Hacker Newsnew | past | comments | ask | show | jobs | submit | kaszanka's commentslogin

Also in Polish, which would mean "dog".

> no winhttp.dll, wininet.dll, or ws2_32.dll. offline validation only. all crypto is local, so theoretically extractable.

You can't possibly know that by the mere lack of these DLLs from the import directory.


TFA is checking those via imports, not copied DLLs.

I suppose they could LoadLibrary/GetProcAddress at runtime, but that'd be a lot of effort for obfuscation.


That's still not a fair comparison, because on a console you don't have the option to do any of that.


It is a pretty fair comparison.

You do have the option to open up Discord voice chats on PS5. Amazing what Discord could do when forced to actually write something efficient.

Youtube also exists as an app, and maybe you can trick the heavily gimped built in browser to go there as well, although last I checked it wasn't trivial.


TIL! That's neat, I wonder how much RAM that client uses compared to the desktop one.


Personally I haven’t caught the discord electron app (it’s not a desktop client) using more than 4G of ram at one time :)

Maybe 6 once. Try not to leave it for weeks displaying the memes/cat photos channels…


It kind of is, because if you use a PC like a console 16 Gb is enough. If you use a PC like a PC it's not.


> after booting my VM KDE just flashed because my external GPU was gone but everything went back working without a need for relogin.

What GPU are you using and how did you configure this, if you don't mind me asking? On my end I just can't unload the driver for it if I let KDE start with the external GPU available.


A Sapphire Radeon 9070 as the external GPU and a Ryzen 7 7600 as the integrated GPU. But I don't recommend this particular model for the 9070 if you want to do VFIO, it has the infamous reset bug so after booting the VM once I can't use the external GPU anymore unless I restart the machine. Also I never got the VFIO completely working, I could pass the GPU to the VM but the VM could not find the GPU (e.g., the AMD drivers said "no GPU found" while running the installer).


Actually, now that I think about this could be that my system is set to autologin (I am using Jovian-NixOS to get a almost SteamOS experience), so maybe this is not KDE being smart and could just be that it crashed and the system automatically login again. So yes, maybe this doesn't work.


Good post on troubleshooting the failure to boot, but from the title I was kind of hoping for something like decryption and analysis of the blobs' contents, rather than just metadata. Very "cool" that 3 megabytes of unauditable malware (the public blobs) are still not enough to even boot the platform...


Anyone can do this by changing the author and committer date. Take a look at https://github.com/dspinellis/unix-history-repo, linked in the comments here, for example.


This is basically what most of the challenge types in go-away (https://git.gammaspectra.live/git/go-away/wiki/Challenges) do.


+1 for go-away. It's a bit more involved to configure, but worth the effort imo. It can be considerably more transparent to the user, triggering the nuclear PoW check less often, while being just as effective, in my experience.


Probably even non-vetted firmware-to-browser chains, by requiring boot attestation to open a TLS connection or something.


I'm dreading the day when this becomes required by the government...


With the ramping up of 18+ verification in Australia and now Europe (and South Korea and China already having such a programme for many years, including game time locks for young people), yeah.

It doesn't seem that big a leap to connect the dots from device attestation > web browser integrity > identity verification > verified web access

There is actually a relatively old game series of the 2000s called Bluesky Hacker Replay that has this as the core element of its worldbuilding. Governments and corporations became tired of the internet being overrun with spam, viruses, porn and cyberterrorism and decide to create an internet 2.0, tightly controlled by corporate interests. Hackers persist on the old 1.0 internet called the SwitchNet.

And really, when you think about it.. if you composed an internet solely from the big name social media, entertainment, work, food, news and knowledge services, running atop Cloudflare who verifies everyone via government ID, how many would really complain? 99% of their internet time is already spent inside that bubble.


To be even more pedantic, it's also not present on Android.


Good points, I've been out pedantic-ed!


not if you fork an open source os and add /etc/passwd you haven't been


Oh joy. So when this sort of stuff comes to mobile phones, at least when the McDonalds app refuses to start on your pocket general purpose computer (because it's not running software that Google considers 'trustworthy') you'll be able to confidently say that the RTL for the part of the chip that is ultimately responsible for betraying your interests is open source. Surely consolation enough for missing out on your burger discount.

I like to bring up McDonalds as an example because IIRC it requires the highest, 'strong integrity' verdict from SafetyNet/Play Integrity/nom-du-jour. Maybe they should rename it to something with Open in the name when OpenTitan comes to Chromebooks.


"Open" does not mean "open source" anymore thanks to "OpenAI"


It never did, what open source has Open Group ever did?

In the old days Open was about industry standards not source code.


CDE is Open Source :)

But of course, you are correct.


Eventually, after it no longer mattered.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: