• 0 Posts
  • 42 Comments
Joined 2 years ago
cake
Cake day: April 3rd, 2024

help-circle

  • The second move is for target acquisition and often precedes a pounce. The wide pupils let in more light, enabling a more precise pounce.

    Why the cat’s body is preparing to pounce is entirely situational. Maybe it’s a hunt, maybe it’s play, maybe it’s just because the cat is being a little overenergetic derp. When you spend time living with a cat you usually learn to identify them pretty reliably. Especially the last one.





  • Most newer drives won’t give you the kind of direct access you need for an accurate copy. Some disc areas necessary for dealing with copy protection are inaccessible except by specially blessed playback software.

    Some older drives ignore this restriction but newer ones, especially all 4K-capable drives, don’t.

    There’s an alternative firmware called LibreDrive that enables a low-level access mode where an application has direct control over the laser assembly. That plus ripping software aware of this mode (MakeMKV) will get the data off the disc. Add known decryption keys and you can get at the raw video files.











  • That is one way an attacker can gain access to the browser’s memory. It’s not the only way.

    Besides, administrative access does not necessarily mean that the attacker has complex attack code for every possible scenario included with whatever they’re running. The more work they have to do to access your data, the less likely it is that they’re doing that specific work.

    Leaving stuff lying around in the open because an attacker potentially could have a specific countermeasure to more strict safety measures is equivalent to giving up. At that point you can just forego security at all because whatever you have might potentially have an exploit.





  • You assume malware that comes from somewhere else and has full access to the entire system by the time it tries to attack the browser. If your default scenario is that the system has been completely compromised by arbitrarily complex malware, there’s no point in security measures at all because they’ve already failed by definition.

    What about malware that runs inside the browser, e.g. after exploiting a vulnerability in the JS runtime? Peeking at the browser’s memory would be easier than breaking out of containment and obtaining control of the entire system. It would even be easier than obtaining control of the browser to a degree where you can access credentials without user intervention. Even if we assume that it’s as simple as reading the key from an easily found location and the credentials from another easily found location, that’s more work than just reading the credentials. And it becomes harder if the locations are less easily found.

    Also, a defense doesn’t have to offer perfect protection in order to be worthwhile. It’s all a game of likelihoods; making an attack harder means it’s less likely to be done. Any additional step the attacker needs to take offers more protection because the attacker actually needs to take it. Microsoft actively worked to reduce the number of steps an attacker needs to take, which is worth calling out.

    Defense in depth is important. Don’t insist that one single safety mechanism should protect against everything when layering them is known to be more effective.