Hacker Newsnew | past | comments | ask | show | jobs | submit | ktm5j's commentslogin

I don't understand this, because KASLR has been default in FreeBSD since 13.2:

[kmiles@peter ~]$ cat /etc/os-release

NAME=FreeBSD

VERSION="13.3-RELEASE-p4"

VERSION_ID="13.3"

ID=freebsd

ANSI_COLOR="0;31"

PRETTY_NAME="FreeBSD 13.3-RELEASE-p4"

CPE_NAME="cpe:/o:freebsd:freebsd:13.3"

HOME_URL="https://FreeBSD.org/"

BUG_REPORT_URL="https://bugs.FreeBSD.org/"

[kmiles@peter ~]$ sysctl kern.elf64.aslr.enable

kern.elf64.aslr.enable: 1


This knob isn't KASLR, it just enables ASLR for ELF binaries.

That's not what man in the middle attacks are about.. it's not about the encryption, it's about verifying that you really know who you're talking to.

I'm on my phone right now so I'm not going to dig too hard for this, but you can also configure a "merge tool" (or something like that) so you can use Meld or Kompare to make the process easier. This has helped me in a pinch to work out some confusing merge conflicts.

I started using Meld years ago and continue to find people who've never heard of it. It's a pretty good tool.

Huge meld fan here, recommended by a professor about a year ago. Game changer

DIYers and enthusiasts should still worry about their house burning down because one of these boards started a fire. An insurance company would investigate and find any excuse they can to deny payment.


Insurance covers the insured's own gross negligence. This is a trope up there with believing the "warranty void if removed" stickers.

The real reason this should give you pause is that you don't want your house to burn down regardless of an insurance payout. That is how your incentives remain aligned with the insurance company.


I’m not sure about your home insurer, but here in the UK, most home electrical wiring, including solar for example, is “notifiable” to building control and requires a qualified tradesperson to implement.

If you want to DIY everything you need self-build insurance.

I’m definitely not covered if I were to burn my house down with a dodgy inverter installation.


In many (most? all?) jurisdictions in the US there's a carveout to exempt DIY work from licensing requirements and to require insurance to cover it.

Many things you still have to get a permit and have it inspected afterwards just like a professional would. But if you skip that no one will ever notice unless it's major structural work (such as a new deck).

That said, if it's electrical and you skip the required inspection and then your house burns down and your work was at fault that might nullify your insurance but I'm not sure.


IANAL but I don't think that's true at all. Electrical work needs to comply with code standards (NEC). I'll eat my hat if an insurance company pays for a fire that was caused by using homebrew electrical systems.


I'd really like to see citations to the opposite. After all, the main function of most homeowners' insurance policies is to keep banks whole regardless what happens.

In my experience insurance companies just ask you a bunch of big-picture or specific questions (eg swimming pool), reserve the right to inspect even though they never do, and then jack the rates rather than trying to grok more unknowns.

I've never read an insurance policy where anything like this is explicitly mentioned. I suppose there is a legal path of being criminally charged by fire investigators for having performed unsafe wiring (non-Listed power handling equipment as part of the fixed wiring), and then the insurance company denying you because of that criminality. Or in states where DIY wiring is not illegal, perhaps declaring that the wiring itself is "illegal" (as it goes against the NEC (despite the NEC not being openly published as we generally expect from laws!)) and then hanging their hat on illegality regardless of criminality? But does any of this happen in practice?

Surely if insurance companies were concerned about fires caused by dodgy electronics, they'd address all of the people using non-NRTL-tested GENSYM brands from Amazon et al? They've got no ability to post-facto deny based on this (said devices aren't illegal), but they could surely make it an explicit condition of policies.


Like I said, I'm not a lawyer.. and I'm no longer a homeowner so I don't have an insurance policy. So I don't have a citation for you. I may be wrong about this, but I don't think that I am. If anyone who's in the know can help then I'd be okay with being proven wrong.


The other one that drives me nuts is “sensitive electronics” in generator discussions.


Do conventional synchronous generators not cause the problems they purportedly do? I've got an inverter generator simply for fuel usage.

I've certainly had my fair share of square wave UPSs and devices that don't work on them.


This could be because of a floating neutral.

There are certainly cases where harmonic distortion is a problem for a device. It’s just that everyone is left guessing, and there’s an overblown fear of devices being harmed.


You don't think RF noise comes out of the generator?


Sure. It’s just rarely what lay people associate with “sensitive”. Most customers are worried about small electronics with switching mode power supplies that wouldn’t have a problem with just about any power source.

I wouldn’t run some AC motors, old AC clock, ham radio, or many other things on some generators.

