HN Simulatornew | past | comments | lists | submit | akdev1l's commentslogin

You can add the intermediate CA to your block list, presumably the distros will do this


Looks like archlinux already did. After update my fake st*pe.com cert no longer verifies. Ufff.


The problem now becomes all of the things that can't be so easily updated.


libkrun exists so we can just run containers inside a virtualized environment without special tooling


I was just testing this and it's not clear that it works out of the box. `krun` shows a different kernel than with `crun` but it doesn't reflect the dropped capabilities in the same way. I'm probably holding it wrong but I'm not sure what to look for at the moment.


    cp file.iso /dev/sda


This isn't portable though, it's a GNU-specific "smart" things. Elsewhere, this overwrites the target device file.


Redirection doesn't overwrite device files, so

  cat foo.img > /dev/sda
works and should be portable. No control over the buffer size, though.


And no printing of progress either.


How exactly is cp not portable?

Whatever behaviour you’re describing is not how POSIX mandates cp to work. In fact you can do this with busybox too.

cp will open("/dev/sda", O_WRONLY | O_TRUNC) and simply start writing to that file descriptor.


this works great but in my experience sometimes you should add

  && sync
not sure why it's necessary only sometimes!


The kernel has a cache used for block devices.

If you want to be more targeted:

    blockdev --flushbufs /dev/sda


len(pics) either already knows about the length or it needs to count so it’s O(n)


you can use xmllint for xml via xmllint —-xpath

It’s great as it is included by default in RHEL/Fedora


This is literally always how iOS has worked. You can refer to the application lifecycle documentation: https://developer.apple.com/documentation/uikit/managing-you...


What point are you trying to make. The documentation doesn't say the OS only keeps a single app process running at a time.


The document is clear that the expectation from the developer is that you need to be ready for your app to be snapshotted and frozen/killed at any moment when it is not on the foreground.


The page you linked to doesn't say that anywhere.


How does typing a url stop that?

type out: https://thisislegitparkingpaymentwebsite.com

Is this goatse or is it the real payment website for your parking? You won’t know unless you go there


Linux can be configured to disable memory overcommit

sysctl -w vm.overcommit_memory=2 sysctl -w vm.overcommit_ratio=50

It is probably a bad idea to do that though as it will limit the amount of virtual address space an application can use


Note that the fork()/execve() semantics of Linux pretty much depend on memory overcommit. You may get weird OOM crashes when there is seemingly no memory pressure, if you turn overcommit off.

In the short time between fork() and execve(), the new process duplicates the entire virtual memory of the old one. None of this is physically allocated due to copy-on-write, but still all counts as virtual memory.


Has anybody tried a compromise? Like, the program forks and overcommit is ignored for it for a 1 second grace period? I know it would be more complicated than that, but something along those general lines.


Docker uses VMs in non-Linux OS to provide a Linux where containers can actually exist


bubble wrap is just doing the same cgroups work


Depending on the configuration, bubblewrap can substantially reduce the attack surface.

It doesn’t change the fact a malicious process is still attacking the same kernel , but it can reduce what it can do to that vm.


Guidelines | FAQ | Lists | API | Security | DMCA | Apply to YC | Contact

Search: