[-] [email protected] 2 points 1 day ago

I honestly detest those kinds of names. It is so... wild. And that's me coming from magic the gathering and yugioh where we get exclaim random card games with joy and fun rage.

[-] [email protected] 30 points 1 day ago

So the landlord will use the money from the rent to personally hand repair that furniture himself, right? He won't just jack up the price and hire a cheap fixture repair place, right?

[-] [email protected] 6 points 1 day ago

Literally walk onto the floor and go "I'm smoking that Shadow Garden Dark Evil pack." Just go full blown into the meme.

[-] [email protected] 20 points 1 day ago

Cool! Now are we gonna get any laws to prohibit this national security threat? Maybe ban shady donations from billionaires both American and abroad? Because if we just ban Putin from donating directly, they can just make a shell company in New York and fund him.

We're going to get the laws put into place to stop this, right? Anything to stop Trump from getting into the office again?

[-] [email protected] 14 points 5 days ago

Free software != free of charge.

Nothing about free software says you need to give it away for no cost, nor that anyone can't do it. You can charge $100 for a simple calculator program that is under the GPL for its code. Nothing is there to prevent you from assembling the code and making it yourself, or from the buyer from copying and sharing the program. It's just way way easier to show off the program for free as in price and freedom for most programmers.

It's why the people who made Debian/Slackware/Ubuntu discs could charge money for an otherwise free product. Because the programmers openly allow this.

And programming is itself labor, just a lot of free software devs don't worry too much about getting paid for it.

https://www.gnu.org/philosophy/selling.html

Except for one special situation, the GNU General Public License (GNU GPL) has no requirements about how much you can charge for distributing a copy of free software. You can charge nothing, a penny, a dollar, or a billion dollars. It's up to you, and the marketplace, so don't complain to us if nobody wants to pay a billion dollars for a copy.

The one exception is in the case where binaries are distributed without the corresponding complete source code. Those who do this are required by the GNU GPL to provide source code on subsequent request. Without a limit on the fee for the source code, they would be able set a fee too large for anyone to pay—such as a billion dollars—and thus pretend to release source code while in truth concealing it. So in this case we have to limit the fee for source in order to ensure the user's freedom. In ordinary situations, however, there is no such justification for limiting distribution fees, so we do not limit them.

Sometimes companies whose activities cross the line stated in the GNU GPL plead for permission, saying that they “won't charge money for the GNU software” or such like. That won't get them anywhere with us. Free software is about freedom, and enforcing the GPL is defending freedom. When we defend users' freedom, we are not distracted by side issues such as how much of a distribution fee is charged. Freedom is the issue, the whole issue, and the only issue.

[-] [email protected] 86 points 2 weeks ago

Can someone try to "Little Bobby Tables" them? Just put some SQL injection shit to make the servers more of a dumpster fire?

39
submitted 1 month ago* (last edited 1 month ago) by [email protected] to c/[email protected]

Hello! The TL;DR is:

I have an m.2 drive that is in a sturdy enclosure that has 1 TB. I have Ventoy with Medicat on there, with some backups of important data.

I still have a lot of room left on there, so I was thinking what else I could do, and the idea of basically installing a Linux Distro to a chunk of free space on there. Maybe Debian/Fedora or Arch.

Is there anything I should be aware of to help not break that system or rapidly kill the drive? It's not a USB flash drive, it's a M.2 drive that's put on a small board that then allows it to talk via USB C/Thunderbolt.

EDIT: Just to be sure, if I use Ventoy's EFI, do I need to be worried about a conflict with the bootloader of the Linux install?

[-] [email protected] 76 points 2 months ago

Place your bets for how long until Google kills this. I'm willing to bet 2 years.

163
submitted 2 months ago by [email protected] to c/[email protected]

Firmware security company Binarly on Wednesday disclosed the details of an attack method that can be used to compromise many consumer and enterprise devices by leveraging malicious UEFI logo images.

The attack method, dubbed LogoFAIL, exploits vulnerabilities in the image parsers used by the UEFI firmware to display logos during the boot process or in the BIOS setup. Getting the affected parsers to process a specially crafted image can enable the attacker to hijack the execution flow and run arbitrary code.

Hackers can use the LogoFAIL attack to compromise the entire system and bypass security measures such as Secure Boot.

