Category Archives: News

Shared items and notes from my feeds and browsing. Subscribe as feed.

Mis-issued certificates for 1.1.1.1 DNS service pose a threat to the Internet

Source: Ars Technica

Article note: Someone fucked up and granted a random asshole certificates for one of the most widely used DNS servers, which they most certainly do not control. Good news, not in the chain of trust for Mozilla or Google. Bad news, in the chain of trust for Microsoft. The PKI infra is always worrying when you hear about it.

People in Internet security circles are sounding the alarm over the issuance of three TLS certificates for 1.1.1.1, a widely used DNS service from content delivery network Cloudflare and the Asia Pacific Network Information Centre (APNIC) Internet registry.

The certificates, issued in May, can be used to decrypt domain lookup queries encrypted through DNS over HTTPS, a protocol that provides end-to-end encryption when end-user devices seek the IP address of a particular domain they want to access. Some security experts are also concerned that the certificates may underpin other sensitive services, such as WARP, a VPN offered by Cloudflare. The certificates remained valid at the time this post went live on Ars.

Key failures

Although the certificates were issued four months ago, their existence came to public notice only on Wednesday in a post to an online discussion forum. They were issued by Fina RDC 2020, a certificate authority that’s subordinate to the root certificate holder Fina Root CA. The Fina Root CA, in turn, is trusted by the Microsoft Root Certificate Program, which governs which certificates are trusted by the Windows operating system. Microsoft Edge accounts for approximately 5 percent of the browsers actively used on the Internet.

Read full article

Comments

Posted in News | Leave a comment

Judge: Google can keep Chrome, must share search data with “qualified competitors”

Source: Ars Technica

Article note: It's a weird situation. On one hand, we've basically determined that yes, they're abusing a monopoly, and no, we won't be imposing any meaningful penalties. On the other hand, there are very few entities that could end up with Chrome (or Android) without doing something even more harmful, and the search bundling payouts are what's keeping Firefox (as the only serious competitor in one of the spaces) afloat, and so on. ...Boy we've allowed some structurally abusive shit to get deeply rooted, and it's pretty clear via the various open-washing and deals between large players that much of it was planned/intended/done with careful legal consideration.

Google has avoided the worst-case scenario in the pivotal search antitrust case brought by the US Department of Justice. More than a year ago, the Department of Justice (DOJ) secured a major victory when Google was found to have violated the Sherman Antitrust Act. The remedy phase took place earlier this year, with the DOJ calling for Google to divest the market-leading Chrome browser, release data to competitors, and end many of its search distribution deals.

The government is getting almost none of that. DC District Court Judge Amit Mehta has ruled that Google doesn't have to give up the Chrome browser to mitigate its illegal monopoly in online search. The court will only require a handful of modest data and behavioral remedies, forcing Google to release some search data to competitors and limit its ability to make exclusive distribution deals.

Chrome remains with Google

This case drew many comparisons to the decades-old antitrust case against Microsoft, which nearly saw the company split in two. The company narrowly avoided that fate, and it seems Google will as well—the DOJ came up short on the so-called structural remedies. While there will be some changes to search distribution, the court didn't believe that a breakup was fair in this situation.

Read full article

Comments

Posted in News | Leave a comment

This ultra-rare ’90s LaserDisc game console can finally be emulated on a PC

Source: Ars Technica

Article note: This is extremely cool. Had to work through over a decade of folks inventing the necessary technologies to make it happen.

Here in the year 2025, it's not every day that a classic gaming console from the 20th century becomes playable via emulation for the first time. But that's just what happened last week with the release of Ares v146 and its first-of-its-kind support for Mega LD titles designed for the Pioneer LaserActive.

Even retro console superfans would be forgiven for not knowing about the LaserActive, a pricey LaserDisc player released in 1994 alongside swappable hardware modules that could add support for Sega Genesis and NEC TurboGrafx-16 games and controllers. Using those add-ons, you could also play a handful of games specifically designed for the LaserActive format, which combined game data and graphics with up to 60 minutes of full-screen, standard-definition analog video per side.

