u/ammar2

I would recommend disclosing that on the Github project, and maybe providing any AGENTS.md/CLAUDE.md that you're using.

Also, I've spent a good amount of time reverse-engineering Sims 2's engine for OpenTS2 at this point. I have no doubt that is picked up in LLM training data at this point so it would be nice to clarify that the file formats etc in this project are AI generated so people don't necessarily trust them blindly.

And with a history of malpractice suits and connections to local politicians: https://thenevadaindependent.com/article/poke-eye-part-ii-doc-carpenter-submitted-final-athletic-commission-application-months-sandoval-appointment

Definitely something going on with the audio mixing. There's a noticeable bump in volume after the landing.

The engine and wind noise is probably really loud in the starting part so they might have quietened everything down. They probably said something in the air, like the instructor saying "my flight controls" after the engine quit but it was probably drowned out by noise.

For reference, this was the plane from the video: https://en.wikipedia.org/wiki/Aero_Adventure_Aventura

Not much for landing gears on it anyway.

From the original video: https://youtu.be/LVFLK5j087g

Says an experimental light sport flying boat. This article (https://www.gazettejournal.net/emergency-landing/) says it is a Aero Aventura II. (Experimental category in the US is kit planes/hand-built planes)

You are correct, but this could happen in the commercial flight industry too.

Completely different ball game of risk. A lot of effort has gone into making commercial air travel as safe at is. For a general aviation flight such as the one in this accident, the risk is somewhere around 10x worse than driving and 2x better than motorcycling: https://pilotinstitute.com/is-flying-safer-than-driving/

Hobby pilots are usually the ones responsible for both piloting and maintaining their aircraft

Not in the US with certified aircraft at least. As an owner you may be familiar with maintenance procedures and problems but only a certified A&P (Airframe and Powerplant) mechanic can work on your plane.

If you built your own plane, then you could be more involved with the maintenance.

Well, the keypress issue hits accept for you. The one-click im referring to there is getting someone to navigate to any URL and then them hitting the confirmation to sign in to GitHub as shown in the "protecting yourself" section.

local extensions are installed and run automatically in a "trusted" context

They are not, you still have to accept the notification to install the recommended extensions for local workspace extensions.

On github.dev and browser versions of VSCode, the workspace is always considered trusted.

I didn't look too far into this vulnerability for desktop vscode but I think nowadays it might block rendering notebook output in untrusted workspaces so that avenue might be mitigated there.

That was mostly a courtesy to GitHub, the intent here was full public disclosure. In my past experience reporting github.dev bugs to them, they tell you that it's out of scope and go report it to MSRC.

And as I outlined in the article, I really don't want to deal with MSRC on VSCode bugs.

Just fyi I think this particular incident happened during the day:

Officials confirmed to FOX 5 that the stabbing happened off Flagler Avenue on Thursday afternoon

and don’t see the point when it is faster to pull the breaker.

One concern might be that breakers are not rated for that many on/off cycles. As per this FAA study on circuit breaker aging (section 4.1.2) they can handle about 2,500-10,000 cycles.

Obviously this might not matter for your particular case, but e.g in a trainer aircraft with multiple students turning it on and off per day, you could cause premature failure of the breaker.

Try updating your Java, looks like 21.0.9+10 is the latest Temurin.

This is likely a Java JDK bug, it really shouldn't be segfaulting during GC like that. I saw some open issues on the JDK tracker with similar backtraces but hopefully just updating it fixes it.

Hmm do they say somewhere it's just based off the HTTPS request headers? Could also be stuff from the networking layer like TCP layer details, see https://lcamtuf.coredump.cx/p0f3/ for example

Thanks for the plug! Glad people are using it 

If you're so inclined /u/nascent_aviator the website's data is available as a big machine readable file. I never bothered making the minimums data filterable/searchable but it's there if you click on the approaches.

Glad to hear it, yeah I would definitely advise against participating in their bug bounty program for vscode.

