interesting new technique for Spectre mitigation with supposedly as little as 2% performance overhead arxiv.org/pdf/1807.05843.pdf (this is for all Spectre variants)

@TomK. That's interesting/clever

definitely

and supposedly this is tweakable to work against Meltdown as well

and they might be able to bring down the overhead even further

best sentence in the paper: "A naive approach to fix Spectre vulnerability is to put fences (e.g. lfence in x86) after every branch instruction"

that was basically Microsoft's approach with their C-compiler update :>

paulkocher.com/doc/MicrosoftCompilerSpectreMitigation.html

I am texting to a person. He claims to be from coca cola. He is saying that he can get me a job in USA, since there is a hiring going on in coca cola. Now he is asking me to share my CV and Passport image. He is resisting to share his detail to me. Shall i share my passport image? Is something wrong could be done by him?

@SiddharthChoudhary Do not do this

Large corporates have HR web portals

Coca cola will have one

Trying to work through a recruiter across national boundaries - by text... !

it's a scam

"he is resisting to share his detail with me" is also fishy

Even if its an outsourcing firm, at the very least you should have email, not text.

exactly, i thought. that's why i had stopped there.

how did this person get your number in the first place?

well, maybe there are some cultural differences too. I knew a gue in Malaysia who do tech support by whatsapp rather than mail

but still, asking for personal documents without giving more info screams like scam

Soo... SE stopped replying about the security bug I reported in November 2017 (!) altogether

good tactic

well, does it still work?

The tactic or the bug?

Yeah - I don't see you on the list yet: stackexchange.com/about/security

Yeah the bug still works

Frankly it has gotten to a point where I think it's irresponsible

@Arminius what is the escalation route?

A suggestion, ping an email to team with the current email trail in it

that should hopefully expedite

@RoryAlsop did SE get their new security head yet?

You know they still have their advert up for a security director, so my guess is a lack of resource, or prioritisation

(I kinda lost track)

@JourneymanGeek the advert still looks like it's up

ah

@Arminius Just drop it here.

I used the contact form, email, got either no replies or generic "we are still looking into it", I also posted on meta

@Arminius have you got the meta link?

@forest Heh, we're having that conversation each time

I can try and help push it

@Arminius that seems vaguely common for contacts :(

I almost want to half jokingly suggest tweeting Joel

@RoryAlsop It was that one. I'm writing up another one because making that public seems to be the only way this may move forward

It's not that this is a terrible bug

But they are not even replying anymore

If it's XSS, it is a terrible bug.

Cheers

Thanks

@RoryAlsop #DaysOfOurDMZ ?

Ha! They patched it! 🎉

Suddenly everything went really fast :-)