Forgot your password?
typodupeerror

Comment Re:So, how does that cause privilege escalation? (Score 3, Informative) 34

At least on my systems you need to be root do to anything with nf_tables. Is this some distro specific permission stupidity?

Maybe. There's a feature called user namespaces in Linux that effectively allows an unprivileged user to act as if they were a privileged user within a specific environment. (Basically, containerization.) Within such a namespace, a non-privileged user could conceptually access nf_tables as if they were a privileged user. In theory this would only allow them to add additional filters within the namespace, but the vulnerability here can provide direct access to kernel memory.

Some distros add additional layers of security to prevent flaws like that, blocking access to nf_tables even within a namespace, but the vulnerability links to ways around those. (Link to the Wayback Machine from the source vulnerability disclosure.)

It's possible your distro may be secure - or it may not be. It depends on what features are enabled.

Comment Re:That's creepy (Score 2) 40

Only the sender and recipient have they keys to decrypt the messages on device; Apple does not.

Which is great, when they're in transit. But once they're on-device, they're decrypted, and then Apple has access to them.

We know this, because there have been court cases where iCloud-subpeonaed iMessage messages were presented as evidence.

Just because the transit is secure, doesn't mean the endpoints are.

Comment Re:Oh crap (Score 1) 62

Also, weren't you one of the geniuses here on /. telling us that Trump would keep us out of wars? How is that one going?

Oh, but these are *preventative* wars. He gets a peace prize for every country he invades!

Venezuela was using fentanyl as a WMD. Iran was about to nuke us. Cuba might attack us with drones if someone provides them. Greenland might start a snowball fight, and make us look bad if we lose.

Presumably we've got all our best people on this, since they're obviously not on the UFO videos.

Comment Re:Weaponization of lockouts (Score 1) 66

DVRs were the starting point. The namesake for what you're talking about, tivoization, is Tivo, the DVR that existed way back when TV was still analog and being displayed on CRTs.

It's why the GPLv3 was made: to add clauses to forbid tivoization. Instead, a lot of the open source community moved in the opposite direction, moving to licenses that allowed companies even more freedom to lock up their code.

At some point people have to learn and fight back.

Good luck. This is not a new fight by any means. You could argue that the FSF has been fighting it for almost half a century. People by and large do not care.

Comment Re:Win the battle, lose the war (Score 3, Insightful) 66

More likely they'll separate the OS and the TV code so they can ship the open source OS along with their closed source software

I'd be amazed if this wasn't already the case. We've already been through this with Tivo, it was one of the reasons behind the creation of the GPLv3. Tivo based their DVRs on Linux, and provided downloads of the Linux code. But their DVRs used hardware DRM to ensure that only code signed by Tivo would run, making it so that even with the open source code, you couldn't run changes on the hardware.

From what I can tell, Vizio is doing the same thing, but isn't providing downloads to the kernel code they're using. It's possible that there's some proprietary hardware drivers that they don't want to release code to, but Nvidia has already show how to work around that.

I expect the end result to be like Tivo: a bunch of archives of the open source software used in the TV, but none of the code required to make it useful and no signing key necessary to allow any changes to run on the TV itself.

Comment Re:Federal Bribery and Taxpayer Abuse. (Score 1) 101

Every republican that acts like it's bad, probably voted for it. Every democract that speaks out against it probably voted for it.

You can't count on voting records to mean anything, thanks to the "designated villains:" the politicians whose job it is to tank a law that a party wants to be on record as having voted for, but don't want to pass. We're watching this happen right now with votes on the Iran war. Democrats don't want them to pass. What they want is to be on the record as being against it and want Republicans to be on the record as supporting it, even though there is no chance they'll do anything to stop it if they get the power to do so.

Both sides play games like this, with the end result being that only laws that have the support of large donors having any real chance of passing. Who votes for and who votes against is always carefully calculated to let vulnerable politicians give the appearance of supporting things constituents support, while never needing to support those things in actual fact.

Slashdot Top Deals

1.79 x 10^12 furlongs per fortnight -- it's not just a good idea, it's the law!

Working...