HN user

jasomill

1,515 karma

Email: jtm@<HN user>.at

Posts3
Comments1,239
View on HN

Even games with strong anticheat could benefit from sandboxing, as the anticheat mechanisms that need access outside the sandbox represent a much smaller surface area for exploits than the entire game.

In theory, sandboxing mechanisms could even be used to improve anticheat.

What I always sort of assume the endgame could be for highly competitive Windows games is something akin to cartridge or bootable floppy games from the 8-bit era, where games would install into or be supplied as disk images containing locked-down Windows installations that only permit signed (and possibly whitelisted) drivers and whitelisted applications, which would include the game and a small number of other approved applications like Discord, MS Edge and possibly selected third-party browsers, and support software for hardware like GPUs and gaming input devices, which Windows would then boot to run the game, either on bare metal or in an isolated VM.

As opposed to streaming video services, which, aside from the content they provide, have been shit from day one.

While the web UIs suck compared to local media players, they work well enough that I can cope.

But most services restrict 4K (and at least historically 1080p) web playback, even on Windows with a GPU that supports top-tier hardware DRM and an HDCP display.

My desktop display is a recent 55" LG OLED smart TV, and the streaming service apps on the TV work fine when my attention is devoted to whatever I'm watching, even if they tend to be slightly shittier than the already mediocre web UIs.

But when task switching or multitasking, my only options are reduced video quality, borrowing or purchasing a physical copy if available, or piracy.

Given how quickly everything shows up on public torrent trackers, I struggle to understand why the 4K limitations remain in place, as it obviously doesn't stop whoever uploads the torrents, and there has to be a vanishingly small number of paying customers who'd prefer to crack DRM locally or record HDMI instead of simply downloading the torrent.

Do streaming services get kickbacks from smart device vendors?

Middle-out compression was indeed the first thing that came to mind when reading the headline.

That, and billionare investor Russ Hanneman standing in front of his orange McLaren waiting for his daughter to be released from the grade school he forgot she no longer attended screaming about his willingness to pay for gay sex.

Not really. For the most part, accessibility APIs provide programmatic interfaces to user interfaces, application APIs provide semantically meaningful interfaces to application functionality.

A closer analogue would be AppleScript, or rather, the underlying Apple Event and Open Scripting Architecture functionality supplied by the OS to support AppleScript, that allowed applications to expose these interfaces along with metadata documenting them, and for external tools to record manually performed tasks across applications as programs expressed in terms of these interfaces to make them easier to use (this last bit, while not strictly required, is convenient, and especially useful for less technical users).

If you're familiar with VBA in Microsoft Office applications, sort of like that, except with support provided by OS APIs that could be used by any application that chose to implement scripting support, official guidance from Apple suggesting that all well-designed applications should be scriptable and recordable, and application design patterns and frameworks designed with scriptability and recordability in mind.

Note that I use the past tense here, despite AppleScript still being available in macOS, because it is not well-supported by modern applications.

https://dl.acm.org/doi/epdf/10.1145/1238844.1238845

Do you want to do something that can't be done through AppleScript, macOS accessibility APIs, and something like Puppeteer to control the browser?

Or something you don't understand how to do manually?

Because I guess I don't understand the attraction of using an LLM for system automation where existing interfaces exist, other than as a form of documentation, or to write code using these interfaces.

The nicest thing about this rush to find and build "agentic" endpoints for controlling everything is that there's no reason these same endpoints can't be consumed by deterministic, non-LLM software as well.

It feels like 1994 called, and it's giving me my AppleScript back.

From applications that capture the screen or use accessibility APIs, perhaps, but what about, e.g., Windows applications that capture window messages, e.g.,

https://devblogs.microsoft.com/cppblog/spy-internals/

Obviously, if you can inject code into a process that receives sensitive data, you're already running in a context where all security bets are off.

But with processes you yourself create, you probably can, even without elevated privileges, unless the application takes measures to prevent injection (akin to game anticheat mechanisms), so it seems worth pointing out that there are simple mechanisms to subvert such "protected" fields that don't require application-specific reverse engineering.

I think this is just saying you can’t sign up for a new account after a previously created account gets suspended, not that the act of suspension itself causes you to violate the the terms of service in perpetuity because, pedantically, any suspension that has happened, happened “previously”.

I had one project where a desktop application deliberately hid the contents of all grid controls from Windows accessibility APIs, took measures to ensure checkbox and radio button selections made through accessibility APIs did not register, and all functions that allowed data to be exported were protected by CAPTCHAs.