“These vulnerabilities can compromise the entire system’s security, rendering ‘below-the-OS’ security measures like any shade of Secure Boot ineffective, including Intel Boot Guard. This level of compromise means attackers can gain deep control over the affected systems,” Binarly explained.

Binarly’s analysis showed that UEFI vendors use various types of parsers for BMP, PNG, JPEG, GIF and other types of images. The security firm’s research targeted firmware from Insyde, AMI and Phoenix and led to the discovery of two dozen vulnerabilities, more than half of which have been assigned a ‘high severity’ rating.

The impacted firmware is shipped with hundreds of consumer and enterprise computer models — including x86 and ARM-based devices — made by companies such as Acer, Dell, Framework, Fujitsu, Gigabyte, HP, Intel, Lenovo, MSI, Samsung, and Supermicro. This means millions of devices worldwide could be exposed to attacks.

A LogoFAIL attack can be launched by abusing the firmware update procedure to replace the legitimate logo with a malicious version. Attacks through physical access may also be possible, using an SPI flash programmer, assuming that the logo is not protected by hardware verified boot technologies.

Some vendors — this includes Intel, Acer and Lenovo — offer features that enable users to customize the logos displayed during boot, which can make it possible to launch LogoFAIL attacks from the OS, without the need for physical access to the device.

It’s important to note that while image parser vulnerabilities have been found in devices from all of the aforementioned vendors, they cannot always be exploited. In Dell’s case, for instance, the logo is protected by Intel Boot Guard, which prevents its replacement even if the attacker has physical access to the targeted system. In addition, Dell does not offer any logo customization features.

Details of the attack were presented by Binarly at the Black Hat Europe conference on Wednesday, and the company has published a technical blog post describing its findings.

The security firm has published a video showing a proof-of-concept (PoC) LogoFAIL exploit in action, demonstrating how an attacker who has admin permissions on the operating system can escalate privileges to the firmware level.

The vulnerabilities were reported to impacted vendors through CERT/CC several months ago, but it can take a lot of time for patches for these types of security holes to reach end devices, even if vendors create the fixes.

[-] [email protected] 84 points 2 months ago

If someone randomly told the public "Hey whatever you do, don't look into my basement" I would instantly start wondering what's in there. If a company said "We don't need to be investigated" I'd instantly double the funds to investigate them.

[-] [email protected] 63 points 2 months ago

"oh man I don't wanna call the cops on this white boy... Honey he says he wants the menu. I dunno. Make him some noodles and some chicken. He doesn't know I'm speaking English and not Cantonese, that's how zooted he is."

[-] [email protected] 637 points 3 months ago

"They're the same picture."

Also, that does not explain why:

  • Chrome users who use an adblocker don't get the issue
  • Firefox users who do not use an adblocker get the issue
  • FIrefox users who use an adblocker, but change User Agent to Chrome, don't get the issue

Now, if only we knew who made Chrome and YouTube... The mind boggles.

280
submitted 3 months ago by [email protected] to c/[email protected]

Microsoft is singing the praises of the new Outlook and wants to persuade users to switch. But beware: if you try out the new Outlook, you risk transferring your IMAP and SMTP credentials of mail accounts and all your emails to Microsoft servers. Although Microsoft explains that it is possible to switch back to the previous apps at any time, the data will already be stored by the company. This allows Microsoft to read the emails. Start menu shows new Outlook as recommended app

The new Outlook now appears as a recommended app in the Windows Start menu of Windows 11 devices with the 2023 update. The Outlook client itself also offers to test the new Outlook version with a "The new Outlook" switch. This is still under development, but is set to replace the mail program and the calendar included in Windows in 2024. In a recent tech community article, Microsoft employee Caitlin Hart also explains that it will also replace the classic Outlook. However, unlike the Windows Mail and Calendar apps, the timetable for this has not yet been set.

