Hacker Newsnew | past | comments | ask | show | jobs | submit | throwaway53453's commentslogin

That does not sound like they were working in the main trunk. I do not believe you can run any production code that was self signed like this.


You can't. Borg binary authentication is integrated with build and review. A build that does not descend entirely from reviewed, approved, and committed code running as a production user with access to userdata will raise alerts. Individuals are able to run non-committed code on Borg under their own accounts, but not under production role accounts.

You can break glass in emergencies by committing code TBR, or "to be reviewed", however this automatically escalates to owners of the code in question plus your manager and director, and all TBRs have to be resolved by actual review within a short time. An author cannot submit to-be-approved code; they have to be owners of the code in question (personally or transitively included in the OWNERS file) to TBR.

You can read about this system here: https://cloud.google.com/security/binary-authorization-for-b...


The worry is not about ML. It's about bot farms in India/China with real people behind the wheel. That's why CAPTCHA needs to be able to evolve without maintenance from the website operator.


It’s not like Googles solution is watertight.


I'm a developer who uses Steamworks. Keys are free for us to generate and sell at will. Valve reserve the right to say no, but from what I can tell, their only policy is to not take the piss (selling millions of keys), and not to charge more to customers who buy directly from Steam.


How would you do it? If nobody sells your software, and nobody is donating.


Get a different job? It may not have anything to do with FileZilla but no software developer with a successful open source project on their resume is forced to use adware. I'd understand if they were unable to work for whatever reason, but FileZilla development looks too active for that.


The issue with that is so much of the software industry is propped up by advertising. There is nowhere to go without being involved with ads, so why fight it?


The definition of assault rifle is very poorly defined. There are dangerous weapons on both sides of the definition.


Yes. Each time shooting happens I see 'analysts' thinking everything is full-auto only because of how it looks, and that automatically discredits them.


I agree. Social distancing + vaccination is pretty much the only effective strategy so far. Lockdowns do enforce that, but they also create vast damage beyond what's needed.


It's become a politically charged subject. Conservatives are barely touching it because it's not a polite topic, and Labour outright are pretending it's not an issue.

Also, this happened: https://metro.co.uk/wp-content/uploads/2017/08/pri_50287010..... Kind of shows the mindset a little.


> Why use a gendered pronoun here? It’s a bit unfair that the only non-specific gendered pronoun relates to a bad programming practice.

Spoiler alert, but making mistakes isn't just a male issue. Real representation means taking the bad with the good.


I agree. Women also code, which means we also make mistakes.

Equality means no mercy


And other programs don't?


An instant messaging client shouldn’t be executing arbitrary remote code, no.


It's not really possible to prevent that. E.g. a well crafted image can easily trigger an RCE on some older versions of Android: https://nakedsecurity.sophos.com/2019/02/08/android-vulnerab...

Issues like this exist at all layers of the stack, so anything touching the internet needs regular security patches.


I agree completely. But, I also think that in most cases, if a simplistic piece of software like an IM app needs a security patch every three months, regularly, it's a sign the attack surface is too large.


Isn't the whole point of WebView that Firefox et al can provide it as well as Chrome?


Not really, though vendors of Android can provide alternative web views (of course). Samsung used to (may still) which was a giant pain in the ass, since you'd see different behavior out of web views on Samsung versus almost any other Android device, but Samsung was too common to ignore, so if you did cross-platform apps that included web views you ended up with platform specific bugs for iOS, then for two flavors of web view on Android—and then multiply that by the many versions of Android you'd have to support, for Samsung and everyone else, versus maybe 2 versions for iOS for non-super-huge-userbase applications (where those sub-1% users not on the two most recent versions are worth spending money to support, because you have so many users that 0.5% or whatever is still a ton of people)

If anyone could provide web views they'd be practically useless, as they'd just be a constant source of bugs, and everyone would simply start embedding a browser engine instead.


The situation I’m responding to is the suggestion that you bundle your own browser rather than using one provided by Android System WebView or equivalent.


Yes, Firefox can act as a WebView implementation on any Android phone. Apps don't need to ship this.


No it can’t. https://wiki.mozilla.org/Mobile/GeckoView: “GeckoView serves a similar purpose to Android's built-in WebView, but it has its own APIs and is not a drop in replacement.”

The purpose of WebView has certainly never been about using a different engine; rather, it’s to have only one copy of a browser for apps to use as a widget, rather than each app bundling its own browser which uses vast amounts of space and raises serious security concerns.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: