Me: first I'll be busy with KDE stuff and then I'll go sightseeing in Graz, so I won't be doing any Apple-related stuff until I get back home.
Also me:
Remote
Nicolás Alvarez
@nicolas17@social.treehouse.systems
mastodon 4.6.7+glitch-thCurrently hacking and documenting Apple stuff for fun and no profit.
536 Followers
217 Following
50 Posts
Joined November 11, 2022
Twitter:
Location:
Buenos Aires, Argentina
Liberapay:
Replying to
@androcat@toot.cat @markmetz@sfba.social which part of mammography involves "language"? 🤨
Replying to
@siguza@infosec.space @janne@social.treehouse.systems I think M5 Pro and M5 Max use the same CPU die attached to a different GPU die, so that could explain why the CPID is the same. But on the other hand, M1 Ultra is two bonded M1 Max and yet those have different CPIDs. And A18/A18 Pro having same CPID has no sensible defense...
Between July 27 and August 6, if your iPhone was already on iOS 18.7.8, Software Update showed "update to iOS 18.7.8" and would install 26.5.2 instead. Several liquid glass haters who were intentionally avoiding iOS 26 got screwed 💀
https://www.reddit.com/r/iphone/comments/1vfw3uk/psa_if_you_have_an_iphone_thats_currently_running/
Replying to
@lina@vt.social I searched AppleCVA on DuckDuckGo and the first two results are your gist and your tweets. 1. that's fast indexing, 2. seems literally nobody documented this before!
Replying to
Replying to
@xgranade@wandering.shop @neckspike@indiepocalypse.social @eniko@mastodon.gamedev.place
I personally witnessed a university janitor emptying the trash and recycling bins into the same giant bag.
We all know that happens, but seeing it was... wow.
Replying to
@me@jaehanley.social I have seen that phrasing about cryptocurrencies.
That's the opposite of an endorsement.
Replying to
@zanchey@aus.social @jwdt@mastodon.social they also found a new grift which is BIMI certificates for email
Replying to
@scheme@freiburg.social @cwebber@social.coop Christine's link lets you read the article without being a subscriber
Replying to
@OmegaPolice@hachyderm.io I can't believe people are still throwing the argument of "we can't ban X because there's no 100% reliable way to know if X was used, so let's fully allow it".
Replying to
@OmegaPolice@hachyderm.io it doesn't matter if it can be reliably identified or not, it should still be banned. Most make it plainly obvious anyway.
Replying to
@futzle@old.mermaid.town I wonder if any country has pulled timezone bullshit that can beat this http://web.archive.org/web/20080914163947/http://marga.com.ar/blog/index.cgi/debian/Argentina_changes_timezone.html
Replying to
@gemelen@mammut.moe @federicomena@mstdn.mx @mhoye@cosocial.ca No su binary just means that particular exploit won't work but you can still "modify" arbitrary executables, including those root is currently running. But not having those modules you should be fine I think?
Replying to
@heidilifeldman@mastodon.social In Argentina the gas station signs haven't shown decimals for a long time, but that's due to inflation, not gas prices specifically. I do wonder what they'll do if they ever start needing five digits...
Replying to
@SylvieLorxu@chaos.social I contributed to BOINC for a year before telling the main developer that I was 15.
Replying to
@neurovagrant@masto.deoan.org so which greyhat is going to remotely brick them all for the common good?
Replying to
@CodingItWrong@oldbytes.space @rmondello@hachyderm.io my father added a passkey to his Google account without even realizing, through some set of dark patterns that pushed him there.
Replying to
@whitequark@social.treehouse.systems Ah this is where I saw it: https://x.com/spendergrsec/status/2052477974818033758
Replying to
@whitequark@social.treehouse.systems @Jetengineweasel@masto.hackers.town https://www.openwall.com/lists/oss-security/2026/05/07/12
but for the "vibe coding" part I don't have a source, I might be mixing up with another case.
