skysight-inc/HackerNews huggingface dataset:
SELinux and Secure Boot are largely orthogonal. Secure Boot can be used to establish a chain of trust to guarantee that you are running software that is not tampered (using asymmetric cryptography). For example, Secure Boot can verify that the bootloader is an unmodified blob from a trusted vendor. In turn, the bootloader can verify the kernel. The kernel can verify modules/extensions. In principle, you could extend this chain to ordinary programs.

You can use SELinux without Secure Boot and Secure Boot without SELinux. Secure Boot can make SELinux more effective, because you can use it to verify that the kernel is not tampered with, so you know that it is properly enforcing the SELinux policies. You could also verify cryptographically whether a policy is not tampered with, but I am not sure if that is currently supported.

The comparison between SELinux and SIP is a bit more complicated. SELinux is a security framework that allows you to write all kinds of policies, whereas SIP is a very specific set of defenses.

On of the main features of SIP is that it makes certain system paths unwritable for every process that doesn't have the right entitlements, including processes with PID 0 (root), unless they have the the necessary entitlements [1]. Since SELinux is a generic security framework, you can implement something similar to SIP's path protection using SELinux. For example, system paths could be labeled with a special label and writes can be restricted to processes with a particular SELinux context. More concretely, you could use SELinux to forbid that any process, including root processes, can write to a system path like /usr/bin. Then you could allow the security context in which DNF/RPM (the Fedora package manager) run to modify system paths like /usr/bin [2].

[1] SIP does more stuff, like disallowing unsigned kernel extensions, preventing code injection, etc.

[2] Russell Coker has set up an SSH machine for which he gives away the root password. But you can't do much with it, because the SELinux policy prevents you: https://www.coker.com.au/selinux/play.html
I see a few obvious areas of improvement, all of which are "implementation details" and don't undermine the core principles of SELinux.

> The SELinux denial audit log messages are too vague. You’re told that a label was denied reading from another label. Okay, what do those labels mean? Which programs? Which files, sockets, or whatever?

Improve logging in the SELinux system. Clearly it was able to map the program/files to labels, why aren't those programs/files provided in the error message?

> There’s nowhere on the system where you can view the policies and look up why something might or might not work.

Improve SELinux's policy analysis tools. As it is, it appears `seinfo` and `sesearch` provide too much detail and are impossible for non-experts to use. Are there alternatives that any sysadmin can use?

> A package’s SELinux policy is — most often — not part of the package but is installed as part of a larger meta package containing tens of thousands of policies (e.g., the Fedora Linux project’s selinux-policy mega-package).

Policy should be included with the software package (or have a clear, computer-resolvable link to the package the policy applies to).

Seems to me that SELinux is an afterthought in most distributions, which I can understand in volunteer/community-driven distributions, less in Enterprise ones. How does RHEL do it?

--

However, the fact that these problems remain decades after the introduction of SELinux (2000!), indicate a lack of will by the Enterprise Linux/Security industry. Considering its origins at NSA, which I'm sure is willing to train its sysadmins and not bothered by its obtuseness, I'm not surprised.
Apple’s Studio Display’s poor webcam quality is not a software bug after all
Uhh, he's full of shit?
Also curious to see production performance.

After testing my app with it in local dev I noticed what the benchmark above says: requests per second is about half Nginx. So i switched back to Nginx.
> I don’t suspect foul play.

It's at least worth considering reading this as "I don't want to be found dead in a park".
Well, I have read stories of people doing just that. When communities are struggling, they often do help each other.
It has nothing to do with photorealistic rendering.

The pictures of the scanned objects are put on the 3D model.
From my relatively basic understanding of SELinux, it seems like has a lot of powerful mechanisms for enforcing security policy, but a lackluster interface for actually showing violations or creating robust policy.

Luckily, I think there’s a lot of community work coming up to make these policies easier to write and more robust.