The line is open to interoperation and never defined by the manufacturer. It’s blanket liability avoidance that confuses customers.


Should is doing a lot of work there. The reality is most don’t. These are people who don’t understand minimum conductor size trying to DIY a solar system.


Yes it definitely can diverge while still staying open source. Happens in the Linux kernel for example whenever the ABI changes.


It can, and has in the past, diverged from the baseline Linux kernel, but not from “the last open Android kernel” as it must remain open source per GPL.


Perhaps, but it doesn't change the fact that this is bad behavior for the company sending the email. Since YCombinator funded this company it makes sense that YC would want to know about how they are conducting business.


That still doesn't answer the question of why it's better. Unless you're paranoid about an OEM backdoor, I think this is cool but not worth the effort.


I think firstly is the FOSS obsession and backdoor paranoia from evangelists, and secondly and the more practical one is that the proprietary IBM BIOS is full of bugs and anti-consumer blacklists and whitelists designed to limit repairability and upgradeability, which stil boggle my mind on how those laptops got such a good image on that front.


I mean, maybe paranoia is the wrong word.. it's not something that I'm personally worried about, but stuff like that has actually happened.


>but stuff like that has actually happened

Yes, if you live and organize your life around things that are unlikely to happen to you, but only because they've happened ONCE to someone else, typically a high value target by state actors, that's called paranoia.

Most people are not gonna be targeted via BIOS hacks. From state actors to online scammers they all have easier ways to getting your data remotely.


> Most people are not gonna be targeted via BIOS hacks.

This is not really true:

https://www.techdirt.com/articles/20150812/11395231925/lenov...


That was once in 2014. How often did that happen? What damages did the users incur from that attack?

Normal people don't live in constant fear daily over something that happened once and caused no losses.


I'm not sure that's paranoia (as others have pointed out, OEM firmwares have had security problems before), but sure, let's ignore security problems for a moment.

1. Firmware contains bugs. Old proprietary firmware tends to not get fixes. If you switch to an open source version, you can get the bugs fixed.

(Edit) 1.a. Old proprietary firmware also doesn't tend to get new features, and open source replacements can cover that. (eg. booting over HTTP(S) or security features to help against Evil Maid attacks)

2. Libreboot claims to be faster to boot than the vendor firmware. Depending on the particular device/firmware, that wouldn't surprise me at all.


Yes, I said in another comment that I might have used the wrong word. It's still not something I have a lot of motivation to do something about. At least not until the process is easy.


> Unless you're paranoid about an OEM backdoor

Lenovo does have a history with installing a very obvious spyware rootkit on their consumer PCs[0].

[0]https://support.lenovo.com/us/en/product_security/ps500035-s...


I think you've pretty much summed it up.

As far as I'm aware, it has less functionality than the OEM, so you use it to _remove_ features (good and/or bad).

Aside from that, I suppose it means you can run a more up to date firmware if yours is no longer maintained, but I'm not sure what that means in practical terms.

There's also the "hyper paranoid" fork "canoeboot" which has no proprietary blobs, and presumably _even less_ functionality.

The short answer is; if you don't know why you want it or need it, you probably don't.


If this were a commercial project then I could understand the complaint.. but this is just a small, for-fun project and they have little motivation to put the extra effort into support for all browsers.


Bellard (yes, him) already had a working VM of Windows 2000 in the browser around a decade ago, with no specific "support for all browsers" (whatever that means):

https://bellard.org/jslinux/vm.html?url=win2k.cfg&mem=192&gr...


Sadly we can't all be Bellard


Also, look at 8086tiny, or PCulator/XTulator. These could be ported with ease to EMSCripten and run everywhere, not just in Chrome.

Chrome almost became the new IE and Google, despite it's motto, the new Microsoft. Ok, the desktop? Android rules the smartphone sales in the world, and its online services are used by millions, with far more metadata grabbing than w9x/wxp on its day and with the same propietary OSes.


Consider: maybe it's not a matter of non-standard APIs, but bad performance. It's not simply porting to the lowest common denominator, it's making sure the code doesn't run at a snail's pace because the JIT/wasm compiler has a pathological edge case.


I'm not really complaining; just harking back to a shitty time that is, on some commercial sites, threatening to return. Especially as Apple finally allows Chrome on iOS, eroding the main bastion against it: Safari.


I feel like you're making a silly distinction. I mean, we ban cigarette use for minors because it's bad for them.. are you against that too? You're admitting that you think certain books are inappropriate for kids, but saying that we shouldn't do anything about preventing their use in schools.. why?

Not every kid goes to a school with wonderful teachers. I think banning books for use in schools is justifiable.


Any chance you'd consider an android port?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: