IANAL nor intelligent, but after skimming the text of the directive I felt like the definition of damage is very limited. In particular, if I understand correctly:

our business to lose this giant contract

would not be covered by this directive, this directive is only about a human being hurt in some way,

thousands of consumers left with bricked devices

would be covered in case of “your game installs a kernel-level anticheat and the anticheat breaks PCs”, but not in the case of “you uploaded an upgrade to a firmware of the washing machine you produced and it bricked the machines”; the directive is not about a product breaking, but about the product breaking your health, other property or data,

my washing machine to eat my dog

is basically the exact case this directive covers.

Same in Python, Rust, Haskell and probably many others.

But apparently JS does work that way, that is its filter always iterates over everything and returns a new array and not some iterator object.

Hasn’t Google already made advances through its Alpha Geometry AI?? Admittedly, that’s a geometry setting which may be easier to code than other parts of Math and there isn’t yet a clear indication AI will ever be able to reach a certain level of creativity that the human mind has, but at the same time it might get there by sheer volume of attempts.

Wanted to focus a bit on this. The thing with AlphaGeometry and AlphaProof is that they really treat doing math as a game, not unlike chess. For example, AlphaGeometry has a basic set of rules, it can apply them and it knows when it is done. And when it is done, you can be 100% sure that the solution is correct, because the rules of the game are known; the 28/42 score reported in the article is really four perfect scores and three zeros. Those systems do use LLMs, but they really are only there to suggest to the system what to try doing next. There is a very enlightening picture in the AlphaGeometry paper here: https://www.nature.com/articles/s41586-023-06747-5#Fig1

You can automatically verify correctness of code the same way. For example Lean, the language AlphaProof uses internally, can be used for general programming. In general, we call similar programming techniques formal methods. But most people don’t do this, since this is more time-consuming than normal programming, and in many cases we don’t even know how to define the goal of our code (how to define correct rendering in a game?). So this is only really done when the correctness of the program is critical, like famously they verified the code of the automatic metro in Paris this way. And so most people don’t try to make programming AI work this way.

It seems OP wanted to pass the file name to -k, but this parameter takes the password itself and not a filename:

       -k password
           The password to derive the key from. This is for compatibility with previous versions of OpenSSL. Superseded by the -pass argument.

So, as I understand, the password would be not the first line of /etc/ssl/private/etcBackup.key, but the string /etc/ssl/private/etcBackup.key itself. It seems that -kfile /etc/ssl/private/etcBackup.key or -pass file:/etc/ssl/private/etcBackup.key is what OP wanted to use.

Oracle trilateration refers to an attack on apps that have filters like “only show users closer than 5 km”. In case of the vulnerable apps, this was very accurate, so the attacker could change their position from the victim (which does not require physical movement, the application has to trust your device on this, so the position can be spoofed) until the victim disappeared from the list, and end up a point that is almost exactly 5 km from the victim.

Like if it said the user is 5km away, that is still going to give a pretty big area if someone were to trilateral it because the line of the circle would have to include 4.5-5.5km away.

This does not help, since the attacker can find a point where it switches between 4 km and 5 km, and then this point (in the simplest case) is exactly 4.5 km from the victim. The paper refers to this as rounded distance trilateration.

That command will produce a list of (dynamic) libraries that are being used by that helper. It will look somewhat like this (this is copied from my Arch instalation):

	linux-vdso.so.1 (0x00007edb2f060000)
	libcurl.so.4 => /usr/lib/libcurl.so.4 (0x00007edb2ee6f000)
	libpcre2-8.so.0 => /usr/lib/libpcre2-8.so.0 (0x00007edb2edd1000)
	libz.so.1 => /usr/lib/libz.so.1 (0x00007edb2edb8000)
	libc.so.6 => /usr/lib/libc.so.6 (0x00007edb2ebcc000)
	libnghttp3.so.9 => /usr/lib/libnghttp3.so.9 (0x00007edb2eba9000)
	libnghttp2.so.14 => /usr/lib/libnghttp2.so.14 (0x00007edb2eb7f000)
	libidn2.so.0 => /usr/lib/libidn2.so.0 (0x00007edb2eb5b000)
	libssh2.so.1 => /usr/lib/libssh2.so.1 (0x00007edb2eb12000)
	libpsl.so.5 => /usr/lib/libpsl.so.5 (0x00007edb2eafe000)
	libssl.so.3 => /usr/lib/libssl.so.3 (0x00007edb2ea24000)
	libcrypto.so.3 => /usr/lib/libcrypto.so.3 (0x00007edb2e400000)
	libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x00007edb2e9d0000)
	libzstd.so.1 => /usr/lib/libzstd.so.1 (0x00007edb2e8ef000)
	libbrotlidec.so.1 => /usr/lib/libbrotlidec.so.1 (0x00007edb2e8e0000)
	/lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007edb2f062000)
	libunistring.so.5 => /usr/lib/libunistring.so.5 (0x00007edb2e250000)
	libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x00007edb2e178000)
	libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x00007edb2e14a000)
	libcom_err.so.2 => /usr/lib/libcom_err.so.2 (0x00007edb2e8d8000)
	libkrb5support.so.0 => /usr/lib/libkrb5support.so.0 (0x00007edb2e13c000)
	libkeyutils.so.1 => /usr/lib/libkeyutils.so.1 (0x00007edb2e8d1000)
	libresolv.so.2 => /usr/lib/libresolv.so.2 (0x00007edb2e12a000)
	libbrotlicommon.so.1 => /usr/lib/libbrotlicommon.so.1 (0x00007edb2e107000)

It might be a good idea actually to try running this both when it works and when it doesn’t, maybe there is some difference?

ldd /usr/lib/git-core/git-remote-https?

