Gaelan

Yes (from the Google blog post linked elsewhere in the thread):

CVE-2022-42856, a WebKit remote code execution exploiting a type confusion issue within the JIT compiler (0-day at time of exploitation).

Lockdown mode disables the Webkit JIT.

Routing numbers aren't, but account numbers are: traditionally in the US it's possible to use a routing+account number to withdraw from someone's account.

Perhaps even more evil:

kill -SEGV $1

Looking at the contents of the macOS installer (I haven't tried to run it), it seems to be both. Looks like it's based on https://www.cabbageaudio.com?

Well yes, but GTK and Qt apps feel about as native on macOS as Electron apps do.

Isn't Edge just Chromium these days? The page you linked says:

Evergreen distribution. Rely on an up-to-date version of Chromium with regular platform updates and security patches.

probably prone to issues if you can’t update multiple as part of the same transaction

IIRC one of FoundationDB's features is that it does support such transactions, so you can easily implement indexing on top of it.

This is essentially doing that—it would allow browsers to parse and run TypeScript. What it isn't doing is actually having browsers do type checking, for good reason: the TypeScript type checker is a large and complex piece of software, so browsers would either have to incorporate it (and they're probably not excited to have a large chunk of JS code in the critical web-page-rendering path, nor would they be excited to have a critical chunk of the browser with a single implementation), or reimplement it themselves (which would be a huge amount of work, and make changes to the language much slower and more difficult).

I am not claiming that running on an OS is the same as dynamically linking with a library

In pretty much any case, it literally is: you're dynamically linking against the libc. This is a little fuzzier on Linux (because, as you mention, multiple libc implementations exist), but on Windows, macOS, and the BSDs, the only supported way to make syscalls is to make calls into a dynamically linked libc, provided by the operating system.

Laptops have batteries, so an AC power failure doesn't mean they immediately crash: they just keep running on battery until the battery gets low, at which point the system cleanly hibernates.

  +-----------------------------------------------------------------------------+
  | You are entering the operating system shell. By confirming this action in   |
  | the appliance shell you have agreed that THIS ACTION MAY VOID ANY SUPPORT   |
  | AGREEMENT. If you do not agree to this -- or do not otherwise understand    |
  | what you are doing -- you should type "exit" at the shell prompt. EVERY     |
  | COMMAND THAT YOU EXECUTE HERE IS AUDITED, and support personnel may use     |
  | this audit trail to substantiate invalidating your support contract. The    |
  | operating system shell is NOT a supported mechanism for managing this       |
  | appliance, and COMMANDS EXECUTED HERE MAY DO IRREPARABLE HARM.              |
  |                                                                             |
  | NOTHING SHOULD BE ATTEMPTED HERE BY UNTRAINED SUPPORT PERSONNEL UNDER ANY   |
  | CIRCUMSTANCES. This appliance is a non-traditional operating system         |
  | environment, and expertise in a traditional operating system environment    |
  | in NO WAY constitutes training for supporting this appliance. THOSE WITH    |
  | EXPERTISE IN OTHER SYSTEMS -- HOWEVER SUPERFICIALLY SIMILAR -- ARE MORE     |
  | LIKELY TO MISTAKENLY EXECUTE OPERATIONS HERE THAT WILL DO IRREPARABLE       |
  | HARM. Unless you have been explicitly trained on supporting this            |
  | appliance via the operating system shell, you should immediately return     |
  | to the appliance shell.                                                     |
  |                                                                             |
  | Type "exit" now to return to the appliance shell.                           |
  +-----------------------------------------------------------------------------+

Surely a reasonable court would say that it's very clear what they meant?

Note that they halved the project size in 2021, so the new project sizes are the original pre-2021 size, and the smaller 2021 size.

I'm not too familiar with this, but my understanding is that the push notification just wakes up the Signal app, then the Signal app gets the encrypted message (either from Signal's servers or the push notification payload, I'm not sure) and decrypts it client-side and provides the notification text.

Generally, the idea is that you use a small amount of unsafe code to build a safe abstraction to do what you need, then use that abstraction in many places. So now you only have a few unsafe sections you have to verify for correctness, instead of the entire program like you'd need in C/C++.

@dang could you give "world.hey.com/foo" URLs the GitHub/Twitter treatment where it shows the first segment of the path?

(unless you remapped another key to capslock (why?))

When I first started doing caps-lock-to-control, I mapped my physical control key to caps lock. Eventually, I stopped bothering and kept it as control.

Thumb adds many additional instruction encodings of variable length, load/store multiple already had pretty arbitrary latency

Worth noting that, AFAIK, both of these were removed on aarch64 (and aarch64-only cores do exist, notably Amazon's Graviton2)

https://gitlab.com/crev-dev/auto-crev-proofs is an identity that automatically trusts every known reviewer (at level "none"), which is useful for finding reviewers. You can also browse all known reviews online at https://web.crev.dev/rust-reviews/.

I don't think it was MS that did that, just sloppy third-party developers.

Skipping the Americas does not sound like a typical Apple move.

I know of one place where Apple does this: in China, and only China, you can buy an iPhone with two physical SIM slots. You can do Dual SIM on iPhones elsewhere, but only with an eSIM.

Internet access that isn't subject to whatever domestic firewalling is in place, presumably.

Unless you know something about the protocol that I don't (quite possible), it's not silent: all you devices get "new device registered to iMessage" dialog box.

The level up bots should be unaffected by this, as they don’t need to read message contents—they just need to count messages.

Mobile browsers have, since at least the first iPhone, defaulted to showing websites zoomed way out, on the theory that the site might not have been designed for a screen that narrow. Sites that are designed to support a phone screen are supposed to say so, using the meta tag given elsewhere in the thread.

There's an important point I haven't seen discussed yet: I don't believe it's possible to write secure web apps without a templating engine with safe-by-default XSS handling (i.e. interpolated text is sanitized, unless explicitly marked as trusted HTML somehow), which implies some amount of a web framework or at least a web-specific library.

I saw an interesting point (I think it was a scientist quoted in the NYT) that said once a vaccine out in the general public, it gets incredibly hard to get good efficacy numbers, because there are so many things that correlate with vaccine status—age, wealth, risk level, attitude towards COVID, geographical area—that also can affect risk of being infected/hospitalized.

I'd assume the former.

Wait, so they have the ability to arbitrarily blacklist people from transferring tethers? At this point, is Tether anything other than a weird bank?

Software features are announced at WWDC, which happens early summer and already happened this year. It's only the hardware that gets announced (and the software released) in September.