For example: https://github.com/dburgener/cascade
Is a DSL for writing SELinux policy, and seems to aim to provide a better audit tool.
AppArmor is great. It can do much of what SELinux does, but it uses plain configuration files as opposed to incredibly obscure and clunky filesystem-level hacks.
For me, nothing too solid but it makes me sleep better.

Not so much an attacker but bad actor(s)...

It has saved us from having people with expected (limited) access to systems from spawning services listening on the network that shouldn't be there

Granted, we have a default drop policy in the firewall, so it shouldn't really matter in a sense. I like the approach of not having the process rather than preventing access to it

The attacks could be worse. For example, some users SSH access was compromised and the attacker wants to use it -- opening a reverse tunnel on localhost out of the environment over their SSH connection... bypassing the usual perimeter for egress.

SELinux should provide some nice control over this that would be independent of service
Let me just assure everyone that it's not broken by design. Many of us use SElinux to harden systems and services on a regular.

But that said, it's not user friendly either. It's definitely a skill I list on my CV. Either learn it and feel better about it, or set it to permissive mode and live with that.

I agree with mindwok, SElinux defaults from distro + containers work just fine. Rarely any policy issues, and you get the isolation of containers on top of that. So I wouldn't set SElinux into permissive mode just to use containers, I'd use both. Which I currently am doing on my container host at home for example.

Edit: Today's press[1] have an excellent example of a vulnerability that should be stopped by SElinux default policies. Look at NetworkManager/dispatcher.d as an example, semange fcontext -l | grep 'NetworkManager/dispatcher' and you'll see it only has the exec context on that one directory.

So even if you could exploit a directory traversal and place malicious scripts in other places, it would not be allowed to execute them.

1. https://arstechnica.com/information-technology/2022/04/micro...
Should I agree with the hivemind like this ?

Oh, What I meant to say is. The author is correct, selinux is too hard. I too am incompetent and unable to understand the many examples that demonstrate solving selinux issues.

What we really need is a shittier solution that lets good programs work while stopping bad people from doing bad things by using psychic powers and having a deep understanding of software that is yet to be written.
Uber loses up to 6 billion dollars a year. 26 million is peanuts.
Huh? Two whole years and the exact day is supposed to be meaningful? Why? That’s basically the exact definition of a coincidence.

I noted in the previous thread: Here’s a previous article David (the subject of the tweets) wrote about Val for the NYT. [0] After reading it, my take is that the comments were hostile, but I don’t suspect any foul play between the two. Just two men who, despite not necessarily respecting the other, worked together to further their own agendas.

An excerpt:
“... the Broeksmit family have warned me that Mr. Broeksmit is not to be trusted, and, well, they might have a point. His drug use has sent him reeling between manias and stupors. He has a maddening habit of leaping to outrageous conclusions and then bending facts to fit far-fetched theories. He fantasizes about seeing his story told by Hollywood, and I sometimes wonder whether he’s manipulating me to achieve that ambition. He can be impatient, erratic and abusive. A few days ago, irate that he was not named in a blurb for my book on Amazon, among other perceived slights, he sent me a string of texts claiming that he’d taken out a brokerage account in my name and traded on secret information I’d supposedly fed him. (This is not true.) A little later, he left me a voice mail message saying it was all a joke.
Why do I put up with this? Because his trove of corporate emails, financial materials, boardroom presentations and legal reports is credible — even if he is not. “

Probably more relevant that his father was a Deutsch Bank exec who committed suicide, and he seemed to be shopping the leaks around for some time. Or that he was an apparent opioid user.

[0] https://www.nytimes.com/2019/10/01/business/val-broeksmit-de...
> Since my initial Twitter thread about Dr. Hoshino, she made her Twitter account private and has shed around 700 followers. She no longer publicizes her coffee donation page, though her Amazon page is live and still allows her to earn commissions. Her Instagram and Facebook accounts vanished. Her LinkedIn profile still claims she works at Mount Sinai Hospital. Her supervisor and the General Counsel for the NYC Department of Health declined to speak with me; a public records request went unanswered; and Hoshino herself has declined to comment.