Replying to
Replying to
@benjaoming@social.data.coop When KDE announced they would make KWin Wayland-only, there was a DDoS with millions of requests specifically to that one announcement blog post.
Replying to
@u2be@mastodon.social @christianselig@mastodon.social You can't "uninstall" Siri. And on modern devices it runs locally most of the time, so what does it have to do with privacy and democracy?
Replying to
@siguza@infosec.space On the web I think they're muted by default because modern browsers don't let websites autoplay with audio. And the websites insist on autoplay.
Replying to
@Jetengineweasel@masto.hackers.town @whitequark@social.treehouse.systems apparently nobody with insider knowledge, someone took the fix (public commit) and vibecoded an exploit
Replying to
Replying to
@ryanc@infosec.exchange are we really at the point where "typical residential runs" need more than gigabit/cat5?
Replying to
@lina@vt.social waiiit I misread, this is not in iOSSupport (where Catalyst frameworks are), this is an actual Mac framework? 👀
Replying to
@sarahdalgulls@ecoevo.social I tested it on iPhone and it made me install a Google app 🤔
Replying to
@jaharmi@fosstodon.org @owen@mastodon.transneptune.net And load the root cert into every device in the LAN including guests? (See mention of "club" in first post)
Replying to
@rotopenguin@mastodon.social @i0null@infosec.exchange that's the same as dirtyfrag
Replying to
@rmondello@hachyderm.io In Spanish it's very important to be mindful of diacritics since "bebé" means baby and "bebe" means "he/she drinks" 👀
Replying to
@dzwdz@tilde.zone @davidgerard@circumstances.run they can give a patent license to everyone except those who sue them for infringing other patents, giving them leverage in the defense
Replying to
@mhoye@cosocial.ca They are indeed forgetting how to talk to humans.
Replying to
@gisgeek@floss.social Omarchy of all things?
Replying to
@zhuowei@notnow.dev has anyone documented what vouchers are and what they do in the happy path, rather than just "how to use them for exploits"?
Replying to
Replying to
@lina@vt.social That seems kinda high CPU usage if it's supposed to be doing the main processing on the GPU, weird
Replying to
@gedankenstuecke@scholar.social so... did you test it? does it actually work?
Replying to
@gemelen@mammut.moe You could inject code into libc.so and wait for a process already running as root to run the patched function.
Replying to
@GOKUSHRM@mastodon.social @swelljoe@mas.to how is that relevant here?
Replying to
@lina@vt.social Another one to look into: iOS Switch Control (accessibility) lets you use head tilts to control the UI. Maybe macOS has something similar? I can't check as my Mac is busy with a long-running task in Asahi right now 😅
Replying to
@closeted_unionist@mastodon.social @aks@scalie.zone whether anyone actually lost data due to their agent deleting it, is irrelevant to the AI boosters' willingness to whine about it.
Replying to
@energisch_@troet.cafe @catsalad@infosec.exchange Yes, I have even heard of people successfully adding paw prints to iPhone TouchID.
Replying to
@pikhq what could go wrong
Replying to
@lina@vt.social huh, does that framework actually work? It wouldn't surprise me if those are stubs to let iOS apps linking to ARKit load on Mac at all 🤔
Replying to
@bootlessbuck@mastodon.social @rmondello@hachyderm.io If I don't use passkeys, then if I lose my phone and buy a new one, I still need to login to my password manager to be able to login to the airline website, because I have a long random password for the airline that I can't possibly remember. But if I can use my password manager (be it Bitwarden or iCloud Keychain or whatever) then I have access to my passkeys too.
Replying to
@davidgerard@circumstances.run @yukijoou@fedi.kemonomimi.gay @kimcrawley@zeroes.ca ?si= is definitely tracking
Replying to
@rmondello@hachyderm.io I've said before that the only useful thing I got out of LLMs was "Buttercup, Honeycrisp, Lotus, Orchid, Eclipse" 😉 It's crazy how Apple uses public LLM services for development despite their secrecy culture.