• 0 Posts
  • 66 Comments
Joined 1 year ago
cake
Cake day: June 20th, 2023

help-circle




  • The TSA press office said in a statement that this vulnerability could not be used to access a KCM checkpoint because the TSA initiates a vetting process before issuing a KCM barcode to a new member. However, a KCM barcode is not required to use KCM checkpoints, as the TSO can enter an airline employee ID manually. After we informed the TSA of this, they deleted the section of their website that mentions manually entering an employee ID, and did not respond to our correction. We have confirmed that the interface used by TSOs still allows manual input of employee IDs.

    TSA: lalala i can’t hear you, everything is fine, no issue here







  • To reiterate the other comment about code maintainability, I’d suggest removing all commented out code as your next commit. With git, that information isn’t lost and you can always go back to it on commit d4c981a. The easiest time to create a clean codebase is when you start the project, and the second easiest time is now. Also might be a good idea to use a pre-commit hook to check if commented code is being committed, to stop you from introducing mess in the future.


  • Ohhhh you’re totally right. I tried replicating OPs claim and searched for the video title “Building an Open Source Payment System - Sebastian Javier Marchano, Taler System” and there was no red bar. Searching for “GNU Taler” shows the red bar for that same video. It feels like bad UI, overloading the meaning of the red seek bar, but it seems like in this case, that’s saying it’ll skip you to when they start talking about it, not that you previously watched the video.





  • Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?

    Have you tried turning it off and back on again?





  • This argument implies there’s an easy way for you to perform the reproducible builds on iOS, but it’s quite involved and requires a jailbroken iPhone. Overall this is more a limitation of apple and not signal.

    Even if you were able to perform a reproducible build of Signal on a jailbroken iPhone, there’s no way to confirm that the stock iOS Signal app will match, or has a backdoor that got added in a supply chain attack that only is delivered to non jailbroken phones. You could use a jailbroken iOS device, but then it could be lagging behind updates and be even more vulnerable from zero days.

    The real pressure here should be on Apple to provide a way to verify a build of an open source app matches what is being installed via the app store, but for some reason this is being framed as a Signal issue, which is disingenuous.