Brianna Wu / John Walker Flynt - "Biggest Victim of Gamergate," Failed Game Developer, Failed Congressional Candidate

  • 🇵🇦 Nuestro primer dominio localizado está en español en kiwifarms.pa. Our first localized domain is on Spanish on kiwifarms.pa.
  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account
Destacado
upload_2018-5-10_18-37-11.png


upload_2018-5-10_18-37-22.png


upload_2018-5-10_18-37-41.png


upload_2018-5-10_18-38-9.png
 
Hellfire dijo:
upload_2018-5-10_18-38-9-png.446432
Presiona para expandir...

I flat guarantee you that if Signal didn't use the notifications API, which is the only sensible course, Wu would instead be complaining it didn't meet her expectations as an Apple fanboy in as much as behaving how she expected an app to behave.

If you're supposed to be a secure application, there's no amount of data you can hand over to an untrusted API that doesn't constitute a leak of confidential information. Even "you have X new messages at such and such a time" is a useful audit log for a malicious third party.

Hey, you can probably find fragments of those messages in the page file occasionally as well. I bet they aren't conscientious about how they write these messages to disk, and even if they are, hardware wear levelling on modern SSD drives means you're never sure the logical block you're addressing is the same physical block between any two transactions, so who knows what an attacker with time, money and a scanning electron microscope could discover. You want security? Use full disk encryption. Complaining your toy chat app might actually let people read your messages on your machine is fucking stupid.
 
Norvic dijo:
I flat guarantee you that if Signal didn't use the notifications API, which is the only sensible course, Wu would instead be complaining it didn't meet her expectations as an Apple fanboy in as much as behaving how she expected an app to behave.

If you're supposed to be a secure application, there's no amount of data you can hand over to an untrusted API that doesn't constitute a leak of confidential information. Even "you have X new messages at such and such a time" is a useful audit log for a malicious third party.

Hey, you can probably find fragments of those messages in the page file occasionally as well. I bet they aren't conscientious about how they write these messages to disk, and even if they are, hardware wear levelling on modern SSD drives means you're never sure the logical block you're addressing is the same physical block between any two transactions, so who knows what an attacker with time, money and a scanning electron microscope could discover. You want security? Use full disk encryption. Complaining your toy chat app might actually let people read your messages on your machine is fucking stupid.
Presiona para expandir...

So in true John fashion it's not about why Apple is storing notifications or not implementing a safety feature into the API for secure apps, it's all the app devs fault.

Keep shilling Apple Johnny boy, never change.
 
The Flynt's Stones dijo:
Turning $6,000,000 into $1,800 seems pretty much on par with Johnny.
Presiona para expandir...

John made a shitty vidya nobody played.

Tommy made a titanically shitty movie that literally millions of people paid to see. It was so astoundingly shitty that another movie was made about this shitty movie and was nominated for dozens of awards and showered with accolades.

John screamed about harassment and nobody cared.

Tommy dealt with actually enormous levels of harassment, personal disparagement, insults, harsh reviews, his movie largely being considered one of the worst atrocities ever committed against film, and. . .coped with it. Dealt with it. Actually embraced the reputation.

John. . .so completely irrelevant nobody cares what he does. Nobody will remember him. When he dies, he won't even get an obituary unless he pays for it.

Tommy. . .so beloved that anywhere he shows up, there will be thousands of people cheering him. When he dies, there will be parades past his tomb, and it will be showered with spoons.
 
Tommy Wiseau has balls. How is that not enough to know the fucking difference?
 
Norvic dijo:
I flat guarantee you that if Signal didn't use the notifications API, which is the only sensible course, Wu would instead be complaining it didn't meet her expectations as an Apple fanboy in as much as behaving how she expected an app to behave.

If you're supposed to be a secure application, there's no amount of data you can hand over to an untrusted API that doesn't constitute a leak of confidential information. Even "you have X new messages at such and such a time" is a useful audit log for a malicious third party.

Hey, you can probably find fragments of those messages in the page file occasionally as well. I bet they aren't conscientious about how they write these messages to disk, and even if they are, hardware wear levelling on modern SSD drives means you're never sure the logical block you're addressing is the same physical block between any two transactions, so who knows what an attacker with time, money and a scanning electron microscope could discover. You want security? Use full disk encryption. Complaining your toy chat app might actually let people read your messages on your machine is fucking stupid.
Presiona para expandir...

Just a technical point, (I'm about to sperg out here). Reading the raw data on hard drives based on wear on the drive has been dead since SSD prevalance. Old magnetic disc "spinning-plate" drives had several methods akin to reading it based on voltage differentials and such, which got harder and less effective once hard drive density reached about ~300G.

SSDs are used in a unique way since it's basically flash memory to prevent wear-and-tear. At least on linux/unix/bsd etc. filesystems are optmized to write data in a "linear" fashion. Versus spinning disk where you wanted everything at the inside center to maximize speed of retrieval, there is no difference in SSD performance at the end, beginning, or middle. So the "linear" profile basically allocates new files / growth starting at the beginning of the disk, marking any deletes/moves from the font of the disk as "deleted", and continuing on new allocations until you span the whole disk. Then you start at the beginning again and overwrite on the deleted portions. Since fragmentation isn't an issue on SSDs this is fine and maximizes the lifetime of the drive by performing even write-wear on the disks. SSDs don't really have any decays from reads unlike spinning disk.

As far as virtual address -> physical address, yes that's been true for a long time. Basically, for several decades the way that hard drives work is they're advertised with a capacity, say 1T, but they actually have 1.2T of capacity. That extra 20% is not reachable under normal means. Through the life of the drives, as disk blocks are noted bad by the firmware on the drive they are invisibly remapped to a same-size portion of the extra area. All this data is available (like how many blocks have been remapped) through the standardized "SMART" interface (see: smartctl on linux/unix/mac/bsd). Even the OS doesn't know which blocks have been remapped, that's all done at the firmware level.

A sophisticated technique back in the day (and still today) was cracking the hard drive maker's firmware and storing data in the "remapped" section. If you paid attention to the ShadowBroker's dump, they had shown several companies have been totally pwnd on the firmware side by NSA. So you could hide malware in that extra "available to remap" section, note those blocks as unavilable for remap. When the hardrive is woken up your firmware hack then can copy malware from that hidden section and insert it into the running system through DMA or otherwise, completely invisible from the OS and impossible to clean without hacking the HD firmware yourself.

</sperg>
 
Destacado
Debes iniciar sesión o registrarte para responder aquí.
Atrás
Top Abajo