josephcsible

It doesn't matter whether your mother's banking app refuses to work. If her phone gets rooted, the attacker will replace it with an app that steals her credentials and then refuses to work. …

This doesn't really fix it. Rewriting everything in Java/Kotlin won't magically grant the terminal all of the permissions that it used to have.

Netflix, Snapchat, Pokemon Go, Super Mario Run, etc. will intentionally never work on a FLOSS phone, so I doubt it'll ever catch on outside the tiny enthusiast community.

> Enforcing SafetyNet is probably also a net positive change How so? How does SafetyNet make any end-user even slightly more secure?

> Or maybe safety net is not so much about user safety as it is about platform lockdown and vendor safety. Sadly, it's exactly this. It's not for your safety at all. It's for keeping…

Unless you only use one such website ever, then it's a win for the browser to be the heavy client instead of having separate ones for each.

TIL that's where the word for byte ordering came from.

Yep, that's wrong. There's no way Linus would ever let such a change get merged.

The problem is that it's bad for standards. We're currently in a situation where standards are basically completely irrelevant, and the only thing anyone cares about is support in Blink. Thi…

Ethylene glycol is a deadly poison too, and people get close to it on a regular basis.

They use poison powder, not poison gas, which has at least somewhat reduced potential for collateral damage.

> Also, the text explaining what it does is so small you’d have to put your head near the device to read it. So? It's not a proximity trigger. It won't activate unless you pull on the bai…

It's more open in terms of what software you can run. And if you cared about hardware being open, RISC-V is where you'd have to go. ARM certainly isn't open hardware.

> But of prices on... what? Yaacts? It's not like people are going to start buying 1000x more bread loaves and corollas. And then what will the yacht company do with all of the money? > it …

> there is now a compelling reason to perform the impossible: spend all that damn money before the tax man gets it. Isn't that a recipe for hyperinflation?

The link is to insecure HTTP. I think that site just doesn't support HTTPS.

I feel like this article makes the technique sound a lot more novel/surprising than it is. It seems like a simple case of "phone had an RCE vulnerability that got exploited by an attacker in…

Not every security fix is known to be a security fix at the time. If such a system existed, people would be overconfident in it and this would happen even more.

Why shouldn't old-but-capable hardware be able to run new software?

You can have your cake and eat it too. Use progressive enhancement/graceful degradation so that users with JS get immediate visual feedback, and just fall back to reloads without JS.

This reminds me of https://xkcd.com/1172/ (how do I re-enable spacebar heating?) and https://weblogs.asp.net/alex_papadimoulis/408925 ("A client has as…

They reversed course! https://github.com/bountysource/core/pull/1498/commits/b9774... …

Isn't that basically what the stillborn Intel MPX was?

> like if Chrome attached a header to all outgoing requests that said incognito=1 or something Which, by the way, would be a disaster. There's already enough otherwise-legitimate sites that ex…

Yes. The whole point of end-to-end encryption is that your data is safe even when it goes through untrusted servers. (I know they might have a backdoor, or might screw it up somehow. But in principle,…

That's a reasonable point, but they could have addressed it without keeping everyone's money. People would be a lot less upset if you had a 30-day grace period to claim a refund whenever a b…

> There's probably a good chunk of change there held by now-inactive users who they're hoping won't actually do anything about the change like redirecting their funds. Or it could be…

> Can't you just uncheck an option in the settings? > The significant difference to iOS is that you can tell your user what to do to get the app running anyway. No such (reasonably expectab…

For context, Bountysource is a site that lets people put bounties on feature requests for open-source software. A developer who implements the request can then claim the bounty. Anyway, this change ad…