybody is saying to patch your python, go, and node infrastructure separately from /etc/ssl. > which on all platforms has…