I like btdu which is essentially ncdu, but works in a way that is useful even if advanced btrfs features (CoW, compression etc.) are used.

I am afraid you are still a bit misled; WireGuard is exactly what they use for the demo video. In general the underlying protocol does not matter, since the vulnerability is about telling the system to direct the packages to the attacker, completely bypassing the VPN.

I really need to try out Mercury one day. When we did a project in Prolog at uni, it felt cool, but also incredibly dynamic in a bad way. There were a few times when we misspelled some clause, which normally would be an error, but in our case it just meant falsehood. We then spent waaay to much time searching for these. I can’t help but think that Mercury would be as fun as Prolog, but less annoying.

I actually use from time to time the Bower email client, which is written in Mercury.

My understanding is that all issues are patched in the mentioned releases, the config flag is not needed for that.

The config flag has been added because supporting clients with different endianness is undertested and most people will never use it. So if it is going to generate vulnerabilities, it makes sense to be able to disable it easily, and to disable it by default on next major release. Indeed XWayland had it disabled by default already, so only the fourth issue (ProcRenderAddGlyphs) is relevant there if that default is not changed.

I got curious and decided to check this out. This value was set to the current one in 2009: https://github.com/torvalds/linux/commit/341c87bf346f57748230628c5ad6ee69219250e8 The reasoning makes sense, but I guess is not really relevant to our situation, and according to the newest version of the comment 2^16 is not a hard limit anymore.

Regarding /etc/skel being an empty directory, note that it is one of the few places outside /home where you can actually expect hidden files :) On my Arch it contains Bash dotfiles, for example.

Have you tried etckeeper? I haven’t, but it’s supposed to be an improvement over just using git in this usecase.

Interesting. I looked this up and I think that in Poland, the wait time in let’s say Warsaw peaked at like 2 months during pandemic, but is around 2 weeks now.

Many people living in big cities will have their exams in smaller WORDs anyway, as the pass rates tend to be higher there (not a surprise, less traffic means an easier exam). Apparently in some WORDs you can even get a new attempt the same day after failing one.

In Poland:

• driver’s permits are not a thing. In general, it’s illegal to drive without a professional instructor (with parents, for example) before getting a driving license, though a lot of people, especially in the countryside, will still do so,
• you can only drive after turning 18. You can start the course a few months earlier, but you can only take the final exam after you turn 18 (there exists a category that allows you to drive after turning 16, but it’s limited and IME extremely unpopular),
• you need to go to a paid course, which includes theory classes and at least 30 hours of driving with the instructor,
• most people drive in a car owned by the instructor or the driving school, as the car must have another pair of brakes for the instructor,
• you need to pass a theoretical and a practical exam in one of the centers (Wojewódzki ośrodek ruchu drogowego),
• the theoretical exam is just closed questions. You need to get 68 out of 74 points, but (AFAIK, this has changed over time) all the questions are known, so people will just cram them,
• the practical exam is first some maneuvers on the center grounds, and then a ride around the city. The exam is rather objective and is failed if you do any big mistake or fail any exercise twice,
• the exams are not easy. The data I found is for each WORD, but in general I feel like the pass rate is around 50% for the practical exam and 70% for theory. It’s not incommon for somebody to only pass their practical exam on like 5th attempt,
• there were supposed to be some restrictions for new drivers, but they had been discussed for a long time, even back when I passed my license before the pandemic, and I have no idea if they ever actually came into force,
• some people think that the system is super flawed. Here’s some discussion by the Supreme Audit Office in Polish: https://www.nik.gov.pl/aktualnosci/system-szkolenia-kandydatow-na-kierowcow.html,
• costwise, it’s apparently like 4000 zł for the course right now. Exams are paid per attempt, 50 zł for the theory and 200 zł for practice. 1 euro is 4.33 zł as of writing, but you need to take into account the difference in purchasing power and it’s probably not much cheaper than Germany even if you pass both exams the first time.

Phoenotopia: Awakening – an amazing metroidvania-related game. Relatively more popular than the other games I list, but is honestly one of my favorite games of all time.

Vision: Soft Reset – a metroidvania, but you can travel backwards and forwards in time and this really matters for gameplay.

Bombe – Minesweeper, but instead of solving the puzzles manually, you create rules (“if there is a cell with the number N and there are N empty cells around it, mark them all as mines”) which the game applies automatically.

SOLAS 128 – a puzzle game where you redirect signals in a huge machine, just a great experience if you like puzzle games.

The bootloader is stored unencrypted on your disk. Therefore it is trivial to modify, the other person just needs to power down your PC, take the hard drive out, mount it on their own PC and modify stuff. This is the Evil Maid attack the other person talked about.

Not a Fedora user, but according to https://www.freedesktop.org/wiki/Software/systemd/APIFileSystems/ adding a new fstab entry with the correct option should just work. They even give changing the size of /tmp as an example usecase :)

Just wanted to say that you actually can sign git commits using SSH keys! :) It’s nowhere close to being as flexible as what you suggest, but it’s also not GPG, so there’s that.