Hacker Newsnew | past | comments | ask | show | jobs | submit | jarfil's commentslogin

Archiving the repo doesn't stop the downloads. They would need to rename it in order to prevent distro CI/CD from keeping downloading untrustworthy stuff.


Distros downloading directly from GitHub deserve what they get.


But UEFI can have pretty graphics and mouse support, so it must be better... /s

Now seriously, TPM and GPT are improvements. Customizable SecureBoot along with disk and RAM encryption, are also nice.


I'll agree that you can use TPM and GPT to your advantage, and even SecureBoot can fill an actual need for a small number of PC owners.

But with GPT it was strongly recommended by Microsoft as more secure by having no unused sectors on the drive when it is partitioned according to GPT.

The unused sectors of a traditional MBR-partitioned drive had been identified as the preferred location of malicious "root-kits" that were capable of executing before the OS even had a chance to boot, were not actually on the Windows partiton and therefore difficult to scan for, and were resistant to reformatting the partition which did not delete the rootkit. To be really sure you got rid of a BIOS/MBR rootkit completely you would have to zero the entire drive, or at least the sectors containing the root kit. Full reinstallation of Windows or even zeroing the entire partition itself didn't help at all.

But using GPT there are usually way more unused sectors on the same drive compared to MBR partitioning. Always have been. That's just one of the original lies propagated by Microsoft, endorsing the migration away from a more well-proven traditional BIOS.

And here we have a defect in one of the supposedly true security improvements baked into UEFI, with ridiculous false-sense-of-security implications since day zero, now-confirmed and it's exactly a vector for a rootkit no differently than under good old-fashioned BIOS.

Except zeroing the entire physical drive still wouldn't get rid of a UEFI rootkit which can now be even more stealthy, enough to reside in the firmware itself. Even at this late date, how many users are scanning their firmware and what apps would they use for that anyway?

When truthiness is not a way of life, there can not be actual trust.


It doesn't help that much of the "C development community" is made of electronics engineers writing "some code to make the hardware work", instead of people with a focus on security.

It's similar to the "C++ developer community" being made of CS people writing whatever abstract thing they wish, then blaming the compiler for their code going belly up on one of the myriad of "undefined behaviors".


Is that TBM small enough to fit on a SpaceX Starship and send it to Mars?

I always thought Boring was a project intended for digging a base on Mars, fitting a whole Tesla in the tunnel would be even more than what's needed to connect some underground habitats.


It's both.

Trademark law requires registering for a series of categories where a product seeks protection, with each category being relatively specific.

At the same time, suing someone for Trademark infringement requires a judge to decide whether it could "potentially induce confusion in the user".

Could an app be confused for a sausage? Could it be confused for a sneaker?... I'd say not, but I'm no judge!


It is an issue of trust precisely because a third party controls the platform. If mods actually owned the infrastructure for their spaces, there would be no trust involved, they'd just own it.

In this case, mods trusted the company making a promise about the platform, breaking that promise breaks the trust in the company, and makes the platform risk plain to see for all.


I don’t think any mod could possibly have thought Reddit was making such a strong promise. The moderator community has repeatedly asked Reddit to take an active stance in moderation disputes; the most recent blackout protest before this one was asking Reddit to prohibit Covid denialism.


One should never trust a corporation, who only acts in the interest of money, is my point. That they even trusted them in the first place is a gross misjudgment. It's not about what words a corporation utters, it's about what actions it takes that determines its value.


Mastodon, Lemmy, kbin, and the fediverse in general, are right now experimenting an unprecedented growth in number of instances, users, and activity.


Reddit is failing right now.

Popular communities already had a lot of people who wouldn't engage in positive discourse, only offset by those massively downvoting and reporting the "noise" comments.

Now that they're the only ones left, all discourse is disappearing, getting replaced by cheap quips and memes.


Seems fine to me. I’m still on it. It’s still active, I still see content. So some community is dark? Who cares. If i wasn’t subbed to it I don’t really care.


Q1) Sure, why not. Plenty of power tripping people out there wishing for a turn at the banhammer.

Q2) No. The communities are already failing just because the exodus of power users is causing a lack of self-moderation via up/down votes. Add to that random tyrants who haven't built the community, and there is no way for them to survive.


Indeed. It can however interact with Lemmy and kbin, which are direct Reddit replacements.


All three use federated groups:

https://socialhub.activitypub.rocks/t/groups-implementation/...

There are groups on Mastodon that you can join and follow.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: