Basically a deer with a human face. Despite probably being some sort of magical nature spirit, his interests are primarily in technology and politics and science fiction.

Spent many years on Reddit before joining the Threadiverse as well.

  • 0 Posts
  • 693 Comments
Joined 2 years ago
cake
Cake day: March 3rd, 2024

help-circle





  • Okay, wow. I’ve garnered plenty of downvotes on the Fediverse by not auto-hating many of Microsoft’s new features and updates, I’m sure I’ve been labelled a “Microsoft shill” or somesuch in some folks’ user notes. But this is just ridiculous.

    The single most important rule Microsoft should have is “thou shalt not brick thy customers’ computers with a routine update.” Sure, it’s not the most common set of triggering conditions in the world, but the problem is immediate and obvious upon booting up. How do they not have a test plan that would catch this?








  • It works because the .png and .jpg extensions are associated on your system with programs that, by coincidence, are also able to handle webp images and that check the binary content of the file to figure out what format they are when they’re handling them.

    If there’s a program associated with .png on a system that doesn’t know how to handle webp, or that trusts the file extension when deciding how to decode the contents of the file, it will fail on these renamed files. This isn’t a reliable way to “fix” these sorts of things.




  • It comes down to whether you can demonstrate this flaw. If you have a way to show it actually working then credentials shouldn’t matter.

    If your attempts at disclosure are being ignored then check:

    • Am I presenting this in a way that makes me seem like a deranged crazy person?
    • Am I a deranged crazy person?

    Try to resolve those. If the company you’re trying to contact is still send your emails to the spam bin, maybe try contacting other people who have done disclosure on issues like this before. If you can convince them then they can use their own credibility to advance the issue.

    If that doesn’t work then I guess check the “deranged crazy person” things one more time and move on to disclosing it publicly yourself.


  • The Coordinated Vulnerability Disclosure (CVD) process:

    1. Discovery: The researcher finds the problem.

    2. Private Notification: The researcher contacts the vendor/owner directly and privately. No public information is released yet.

    3. The Embargo Period: The researcher and vendor agree on a timeframe for the fix (industry standard is often 90 days, popularized by Google Project Zero).

    4. Remediation: The vendor develops and deploys a patch.

    5. Public Disclosure: Once the patch is live (or the deadline expires), the researcher publishes their findings, often assigned a CVE (Common Vulnerabilities and Exposures) ID.

    6. Proof of Concept (PoC): Technical details or code showing exactly how to exploit the flaw may be released to help defenders understand the risk, usually after users have had time to patch.

    You say the flaw is “fundamental”, suggesting you don’t think it can be patched? I guess I’d inform my investment manager during the “private notification” phase as well, then. It’s possible you’re wrong about its patchability, of course, so I’d recommend carrying on with CVD regardless.



  • If you believe that Google’s just going to brazenly lie about what they’re doing, what’s the point of changing the settings at all then?

    In fact, Google is subject to various laws and they’re subject to concerns by big corporate customers, both of which could result in big trouble if they end up flagrantly and wilfully misusing data that’s supposed to be private. So yes, I would tend to believe that if the feature doesn’t say the data is being used for training I tend to believe that. It at least behooves those who claim otherwise to come up with actual evidence of their claims.