Author Archives: pappp

Article note: This is an illustration of a lot of fun things at once. The certificate ecosystem is an utter shitshow of exposed complexity. GUIs are awkward tools for coping with complexity that can be reasonably manageable in scritpable text GUIs are actually really nice for discoverability (I actually find that easier to visually parse than the relevant man page for handling x509 certs)

Article note: Doing an exceptionally bad job at parsing strings brings AAA title to its knees.

Article note: This is delightful.

Article note: Ugh. I care _much_ more about preservation and sharing experience (eg. high quality scans and disc images being distributed widely enough that they won't be lost to time) than original media and packaging, but counterfeiters using the digital copies to scam people who care about original media produces a disincentive for sharing high-quality digital copies.

Enlarge / Beyond adventure lies... forgery? (credit: Collage by Aurich Lawson)

Before last month, Enrico Ricciardi was one of the most respected members of a niche community of classic PC game collectors, with a practically unrivaled collection of rarities that he regularly bragged about on social media. Today, he’s a pariah in that community, the central figure in a wide-ranging alleged forgery scandal that has changed the way many collectors look at their hobby.

At least seven PC game collectors have publicly or privately identified dozens of suspected forgeries they say Ricciardi traded or sold as far back as 2015 and as recently as last month. Collectors estimate that those trades and sales include games that would be valued at well over $100,000 total on the open market if they were authentic.

Ricciardi told Ars he is also a victim who simply unknowingly passed along suspect collectibles without checking them thoroughly enough. Regardless, the overwhelming evidence suggesting that there are many forgeries circulating through the world of rare PC games has shaken the trust of that community to the core.

Article note: This is a pretty nifty bit of tech, and uncharacteristically exposed for Apple. Some folks seem to have pulled the binary and run it on Linux boxes running on other AARCH64 chips with x86 style memory ordering and it seems to just work for the most part.

Enlarge (credit: Apple)

One of the few things that Intel Macs can do that Apple Silicon Macs can't is run operating systems written for Intel or AMD processors inside of virtual machines. Most notably, this has meant that there is currently no legal way to run Windows on an Apple Silicon Mac.

Apple Silicon Macs can, however, run operating systems written for Arm processors inside of virtual machines, including other versions of macOS and Arm-compatible versions of Linux. And those Linux VMs are getting a new feature in macOS Ventura: the ability to run apps written for x86 processors using Rosetta, the same binary translation technology that allows Apple Silicon Macs to run apps written for Intel Macs.

Apple's documentation will walk you through the requirements for using Rosetta within a Linux guest operating system—it requires creating a shared directory that both macOS and Linux can access and running some terminal commands in Linux to get it set up. But once you do those steps, you'll be able to enjoy the wider app compatibility that comes with being able to run x86 code as well as Arm code.

Article note: That's some bullshit. The HangPrinter design has been around in public for almost a decade.

Article note: Ooh. UK's ECE department has a couple of these things, and frankly the user experience is superb... turns out like many pandemic-expedient telecom tools, they're a security clusterfuck.

Enlarge (credit: Owl Labs)

The Meeting Owl Pro is a videoconference device with an array of cameras and microphones that captures 360-degree video and audio and automatically focuses on whoever is speaking to make meetings more dynamic and inclusive. The consoles, which are slightly taller than an Amazon Alexa and bear the likeness of a tree owl, are widely used by state and local governments, colleges, and law firms.

A recently published security analysis has concluded the devices pose an unacceptable risk to the networks they connect to and the personal information of those who register and administer them. The litany of weaknesses includes:

• The exposure of names, email addresses, IP addresses, and geographic locations of all Meeting Owl Pro users in an online database that can be accessed by anyone with knowledge of how the system works. This data can be exploited to map network topologies or socially engineer or dox employees.
• The device provides anyone with access to it with the interprocess communication channel, or IPC, it uses to interact with other devices on the network. This information can be exploited by malicious insiders or hackers who exploit some of the vulnerabilities found during the analysis
• Bluetooth functionality designed to extend the range of devices and provide remote control by default uses no passcode, making it possible for a hacker in proximity to control the devices. Even when a passcode is optionally set, the hacker can disable it without first having to supply it.
• An access point mode that creates a new Wi-Fi SSID while using a separate SSID to stay connected to the organization network. By exploiting Wi-Fi or Bluetooth functionalities, an attacker can compromise the Meeting Owl Pro device and then use it as a rogue access point that infiltrates or exfiltrates data or malware into or out of the network.
• Images of captured whiteboard sessions—which are supposed to be available only to meeting participants—could be downloaded by anyone with an understanding of how the system works.

Glaring vulnerabilities remain unpatched

Researchers from modzero, a Switzerland- and Germany-based security consultancy that performs penetration testing, reverse engineering, source-code analysis, and risk assessment for its clients, discovered the threats while conducting an analysis of videoconferencing solutions on behalf of an unnamed customer. The firm first contacted Meeting Owl-maker Owl Labs of Somerville, Massachusetts, in mid-January to privately report their findings. As of the time this post went live on Ars, none of the most glaring vulnerabilities had been fixed, leaving thousands of customer networks at risk.

Article note: This is a neat argument.

Article note: Google's chat service flailing is truly a thing to behold.

Article note: It's almost refreshing how _boring_ this thing is. It's a bunch of AMD EPYCs, a bunch of AMD's now-differentiated HPC only DP-focused "GPU" SIMD engines, tied together by some enhanced HPE/Cray fancy Ethernet (and apparently secondary fast IO that isn't actually up yet). It's not full of AI pixie dust. It's not hitting numbers by working on low-precision values. It's not 4 years late (looking at you, Intel's ANL Summit Aurora contract). It's water cooled (not special environmental catastrophe sauce). It is, however, sucking down 40MW to do it, at 400KW per rack.