I continue to be impressed by how far we've come in algorithmically imitating forces of nature. If you like this stuff, have a look at the EmberGen demo clips
- Posts
- 45
- Comments
- 309
- Joined
- 3 yr. ago
- Posts
- 45
- Comments
- 309
- Joined
- 3 yr. ago
Even the Linux kernel / Linux Torvalds are moving towards Rust.
No, they aren't. They are experimenting with it in certain new device drivers. No move is planned, and it's too early to tell whether there will ever be one.
Either of these commands will reveal processes listening on the port that's vulnerable by default:
shell
$ sudo lsof -i :631shell
$ sudo fuser -v 631/tcp 631/udpThe wording of this post gives me the impression that it could exploited even if you don't have any such processes, if your system contacts a malicious or compromised print server. I would avoid browsing or using printers on unsafe networks until this is patched.
The port 631 process just makes it worse, by allowing someone else to initiate that contact remotely.
Based on this...
Exploitation involves sending a malicious UDP packet to port 631 on the target, directing it to an attacker-controlled IPP server. The system’s cups-browsed service then connects back, fetching printer attributes, which include malicious PPD directives. When a print job starts, these directives execute, allowing the attacker’s code to run on the target system.
...it seems the exploit can be triggered either remotely through your CUPS instance listening on port 631, or locally by interacting with a malicious/compromised print server.
So if I understand correctly, shutting down that port wouldn't be enough by itself. You would also have to keep your system from initiating contact with such a server, such as by using a public printer, or conceivably even just browsing printers at a cafe/business/school. I haven't read the exploit details, so I don't know which interactions are safe, if any.
Whenever I see posts like this, I wonder if they cover manual loop unrolling, which these days is usually an optimization left to the compiler.
Control+F, Duff's Device
Yep, this post mentions it. Good for them. :)
Good question. Please see my follow-up comment.
Not putting your WiFi password in would absolutely be reliable.
No, it would not.
I’d love to hear your ideas on how they’d remotely break into your WiFi Network
They wouldn't, of course, nor did I say they would.
(But since you brought it up, we have already seen internet providers quietly using their CPE to create special-purpose wireless networks surrounding customers' homes. These could obviously be made available to any company that paid the ISP for access, just as cellular networks have been made available to companies like OnStar. So a TV could do this with a business deal rather than breaking in to your normal WiFi.)
However, your network is not the only network in the world, and WiFi is not the only kind of link. Neighbors exist. Open guest networks exist. Drive-by and fly-by networks exist. Mesh networks exist (and are already created by devices like Amazon Echo). Power line networking exists. Bluetooth, LoRa, cellular, etc. etc. etc. Maybe you live on an isolated mountain top where these things are unlikely to reach you (at least until satellite links become a little smaller and cheaper) but even that is not absolute, and most of us don't.
Unless you disassemble your TV and examine all the components within, and know what they do, it could have any number of these capabilities.
Also, partly due to how prevalent multi-network support is becoming in electronics integration, it is not unusual for related functionality to be dormant at first yet possible to activate later.
I'd love for you not to be adversarial, and to learn more about a topic before making bold claims about it in absolute terms.
Friendly reminder that gaming console monitors, computer monitors, projectors, dumb TVs, and commercial displays exist.
Yes, I could hack a smart TV to disable its networking capabilities. (Merely withholding my wifi password is not reliable.) But that would still be showing the manufacturers that I find spyware TVs acceptable, and supporting the production of those models.
Also, this would be a good time to pressure our legislators into criminalizing this nonsense.
- JumpDeleted
Permanently Deleted
It's disappointing to see that a couple dozen people decided to hit your post with drive-by downvotes, rather than using their words to express themselves in a way that actually contributes to this community.
Your question is a legitimate one, and relevant at a time when Windows is increasingly bloated and invasive, spyware is out of control, and Linux is increasingly a viable alternative even in certain tough areas like games. I just wish you had elaborated on why you singled out Ubuntu when several other widely-supported Linux distributions exist.
If those were my only two options, I would pick Ubuntu over Windows, no contest. I would replace its default desktop with KDE Plasma (or just choose the Kubuntu variant in the first place), rip out as much of Snap as I could, update the kernel, and plan to migrate to a distro that I like better whenever I was able.
