Avatar
banjo
94f66a6138a20e120cefbe343103186804847ad9619316761e3e76a062d5fed0
"Freedom of speech is being able to tell someone else something they don't want to hear." "No matter what you say, someone is going to be offended." "Once you realize that politicians are not altruistic, and that they're in politics for themselves and their own personal gain, then everything makes sense." "No one is above the law." "Have you ever met a poor politician?"

Don't do it--damage is cumulative (i.e. you never grow more enamel--you might be able to remineralize somewhat, but what you have now is all you're ever going to have, and whitening strips off a small layer each tiem you use it.

GM Nostr!

Happy Friday

Looks like another great day here--blue skies and sunny (and coffee)!

#coffeechain

actually you shouldn't try whitening...that'll damage your enamel (cleanings, no...)

Helping others when they can't return the favor is the only true help out there...

If you expect something in return, it's not really helping--it's a trade.

#GrapheneOS receives fourth Android Security Acknowledgement of the year. This time we are credited for moving wipe-without-reboot to the stock OS.

CVE-2024-32896 which is marked as being actively exploited in the wild in the June 2024 Pixel Update Bulletin is the 2nd part of the fix for CVE-2024-29748 vulnerability we described here:

nostr:nevent1qqsw5mj0jlf4e7jscd5yxnxjls0nscl79yjcktghx5kx0tqeaunp0zspzpmhxue69uhkummnw3ezumt0d5hsygxptfdxtxrw026pxn0w82u9y4x6t3w5kp883d83djpgxuvj6d23s5psgqqqqqqs545s2v

None of this is actually Pixel specific.

Bulletin:

https://source.android.com/docs/security/overview/acknowledgements

Attribution to us:

https://source.android.com/docs/securi

CVE-2024-32896 and CVE-2024-29748 refer to the same vulnerability of interrupting reboot for wipes via the device admin API, which applies to all devices.

CVE-2024-32896 is a full fix in AOSP as part of Android 14 QPR3. It's not at all Pixel specific.

This is being widely incorrectly reported in tech news coverage. Pixel Update Bulletins are almost entirely patches for vulnerabilities which apply to other devices too. Android Security Bulletins are the list of what other OEMs are required to fix, not the full list of patches.

We explained this in our previous thread:

https://grapheneos.social/@GrapheneOS/112204437363495338

CVE-2024-29748 was a mitigation for the issue implemented in the Pixel bootloader. Full solution is implementing wipe-without-reboot, which is now a standard feature in Android 14 QPR3 released as part of AOSP.

Our 2024052100 release backported the upstream wipe-without-reboot feature being shipped in the June 2024 release of Android (Android 14 QPR3): https://grapheneos.org/releases#2024052100.

We extended it to make it more robust via extra redundancy in our 2024060400 release:

https://grapheneos.org/releases#2024060400.

There were 2 main issues:

1) memory not wiped when booting firmware-based fastboot mode, allowing exploiting it to get previous OS memory

2) AOSP device admin API depends on reboot-to-recovery to wipe before Android 14 QPR3

Neither of these issue is being fixed outside Pixels yet.

Each month, Android has a new version released. These are the monthly, quarterly (QPR) and yearly releases. The baseline monthly security patches are NOT the monthly releases of Android. They're backports of a SUBSET of the patches with High/Critical severity, not all patches.

Most devices only ship the backported patches to older Android releases (12, 13 and 14). Pixels ship the monthly, quarterly and yearly releases. Other devices will mostly get the 2nd vulnerability fix when they update to Android 15. They'll have to fix the 1st issue on their own.

We have a thread about forensic company capabilities at:

nostr:nevent1qqst3mtuajfjrhmtr5sls78ycp5jh96tz92mfdl3x7d3mwvvv7cerqspzpmhxue69uhkummnw3ezumt0d5hsygxptfdxtxrw026pxn0w82u9y4x6t3w5kp883d83djpgxuvj6d23s5psgqqqqqqsa8r988

based on leaked Cellebrite documentation. Shows GrapheneOS does a much better job than iOS/Android blocking exploits and only Pixel 6 and later or iPhone 12 and later successfully stop brute forcing.

Thanks Graphene--love you guys!! ๐Ÿ˜ƒ

(You're our only hope, Obi-Wan!)

I'm torn here...yes it's cheap, and yes the hash rate isn't top notch, but...if every Satoshi had one of these, and solo mined...

Wonder what that math might look like?

(I believe everyone should be running some kind of miner, just like everyone should use cold storage, and everyone should be running a node...if you can afford the sats for a Cold Card (or two ๐Ÿ˜ƒ) shouldn't the purchase and use of a miner be everyone's next logical step?)

Ah...poor judgment--the spice of life (and the creatror of the very best stories and memories)!!

Never lament time spent having fun...the mines will still be there when you get back!

I'm betting it'll be more productive than my Nerd Miner ๐Ÿ˜ƒ

GM Nostr!

Yesterday, we won an iced coffee maker!

You know that's going to come in handy today!

#coffeechain

Wait...you're saying we DON'T have inflation at 3.4%??

How can that be? That's the number that gets published by the government...they have armies of economists--the best in the nation--calculating those numbers.

Don't be silly...10-15%...

GM Nostr!

Going to be one of the best days of the year today--bright, sunny, warm, deer hanging out in the backyard--just perfect.

And...coffee!!

#coffeechain

Was being cute--but still--Apple hardware is the problem. The only solution is (of course) to switch to Google and Graphene...

Graphene fixes this--which means you get to throw your iPhone in the trash (or trade it in on a Pixel).