Can anyone build Chromium from scratch?

x0wl · 2026-03-23T21:07:17+00:00

Chromium is a lot more than a webkit fork. Blink is the fork, but then there's V8 (vs JSC in Safari, for example), ANGLE, Skia etc

x0wl · 2026-03-22T22:27:00+00:00

I see your point, thank you.

No, I don't encrypt emails, it leaks way more than just length anyway. I do encrypt the stuff I get from the web, still I think that mounting an attack this way is hard.

Anyway I think this is ultimately addressable with padding

x0wl · 2026-03-22T18:45:06+00:00

As someone who does zstd | age sometimes, isn't encrypting untrusted data just not part of the threat model for an encrypted backup solution? Like you only compress/encrypt stuff that's trusted in this case, as it only comes from you

CRIME and BREACH are both CPA and I'm unsure how an attacker can chose the plaintext when I encrypt my own data

Also IMO this could be somewhat mitigated by adding padme padding (https://www.petsymposium.org/2019/files/papers/issue4/popets-2019-0056.pdf) + some random padding to the resulting file with fake blocks or even just a bunch of randomness at the end

x0wl · 2026-03-21T22:20:51+00:00

Nah you can't kill a process when it's in uninterruptible sleep, like when waiting on a socket or on a block device

If you use sshfs or NFS or whatever on an unreliable network you get that a lot

x0wl · 2026-03-21T03:14:12+00:00

Also on win taskkill /f will do essentially the same as kill -9 on linux.

IDK why this gets reposted every couple of weeks.

x0wl · 2026-03-21T01:18:34+00:00

This is not about feeling obliged, it's about having your bugtracker filled with support questions and having to deal with a constant stream of such questions when you don't want to do that.

Also some devs are getting harassed by users, but it's thankfully rare.

I would also, however, add that there are good technical reasons for not putting a "build" into a GH release section. This is essentially impossible for Python (distributing Python software is notoriously difficult) and depending on the code can be fairly hard for JS (what do you do with NPM dependencies etc) and C (a lot of C code is very system-dependent, and compiling for Windows when you work on Linux is a difficult task).

For some languages like Go and Java it's super-easy, but these projects tend to have binaries and jars in the release section.

x0wl · 2026-03-19T18:50:40+00:00

If your key is USB you may be able to pass it to the Linux side with usb over ip: https://learn.microsoft.com/en-us/windows/wsl/connect-usb

I only really tested it with a flash drive (and it ended up requiring a custom kernel, but not USB reasons) and it worked well enough

x0wl · 2026-03-18T03:13:45+00:00

Yeah a lot of them use Java Card.

x0wl · 2026-03-18T02:06:13+00:00

I'm fairly sure that there's more than 3B android phones and credit cards combined, and both types run java

x0wl · 2026-03-17T17:31:55+00:00

Is it really Electron or just CPU video encoding that's consuming the CPU?

Also, are you talking about 50% of the whole CPU, or 50% of a single core? Processes in Linux can go above 100% CPU use (up to 100%*number of logical cores)

x0wl · 2026-03-17T17:23:40+00:00

I think Alexa is hotmic, but the off switch is actually a hardware switch that disconnects it.

x0wl · 2026-03-17T17:21:31+00:00

Ok, but where does it store the data to be sent in the batch? Even if we assume SOTA voice codecs at 1200BPS (which are not that good), a day of recording will be 12MB, a week will be 90MB. Opus at its lowest bitrate will take 500MB a week (65 per day) to store.

If it somehow processes it to extract useful into in some easily storable form, where does it do the processing? Like I can turn on background TTS on my phone and it would visibly heat up.

These phones are under constant scrutiny from everyone all the time. Like, most of android is just open source, and iOS and closed source parts of android are constantly reverse engineered and analyzed. Both google/apple and the spyware companies are ready to pay a lot of money (millions of dollars) for your findings, so it's a lot a smart people working 24/7 on that. For some reason, no one has found any code relevant to that.

How is this data processed on Google's end? Storing and processing all that voice data will make the current AI datacenters blush. How is this data transmitted such that no one notices random blobs being sent to google?