I don’t know if it is the one you have been referring to

In the one with Tom Scott and Mentor Pilot that OP is talking about, the instructor is not behind him in the simulator. He is talking over the radio with a reference of the cockpit and the airplane location (as far as I can tell he can not see what is going on directly in the simulator).

The first landing is attempted manually and goes about as well as you'd expect.

The second one with autoland is successful but at that point Tom has already familiarized himself with the cockpit. Also, like the other comments say, there is the huge benefit of already having established two-way communications.

It's linked below in the thread: https://guides.frame.work/Guide/Liquid+Metal+-%3E+PTM+7958/402

The guide's approach seems to mostly be lifting off the solidified part with a spudger and then isopropyl alcohol.

Oh actually it won't be as easy as calling security_add_hooks. The kernel does go through some effort to put security_add_hooks in a section that gets free'd. See: https://stackoverflow.com/a/74183862

You could try to do what security_add_hooks does manually in your own code: https://github.com/torvalds/linux/blob/93d52288679e29aaa44a6f12d5a02e8a90e742c5/security/security.c#L625

but it looks like there's attempts to block that as well, since for example, the lsm_active_cnt variable is marked:

u32 lsm_active_cnt __ro_after_init;

so it would go read-only after kernel initiatialization? But theoretically there's nothing stopping you from reversing that and making it writable again with say

module_set_memory(mod, MOD_RO_AFTER_INIT, set_memory_rw);

Are you using register_security as an example? Because it was yeeted back in 4.2 I believe https://github.com/torvalds/linux/commit/b1d9e6b0646d0e5ee5d9050bd236b6c65d66faef in favor of security_add_hooks

But in general, you can definitely find the symbols in userspace, the way I found the grsec_lock offset in that is to use extract-vmlinux to grab the kernel as an ELF and then used ghidra. You could probably also just use objdump or something.

AFAIK using unexported kernel functions on Linux is basically not possible and is considered a serious security exploit when it rarely becomes possible.

Hmm? You mean from a kernel module? The kernel and kernel modules are in the same address space and protection level, there's nothing stopping you from calling unexported kernel symbols as long as you know their offsets.

Folks used to use kallsyms_lookup_name which was exported to find any kernel symbols which lets you be a little bit portable. More recently that is no longer exported so people use kprobe hacks to find kallsyms_lookup_name and then use it again: https://github.com/xcellerator/linux_kernel_hacking/issues/3

Personally, I've used a kernel module a while ago when hacking a Roku tv to disable grsec, which is a Linux Security Module itself. I literally just popped the kernel open in ghidra to find the magic offset.

That is theoretically a possibility, yes. It's just that I think comments from someone who actively contributes in wide areas of the kernel would have a voice that would be weighed highly by maintainers compared to a bunch of randos.

The analogy would be more like one person at Intel pretending to be active developers [email protected] and [email protected] and commenting on their own patches.

using a single person as the contributor even though the code might have been written by a team of 50

My point was the exact opposite, code written by one person but being supported/endorsed as if it were multiple people

> Direct anonymous contributions to the kernel isn't accepted

That's actually pretty curious, the licensing section of the docs does say (https://www.kernel.org/doc/html/latest/process/1.Intro.html#licensing ):

> It is imperative that all code contributed to the kernel be legitimately free software. For that reason, code from anonymous (or pseudonymous) contributors will not be accepted.

Yet it seems like there's patches submitted from Asahi Lina directly? For example: https://lore.kernel.org/all/[email protected]/

But seems like this issue has already been discussed on the mailing lists (1, 2) a little to no conclusion.

Edit: I was wrong/reading outdated stuff. The patch submission documentation actually conflicts with the above:

using a known identity (sorry, no anonymous contributions.)

This was updated by Linus recently-ish to remove the pseudonymous part. And here's Greg affirming that "known pseudonyms" are allowed. (Sent a patch to fix this).

My only real concern would be using the account as a sockpuppet on places like the kernel mailing list to endorse or approve their own changes/ideas.

But, I haven't looked into whether this has ever happened.