Notices by Billy O'Neal (malwareminigun@infosec.exchange)

@GossiTheDog I don't understand why people keep blaming the TPM requirement for this; it was a standard part shipped on every system 10-iah years before it was made a requirement.

Blame the CPU allow list that excluded like 6 years of perfectly good platforms all of which had TPMs.

@evan You didn't say "what are your conditions to use software", you said "how many unpaid volunteer hours should there be". There is software with those problems with thousands of hours of investment, there is also software without those issues with very little.

I don't "owe" the project usage, and the maintainers don't "owe" the project maintenance hours.

@evan A: What *they* want to.

@killyourfm @catsalad I'm.... not sure what one was expecting an Echo device to do other than talk to Amazon constantly?

@killyourfm That's fair. It's one of the reasons I don't have those 👍

@whitequark @aris TTs?

@karotte @whitequark I can’t believe they still can’t get the names right even when it’s not about the consumer “make the names confusing so we can advertise the same garbage as new” scam

I will keep protesting by saying USB <bitrate> until they choose something more sane.

No: USB 3 Gen 1 Yes: USB 5Gbps
No: USB 3 Gen 2 Yes: USB 10Gbps
No: USB 4 2.0 Yes: USB 80Gbps

And so on

@fleaz I think 'USB 4 2.0' is worse than that. At least the 'x2' part actually describes the operation of the interface and conveys that devices not supporting that protocol would still operate at 10Gbps (assuming USB 3 Gen 2 is understood as 10Gbps).

In fact this protocol is the one big wrench in the gears of my 'just name then by bandwidth' strategy as my hypothetical 'USB 20Gbps' actually operate in 'USB 10Gbps' mode for most 'USB 40Gbps' implementations like Thunderbolt 3/4 controllers.

@aris I'm sorry but WHAT.

I know double-Es say USB is cursed but that's a new one

@whitequark Imagine there's an inline function in a header, that has a bug leading to the aforementioned WWW. That header is # included by a hundred other components. Since each component is different, the practical impact of that WWW will be different. But all hundred components need to re-built and re-shipped to fix it

@whitequark Does the same code in a header resulting in slightly different real exploits by giving attackers a Write-What-Where gadget count?

@whitequark I don't get it 🤔

@whitequark *gestures to https://chromium.googlesource.com/infra/goma/client/+/6bae3f8023bfb7b861b2c0b1e12aa0be55f0f829/README.md *

@cthos What happened with Framework?

@whitequark I like how this post is evergreen and applies to every OS

@vncresolver @catsalad hmmmm I've heard of honeypots but not furrypots

@0xabad1dea It's true that taking random dependencies without thought for how they are maintained is problematic but if anything npm gives you tools like lock files to at least get to repeatability and similar.

It's no different in any other system like apt or dnf etc.

@meowray "A binary heap where someone wanted to get 𝒻𝒶𝓃𝒸𝓎"

@prettygood The bell makes me think https://infosec.exchange/@jerry

@whitequark All in all, another brick in the https://xkcd.com/927/