jbroman

I believe you can purchase a GameBoy cartridge reader.

This is an improvement to that feature which allows you to modify the response headers in addition to the response body.

Sure, but a credentialed person is more likely to be familiar with other research in the area and have expertise with state of the art techniques in the field.

So an uninformed reader (with less background than either to critically evaluate the work) should, all else equal, prefer the analysis of an expert. That's not to say the expert cannot be wrong, but a non-expert has a greater need to establish the credibility of their argument.

The alternatives would seem to be "data center powered by non-renewable energy" and "no data center", no?

Kinda specific, but breakdancing: https://www.youtube.com/watch?v=AIDaadRNPpg

The very first sentence points to a PZ blog post about the Chrome sandbox.

The more recent weakrefs addition does allow you to observe finalization: https://v8.dev/features/weak-references

Because by doing this you have misrepresented the truth in order to extract more money from your employer than you agreed (presumably, in your employment contract).

(As I commented elsewhere, whether you think paying by local cost of living is the right policy is valid to debate but isn't the point here.)

It seems pretty unwise to defraud your employer like that.

This is consistent with what major tech companies do today when an employee relocates (or are simply hired in a less pricey region).

Whether or not you agree that employees should be paid differently depending on cost of living where they reside, it isn't new.

Have you tried making an installable PWA? This should allow you to get an icon, notifications, and a separate window.

It's uses gn, a build system developed for Chromium. That said, on an Ubuntu system the steps to build Chromium are fairly well-documented and straightforward, as long as you have an appropriately beefy system (unfortunately it's a long wait and a fair amount of RAM is required, and Googlers tend to use a distributed build system).

https://chromium.googlesource.com/chromium/src/+/master/docs...

Executing JavaScript every frame is not that heavy, but if the main thread is blocked because of something that is, which may even be in another tab, the animation will stutter.

The animations built into the platform can run and remain smooth under a broader range of conditions, which is why they should be preferred if you don't need the level of control that running script via requestAnimationFrame gives you.

Specifically, the new version is at https://source.chromium.org/, and the Android counterpart is https://cs.android.com/.

Something running with your privileges could similarly use your existing sudo ticket, or manipulate the memory of your terminal emulator, or modify your shell to grab your credentials the next time you authenticate (and pass those to sudo), etc.

This isn't tmux's fault; this is fundamentally the sort of thing that's possible under the security model of modern Linux desktops.

Most desktop OSes aren't designed to defend applications run by the same user from one another. As a consequence an attacker running unsandboxed code with your user privileges is an attack that's very difficult to defend against.

If you can run code with the same privileges as Chrome (under an authenticated user account), then on most desktop OSes, you can do whatever Chrome can do, including access the password store.

This may be a more convenient way to do so, but ultimately it's an attack that's rather hard to defend against under the usual desktop user-based access control model.

If you're on Linux >= 3.10, I believe Chrome should use the namespaces sandbox rather than the (privileged) setuid sandbox.

https://chromium.googlesource.com/chromium/src/+/master/docs...

Maybe browsers could do some static analysis for the simple cases?

The risk here is that you end up where cases where non-obvious changes cause the static analysis to no longer work; at least in the current world there's a clear line between having a non-passive event listener and not having one. Attempting a heuristic could cause both unpredictability and interoperability issues (since the heuristic will surely vary by browser vendor).

Presumably https://www.google.com/webmasters/tools/mobile-friendly/

See also http://googlewebmastercentral.blogspot.com/2014/11/helping-u... and http://googlewebmastercentral.blogspot.com/2015/02/finding-m...

It's somewhat complicated.

The changes to Chromium itself are here: https://chromium.googlesource.com/chromium/src/+log/37.0.206...

But this is more likely to be a result of one of the underlying repositories. For instance, it looks like Blink was rolled back from 091cb19dc52917020bfda19b2a41d8f097c02d92 to 6894b21e75041bc3e050a7591388f866cbe7282b.

Thank you for reporting this level of detail; having a narrow revision range is helpful for tracking down bugs.

This has been fixed. Thanks for reporting.

I don't mean to put down Twitter's contribution to open source – which is substantial – but I think you're underestimating Google and Facebook's contributions when you suggest that they are only "one-upping each other with ... open data center designs".

I'm more familiar with Google's contributions, but I would imagine both high-user-visibility projects like Android and Chromium and more developer-oriented projects like protobuf, the Closure Compiler, the Dart and Go programming languages, googletest, Guava, Guice, WebM/WebP, V8, Breakpad qualify. I could consider all of these "projects that are applicable to a large group of people". This, on top of large contributions to other key projects like the Linux kernel and LLVM.

I know less about Facebook's contributions, but I do know that their open source projects includes HipHop/HHVM, and they contribute significantly to Hadoop, LLVM and Mercurial (among other high-profile projects).

Not sure if this is serious or snark, but...no, you use the card number, of course. Similarly, the magnetic stripe is not typically used in online transactions either.

The question is whether the chip-and-PIN technology would have revealed less information (i.e. insufficiently much to allow online purchases, etc.).

I believe Chrome apps can use Native Client, if you want to message between a C/C++ module and your web application. And of course there are increasingly mature tools for compiling C++ to some subset of JavaScript. https://developers.google.com/native-client/

Have you seen the Chrome apps platform?

http://developer.chrome.com/apps/about_apps.html

It's pretty damned close to what you're asking for.

But it's reasonable to expect him to say something about how it was done. Recording a video is one possible method, and one he's evidently capable of.

Pasting a link to a Facebook profile does not explain the exploit.

Blink is a fork of the entire WebKit repository. The lion's share of that is WebCore (especially after removing platform bindings that don't apply to Chromium), but it's entirely fine to call it a fork of WebKit.

While this is true, it would also mean that more games could be run concurrently as the total computing horsepower would be larger than what the contest can afford to fund. :)

Doing this has some really cool advantage, but also some significant disadvantages. Namely, it gives a large advantage to those with access to powerful computers. Ideally, the contest would be one of "Who can create the best bot?", as opposed to one of "Who can afford/borrow the most computing horsepower?"

But feedback is always welcome.