• 0 Posts
  • 285 Comments
Joined 3 years ago
cake
Cake day: June 9th, 2023

help-circle
  • I fully agree, there isn’t a good reason. The issue is that flaw is a systemic one in Windows.

    Modern operating systems should be operating under zero trust. The fact that Windows still operates on Intranet Era logic, where if a file is reachable, it’s probably safe, is exactly why these exploits keep happening.

    The problem comes down to a Windows API called ShellExecute. When an application like Notepad passes a link to this API, it is effectively saying to the OS, The user wants to open this, figure out how to run it.

    Windows looks at it and essentially says, Oh, it’s an .exe on a network share? The user must want to run that software, launch it, rather than, This is executable code from a network location I don’t control, download it and make the user double-click it themselves.

    The main reason it does this is for legacy enterprise convenience. Decades ago Microsoft designed Windows so that companies could put internal tools on a shared drive and employees could run them instantly. They prioritised seamlessness over security by assuming the network perimeter was the security boundary, and everything on it was there because they wanted it to be.

    Obviously that assumption is dangerous. Like you said, no remote executable should ever be treated as trusted by default, regardless of whether it came from the Store, an SMB share, or a web link. The action of clicking a link should never map directly to execution of code. It should map to retrieval of data. Microsoft basically turned a convenience feature into a permanent vulnerability.


  • Yeah I get your thought process, but the second vulnerability is actually just how Windows is designed to work. When Notepad follows a link, it isn’t opening a web page, it’s passing a command directly to the OS shell.

    Because Notepad is a trusted native application, it bypasses many of the security checks that a browser has.

    If the link uses the file:// protocol to point to an .exe on a remote server, or ms-appinstaller to trigger an install, the OS treats that as a direct instruction to launch that software, so it can trigger an app installation prompt or, depending on the exploit, silently side-load malicious packages.




  • Robust Mirror@aussie.zonetoMemes@sopuli.xyzIt's the dream
    link
    fedilink
    arrow-up
    1
    arrow-down
    1
    ·
    23 days ago

    What I’m going to say is: technology. The calendar will never change because of technology. This would be the most expensive and extensive change in history. Every computer system, program, device everything.

    And you have to either retroactively change past dates, or support 2 systems at the same time. It’s almost insurmountable at this point.








  • Reception Critical response On the review aggregator website Rotten Tomatoes, 67% of 76 critics’ reviews are positive. The website’s consensus reads: “A family affair both on screen and behind the camera, Kate Winslet’s directorial debut stacks the deck for tears a little too lopsidedly, but honest performances help put this drama’s heart firmly in the right place.”[11] Metacritic, which uses a weighted average, assigned the film a score of 55 out of 100, based on 25 critics, indicating “mixed or average” reviews.[12]

    Peter Bradshaw of The Guardian wrote that Goodbye June is “a well-intentioned and starrily cast yuletide heartwarmer, like a two-hour John Lewis Christmas TV ad without the logo”, but criticised its “treacly soup of sentimentality” and “cartoony quasi-Richard Curtis characterisation” that feels unreal.[13]





  • It’s mostly just that. The whole thing was a mess. The atheists were told they would be debating a Christian and prepared as such, but he won’t define himself as a Christian. So much time is wasted dancing around that. They had to change the title from Christian debates to Jordan Peterson debates. On top of that he will barely engage properly, saying things like he won’t entertain a hypothetical because he wouldn’t allow himself to get in that situation in the first place. Just generally not acting in good faith.




  • Fair point.

    I was definitely too focused on the narrow “did they rule on birthright citizenship” question and missed the bigger picture. You’re right that this is way more than just procedural, it’s a massive shift in executive power.

    The fact that federal judges can now only issue piecemeal, state-by-state rulings essentially breaks their ability to actually check presidential overreach in any meaningful way.

    I think I got too caught up in fact checking the specific headline and missed how big Trump’s win actually was here, just not in the way the headlines suggested. Thanks for the correction.


  • 100% on both counts.

    The forum shopping issue you’re describing is exactly the problem. Trump’s team can now basically pick and choose where to implement policies that have been ruled unconstitutional elsewhere. It creates this patchwork where your constitutional rights depend on geography, which is obviously fucked.

    And you’re spot on about the cowardice. The Supreme Court absolutely should have ruled on the constitutional question first. That’s the actual substantive issue everyone cares about. Instead they took the cop out that gives Trump more power without having to make the hard call on whether his order is constitutional.

    Honestly it looks like classic Roberts Court behaviour: make big changes to how government works while pretending you’re just doing technical legal housekeeping. They know damn well that ruling on birthright citizenship would be messy and politically explosive, so they found a way to help Trump without having to own the constitutional implications.

    Your point about this cutting both ways (like with mifepristone) is important too, but the timing here makes it pretty clear what they’re really doing.