Generative AI wasn't a thing at the time, but I had to resort to a combination of OCR, simulated user input, and print capture to drive the application and export data.

Had the developers been aware of the Windows DRM APIs that block screen capture, or the fact that text is easily recoverable from PostScript files with minimal formatting, I don't know what I would have done.

The irony is that the process this replaced involved giving cheap offshore labor full read-only remote access to all data in the system, which was by any measure a far more serious security risk than otherwise authorized employees using tools running locally with no network access provided by established, trustworthy vendors to automate their work.

In what world would a vision agent be the default, when whatever HTTP-based mechanism a site uses to communicate with the server can usually be reverse-engineered and easily emulated with widely available HTTP request libraries, HTML parsers, and JavaScript engines, and at worst you can use something like Puppeteer to navigate and control applications at a significantly higher level than image scraping and simulating user input?

It seems like you'd need a deliberately hostile app before a vision agent would even be considered as an option.

Historical auto design and technology is interesting.

Two random tech examples: the first concept car with a back-up camera was the 1956 Buick Centurion; both Chrysler and RCA sold car stereos with record players in the '50s and '60s.

People have this image of farmers as ignorant bumpkins, when owners of even small family farms are some of the most intelligent, objective, and economically-motivated businesspeople I've known.

The first IBM PC I ever used was in the home office of a farmer who was using it for economic forecasting. And I grew up in the middle of a large city (for reference, I had an Atari 800 at home, regularly used Apple ][s at school, my friends were raving about the newly-introduced Commodore 64, and the most impressive tech I had ever seen was a VAX 11/780).

Violation of these rights may be criminal without meeting the strict legal definition of theft.

This can even extend to stealing physical property.

Depending on local laws, stealing a car may not actually be theft if the defendent can prove they intended to return it before the owner got home from work, though it would certainly be considered theft in the colloquial sense of the term, and they would still be guilty of a lesser offense like civil and/or criminal conversion.

Likewise.

And after reading the Wikipedia article on Drebbel, how have I never heard of this guy?

I'm particularly curious how the Royal Navy failed to realize the value of the submarine.

Reading over the article on the history of the torpedo, it sounds like early attempts to weaponize, by Drebbel and others, were unsuccessful.

Even so — bearing in mind that this a undoubtably a reflection of my own bias as a child of the Cold War raised in the shadow of the largest military-industrial complex the world has ever known — I can't help but marvel at the fact that no spare-no-expenses crash development programs arose to operationalize effective submarine-based warfare by the naval powers of the time.

For a recursive acronym, I prefer LiNT, officially LiNT is NT, and unofficially, either Linux in NT or Linux is Not There, with the official and second unofficial definitions reflecting the WSL 1 architecture where WSL, like Win32, is a subsystem layered on top of the NT kernel, and doesn't rely on any Linux kernel code.

In the present context, I'm reminded of IBM's "OS/2 for Windows", which, while actually a reduced-price version of OS/2 2.1 that used a customer's existing copy of Windows 3.1 to avoid the cost of licensing the Windows 3.1 components IBM shipped with OS/2 to support Windows compatibility, was also a marketing ploy to reposition OS/2 as a Windows enhancement rather than a replacement OS (which, to be fair, is not as misleading as it may sound, since OS/2 2.1, unlike Windows 3.1, is capable of memory protection and preemptive multitasking between Windows applications).

My favorite feature of 3270/5250-style keyboard layouts is the separate carriage return and Enter keys, allowing for multiline text entry without special handling to avoid conflicts with the command to signify that input is complete.

With only a single combined Enter/Return key, it's hard to remember in any given context whether Shift+Enter or Control+Enter will open up a new line instead of immediately sending a message, dismissing a dialog box, completing input into a particular spreadsheet cell, editable filename, text object in a drawing program, etc., or whether I need to copy/paste a line break from another application because no such shortcut exists at all.

Unfortunately, these efforts will continue so long as the idea that "if I'm not doing anything wrong, I have nothing to hide" remains commonplace.

The optimist in me hopes that attempts to censor popular and relatively harmless content like pornography will discredit this notion for good, sort of like how Internet commerce put to rest the idea that cryptography was only useful for governments, corporations, and bad actors.

Maybe?

But there's also a decent chance a game won't run at all, and when performance is actually a problem, an even better chance that Windows-specific performance optimization tips will be more readily available than Linux-specific tips.

Given that games almost universally have their own immersive user interfaces, and therefore require minimal interaction with the host OS, it's hard for me to justify running Linux on a dedicated gaming PC.