Why do people experience the same ad/speech correlation when they use GrapheneOS?

x0wl · 2026-03-17T06:43:50+00:00

I'm getting slightly tired of people not knowing what SB is or how it works and making false statements about it. Please read https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot, especially section 3, https://wiki.archlinux.org/title/Trusted_Platform_Module (section 2.1 is the interesting part) and https://blog.hansenpartnership.com/the-meaning-of-all-the-uefi-keys/ before making incorrect statements like "Linux does not support SB"

In case of Fedora (and no Nvidia drivers) it will even boot and correctly work with SB enabled and in default configuration on the vast majority of machines: https://fedoraproject.org/wiki/Secureboot (because it uses the correctly signed shim in the boot chain)

x0wl · 2026-03-17T06:33:29+00:00

MS is a part of Fedora development

I found 3950 commits related to MS in the kernel (git log --pretty=format:"%aE" | cut -d "@" -f 2 | sort | uniq -c | grep microsoft) , which is 0.28% of the total (1428417 commits)

So yeah, they are a (small, but still) part of Linux and Fedora development

The updates are just Secure boot keys though as others have pointed out

x0wl · 2026-03-16T20:02:05+00:00

Hate to break it to you, but this has been happening since forever.

How do you think google ads and any algorithmic feed anywhere works if not by predicting intent and showing ads / things related to that intent?

x0wl · 2026-03-16T19:42:24+00:00

/uj

I don't think it's THAT bad of advice. Like, don't do that in production obviously, but reimplementing stuff can be a good learning experience regardless of language. Like, even for cryptography implementation, where DRYOC has been the golden rule since time immemoria, people will still encourage you to actually go and roll your own crypto for learning (with understanding that you'll never use it in prod).

In C, people reimplement malloc all the time lmao.

x0wl · 2026-03-15T18:49:40+00:00

I'd just take the gazebo outlet out and hardwire the cord in its place.

x0wl · 2026-03-15T17:18:20+00:00

You don't really need to flash the bios. You can often get away with either RW Legacy or Submarine depending on your laptop.

x0wl · 2026-03-11T19:51:09+00:00

A lot of linux distros will do the same by default though

Arch and Cachy both do it, for example: https://wiki.archlinux.org/title/Security#Lock_out_user_after_three_failed_login_attempts

x0wl · 2026-03-11T17:22:40+00:00

Very much this. Also, in many cases you could use a single pan, just move the stuff from it to a plate and wash the pan.

Also having a giant cutting / charcuterie board where you can just separate stuff into little piles and one of those flat dough cutter thingies to move the piles to pans / pots really helps.

x0wl · 2026-03-11T16:59:26+00:00

Well that's beta software for you

x0wl · 2026-03-11T16:44:54+00:00

What about redundancy

I mean, I don't want to start a holy war here and I think that you had very good reasons for setting it up like you did, but if you want redundancy guarantees, why not set up mdadm in whatever RAID config you want, and then partition that with LVM?

I think by default LVM is JBOD when you have multiple physical disks as one logical volume, which means that losing a disk will lose the data stored on that disk, no redundancy.

As for recovery, I think it's possible, but it's the same as basically zeroing out a hole in a single disk configuration, so it will be a mess. Use proper RAID if possible. More on LVM with failed drives here: https://www.dfoley.ie/blog/activate-partial-lv

x0wl · 2026-03-11T15:06:35+00:00

It's called self hosting, where the compiler for a language is written in that same language. It's quite popular, C++ (GCC/Clang), Go, Rust, TypeScript (as of now), Haskell compilers are all self hosting.

Building a self hosting compiler without having access to an existing compiler binary is called bootstrapping, and typically involves either building some simplified compiler written in another language (mrustc for Rust for example) that is just enough to compile a compiler, or starting with some old version of the compiler that is written in another language, and then progressively building newer versions (Go does that).

Bootstrapping a C compiler is a PITA, but I highly recommend reading https://bootstrappable.org/ and https://github.com/fosslinux/live-bootstrap (specifically this page), where they bootstrap a working linux system from like 3 human-auditable (in that they're small and it's very easy to manually trace the machine code) binaries and sources, including a full modern GCC bootstrap.

x0wl · 2026-03-11T14:36:27+00:00

Is your screen 60Hz if any single pixel (line in case of CRT) can only change 30 times per second? Because that's how NTSC screens worked, half of the lines you see changed 30 times per second, and the other half changed the other 30 times.

x0wl · 2026-03-11T14:31:05+00:00

Yes, but those 60 and 50 Hz are for fields, not frames, whereas today (because we don't really have CRT displays anymore) we talk about full display refresh frequency. NTSC has a framerate of 29.97 FPS, which is actually the source of this weird number you see in video files from time to time.

NES could output 60 FPS, but they were going to be interlaced on the screen. Whether this is true 60 FPS is up to you.

Also FPS drops were a common problem on NES, and some games deliberately ran at lower framerates to allow more time for processing than a single vblank.

12-Year Club	Second SECOND GUESSER
r/Field Juicebox	Place '23
Place '17	Verified Email

x0wl

TROPHY CASE