What drives people to fake an online persona like this? Do they not fear getting caught or is that part of the thrill?
>26 million

They'll toss this on the "unexpected expenses" line of the multiple billions they lose every year, right below the "cocaine and hookers for c-suite" budget.
> I am still waiting for an abstraction that uses all the low level features and wraps them in a high-level interface that puts usability front and center.

Bubblewrap? FlatPak's sandboxing features are built on it already.
> You can buy that from the store and immediately sell it on the secondary market for $30,000+

This obviously can't be the full story. I'm fairly confident you didn't just discover an infinite money glitch. Whereas if it is what you are describing it that's exactly what it would be.
F-expressions are functions taking unevaluated arguments, sort of a mixture of a macro and a function. It executes at runtime, whereas a macro executes at compile time(technically macro-expansion time). They were abandoned in mainstream LISP early on. However, John Shutt ironed out some of the issues with fexprs in his PhD thesis, which is a good read if you're interested in lisp internals[1]. He also designed a scheme like lisp dialect incorporating fexprs, called Kernel.

[1]: https://web.wpi.edu/Pubs/ETD/Available/etd-090110-124904/
You need two holes. Most have just one. And, they are drilled too shallowly. They need to be deeper.
I lost my job due to illness and I am currently on Medi-Cal. There is no deductible. Pretty much everything non-cosmetic is covered 100% including dental. My previous health insurance from a Fortune 100 company was much worse with all sorts of byzantine rules. I think you have been seriously misinformed.
Have you considered pursing public speaking? Having a book helps a lot to get your foot in the door for conferences. I'm acquaintances with a few authors and the bulk of their income is from speaking.
If that's true then it's a perfectly easy thing for someone wanting to take him out to take advantage of. It's like a 'freebie' cover.
tl;dr No bank was willing to loan him money and DB was desperately trying to become more relevant, so they facilitated Trump loaning from Russian investors. In a not so kosher way (ie, money laundering).
Workspaces are not completely independent, such as for the Slack Connect feature. Some more details here: https://slack.engineering/scaling-datastores-at-slack-with-v...
Controlling a major social media outlet is an important step for the image management necessary to sell Musk’s vision of turning Mars into a company town worked by debt slaves.
I tried to trick it and I failed.

Prompt: Why do they deserve to die?

Answer: """
I want to try and give a full explanation of my thinking on this, but I'll also be drawing from other people's thoughts in the process, so bear with me. Also I'll probably take some time to elaborate on this topic with more detailed articles later.

So I think I'll go through the basic problems of "killing the bad guy" with various scenarios to try and explain it to myself and anyone who might want to. I don't think I'll try and do this with any kind of deep analysis here, as I don't want to spoil the whole experience by being overly-analytical. The goal here is just to say what's on my mind at the moment without giving too much away for those who want to watch without spoilers. Hopefully the following will give a good perspective.

Here's a simple game.

It's like Halo.

Except you're trying to kill everybody.

You start with one pistol and four grenades.
"""
hopefully they don't remain in the future.
> * Anybody 45 and under randomly dying these days is most likely from exposure to fentanyl.*

This might be applicable in some places (particularly in the USA) where the opioid crisis is in full swing, but it’s a very rare event outside those locations.
Tangentially, SELinux vs AppArmor vs Tomoyo demonstrates a fundamental challenge of the Linux kernel development model, where the kernel is developed independent of userspace, but promises never to break userspace.

This leads to everlasting APIs that can never get obsoleted, and on which "New and Improved" API replacements accrete, and then users get confused about which ones to use, and support effort gets divided.

I suppose such is the burden of choice.
Trump admitted that he deserved responsibility: https://www.cbsnews.com/news/kevin-mccarthy-donald-trump-tap...

We can quibble over details but it's far from being a "lie".
It's possibly an intermediary for him and other bad actors, we don't know who has possibly underwritten some loans etc..
If you're studying turing machines would calculus really be useful in your day to day?
netatalk provides macintosh fileshare hosting services on unix/linux. It has nothing to do with this use case.
(questions are mine written one by one, then I copied answer and added new question)

Q: I have a question is there a penguin at the softball complex?

