• 0 Posts
  • 66 Comments
Joined 2 years ago
cake
Cake day: June 12th, 2023

help-circle
  • Honestly, I was running into the limits of stow. Want to unstow some configs on a bare machine? I hope you wanted that entire directory to be a symlink. Then I saw that someone had actually fixed that many years ago but the maintainer at the time was caught up in some personal crypto related projects and did not appear to be looking at the mailing list.

    Chezmoi fixed that, applied a templating engine and added a data mechanism. In moving my stow configs I realized that application specific config file deployments are nice but shouldn’t be necessary. Templates fill that gap, and meshing them with scripts allows you to do some cool things only when variables change.

    Plus I was beginning to play around with go at the time, so it just seemed like a good idea to use something I could contribute to if I needed.

    I still don’t think I’m using chezmoi to it’s full potential, but I am fairly proud of the script I use to determine data sources for my waybar config on all of my machines.







  • The most useful quote to those familiar with the linux boot process:

    “An attacker would need to be able to coerce a system into booting from HTTP if it’s not already doing so, and either be in a position to run the HTTP server in question or MITM traffic to it,” Matthew Garrett, a security developer and one of the original shim authors, wrote in an online interview. “An attacker (physically present or who has already compromised root on the system) could use this to subvert secure boot (add a new boot entry to a server they control, compromise shim, execute arbitrary code).”

    If an attack needs root then it doesn’t matter. Your box is toast anyway. If you’re using http boot without verification then you should have seen a MITM attack coming.


  • Something akin to haveibeenpwned.com password hash partial match? Can that even be done with this data?

    Edit: You goofs know you can calculate the hash locally and submit it for review without actually exposing your password to them right? That’s how bitwarden does it’s check. https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity

    Ah, but Mozilla isn’t even trying to do anything cool like that. They just use onereap and those fuckers look shady. Quotes from their privacy policy: https://onerep.com/privacy-policy#what-data-we-collect-and-how-we-do-that

    We use your Personal Information for a number of purposes, which may include the following:

    [snip]

    • To display advertisements to you.
    • To manage our Affiliate marketing program.

    There will be times when we may need to disclose your Personal Information to third parties. We may disclose your Personal Information to:

    [snip]

    • Third-party service providers and partners who assist us in the provision of the Services and Website, for example, (a) those who support delivery of or provide certain features in connection with the Services and Website (e.g. Stripe, a payment services provider; Sendgrid, an email delivery service; HubSpot, a CRM platform, and Sentry, a crash reporting platform); (b) providers of analytics and measurement services (e.g. Google Analytics, ProfitWell etc.); © providers of technical infrastructure services (e.g. Microsoft Azure, Google Cloud, and Amazon AWS); (d) providers of customer support services (e.g. Zendesk); (e) those who facilitate conduct of surveys (e.g. Hotjar); (f) those who help to advertise, market or promote our Services and Website (e.g. Mautic, Facebook Ads, Google Ads, Linkedin Ads, Reddit Ads, and Microsoft Ads);

    The bastards







  • Well, when the game is essentially running in a virtual machine with an address translation layer that scrambles the backing memory every few minutes you’re lucky the game even runs. Good luck trying to decipher that hell. A few guys have done it, I remember the one dude ranting on Twitter about trying to crack Borderland’s 3 back around launch.

    And then the follow up which was that Denuvo was basically adding a ~30fps overhead to the game and everyone was initially blaming the devs for releasing unoptimized garbage.

    Gabe had it right, piracy is a service problem. And my motto has always been if the game has some garbage like Denuvo, then you couldn’t even pay me to take a copy. Not worth the headache.