• 10 Posts
  • 73 Comments
Joined 1 year ago
cake
Cake day: June 14th, 2023

help-circle

  • Not quite. Their “malicious” extension only got a few hundred installs. Using the data gathered by that extension and via other means they were able to locate other actually malicious extensions. Those total in the millions of installations.

    Through this process, they have found the following:

    1,283 with known malicious code (229 million installs).
    8,161 communicating with hardcoded IP addresses.
    1,452 running unknown executables.
    2,304 that are using another publisher's Github repo, indicating they are a copycat.
    





  • Most closely matches the behavior of actual SNES consoles.

    This requires very careful emulation of the timings of the various buses and co-processors, as well as on-cart chips which may or may not be present. For instance, a Speedy Gonzales game has a button in the final stage which crashes almost every emulator because enters an infinite loop reading from an open bus and waiting for the value to attain a specific pattern. However reading from an open bus is generally specified to be the last value loaded into the bus, which in this case is the load instruction itself, $18. So the value is read to be $1818 by most emulators, which doesn’t match the pattern expected.

    However, this is only if you’re emulating with instruction level accuracy. It is possible for the value of the bus to change in between the instruction being loaded and the value of the bus being loaded due to an HDMA load being triggered, but this requires a cycle accurate emulator.





  • GT4 is better than GT3 imo, but if you have to spend money on it, it might not be worth.

    I’m mostly into RPGs, and it doesn’t seem like you are from this list. If you are, then FF10 and 12 are available. So are KH1 and 2, and also Wild Arms 3, Personas 3 and 4, Disgaea, Shadow Hearts, Okage, Okami, Star Ocean, Dragon Quest, Devil May Cry, God of War, and so on.

    Viewtiful Joe 1 and 2 are silly and fun side scrolling beat 'em ups. Tony Hawk needs no introduction. Silent Hill 2 and 3 if you’re into horror. Resident Evil 4 if you’re into action horror.

    Shadow of the Colossus is great if you’re into a quiet, contemplative adventure game.






  • I spent an hour and a half arguing with my brother about probability, because he asked ChatGPT what the probability that he and his daughter were born on the same day.

    ChatGPT said 1/113465 which it claimed was 1/365^2 (this value is actually 1/133225) because there’s a 1/365 chance he was born on such and such day, and a 1/365 chance his daughter was too.

    But anyone with even a rudimentary understanding of probability would know that it’s just 1/365, because it doesn’t actually matter on which day they both happened to be born.

    He wanted to feel special, and ChatGPT confirmed his biases hard, and I got to be the dickhead and say it is special, but it’s 1/400 special not 1/100000. I don’t believe he’s completely forgiven me over disillusioning him.

    So yeah, I’ve had a minor family falling out over ChatGPT hallucinations.





  • Well, the problem is you don’t know what you don’t know. One of the first example tasks in the paper was regarding implementing a symmetric cipher. Using a weak cipher was recommended by AI tools sometimes, these developers didn’t know that some ciphers were weak. Additionally, even when the AI tool recommended a strong cipher, such as AES, it generated code that screwed up an implementation detail (failing to return the authentication tag), making the result insecure. And the user didn’t know it was wrong because they didn’t know it was incomplete.

    There’s no substitution for domain specific knowledge. Users who were forced to use traditional tools got the answer correct significantly more often because they had to read, process, and understand the documentation for the libraries, which meant they understood why the symmetric cipher was the way it is, and what additional information needed to be reported and why.






  • So please forgive me if this is a rather naive question. I haven’t seriously used Windows in nearly 15 years.

    I seem to recall runas being a lot like su, in that you enter the target user’s credentials, rather than your own as in sudo. This works because sudo is a setuid executable, and reads from configuration to find out what you’re allowed to do as the switched user.

    Is the behavior of windows sudo like unix su or unix sudo with regard to the credentials you enter? Can you limit the user to only certain commands?