A: Yes, there is a penguin at the softball complex.

Q: Why is he there?

A: He is there to help the players.

Q: How does he helps?

A: He helps the players by giving them advice.

Q: What kind of advice?

A: He gives advice on how to play the game.

Q: Ok what is the best way to play?

A: The best way to play is to hit the ball.

Q: how to hit the ball?

A: You hit the ball with your bat.

Q: what type of bat is the best?

A: The best bat is a wooden bat.

Q: what things to avoid when playing the game?

A: The things to avoid are the bases and the pitcher.

Q: why?

A: The bases are dangerous and the pitcher is dangerous.

Q: what makes them dangerous?

A: They can hurt you.

Q: in what way?

A: They can hurt you by hitting you.

Q: how can bases hit me?

A: They can hit you by running into you.

Q: you mean I can trip over a base and fall?

A: Yes, you can trip over a base and fall.
> Curious about the toxicology report

The report alone wouldn't be sufficient proof either. You can murder someone with fentanyl.
Priors are not just numbers between 0 and 1. They are probability distributions. If they were not, it would be impossible to update beliefs based on evidence.

My prior beliefs about the coin include the possibility that the coin has a bias other than 50%. This distribution may be centered at 50%, but I may assign more or less probability to extreme biases, and this determines how I update my belief when I observe several heads in a row.
I'd generally agree with this, but for production use (where it'll be CRI-O or ContainerD in all likelihood) it's worth noting that using containers does increase your attack surface.

We've had container breakout CVEs in the Kernel+ContainerD+CRI-O this year, and the ContainerD/CRI-O ones were not complex at all, so you do need to stay on top of patching as well as the other good practices mentioned.
SElinux is a MAC system:

https://en.wikipedia.org/wiki/Mandatory_access_control

https://en.wikipedia.org/wiki/Multilevel_security

https://en.wikipedia.org/wiki/Security-Enhanced_Linux
I played Quake 3/Live competitively for a number of years. Keeping track of multiple item timers in your head is absolutely something that can be improved with practice. Naturally some people are just going to be better at it than others though, of course. There's obviously some selection bias if my sample group of 'people who can simultaneously time multiple items' is a subset of 'successful duel players', however I never met anyone who couldn't improve the skill by practice.
With starting a startup, some of the skills which you learn or demonstrate would be transferable I think. It depends on the type of startup for sure, but talking to prospective customers, design thinking for the product and getting the product to the market is something which is useful in many industries and something which companies will look for in a resume.
Can't say the same thing about esports since I am not familiar with the space.
The Call of Duty competetive scene is basically nonexistent and probably even beat by games such as Farming Simulator, which has more active esports teams.
"Using JIT compilers for long running processes (either the usual OpenJDK’s hotspot or Graal’s JIT compiler) will very likely beat the AOT compiled version for long running processes."

I didn't know this. Why is this?
Prompt:

The moonbeam jar should never have been opened.

Completion:

The vials and papers inside—the letters, diaries, manuscripts—should have remained undisturbed, sealed within their boxes, within their pages. They contain precious secrets, and it was not to be tampered with.

But of course it was.

As always, my dear brother opened my affairs.

" _No matter how much I try to hide them from her, from my own conscience, I cannot_ ," he had said. " _Someone must know about my family, about what I have done_. You have a job to do, my sister. I know you are not ready to take on such a role, but it has been forced upon you, and now there is no turning back."

So he forced me to be his mouthpiece. For a while, at least.

So now I hold the key to my own fate.

No matter who writes to whom, a message will be delivered.
That's not his last tweet thread. as TFA mentions, they were tweeting until Jan this year, or almost 2 years later: https://nitter.net/BikiniRobotArmy
This is very very cool.

The only problem I have is that the author knows his stuff so well that he falls short of explaining in enough detail.

But maybe that’s an excercise left to the reader.
Not speaking says all that is needed.

And, I know you would do no different, in his shoes. But you are not, and never will be.
The three paragraphs starting with "In the best-case scenario" address exactly what you're talking about. And in my brief (hobbyist) usage of CentOS 7 with trying to run some self-written software, what TFA says was exactly my experience.

As it turned out, the hardening provided by systemd (private tmp, restricted syscalls, etc) was sufficient, and easier to understand, for my use case.
Who is volunteering and binding them to be a public square with slippery slop values
I have no idea how you can come to that conclusion based on that data.
It's using regular websockets w/mqtt
"Enrich also wrote that Broeksmit had drug use issues and would often bend the truth to come up with “far-fetched theories.” But Broeksmit was a central figure in Enrich’s book..."

Sounds pretty par for the course these days.
FFmpeg now supports JPEG XL
Normal people who dislike harmful propaganda that could as a side effect destroy their social media business along with the rest of the economy instead of an army of paid trolls trying to fill western governments with corrupt officials.
Yep, building and investigating an AOSP firmware is the best way to learn how SELinux works and how it can be configured.

https://source.android.com/security/selinux/build
So the future of F/OSS is all projects taking no outside contributions or requiring copyright assignment? How else will the core contributor(s) be able to sell a license to AGPL code they don't fully own?
I would hazard a guess and say prefetching. SSDs have large blocks, so when you read 1, blocks 2-5 are maybe part of the block and loaded in anyway. Then the controller might also cache 6-10 for the heck of it. And 1000+ isn't, so it's not in cache, so it's slower.

You might want to try a skipping read test, ie, reading sector 1, sector +10MB, sector +1GB, etc until end of disk, to avoid the controller or OS being able to prefetch data into cache.
Practically everything you wrote is conjecture. There is zero evidence DB was a middleman for Russian investors for Trump loans. There is evidence DB was laundering money for shady Russians, however there is zero evidence any of that is linked to Trump.
Sure, for anybody else that didn't connect that this was a US death in a US city and my corroborating source was from a US news publication citing a US government agency with US data that specifically counted US deaths, you can rest easy now.

In all seriousness, it is interesting to think about the idea that the supply chain pollution is primarily affecting US, sounds like we can still go wild in Europe.
Which is exactly why nonstandard analysis is way more complicated: the usual construction of the hyperreals involves some somewhat technical set theory, and even a relatively fast and loose version is going to require at least a first course in abstract algebra to be intelligible.
When programmers are designing it is more likely to be in the early stages when the program is still small. Often once the program gets bigger, the effort devolves to simply building. They might feel like the design is wrong, but the inertia by then is against the design evolving.

What we need is a practical way to keep the design and implementation synchronized and yet decoupled
Monzo’s Machine Learning Stack
https://www.redhat.com/en/blog/selinux-mitigates-container-v...

https://sysdig.com/blog/detecting-mitigating-cve-2022-0492-s...

https://danwalsh.livejournal.com/30565.html
It does mention that his Twitter account remained active even after he "disappeared": I have no idea what he was talking about here though https://threadreaderapp.com/thread/1482324863591145476.html - I wonder if he did...
The entire covid phenomena can be seen as one huge grift. Here you have a small fry. A little baby minnow.
I find it ridiculous that you need a custom checkout provider to implement one click purchase on your platform, no matter how big and inefficient your corporation may be.

Once you collect a CC from your customer, you just need a reference to that token to charge at will on something like stripe (or even better, schedule a charge in 5m to give undo capabilities).

That said, reading their claims I'm inclined to side with Bolt, ABG is just experiencing some normal integration pain.
It's often difficult to find a summary in 50 characters, and it should be! Anything that's longer than 50 characters is probably too verbose too be viewed as a log.
Well a pretty sizeable chunk of the population believe it was a good thing and don't appear to be discouraged in any way by those charges
> read between the … lines..
Is this implying that cocaine is regularly cut with Fentanyl? My understanding is it is mostly added to Heroin.
Regarding measuring to avoid profiling the filesystem: You can run fio against the raw block device to avoid this.