Hacker Newsnew | past | comments | ask | show | jobs | submit | eggnet's commentslogin

TLS also allows for the contents of a boot image to be hidden from others.

Ok, but so what?

You guys are out here protecting against ghosts but at the same time making the really important stuff 10x harder and more vulnerable to bugs.


The lack of ads, and the algorithm for sorting the feed.

I think the spectrum runs from social media, to forum, to news feed… maybe other things. HN isn’t toxic.


I assume it would be chrome debug, and their chrome plugin, like it is on macos and windows. They could punt arbitrary app control easily enough.

That happens with execve(). clone() allows you to not copy the page table prior to the execve() call.

Which argument to clone does that?

There are microcode updates for this already https://www.amd.com/en/resources/product-security/bulletin/a...


but is it possible to verify that the cloud provider has applied the update?


The SEV-SNP attestation includes the microcode version. https://www.amd.com/content/dam/amd/en/documents/developer/l...


Yes, it is. You do have to have some infrastructure you trust somewhere to validate an attestation report from the confidential VM.


/proc/cpuinfo shows the current microcode version


/proc/cpuinfo shows whatever the hypervisor said, often simply "microcode : 0x1000065"

https://github.com/torvalds/linux/commit/518e7b94817abed94be... https://github.com/qemu/qemu/blob/ac6721b88df944ade0048822b2...


i don't think the information that unprivilleged VMs can obtain from that is necessarily reliable. for example with Xen as hypervisor only dom0 is privilleged (as management console for the system) and still it needs to call dedicated tooling in order to read or manage CPU features like clock speed or frequency scaling


That’s for rx, not tx. When you close a socket with data in the send buffer, that does not trigger a RST. If you just close the socket normally.


> When you close a socket with data in the send buffer

That's not what's happening here. The server is closing the socket when there's data from the client that it hasn't read.


Yep, and that makes implementing addition of "Connection: close" in an HTTP reply at the HTTP/1.1-server's side somewhat tricky: you ideally need to read all of the pipelined requests from the client before closing the connection, which is usually something you'd rather not do. But if you just close it, you risk your client getting a partial reply, so you better add "Content-Length"/"Transfer-Encoding: chunked" in your reply as well... but one common reason to do connection-close reply is when you don't know the content-length beforehand, so — I hope you implemented chunking correctly :)


Even if you just close it, and it RSTs, and you implement chunked etc. properly, the client can't even necessarily read all of the information already sent to the client.

If the client does a read() after the RST gets there, any data in the receive window is gone, any packets that might have been dropped and need to be resent are gone, etc.


More explicit connection closing indications are one of the nice things of http/2. Of course, it's bundled with the silly multiplexing :(


Signal doesn’t provide anything in the message other than… “there are pending messages.” Signal wakes up, fetches them, then generates notifications on the phone itself.


That doesn’t solve the problem. You have to configure Signal to not send the information in the notification.


“We learned that specifically on iPhones, if one’s settings in the Signal app allow for message notifications and previews to show up on the lock screen, [then] the iPhone will internally store those notifications/message previews in the internal memory of the device,” a supporter of the defendants who was taking notes during the trial told 404 Media

Doesn't indicate this is an issue when you have it set to preview when unlocked.


Will Foxconn and other Chinese manufacturers be less involved in Vietnam? How much less?


I assume you're joking, but this is just sales tax.


Tariffs are quite different than a sales tax because they can select winners and losers in a market. Cane sugar vs sugar beets etc. https://en.wikipedia.org/wiki/Sugar_beet

However, they don’t have to be high enough to change who wins, even small ones adjust how much foreign subsidies manipulate the market. Foreign governments should consider how much US corn syrup impacts domestic consumption for example as a separate issue from how it impacts domestic sugar production.

China’s currency manipulation has second order effects that benefits Americans. We don’t necessarily want China to stop, instead the goal should be to minimize the harm while extracting maximum benefits. A small tariff that caused them to double down on currency manipulation would be a massive win.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: