Viewing profile — Denvercoder9

DESIGN.md: > Each rule below is enforced mechanically by the skill, not left to vibes. > R1. Repo docs are the memory; not in HANDOFF.md = didn't happen SKILL.md: > Not in docs/HAN…

I'm not up-to-speed with the current state of sandboxing in browsers, but in principle it's (on modern operating systems) not especially hard for them to sandbox the decoding into …

> can't all the banks just agree to enforce 3DS They could, but it's one of those things that really only work if everybody joins. Because 3DS is rarely used right now, a portion o…

Account Updater functionality isn't necessarily even involved there. In the end whether to accept a transaction is up to the issuer, and quite often they'll keep accepting recurrin…

Indeed, I suspect that's what went on here. I don't think there even exist 99 providers of what's customary called a digital wallet (e.g. Apple/Google Pay), and there's no definite…

> merchants can’t select what level of security they want from the credit card processor That really depends on the processor; many processors do allow merchants specify your accep…

> but things like this are a matter of negotiation between the card issuers and the merchants. Not necessarily, the EU has mandated strong customer authentication by law (PSD2), an…

I'm not advocating for delaying the disclosure at all; my point is, if you see your initial disclosure to the kernel didn't go anywhere, to be responsible is to put in a little ext…

The situation with e.g. BlueHammer is fundamentally different: there, the only party that could act on it (Microsoft) ignored them. In this case, the parties that could act on it w…

> I don't know what exactly can load this module Well, for one thing, opening an AF_ALG socket, as the exploit does.

In my world, responsibility is not just checking a box of following industry practice. Responsibility, as Wikipedia puts it on their social responsibility page, is working together…

None of the distros were.

Not having the module loaded doesn't mean you're not vulnerable, the kernel loads the module on-demand when it's needed. I tried the exploit on such a system, and it worked. Howeve…

Two things can be true simultaneously: the Linux kernel ecosystem should have done better at communicating this to their downstreams, and publicly sharing the exploit was irrespons…

There's no contradiction, the point is that Bob is able to produce valid output using LLMs, but only while he himself is being supervised; and that he doesn't develop the skills to…

> That's why it went beyond web, and why all modern native UI frameworks have a similar model these days. It's more the other way around, this model started on desktop (eg WPF) and…

> It would be infinitely simpler if one could simply 'cross-compile' down to older symbol versions, but the tooling does not make this easy at all. It's definitely not easy, but it…

> why would it be that way? It allows (among other things) the glibc developers to change struct layouts while remaining backwards compatible. E.g. if function f1 takes a struct as…

The same's true for the radio on a Raspberry Pi, though.

So yes, in theory you can always deploys sets of compatible services, but it's not really workable in practice: you either need to deploy the world on every change, or you need to …

Some smartphones are locked down by their vendors. There's plenty of options to get full root access on something that's for all intents and purposes a smartphone, especially if yo…

Maybe the database upgrade from v(N-17) to v(N-16) simply takes a while, and hasn't completed yet? Or the responsible team is looking at it, but it doesn't warrant the whole compan…

https://github.com/jj-vcs/jj

Blue/green might allow you to do (approximately) atomic deploys for one service, but it doesn't allow you to do an atomic deploy of the clients of that service as well.

> Good luck getting 100+ devs to all use the same logical commit style The Linux kernel manages to do it for 1000+ devs.