Android now allows apps to block sideloading
Article, Comments

Android will Block Apps Installed Outside the Play Store — Google rolls out Google Play Integrity API.

What does this mean? Developers will now be able to easily detect if you've installed an app from an unofficial source and block it, forcing you to install from the Play Store.

This new API could potentially put an end to ALL app mods. It's already being used by some games, and there will probably be more of them in the future.

Google is stabbing all Android freedom lovers in the back.
Credit: hitechdailynews

Defusedxml – defusing XML bombs and other exploits
Article, Comments

The original example uses 9 levels of 10 expansions in each level to expand the string lol to a string of 3 * 10 9 bytes, hence the name "billion laughs". The resulting string occupies 3 GB (2.79 GiB) of memory; intermediate strings require additional memory. Because most parsers don't cache the intermediate step for every expansion it is repeated over and over again. It increases the CPU load even more.
An XML document of just a few hundred bytes can disrupt all services on a machine within seconds.

Example XML:

<!DOCTYPE xmlbomb [
<!ENTITY a "1234567890" >
<!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;">
<!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;">
<!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;">
]>
<bomb>&d;</bomb>

quadratic blowup entity expansion

A quadratic blowup attack is similar to a Billion Laughs attack; it abuses entity expansion, too. Instead of nested entities it repeats one large entity with a couple of thousand chars over and over again. The attack isn't as efficient as the exponential case but it avoids triggering countermeasures of parsers against heavily nested entities. Some parsers limit the depth and breadth of a single entity but not the total amount of expanded text throughout an entire XML document.
A medium-sized XML document with a couple of hundred kilobytes can require a couple of hundred MB to several GB of memory. When the attack is combined with some level of nested expansion an attacker is able to achieve a higher ratio of success.

<!DOCTYPE bomb [
<!ENTITY a "xxxxxxx... a couple of ten thousand chars">
]>
<bomb>&a;&a;&a;... repeat</bomb>

external entity expansion (remote)

Entity declarations can contain more than just text for replacement. They can also point to external resources by public identifiers or system identifiers. System identifiers are standard URIs. When the URI is a URL (e.g. a http:// locator) some parsers download the resource from the remote location and embed them into the XML document verbatim.
Simple example of a parsed external entity:

<!DOCTYPE external [
<!ENTITY ee SYSTEM "http://www.python.org/some.xml">
]>
<root>&ee;</root>

Show HN: A whiteboard that writes math equations
Article, Comments

Looking for where to deploy your AI products for free? Checkout

https://www.restack.io/pricing
They have a no credit card with a free 30USD free compute to get u started.

#AI #Deployment

New video of Reachy 2 by France-based Pollen Robotics shows it performing teleoperated high-precision tasks.

The beta version of the bot with open-source ecosystem launches next month.

Prices: $75K for the full robot with a mobile base; $38K for a stationary one-armed model.

Characters that can be represented as a sum of a perfect range

print(b" ".join([chr(sum(range(i))).encode(errors="ignore") for i in range(1000)]).decode(errors="ignore"))

credits: davide

What have students made using Unreal Engine?

Using everything from Unreal Engine and MetaHuman to RealityCapture and Quixel Megascans, these projects are a showcase of what’s possible with a little imagination and the Epic ecosystem!

This video gives you a glimpse at some of the stunning work produced by our talented community of students in 2024 📚

These are not some company-sponsored games, these are games made by university students around the world.

Randomness is extremely important for secure encryption. Each new key that a computer uses to encrypt data must be truly random, so that an attacker won't be able to figure out the key and decrypt the data. However, computers are designed to provide predictable, logical outputs based on a given input. They aren't designed to produce the random data needed for creating unpredictable encryption keys.

https://www.cloudflare.com/learning/ssl/lava-lamp-encryption/

WhatWeb identifies websites. Its goal is to answer the question, "What is that Website?". WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1800 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.

GitHub: https://github.com/urbanadventurer/whatweb
Live: https://www.whatweb.net/