Mega-LD games (as the Genesis-compatible LaserActive titles were called) were, for the most part, super-sized versions of the types of games you'd find on early CD-ROM console of the era. That means a lot of edutainment titles, branching dungeon crawlers, Dragon's Lair-style animated quick-time event challenges, and rail shooters that overlayed standard Genesis or TG-16 graphics on top of elaborate animated video backgrounds (sometimes complete with filmed actors).

Read full article

Comments

Posted in News | Leave a comment

Imgur’s Community Is in Full Revolt Against Its Owner

Source: Hacker News

Article note: Imgur as a "community" has always been weird to me because I remember that it was literally a less-shit photo hosting platform (than photobucket or reddit's awful first party tools at the time, or the like) to use with other platforms, that then metastasized its own community. That said, from a few visits, their revolt looks a little more effective than the last set of bad reddit ToS changes, and the barrier to running an imgur-like service is pretty low, so they might be in danger. I would certainly be happy to see one of the advertising companies who own platforms get kicked in the teeth for shitty extractive behavior.
Comments
Posted in News | Leave a comment

Intel Patents ‘Software Defined Supercore’

Source: Hacker News

Article note: Neeeeat. They've applied for patents on basically putting another layer of JIT between the x86_64 machine code and actual execution engines, so instead of just superscalar multi-issue micro-op tricks on a single core, they can split and schedule across multiple cores.
Comments
Posted in News | Leave a comment

Doge uploaded live copy of Social Security database to ‘vulnerable’ cloud server

Source: Hacker News

Article note: Unraveling all the exfiltration those assholes did is going to be a years-long project, and we'll probably never quite know the extent. Surely a bunch of the more monstrous valleybros are in on it (Thiel), and it's sloppy enough that some foreign intelligence agencies are surely in on it whether or not that was intended, and...
Comments
Posted in News | Leave a comment

We regret but have to temporary suspend the shipments to USA

Source: Hacker News

Article note: We are so fucked if TACO doesn't hold.
Comments
Posted in News | Leave a comment

Troubled USB Device? This Tool Can Help

Source: Hack a Day

Article note: A while back bought a set of breakouts for all the common USB connectors to use for debug/intercept type work, but that thing is fancy.
Close up of a multi-USB tester PCB

You know how it goes — some gadgets stick around in your toolbox far longer than reason dictates, because maybe one day you’ll need it. How many of us held onto ISA diagnostic cards long past the death of the interface?

But unlike ISA, USB isn’t going away anytime soon. Which is exactly why this USB and more tester by [Iron Fuse] deserves a spot in your toolbox. This post is not meant to directly lure you into buying something, but seen how compact it is, it would be sad to challenge anyone to reinvent this ‘wheel’, instead of just ordering it.

So, to get into the details. This is far from the first USB tester to appear on these pages, but it is one of the most versatile ones we’ve seen so far. On the surface, it looks simple: a hand-soldered 14×17 cm PCB with twelve different connectors, all broken out to labelled test points. Hook up a dodgy cable or device, connect a known-good counterpart, and the board makes it painless to probe continuity, resistance, or those pesky shorts where D+ suddenly thinks it’s a ground line.

You’ll still need your multimeter (automation is promised for a future revision), but the convenience of not juggling probes into microscopic USB-C cavities is hard to overstate. Also, if finding out whether you have a power-only or a data cable is your goal, this might be the tool for you instead.

Posted in News | Leave a comment

The size of Adobe Reader installers through the years

Source: OSNews

Article note: Bloat, quantified. This should be embarrassing to the entire software industry.

The following chart shows how the Adobe Reader installer has grown in size over the years. When possible, 64-bit versions of installers were used.

↫ Alexander Gromnitsky

Disk space is cheap, sure, but this is insanity.

Posted in News | Leave a comment

Google to require developer verification to install and sideload Android apps

Source: Hacker News

Article note: The attacks on anonymous publishing seem really coordinated lately. Google is certainly not into this partly to identify and harass the makers of commercially-unfriendly things like alternative YouTube clients. ...And, it will break the chain-of-trust reproducible builds model for things like F-Droid creating a new injection risk. Great.
Comments
Posted in News | Leave a comment