When adding a mail account in the new Outlook that is not hosted by Microsoft but is located on company mail servers, for example, the program displays a message. It links to a support article that simply states that non-Microsoft accounts are synchronized with the Microsoft cloud, whereby Gmail, Yahoo, iCloud and IMAP accounts are currently supported. The new Outlook also does this in the versions for Android, iOS and Mac. This means that copies "of your email, calendar, and contacts will be synchronized between your email provider and Microsoft data center". This gives the company full access to all emails and allows it to read and analyze them. Microsoft wants to provide functions that way that Gmail and IMAP do not offer. Warning message of the new Outlook version when adding a non-Microsoft account

The note makes you wonder: What does Microsoft transfer where? When creating an IMAP account, c't was able to sniff the traffic between new Outlook and the Microsoft servers. It contained the target server, log-in name and password which were sent to those Servers of Microsoft. Although TLS-protected, the data is sent to Microsoft in plain text within the tunnel. Without informing or inquiring about this, Microsoft grants itself access to the IMAP and SMTP login data of users of the new Outlook.

When switching from the old Outlook to the new one, it is installed the new software in parallel. Previously set up IMAP accounts are not automatically transferred, but the account stored in Windows is. During the test with Google accounts, authentication with OAuth2 was used. Users receive an authentication request and Microsoft does not receive any specific access data, but only an access token that users can revoke again.

An answer to our request for a statement from Microsoft is still pending. At this point in time, however, we must warn against trying out the new Outlook without thinking. In addition to all the emails, some credentials may even end up with Microsoft.

Microsoft already attracted attention with such data redirections at the beginning of the year. After Office updates were applied on Mac computers, Outlook redirected the data to Microsoft's cloud servers without any user notification. At that time, the remedy was to delete IMAP accounts and set them up again. However, this is obviously no longer helpful with the new Outlook.

The Federal Commissioner for Data Protection and Freedom of Information of Germany, Professor Ulrich Kelber, is alarmed by the data detour in Microsoft's new Outlook. He posted on Mastodon that he wants to ask for a report from the Irish Data Protection Commissioner, who is responsible for companies like Microsoft, during a meeting of the European data protection supervisory authorities on Tuesday of the coming week.

[-] [email protected] 65 points 4 months ago

Hey everyone, just a reminder:

  • Yes Nazis are also bad, we don't have Nazis pop up anywhere near as often as Tankies
  • We remove and ban Nazis too
  • We're aware of Lemmy's main code writers being ML's, and it's not great.
  • Please report any bigot bullshit, or fascist/tankie dogwhistles.
237
submitted 4 months ago* (last edited 4 months ago) by [email protected] to c/[email protected]

Title. Mainly asking for the library side, but PC cafe is also interesting to ask about.

Mainly since Windows 11 is 64-bit only, and it seems Windows 12 is going to subscription based on top of that, neither of which public libraries can afford tossing out computers and paying more in subscription fees than they make with overdue books.

My local library is only open for 2 days a week, due to a lack of funds for hiring more staff in the area. They use older Dell all in ones, and that just makes me think if they don't have the money for being open 5 days a week, they don't have the money to buy 4 new computers for the space.

Not even getting into the bigger libraries part of that system or the ones nearby. Some have 8 computers in groups, with 4 stations of groups.

So I was just wondering, if anyone has started or is aware of a Library/Public Computer focused linux-based OS? Perhaps one that allows immutable systems, and the library card system backed most use to enable end user access. Perhaps that's a config file tucked away somewhere.

And I guess the PC cafe OS is interesting, simply due to the fact that Linux gaming has been making huge strides, and PC cafes are still popular in Japan, Korea, and China.

EDIT: I am not in control or assistance to the library, just looking if there's a potential solution to libraries like mine. If I could give links to a library computer manager, or if I could give upstream bug reports to people making such software.

[-] [email protected] 177 points 4 months ago

https://www.macrotrends.net/stocks/charts/GOOG/alphabet/gross-profit

Alphabet gross profit for the quarter ending June 30, 2023 was $42.688B, a 7.85% increase year-over-year.

Alphabet gross profit for the twelve months ending June 30, 2023 was $160.503B, a 1.7% increase year-over-year.

Alphabet annual gross profit for 2022 was $156.633B, a 6.77% increase from 2021.

Alphabet annual gross profit for 2021 was $146.698B, a 50.01% increase from 2020.

Alphabet annual gross profit for 2020 was $97.795B, a 8.71% increase from 2019.

Huh, they seemingly have money to not fuck our eyes without lube for ads, but I guess they somehow just don't have enough money, 156 billion dollars is really nothing after all. Probably more money in between my couch cushions. Such a small indie company that has to struggle to remain afloat, like an Etsy store.

view more: next ›

queue

joined 6 months ago
MODERATOR OF
196