For what it's worth, Debian Stable with a few hand-picked backports and flatpacks suits me well, mainly for gaming and software development. (I'm a bit of an outlier among Linux users who post on social media, though: Having my system be low-maintenance is more important to me than always having the latest features in every app, and I've been known to make my own debian packages and flatpaks when something I want isn't ready-made.)
Linux Mint, Pop_OS, and Arch Linux are also popular. There are quite a few more.
FWIW, I think it's too early to tell where this will end up.
On the one hand, it's possible that machine-manipulated (or even machine-generated) voices will supplant most of the demand for voice actors, much like modern photo/image tools and cheap crowd sourcing supplanted much of the demand for professional photographers.
On the other hand, the legal issues (and possible protections) around human likeness and unauthorized use of existing work are in their infancy, and we're already seeing a lot of mediocre-to-bad output from content generation machines.
It should be interesting to see how this all unfolds.
- JumpDeleted
Permanently Deleted
No, it does not. The closest it comes is allowing a PC to take control of a mobile client on the same local network. That might be a convenient way to type with a full-sized keyboard if you have both devices in the same place, but it is not what people mean when talking about multi-device support.
GP wants the ability to use their account from multiple devices independently. From different locations, not tethered on a LAN. With shared message history, notifications, unread state, identity, etc. That's what multi-device support means in the context of messaging services.
- JumpDeleted
Permanently Deleted
I didn't know that; thanks for sharing.
(BTW, I think you meant wreaking havoc.)
- JumpDeleted
Permanently Deleted
I don't care how they estimate their cost in dollars. I think the cost to all of us in environmental impact would be more interesting.
- JumpDeleted
Permanently Deleted
SimpleX also loses messages if you don't pick them up in time. Going on vacation for a few weeks could be problematic, for example.
- JumpDeleted
Permanently Deleted
Just keep in mind that any service that asks for a phone number can also disclose it.
I hope what leaves the Signal client is a hash of your phone number, rather than the number itself. They might even be using salts and expensive-to-execute key derivation functions, to mitigate brute force searches (which are otherwise easy given the relatively small search space of phone numbers). But if compelled, it would be trivial for Signal to change that behavior.
I mentioned Electron only to acknowledge a well-known cross-platform toolkit, not as an example of acceptable results.
Tauri on Linux is effectively a Gtk wrapper (plus WebKit), which makes it unappealing to me. I keep it bookmarked anyway just in case I find myself in a situation where the only other option is Electron, since I suspect Tauri would at least be lighter on system resources.
I don't enjoy writing in Tcl. If I were to use Tk today, it would probably be through Python's tkinter package.
IMHO, Tk interfaces look awful by default, but they can be made to look pretty decent if you're willing to hunt for (or create) a good theme. I have considered it a couple of times for trivial tool UIs, and I occasionally use one that someone else wrote.
That said, getting it to look native on multiple platforms would take more effort than I feel is worthwhile, and getting it to feel native (keyboard nav, etc.) even more so. Qt has this stuff built in, and a lot more.
be as portable as possible
This is important to me, which narrows down my options quite a bit.
Electron is portable across desktop OS, but unacceptably bloated (I don't want my users to have to deal with that) and buggy (I don't want to deal with that).
wxWidgets and various similar wrapper libraries exist, but on Linux most of them wrap Gtk, which in recent years has become very opinionated in UI directions that I find intolerable.
A few new cross-platform GUI toolkits have been appearing recently, but I've found all of them suffer from poor text handling, anemic widget sets, or very out-of-place look and feel (especially keyboard navigation) relative to native applications.
That leaves Qt as my only reasonable choice, at least for now. This is mostly okay, as it does a wonderful job all around. My main complaint is that using the full power of its widgets and libraries means I'm restricted to a handful of languages: C++, Python, and maybe one or two minor ones like D. Its declarative API (Qt Quick) seems to be getting more language bindings, though, so simpler apps might be possible in other languages.
Note that the landscape is different for mobile apps. I don't have a recommendation for those.
I think it happened more than a few years ago. US citizens might want to see about overturning Citizens United.