mberger's comments

On: Password managers less secure than promised

[mberger]

Save you the click.

The researchers demonstrated 12 attacks on Bitwarden, 7 on LastPass and 6 on Dashlane

[bstsb → mberger]

a better summary from the site:

> We examine the extent to which security against a fully malicious server holds true for three leading vendors who make the Zero Knowledge Encryption claim: Bitwarden, LastPass and Dashlane [...] The attacks range in severity, from integrity violations of targeted user vaults to the complete compromise of all the vaults associated with an organisation.

On: FEDAnet Project

[mberger]

How do i get compensated for my infrastructure that i need for this project and how is this different from Tor?

On: What's Hiding Inside Haribo's Power Bank and Headphones?

[mberger]

Gummy bears?

[tclancy → mberger]

My indulgent aunt once let me get a five pound bag of them from one of those Scoop Your Own candy stations. I left them in the rear window of her VW Rabbit for the better part of a summer day and they melted into a horrible blob that scarred me for life. Not sure why this Gummi Bear post is giving me flashbacks to that.

But yes, those folks. Check the product shot in the article for their logo.

[runnr_az → tclancy]

Good thing you didn’t try and drink the hot gummy bear juice… turns out, molten sugar is surprisingly brutal

[micromacrofoot → mberger]

a struggling company will often license their name without much fuss

[nunez → micromacrofoot]

struggling to the tune €2B/yr

On: Cloudflare Global Network experiencing issues

[mberger]

Is it DNS? I went to check the isitdns.com but got a cloudflare error

On: State of Embedded: Q4 2025 Overview

[mberger]

Can you include more prices? It would give me an idea of the cost even if it is in USD. What i found most annoying about my latest search is that it is hard to find something not named raspberry or Arduino for a reasonable price. I was looking for a simple gigabit board with usb 3 to attach a removable drive to. The only one i found was raspberry pi orange 3B . Nobody else seemed to have gigabit nic with usb 3.

[Joel_Mckay → mberger]

The Raspberry PI also has an intangible value from years of community goodwill. And people trust that the kernel OS support will be around in 10 years.

The NVIDIA solution is impressive... but self-immolated with the consumer price point (markets for government equipment may work.) People usually either have money or time... asking for both in a product is foolish.

The other SoM also have a long-tail market attention problem, as one could spend 2 weeks tracking unstable kernel driver problems. Or just drop in a $35 pi, and solve the task at hand. =3

[fisian → mberger]

Does a Banana Pi BPi-M5 fit your specs? The banana pis have pretty good networking options.

[nine_k → mberger]

Why would you expect USB3 and Ethernet, fast and relatively expensive interfaces, to be attached to a cheap low-spec MCU?

Did you consider a ready-made USB3 extender over Ethernet? There is a reason they cost so much ;-/

[rjsw → nine_k]

Rockchip SoCs starting with the RK3399 can do both USB3 and Ethernet.

The only board that I own that does both at the same time is the Pine64 Quartz64 that uses the RK3566. My Pinebook Pro doesn't have an ethernet port, Orange Pi 5 Max has ethernet but doesn't use the builtin controller to provide it.

[idatum → rjsw]

I use NetBSD on a Pine64 RockPro64 and use USB3. It has been stable:

    awge0: flags=0x8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
            ec_capabilities=0x1<VLAN_MTU>
            ec_enabled=0x1<VLAN_MTU>
            address: 26:80:xx:xx:xx:xx
            media: Ethernet autoselect (1000baseT full-duplex)

[nine_k → rjsw]

i see Quartz64 with 4GiB of RAM offered for $60. Sounds pretty reasonable for an SBC of this caliber. I mostly mean that something like the original RPi would be underpowered for USB3.0 and 1GbE, to say nothing of smaller devices like a $15 ESP32.

[Joel_Mckay → nine_k]

Pi4 does two USB 3.0 ports, but you are right in that USB 3.1 is a little much for a SoM.

Its a nice little SoM, in some ways it was better than the pi5 for hardware media encoding. =3

On: Hyprland – An independent, dynamic tiling Wayland compositor

[mberger]

For most electron apps, you should put the above in ~/.config/electron-flags.conf. Note that VSCode is known not to work with it.

Seems like a deal breaker.

[aorth → mberger]

For the benefit of others, that note comes from this page:

https://wiki.hypr.land/Getting-Started/Master-Tutorial/#forc...

It has been common for years to use such flags for Electron-based apps on Wayland. It's not specific to Hyprland, and it's not as bad as it sounds. Chromium has been working on Wayland support for years and it was behind a feature flag. It's worked well for a while now and will be the default soon. https://www.phoronix.com/news/Chrome-Auto-Ozone-Platform

[delusional → mberger]

It's pretty common to need to hack stuff for tiling window managers. Java/Swing has required faking being LG3D since forever for example to run some compatibility code paths. Yeah, Looking Glass.

[bee_rider → mberger]

They clearly managed to make the window manager, so evidently it was not.

[hyperbolablabla → mberger]

Code works just fine with Hyprland in my experience, you just need yo tweak the interface scaling. However, I've taken the opportunity to learn neovim since switching to arch/Hyprland, since the emphasis is much more on keyboard-centric input. Can't say I miss vscode much, other than multi cursor.

[TheRoque → hyperbolablabla]

Multi cursors is in the way for 0.12 I think

On: The Moat of Low Status

[mberger]

I love and struggle with the second point. It's taken me half my career to realize that people would very much prefer the complete and right answer slowly or later than the '90% sure' answer right now. Being quick doesn't make you look smart

On: Assignment 5: Cars and Key Fobs (2021)

[mberger]

You have to be able to get new keys made without having an original to read. A database of vin, key would be too big of a target and would have to be shared with dealers anyway so they could program new ones. I'm not a security expert but it seems like it would really shorten battery life on the fob if you wanted to protect against replay attacks by adding a time sensitive value.

[mppm → mberger]

Key distribution is (as always) an important, but solvable problem. There are some tradeoffs involving centralization vs cost of replacement, but those apply generally, not just in this particular case.

As for replay attacks, that's where the button press comes in (like on a hardware security token) -- the key only responds to challenges within a second or so of a button press and the car sets a similar timeout for validity.

On: Liberux: Linux phone

[mberger]

Starting at $1,999

On: Institutional memory and reverse smuggling (2011)

[mberger]

Needs (2011)