Viewing profile — oxylibrium

Disabling all of Defender is complex, but disabling automatic sample submission is easy. It's an option in the Security settings app, and you're even allowed to disable it during f…

> The performance hit is minimal. I'll bite once again - from personal experience, I knew Gmail is slower than ProtonMail, but I tested it anyway. I loaded both Gmail and ProtonMai…

I'll bite. First, encryption is not "obscurity" in the same way you think DRM is. Second, several other email providers don't think they need to rely on some performance-killing DR…

Pop open developer tools - Gmail's JavaScript is heavily obfuscated, not just minified. (I think it's a custom, self-modifying VM that's written in JavaScript, and it fetches piece…

I think those are particularly choice words coming from Basecamp, who have been particularly active in calling out Apple's treatment of iOS and the App Store, which is in at least …

Oh, there's a lot more "fun" stuff you can do in kernel mode. One comedic example is setting the CPU Vcore offset to +2.2V for fun/revenge. I don't know if it will destroy CPUs per…

There's always going to be software to defeat those tools! I've done my fair share of experimentation with source-to-source transformations; you can do things like substitute for/w…

I think conversations about cheating are missing the forest for the trees - or the learning for the degree. I maintain that cheating is almost always a pedagogical problem first, a…

There's two problems with this statement. First is the assumption that students don't care about privacy, second is the lack of discussion about consent. I'm a student who takes sp…

> During the test, the student is only working on the test, which is not private or secret. You fail to consider the circumstances in which the test takes place. Students take the …

"Security researcher" here: Proctorio's "zero-knowledge encryption" claims were in name only, pretty much. TL;DR Canvas and Moodle use incrementing integers for both user ID and qu…

Genshin Impact's anti-cheat is not completely secure: you can use it to read/write umode memory / read kmode memory with kernel privileges: https://github.com/ScHaTTeNLiLiE/libmhyp…

> ...make it well known that they're installing... Many vendors originally hid the fact until they started receiving community backlash about it. For example, Riot with Vanguard or…

WeChat may have a convenient way to track users within the app, but a "device ID" equivalent is still useful for ad agencies to transparently target users on other apps based on th…

They... aren't doing that?

Hi there, I'm the person who extracted the algo and ran the original test. I picked my words mostly in response to the "fewer than five complaints ... due to race" statement Procto…

hi - I'm the person who extracted their facerec algo and ran the test - another problem is that they're pretending that it wasn't a problem. See "fewer than five complaints" on the…

Thumbnail rendering on GNOME is already sandboxed with bubblewrap, even when you're outside Flatpak: [0] for docs and [1] for code on how they accomplish it. I don't think it's pos…

Not in my experience - for instance, Discord on Windows when I last used it can register itself to run on user login without ever needing UAC to install itself (it installs to %APP…

I'm not too sure about "falling behind Windows", personally. The major lines of defense that Windows appears to rely on are code signing and a signature database, with behavioral A…

I decided to look at the messaging - the websites of both Flatpak[0] and Snap[1] make no claims about security, or about being "designed to be built by less-trusted parties". Both …

Created an account just to reply to this - there is no "proprietary" API for actions like opening files. Both Flatpak[0] and Snap[1] use the same xdg-desktop-portal spec[2], which …